@reefclaw/openclaw-plugin 0.1.28 → 0.1.30

package/bridge/gateway/agent-scope.d.ts

@@ -0,0 +1,30 @@
+/** OpenClaw's default agent id, the one the installer sets the trading agent
+ *  up as, and the id the bridge has always addressed chat to. */
+export declare const DEFAULT_AGENT_ID = "main";
+/** Trim + lowercase (OpenClaw normalizes ids the same way). Undefined for
+ *  anything that is not a non-empty string. */
+export declare function normalizeAgentId(value: unknown): string | undefined;
+/** `agent:<agentId>:<rest>` → `<agentId>`. Undefined when the key carries no
+ *  agent scope (legacy keys, `global`, `unknown`, missing). */
+export declare function resolveAgentIdFromSessionKey(sessionKey: unknown): string | undefined;
+/**
+ * OpenClaw's own rule for the gateway's default agent (agent-scope-config.ts
+ * `resolveDefaultAgentId`): the `agents.list` entry flagged `default: true`,
+ * else the first entry, else `main`. The installer places the ReefClaw skill
+ * in that agent's workspace and the heartbeat cron runs on it, so with no
+ * override the default agent IS the trading agent. Nobody has to configure
+ * anything; an override exists for hand-built multi-agent setups.
+ */
+export declare function resolveDefaultAgentIdFromConfig(cfg: unknown): string;
+/** The agent an event belongs to, when the payload says. An explicit
+ *  `agentId` field wins (future-proofing; today's gateway sends only the
+ *  session key). */
+export declare function resolveAgentEventOwner(payload: {
+    agentId?: unknown;
+    sessionKey?: unknown;
+}): string | undefined;
+/** True when the event is attributable to an agent OTHER than ours. */
+export declare function isForeignAgentEvent(payload: {
+    agentId?: unknown;
+    sessionKey?: unknown;
+}, ownAgentId: string): boolean;

package/bridge/gateway/agent-scope.js

@@ -0,0 +1,67 @@
+// Which OpenClaw agent this bridge belongs to, and how to tell whose run an
+// incoming `agent` event is.
+//
+// An OpenClaw gateway can host several agents (`agents.list`), and it
+// broadcasts EVERY agent's run events to EVERY operator connection —
+// `sendAgentPayload` → `broadcast('agent', …)` in OpenClaw's server-chat.ts
+// carries no per-agent scoping, and an operator token cannot be scoped to one
+// agent. Until 2026-09-16 the bridge forwarded whatever arrived, so on a
+// shared gateway a second agent's morning briefing streamed into the ReefClaw
+// dashboard chat and across the relay (reported by a self-hosting subscriber
+// against 0.1.31 and 0.1.40). The only owner marker on the event is its
+// session key: `agent:<agentId>:<rest>` (OpenClaw routing/session-key.ts).
+//
+// Fail-open on purpose: an event with NO attributable session key (older
+// gateways omit it; legacy/unscoped keys such as `global`) is treated as our
+// own. Dropping it would blind the chat on exactly the single-agent boxes
+// that cannot leak anything.
+/** OpenClaw's default agent id, the one the installer sets the trading agent
+ *  up as, and the id the bridge has always addressed chat to. */
+export const DEFAULT_AGENT_ID = 'main';
+/** Trim + lowercase (OpenClaw normalizes ids the same way). Undefined for
+ *  anything that is not a non-empty string. */
+export function normalizeAgentId(value) {
+    if (typeof value !== 'string')
+        return undefined;
+    const trimmed = value.trim().toLowerCase();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
+/** `agent:<agentId>:<rest>` → `<agentId>`. Undefined when the key carries no
+ *  agent scope (legacy keys, `global`, `unknown`, missing). */
+export function resolveAgentIdFromSessionKey(sessionKey) {
+    if (typeof sessionKey !== 'string')
+        return undefined;
+    const key = sessionKey.trim();
+    if (!/^agent:/i.test(key))
+        return undefined;
+    return normalizeAgentId(key.split(':')[1]);
+}
+/**
+ * OpenClaw's own rule for the gateway's default agent (agent-scope-config.ts
+ * `resolveDefaultAgentId`): the `agents.list` entry flagged `default: true`,
+ * else the first entry, else `main`. The installer places the ReefClaw skill
+ * in that agent's workspace and the heartbeat cron runs on it, so with no
+ * override the default agent IS the trading agent. Nobody has to configure
+ * anything; an override exists for hand-built multi-agent setups.
+ */
+export function resolveDefaultAgentIdFromConfig(cfg) {
+    const list = cfg?.agents?.list;
+    if (!Array.isArray(list))
+        return DEFAULT_AGENT_ID;
+    const entries = list.filter((e) => !!e && typeof e === 'object' && !Array.isArray(e));
+    if (entries.length === 0)
+        return DEFAULT_AGENT_ID;
+    const chosen = entries.find((e) => e.default === true) ?? entries[0];
+    return normalizeAgentId(chosen.id) ?? DEFAULT_AGENT_ID;
+}
+/** The agent an event belongs to, when the payload says. An explicit
+ *  `agentId` field wins (future-proofing; today's gateway sends only the
+ *  session key). */
+export function resolveAgentEventOwner(payload) {
+    return normalizeAgentId(payload.agentId) ?? resolveAgentIdFromSessionKey(payload.sessionKey);
+}
+/** True when the event is attributable to an agent OTHER than ours. */
+export function isForeignAgentEvent(payload, ownAgentId) {
+    const owner = resolveAgentEventOwner(payload);
+    return owner !== undefined && owner !== (normalizeAgentId(ownAgentId) ?? DEFAULT_AGENT_ID);
+}

