@shadowob/openclaw-shadowob 1.1.6 → 1.1.7

package/dist/{chunk-4G572ZLC.js → chunk-XOO7S6K5.js}

@@ -1201,22 +1201,89 @@ function resolveOwnerAllowFrom(policyConfig) {
   const ownerId = typeof policyConfig?.ownerId === "string" ? policyConfig.ownerId.trim() : "";
   return ownerId ? [ownerId] : void 0;
 }
-async function buildMentionedServerAppSkillsContext(params) {
+var MAX_SERVER_APPS_IN_CONTEXT = 8;
+function serverAppCommandSummary(app) {
+  return app.manifest.commands.slice(0, 6).map(
+    (command) => `${command.name}(${command.action}, permission=${command.permission}, approval=${command.approvalMode ?? app.defaultApprovalMode})`
+  ).join("; ");
+}
+function formatInstalledServerAppSummary(ref) {
+  const app = ref.app;
+  if (!app) {