package/bridge/gateway/gateway-config.d.ts

@@ -16,6 +16,13 @@ export interface GatewayConfig {
      *  Optional so a hand-built config (tests, embedders) stays valid; every
      *  consumer treats absent as 'binance', the historical behaviour. */
     venue?: VenueId;
+    /** The OpenClaw agent this bridge serves: chat is addressed to it and ONLY
+     *  its run events reach the dashboard (gateway/agent-scope.ts). Optional so
+     *  a hand-built config stays valid; consumers default to 'main'. */
+    agentId?: string;
+    /** Per-host switch for the dashboard's one-click connector update, which
+     *  opens a PTY on this box (providers/connector-update.ts). Absent = allowed. */
+    allowConnectorUpdate?: boolean;
 }
 /** CLI args specific to gateway provider */
 export interface GatewayCliArgs {
@@ -23,14 +30,20 @@ export interface GatewayCliArgs {
     gatewayToken?: string;
     symbol?: string;
     intelligenceUrl?: string;
+    agentId?: string;
 }
+/** `1/true/on/yes/enabled` → true, `0/false/off/no/disabled` → false, anything
+ *  else (unset, blank, garbage) → undefined so the next source is consulted. */
+export declare function parseOnOffSwitch(raw: unknown): boolean | undefined;
 /**
  * Resolve gateway connection config with priority:
- * 1. CLI args (--gateway-url, --gateway-token, --symbol)
+ * 1. CLI args (--gateway-url, --gateway-token, --symbol, --agent-id)
  * 2. Env vars (OPENCLAW_GATEWAY_URL, OPENCLAW_GATEWAY_TOKEN, REEFCLAW_SYMBOL,
- *    REEFCLAW_INTELLIGENCE_URL, REEFCLAW_VENUE)
+ *    REEFCLAW_INTELLIGENCE_URL, REEFCLAW_VENUE, OPENCLAW_AGENT_ID,
+ *    REEFCLAW_ALLOW_CONNECTOR_UPDATE)
  * 3. Config files (~/.openclaw/openclaw.json, ~/.reefclaw/plugin-config.json)
- * 4. Defaults (localhost:18789, the venue's default symbol, intel.reefclaw.com)
+ * 4. Defaults (localhost:18789, the venue's default symbol, intel.reefclaw.com,
+ *    the gateway's default agent)
  *
  * Returns null for gatewayToken if it can't be resolved (caller must handle).
  * `intelligenceUrl` is never null — see DEFAULT_INTELLIGENCE_URL for why that
@@ -42,6 +55,8 @@ export declare function resolveGatewayConfig(args: GatewayCliArgs): {
     symbol: string;
     intelligenceUrl: string;
     venue: VenueId;
+    agentId: string;
+    allowConnectorUpdate: boolean;
 };
 /**
  * Validate that the resolved config has all required fields.

package/bridge/gateway/gateway-config.js

@@ -7,6 +7,7 @@ import { homedir } from 'os';
 import JSON5 from 'json5';
 import { parseVenue, VENUE_DEFAULT_SYMBOL } from '@reefclaw/shared';
 import { logger } from '../logger.js';
+import { normalizeAgentId, resolveDefaultAgentIdFromConfig } from './agent-scope.js';
 const TAG = 'gateway-config';
 const DEFAULT_GATEWAY_PORT = 18789;
 const DEFAULT_GATEWAY_HOST = 'localhost';
@@ -70,14 +71,30 @@ function readPluginConfig() {
         return null;
     }
 }
+/** `1/true/on/yes/enabled` → true, `0/false/off/no/disabled` → false, anything
+ *  else (unset, blank, garbage) → undefined so the next source is consulted. */
+export function parseOnOffSwitch(raw) {
+    if (typeof raw === 'boolean')
+        return raw;
+    if (typeof raw !== 'string')
+        return undefined;
+    const v = raw.trim().toLowerCase();
+    if (['1', 'true', 'on', 'yes', 'enabled'].includes(v))
+        return true;
+    if (['0', 'false', 'off', 'no', 'disabled'].includes(v))
+        return false;
+    return undefined;
+}
 // ---- Resolve gateway config ----
 /**
  * Resolve gateway connection config with priority:
- * 1. CLI args (--gateway-url, --gateway-token, --symbol)
+ * 1. CLI args (--gateway-url, --gateway-token, --symbol, --agent-id)
  * 2. Env vars (OPENCLAW_GATEWAY_URL, OPENCLAW_GATEWAY_TOKEN, REEFCLAW_SYMBOL,
- *    REEFCLAW_INTELLIGENCE_URL, REEFCLAW_VENUE)
+ *    REEFCLAW_INTELLIGENCE_URL, REEFCLAW_VENUE, OPENCLAW_AGENT_ID,
+ *    REEFCLAW_ALLOW_CONNECTOR_UPDATE)
  * 3. Config files (~/.openclaw/openclaw.json, ~/.reefclaw/plugin-config.json)
- * 4. Defaults (localhost:18789, the venue's default symbol, intel.reefclaw.com)
+ * 4. Defaults (localhost:18789, the venue's default symbol, intel.reefclaw.com,
+ *    the gateway's default agent)
  *
  * Returns null for gatewayToken if it can't be resolved (caller must handle).
  * `intelligenceUrl` is never null — see DEFAULT_INTELLIGENCE_URL for why that
@@ -127,9 +144,30 @@ export function resolveGatewayConfig(args) {
         || process.env.REEFCLAW_INTELLIGENCE_URL
         || pluginConfig?.intelligenceUrl
         || DEFAULT_INTELLIGENCE_URL;
+    // --- Agent id ---
+    // CLI > env > plugin-config.json agentId > the gateway's DEFAULT agent from
+    // openclaw.json (OpenClaw's own rule, see resolveDefaultAgentIdFromConfig)
+    // > 'main'. Zero configuration for every installer-built box: the installer
+    // puts the skill in the default agent's workspace and the heartbeat cron
+    // runs on it. ONE value drives both chat addressing and the agent-event
+    // filter (agent-scope.ts), so a multi-agent gateway can never end up
+    // chatting to one agent while displaying another's runs.
+    const overrideAgentId = normalizeAgentId(args.agentId)
+        ?? normalizeAgentId(process.env.OPENCLAW_AGENT_ID)
+        ?? normalizeAgentId(pluginConfig?.agentId);
+    const agentId = overrideAgentId ?? resolveDefaultAgentIdFromConfig(ocConfig);
+    const agentIdSource = overrideAgentId ? 'configured override' : 'gateway default agent';
+    // --- One-click connector update switch ---
+    // env > plugin-config.json connectorUpdate > allowed. A per-host opt-out
+    // for the dashboard's "Update connector" (which opens a PTY on this box);
+    // see providers/connector-update.ts.
+    const allowConnectorUpdate = parseOnOffSwitch(process.env.REEFCLAW_ALLOW_CONNECTOR_UPDATE)
+        ?? parseOnOffSwitch(pluginConfig?.connectorUpdate)
+        ?? true;
     logger.info(TAG, `Intelligence service: ${intelligenceUrl} (venue=${venue})`);
+    logger.info(TAG, `Agent: ${agentId} (${agentIdSource}); one-click connector update: ${allowConnectorUpdate ? 'allowed' : 'DISABLED on this box'}`);
     logger.debug(TAG, `Resolved: url=${gatewayUrl}, token=${gatewayToken ? '***' : '(none)'}, symbol=${symbol}`);
-    return { gatewayUrl, gatewayToken, symbol, intelligenceUrl, venue };
+    return { gatewayUrl, gatewayToken, symbol, intelligenceUrl, venue, agentId, allowConnectorUpdate };
 }
 /**
  * Validate that the resolved config has all required fields.

package/bridge/gateway/gateway-ws-client.d.ts

@@ -51,6 +51,7 @@ export type GatewayWsEventPayload = {
         seq?: number;
         sessionKey?: string;
         sessionId?: string;
+        agentId?: string;
     };
     presence: {
         payload: unknown;

package/bridge/gateway/gateway-ws-client.js

@@ -344,6 +344,9 @@ export class GatewayWsClient {
                         seq: frame.seq,
                         ...(typeof p.sessionKey === 'string' ? { sessionKey: p.sessionKey } : {}),
                         ...(typeof p.sessionId === 'string' ? { sessionId: p.sessionId } : {}),
+                        // Not sent by today's gateway (the owner rides in sessionKey);
+                        // forwarded if a future build adds it — see agent-scope.ts.
+                        ...(typeof p.agentId === 'string' ? { agentId: p.agentId } : {}),
                     });
                 }
                 break;

package/bridge/index.js

@@ -91,6 +91,10 @@ function parseArgs() {
                 gateway.symbol = next;
                 i++;
                 break;
+            case '--agent-id':
+                gateway.agentId = next;
+                i++;
+                break;
             case '--log-level':
             case '-l':
                 if (['debug', 'info', 'warn', 'error'].includes(next)) {
@@ -118,36 +122,37 @@ function parseArgs() {
     return { cli, gateway };
 }
 function printUsage() {
-    console.log(`
-ReefClaw Skill — Bridge between OpenClaw and ReefClaw relay
-
-Usage:
-  tsx src/index.ts [options]
-
-Options:
-  --provider, -p <mock|gateway>  Provider type (default: mock)
-  --token, -t <token>            Connection token (or REEFCLAW_TOKEN env)
-  --user-id, -u <id>             User ID (or REEFCLAW_USER_ID env)
-  --relay-url, -r <url>          Relay URL (default: wss://reefclaw.radunlupsa.partykit.dev)
-  --gateway-url <url>            OpenClaw gateway URL (or OPENCLAW_GATEWAY_URL env)
-  --gateway-token <token>        OpenClaw gateway token (or OPENCLAW_GATEWAY_TOKEN env)
-  --symbol <symbol>              Trading symbol (default: BTC/USDT, or REEFCLAW_SYMBOL env)
-  --log-level, -l <level>        Log level: debug, info, warn, error (default: info)
-  --setup, -s [token]            Run setup flow (validate token, test connection, save to config)
-  --help, -h                     Show this help
-
-Relay config resolution (highest priority first):
-  1. CLI arguments (--token, --user-id, --relay-url)
-  2. Environment variables (REEFCLAW_TOKEN, REEFCLAW_USER_ID, REEFCLAW_RELAY_URL)
-  3. OpenClaw config file (~/.openclaw/openclaw.json → skills.entries.reefclaw)
-  4. Fallback env vars (MOCK_TOKEN, USER_ID)
-  5. Defaults (relay URL → wss://reefclaw.radunlupsa.partykit.dev)
-
-Gateway config resolution (for --provider gateway):
-  1. CLI arguments (--gateway-url, --gateway-token, --symbol)
-  2. Environment variables (OPENCLAW_GATEWAY_URL, OPENCLAW_GATEWAY_TOKEN, REEFCLAW_SYMBOL)
-  3. OpenClaw config file (~/.openclaw/openclaw.json → gateway.auth.token, gateway.port)
-  4. Defaults (http://localhost:18789, BTC/USDT)
+    console.log(`
+ReefClaw Skill — Bridge between OpenClaw and ReefClaw relay
+
+Usage:
+  tsx src/index.ts [options]
+
+Options:
+  --provider, -p <mock|gateway>  Provider type (default: mock)
+  --token, -t <token>            Connection token (or REEFCLAW_TOKEN env)
+  --user-id, -u <id>             User ID (or REEFCLAW_USER_ID env)
+  --relay-url, -r <url>          Relay URL (default: wss://reefclaw.radunlupsa.partykit.dev)
+  --gateway-url <url>            OpenClaw gateway URL (or OPENCLAW_GATEWAY_URL env)
+  --gateway-token <token>        OpenClaw gateway token (or OPENCLAW_GATEWAY_TOKEN env)
+  --symbol <symbol>              Trading symbol (default: BTC/USDT, or REEFCLAW_SYMBOL env)
+  --agent-id <id>                OpenClaw agent this bridge serves (default: main, or OPENCLAW_AGENT_ID env)
+  --log-level, -l <level>        Log level: debug, info, warn, error (default: info)
+  --setup, -s [token]            Run setup flow (validate token, test connection, save to config)
+  --help, -h                     Show this help
+
+Relay config resolution (highest priority first):
+  1. CLI arguments (--token, --user-id, --relay-url)
+  2. Environment variables (REEFCLAW_TOKEN, REEFCLAW_USER_ID, REEFCLAW_RELAY_URL)
+  3. OpenClaw config file (~/.openclaw/openclaw.json → skills.entries.reefclaw)
+  4. Fallback env vars (MOCK_TOKEN, USER_ID)
+  5. Defaults (relay URL → wss://reefclaw.radunlupsa.partykit.dev)
+
+Gateway config resolution (for --provider gateway):
+  1. CLI arguments (--gateway-url, --gateway-token, --symbol, --agent-id)
+  2. Environment variables (OPENCLAW_GATEWAY_URL, OPENCLAW_GATEWAY_TOKEN, REEFCLAW_SYMBOL, OPENCLAW_AGENT_ID)
+  3. OpenClaw config file (~/.openclaw/openclaw.json → gateway.auth.token, gateway.port)
+  4. Defaults (http://localhost:18789, BTC/USDT)
 `);
 }
 // ---- Main ----

package/bridge/providers/connector-update.d.ts

@@ -45,6 +45,9 @@ export interface ConnectorUpdateOutcome {
  *   - agent runs in a sandbox → in-sandbox terminals are unsupported
  */
 export declare function describeOpenFailure(err: unknown): ConnectorUpdateOutcome;
+/** The operator switched one-click updates off on this box. Refused before
+ *  any gateway call is made; the copy carries the manual path. */
+export declare function describeUpdateDisabled(): ConnectorUpdateOutcome;
 /**
  * Once the command is running, losing the transport is EXPECTED — the installer
  * restarts the gateway, which is the process hosting both the PTY and our own

package/bridge/providers/connector-update.js

@@ -33,6 +33,22 @@
 //     `classifyTransportLoss`.
 //   - The PTY runs as the gateway's own user (`openclaw`), which is exactly the
 //     user the installer must run as. Correct by construction.
+//
+// Hardening after the 2026-09-16 self-hoster audit (a relay message that ends
+// in a PTY on the operator's machine is a capability worth fencing even with
+// a constant command):
+//   - Per-host opt-out: REEFCLAW_ALLOW_CONNECTOR_UPDATE=0 (or plugin-config.json
+//     `"connectorUpdate": "off"`) makes the provider refuse before any gateway
+//     call (`describeUpdateDisabled`). The gateway's own switch
+//     `gateway.terminal.enabled=false` is honoured too (`describeOpenFailure`).
+//   - terminal.* needs operator.admin: the update opens a separate short-lived
+//     admin session and checks the granted scopes before `terminal.open`.
+//   - Residual trust: `@latest` resolves on the npm registry, so the trust root
+//     is the registry plus the publisher account (2FA), exactly as for a manual
+//     `npx`. Pinning an exact, offline-signed version is the planned follow-up
+//     (the SKILL.md OTA already carries the Ed25519 key for it).
+//   - The updater overwrites local modifications to the placed bridge/plugin,
+//     as any reinstall would. Self-hosters carrying patches: switch it off.
 import { logger } from '../logger.js';
 const TAG = 'connector-update';
 /**
@@ -105,6 +121,16 @@ export function describeOpenFailure(err) {
         message: `Could not open a terminal on the box: ${raw}`,
     };
 }
+/** The operator switched one-click updates off on this box. Refused before
+ *  any gateway call is made; the copy carries the manual path. */
+export function describeUpdateDisabled() {
+    return {
+        ok: false,
+        status: 'blocked',
+        message: 'One-click updates are switched off on this box (REEFCLAW_ALLOW_CONNECTOR_UPDATE=0). '
+            + `Update from a shell on the box instead: ${CONNECTOR_UPDATE_COMMAND}`,
+    };
+}
 /**
  * Once the command is running, losing the transport is EXPECTED — the installer
  * restarts the gateway, which is the process hosting both the PTY and our own

package/bridge/providers/gateway.d.ts

@@ -40,6 +40,11 @@ export declare class GatewayProvider implements OpenClawProvider {
      *  Surfaced in agent_state so the dashboard header can show the real agent +
      *  model instead of a hardcoded placeholder. Empty until the gateway answers. */
     private agentIdentity;
+    /** Foreign agent ids whose runs we have already logged as ignored (once each). */
+    private readonly ignoredForeignAgents;
+    /** The OpenClaw agent this bridge serves: chat goes to it, and only its runs
+     *  reach the dashboard (gateway/agent-scope.ts). */
+    private agentId;
     /** Emit the one-time rollout probe (gateway response shape) only on the first attempt. */
     private loggedAgentIdentityProbe;
     /** Last IDENTITY.md read (epoch ms) — TTL gate for the display-name re-read. */

package/bridge/providers/gateway.js

@@ -19,7 +19,8 @@ import { parseIdentityName } from '../utils/identity-name.js';
 import { computeEquity as _computeEquity, computePositionNotional as _computePositionNotional, computeRiskMetrics as _computeRiskMetrics, DEFAULT_RISK_LIMITS, DRAWDOWN_ZONE_THRESHOLDS, TENANT_LIMIT_BOUNDS, boundedNum, validateDrawdownLadder, } from './risk-calculator.js';
 import { executeKill as _executeKill, executeFlatten as _executeFlatten, executePause as _executePause, executeResume as _executeResume, cancelPendingProposals, withProposalDetail, } from './emergency-commands.js';
 import { executeSetTradingMode, executeGetBracketConfig, executeSetBracketRequirement, executeSetExchangeCredentials, executeTestExchangeCredentials, executeClearExchangeCredentials, executeProvisionHlAgentWallet, executeHlAgentWalletStatus, executeSubmitHlAgentApproval, } from './onboarding-commands.js';
-import { startConnectorUpdate, runConnectorUpdate, openAdminGatewaySession, checkPositionGuard, } from './connector-update.js';
+import { startConnectorUpdate, runConnectorUpdate, openAdminGatewaySession, checkPositionGuard, describeUpdateDisabled, } from './connector-update.js';
+import { DEFAULT_AGENT_ID, isForeignAgentEvent, resolveAgentEventOwner } from '../gateway/agent-scope.js';
 const TAG = 'gateway';
 // ---- Day-start NAV persistence ----
 // Persists sessionStartNav (the UTC-day P&L anchor) per date so Day P&L
@@ -159,6 +160,13 @@ export class GatewayProvider {
      *  Surfaced in agent_state so the dashboard header can show the real agent +
      *  model instead of a hardcoded placeholder. Empty until the gateway answers. */
     agentIdentity = {};
+    /** Foreign agent ids whose runs we have already logged as ignored (once each). */
+    ignoredForeignAgents = new Set();
+    /** The OpenClaw agent this bridge serves: chat goes to it, and only its runs
+     *  reach the dashboard (gateway/agent-scope.ts). */
+    agentId() {
+        return this.config.agentId ?? DEFAULT_AGENT_ID;
+    }
     /** Emit the one-time rollout probe (gateway response shape) only on the first attempt. */
     loggedAgentIdentityProbe = false;
     /** Last IDENTITY.md read (epoch ms) — TTL gate for the display-name re-read. */
@@ -669,7 +677,7 @@ export class GatewayProvider {
         }
         try {
             const idempotencyKey = `chat-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
-            await ws.sendRpc('agent', { message: content, idempotencyKey, agentId: 'main' });
+            await ws.sendRpc('agent', { message: content, idempotencyKey, agentId: this.agentId() });
             return { received: true };
         }
         catch (err) {
@@ -749,6 +757,13 @@ export class GatewayProvider {
      * `restarting` and the dashboard waits for the reconnect.
      */
     async updateConnector(args) {
+        // Per-host opt-out FIRST: a box whose operator switched this off must
+        // never open a PTY, connected or not (REEFCLAW_ALLOW_CONNECTOR_UPDATE=0 /
+        // plugin-config.json connectorUpdate:'off').
+        if (this.config.allowConnectorUpdate === false) {
+            logger.info(TAG, 'connector.update refused: one-click updates are switched off on this box');
+            return describeUpdateDisabled();
+        }
         if (!this.wsClient) {
             return { ok: false, status: 'failed', message: 'Not connected to the OpenClaw gateway.' };
         }
@@ -1366,6 +1381,19 @@ export class GatewayProvider {
     onAgentEvent(payload) {
         if (!this.started || !this.eventParser)
             return;
+        // Only OUR agent's runs belong in the dashboard. The gateway broadcasts
+        // every agent's events to every operator connection, so on a shared
+        // gateway a neighbour's cron briefing used to stream into the chat and
+        // across the relay (2026-09-16 audit, item 1). See gateway/agent-scope.ts.
+        if (isForeignAgentEvent(payload, this.agentId())) {
+            const owner = resolveAgentEventOwner(payload) ?? '?';
+            if (!this.ignoredForeignAgents.has(owner)) {
+                this.ignoredForeignAgents.add(owner);
+                logger.warn(TAG, `Ignoring run events from agent '${owner}' — this bridge serves '${this.agentId()}' ` +
+                    '(the gateway default agent unless overridden; set OPENCLAW_AGENT_ID / --agent-id if that is the wrong agent)');
+            }
+            return;
+        }
         // Turn lifecycle WITH the session key — the heartbeat flight recorder
         // keys off `agent:main:cron:…` to scan the beat's transcript right after
         // it ends. Fired before parsing so it never depends on parser state.
@@ -2345,7 +2373,8 @@ export class GatewayProvider {
             (Array.isArray(root.data) && root.data) ||
             [root];
         const rows = rowsRaw.filter((r) => !!r && typeof r === 'object');
-        const row = rows.find((r) => r.agentId === 'main') ?? rows[0];
+        const own = this.agentId();
+        const row = rows.find((r) => r.agentId === own) ?? rows[0];
         const runtime = row ? (asObj(row.agentRuntime) ?? asObj(row.runtime)) : undefined;
         const defaults = asObj(root.defaults);
         return flatModel(row?.model) ?? flatModel(runtime?.model) ?? flatModel(defaults?.model) ?? flatModel(root.model);
@@ -3104,7 +3133,7 @@ export class GatewayProvider {
         ].join('\n');
         try {
             const idempotencyKey = `mission-${mission.missionId}-${Date.now()}`;
-            await ws.sendRpc('agent', { message, idempotencyKey, agentId: 'main' });
+            await ws.sendRpc('agent', { message, idempotencyKey, agentId: this.agentId() });
             logger.info(TAG, `Presented mission ${mission.missionId} to agent ($${absoluteSize.toFixed(2)}, ${quantity.toFixed(6)} units)`);
         }
         catch (err) {

package/exchange-adapter.d.ts

@@ -48,8 +48,13 @@ export interface IExchangeAdapter {
      *  @param closeReason Tags the resulting Trade record with who initiated the close.
      *    Paper mode persists it on the closing Trade.metadata.closeReason so the agent
      *    can see on its next heartbeat that e.g. a stop_watcher auto-closed the trade.
-     *    Live mode currently ignores this (metadata not tracked in live path). */
-    closePosition(symbol: string, closeReason?: CloseReason): Promise<CcxtOrder>;
+     *    Live mode currently ignores this (metadata not tracked in live path).
+     *  @param referencePrice Paper-only: the price the closing DECISION was made
+     *    on (a stop's breach mark, a target level). The simulator anchors the
+     *    fill to it instead of whatever tick/book it has cached: a stop that
+     *    filled off an entry-time cache booked a -1.04R loss as -0.02R
+     *    (2026-09-16 audit). Live venues fill at market and ignore it. */
+    closePosition(symbol: string, closeReason?: CloseReason, referencePrice?: number): Promise<CcxtOrder>;
     getBalance(): Promise<CcxtBalance>;
     getPositions(symbol?: string): Promise<CcxtPosition[]>;
     /**

package/ingest/readiness-reporter.js

@@ -355,6 +355,12 @@ export function startReadinessReporter(opts) {
                 publicApi: opts.publicApi,
                 toolCount: opts.toolCount,
                 resolveStopProtection: opts.resolveStopProtection,
+                // The dashboard's update banner reads these off EVERY post (boot and
+                // periodic). 0.1.28-0.1.29 received them here and dropped them, so
+                // every updated box posted agent:{} without a version and the banner
+                // went silent for it (found 2026-09-16 on the rig).
+                pluginVersion: opts.pluginVersion,
+                installChannel: opts.installChannel,
             }, bootWarmup, { state });
             await postReadiness(opts.apiBaseUrl, opts.token, report, fetchImpl, timeoutMs);
             if (report.overall === 'fail') {

package/live/stop-watcher.js

@@ -212,7 +212,13 @@ export class PositionWatcher extends EventEmitter {
                 throw new Error(`Wave 9 ownership resolution failed before stop close submission: ${ownershipError}; ` +
                     'IMMEDIATE MANUAL INTERVENTION REQUIRED');
             }
-            closeOrder = await this.adapter.closePosition(trustedPosition.symbol, 'stop_watcher');
+            // Fill at the mark the breach decision was made on, not at whatever the
+            // paper engine has cached (the take-profit leg already passes its level
+            // the same way). Live adapters fill at market and ignore the reference.
+            const stopFillPrice = Number.isFinite(trustedPosition.markPrice) && trustedPosition.markPrice > 0
+                ? trustedPosition.markPrice
+                : undefined;
+            closeOrder = await this.adapter.closePosition(trustedPosition.symbol, 'stop_watcher', stopFillPrice);
             if (!candidateId || !this.wave9CloseLifecycle)
                 return 'closed';
             const outcome = await this.wave9CloseLifecycle.settleAfterClose(candidateId, trustedPosition.symbol);

package/openclaw.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "reefclaw-paper-trading",
   "name": "ReefClaw Trading",
-  "version": "0.1.28",
+  "version": "0.1.30",
   "description": "Supervised trading plugin for the ReefClaw dashboard. It runs on YOUR machine and starts in PAPER mode with no API keys. It cannot trade real funds until you supply exchange credentials and step PAPER→MICRO_LIVE→LIVE yourself from the dashboard — the agent cannot make that change (the tool is refused without operator provenance). Exchange keys stay local, are used only to sign requests to the exchange, and are never transmitted to ReefClaw (asserted by a test in this package). Trading telemetry — positions, fills, decision journal — is sent to ReefClaw to render the dashboard. Every live position carries exchange-native protective stops. Remote updates to the agent's trading instructions are applied only after an Ed25519 signature is verified against a public key pinned in this build.",
   "author": "ReefClaw",
   "activation": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reefclaw/openclaw-plugin",
-  "version": "0.1.28",
+  "version": "0.1.30",
   "description": "ReefClaw supervised trading plugin for OpenClaw. Runs entirely on YOUR machine and starts in PAPER mode — it cannot trade real funds until you supply exchange credentials and walk the PAPER→MICRO_LIVE→LIVE ladder yourself from the ReefClaw dashboard (the agent cannot make that change; it is refused without operator provenance). Your exchange API keys stay on your machine to sign requests to the exchange and are NEVER sent to ReefClaw — a test in the package asserts this. What does reach ReefClaw is trading telemetry for the dashboard (positions, fills, decision journal). Live trading always carries exchange-native protective stops. Trading instructions can be updated remotely, and every update must carry a valid Ed25519 signature verified against a key pinned in this build before it is applied. Install: npx --yes @reefclaw/connect, or from ClawHub on OpenClaw 2026.8.1+ (Control UI Plugins > Discover, or /plugins install clawhub:@reefclaw/openclaw-plugin then the same with --accept-capabilities after reviewing the listed capabilities)",
   "type": "module",
   "main": "index.js",

package/paper-adapter.d.ts

@@ -13,7 +13,7 @@ export declare class PaperAdapter implements IExchangeAdapter {
     createOrder(symbol: string, side: 'buy' | 'sell', type: 'market' | 'limit', amount: number, price?: number, metadata?: PositionMetadata, _options?: OrderOptions): Promise<CcxtOrder>;
     cancelOrder(orderId: string, _symbol?: string): Promise<CcxtOrder>;
     cancelAllOrders(symbol?: string): Promise<CcxtOrder[]>;
-    closePosition(symbol: string, closeReason?: CloseReason): Promise<CcxtOrder>;
+    closePosition(symbol: string, closeReason?: CloseReason, referencePrice?: number): Promise<CcxtOrder>;
     getBalance(): Promise<CcxtBalance>;
     getPositions(symbol?: string): Promise<CcxtPosition[]>;
     /** Paper has no exchange fetch to fail — position state is always known. */

package/paper-adapter.js

@@ -22,8 +22,8 @@ export class PaperAdapter {
     async cancelAllOrders(symbol) {
         return this.simulator.cancelAllOrders(symbol);
     }
-    async closePosition(symbol, closeReason) {
-        return this.simulator.closePosition(symbol, closeReason);
+    async closePosition(symbol, closeReason, referencePrice) {
+        return this.simulator.closePosition(symbol, closeReason, referencePrice);
     }
     // Reads pull a newer state.json first (ExchangeSimulator.refreshState —
     // no-op without a hook). Out-of-tool readers (DB-vs-exchange sweep,

package/release-notes.json

@@ -1,5 +1,7 @@
 {
   "_comment": "One line per released plugin version, shown in the dashboard's update banner. Baked into the webapp at build by webapp/scripts/generate-skill-content.mjs (LATEST_PLUGIN_NOTES = the entry for plugin-package/package.json#version). Add a line in the same PR that bumps the version.",
   "0.1.27": "Fixes paper positions showing as closed at $0 in the Journal while still open, and adds a 2-minute grace to the position reconciler.",
-  "0.1.28": "Fixes the connector's gateway handshake on OpenClaw 2026.9+ (it now connects as OpenClaw's local-backend client) and adds in-app update notices with one-click updates."
+  "0.1.28": "Fixes the connector's gateway handshake on OpenClaw 2026.9+ (it now connects as OpenClaw's local-backend client) and adds in-app update notices with one-click updates.",
+  "0.1.29": "Paper stop and target fills now use the price the decision was made on when the cached order book is stale (paper P&L gets more honest); on a gateway with several agents the connector shows only its own agent's runs; one-click updates can be switched off per box.",
+  "0.1.30": "Restores the connector's version reporting, so the dashboard's update notice works again for boxes that already updated (0.1.28 and 0.1.29 reported no version and could not be nudged)."
 }

package/simulator/exchange-simulator.js

@@ -9,6 +9,7 @@ import { randomUUID } from 'node:crypto';
 import { logger, formatError } from '../logger.js';
 import { MAX_TRADE_HISTORY, DEFAULT_SIMULATION_CONFIG } from './types.js';
 import { fillMarketOrder, fillLimitOrder, parseSymbol } from './fill-engine.js';
+import { MAX_BOOK_DRIFT_BPS } from './realistic-fills.js';
 import { updateMfe } from '../mfe.js';
 import { computeInvalidationHit } from '../pinned-plan.js';
 const TAG = 'simulator';
@@ -805,7 +806,10 @@ export class ExchangeSimulator extends EventEmitter {
             logger.info(TAG, `Market order filled: ${order.side} ${order.amount} ${order.symbol} @ ${result.order.average}` +
                 ` (decision: ${eq.decisionPrice.toFixed(2)}, slippage: ${eq.slippageBps.toFixed(2)}bps` +
                 `, latency: ${eq.latencyMs.toFixed(0)}ms, fee: ${eq.feeRate * 100}%` +
-                `, book: ${eq.bookDepthAvailable ? `${eq.bookLevelsConsumed} levels` : 'unavailable'})`);
+                `, book: ${eq.bookDepthAvailable ? `${eq.bookLevelsConsumed} levels` : 'unavailable'}` +
+                `${eq.bookDriftBps !== undefined && Math.abs(eq.bookDriftBps) > MAX_BOOK_DRIFT_BPS
+                    ? `, stale book ${eq.bookDriftBps.toFixed(0)}bps off the decision price: fill anchored`
+                    : ''})`);
         }
         else {
             logger.info(TAG, `Market order filled: ${order.side} ${order.amount} ${order.symbol} @ ${result.order.average}`);

package/simulator/realistic-fills.d.ts

@@ -1,4 +1,18 @@
 import type { OrderBookDepth, SimulationConfig, ExecutionQuality } from './types.js';
+/**
+ * How far (bps) the cached book's mid may sit from the decision price before
+ * the fill is anchored to the decision price instead of the raw book VWAP.
+ *
+ * The book is refreshed only when a tool fetches it (tools/helpers.ts
+ * fetchOrderBook, typically at entry), so a stop or target hours later used to
+ * fill against an hours-old book: an ADA/USDT short stop with a 0.2123 breach
+ * mark filled at 0.207103, 245 bps in the trader's favour, booking a -1.04R
+ * loss as -0.02R (2026-09-16 audit). Inside the band the book is fresh enough
+ * to price the fill directly (unchanged behaviour); outside it the book only
+ * shapes the impact (VWAP vs mid), applied to the price the decision was
+ * actually made on.
+ */
+export declare const MAX_BOOK_DRIFT_BPS = 10;
 /**
  * Walk the order book to compute a volume-weighted average fill price.
  *
@@ -45,6 +59,8 @@ export declare function getFeeRate(orderType: 'market' | 'limit', config: Simula
  *
  * Combines: orderbook VWAP + latency drift + appropriate fee rate.
  * Falls back to simple random slippage if no orderbook is available.
+ * A book whose mid has drifted more than MAX_BOOK_DRIFT_BPS from the decision
+ * price is stale: its impact is kept, the level is re-anchored.
  *
  * @returns fillPrice and ExecutionQuality metrics
  */

package/simulator/realistic-fills.js

@@ -1,6 +1,20 @@
 // Phase 9a: Realistic fill simulation.
 // Order book-aware VWAP fills, latency modeling, maker/taker fees.
 import { DEFAULT_SIMULATION_CONFIG, priceToBps } from './types.js';
+/**
+ * How far (bps) the cached book's mid may sit from the decision price before
+ * the fill is anchored to the decision price instead of the raw book VWAP.
+ *
+ * The book is refreshed only when a tool fetches it (tools/helpers.ts
+ * fetchOrderBook, typically at entry), so a stop or target hours later used to
+ * fill against an hours-old book: an ADA/USDT short stop with a 0.2123 breach
+ * mark filled at 0.207103, 245 bps in the trader's favour, booking a -1.04R
+ * loss as -0.02R (2026-09-16 audit). Inside the band the book is fresh enough
+ * to price the fill directly (unchanged behaviour); outside it the book only
+ * shapes the impact (VWAP vs mid), applied to the price the decision was
+ * actually made on.
+ */
+export const MAX_BOOK_DRIFT_BPS = 10;
 /**
  * Walk the order book to compute a volume-weighted average fill price.
  *
@@ -92,6 +106,8 @@ export function getFeeRate(orderType, config) {
  *
  * Combines: orderbook VWAP + latency drift + appropriate fee rate.
  * Falls back to simple random slippage if no orderbook is available.
+ * A book whose mid has drifted more than MAX_BOOK_DRIFT_BPS from the decision
+ * price is stale: its impact is kept, the level is re-anchored.
  *
  * @returns fillPrice and ExecutionQuality metrics
  */
@@ -103,6 +119,7 @@ export function computeRealisticMarketFill(side, amount, decisionPrice, orderboo
     let latencyImpactBps;
     let bookLevelsConsumed;
     let bookDepthAvailable;
+    let bookDriftBps;
     if (orderbook && orderbook.asks.length > 0 && orderbook.bids.length > 0) {
         // Book-aware VWAP fill
         const { vwap, levelsConsumed } = computeBookAwareFillPrice(side, amount, orderbook);
@@ -113,8 +130,14 @@ export function computeRealisticMarketFill(side, amount, decisionPrice, orderboo
         marketImpactBps = priceToBps(vwap, midPrice);
         // For sells, impact is negative (received less), so take absolute for the metric
         // but keep signed for the actual price
-        // Apply latency drift on top of VWAP
-        const latencyResult = applyLatencyDrift(vwap, side, latencyMs, volFactor);
+        // A book that has drifted from the decision price is stale: keep its
+        // impact, re-anchor the level (see MAX_BOOK_DRIFT_BPS).
+        bookDriftBps = priceToBps(midPrice, decisionPrice);
+        const level = Math.abs(bookDriftBps) > MAX_BOOK_DRIFT_BPS
+            ? decisionPrice * (1 + marketImpactBps / 10_000)
+            : vwap;
+        // Apply latency drift on top of the (possibly re-anchored) VWAP
+        const latencyResult = applyLatencyDrift(level, side, latencyMs, volFactor);
         fillPrice = latencyResult.adjustedPrice;
         latencyImpactBps = latencyResult.latencyImpactBps;
     }
@@ -147,6 +170,7 @@ export function computeRealisticMarketFill(side, amount, decisionPrice, orderboo
         feePaid,
         bookLevelsConsumed,
         bookDepthAvailable,
+        ...(bookDriftBps !== undefined ? { bookDriftBps } : {}),
     };
     return { fillPrice, executionQuality };
 }

package/simulator/types.d.ts

@@ -39,6 +39,10 @@ export interface ExecutionQuality {
     feePaid: number;
     bookLevelsConsumed: number;
     bookDepthAvailable: boolean;
+    /** Signed bps between the cached book's mid and the decision price at fill
+     *  time. Beyond MAX_BOOK_DRIFT_BPS the fill was anchored to the decision
+     *  price (stale book). Absent when no book was available. */
+    bookDriftBps?: number;
     /** Age of the quote the fill priced against (fill time − ticker.timestamp).
      *  Surfaces feed staleness (issue #202); absent on records from before the
      *  field existed or when the ticker carried no usable timestamp. */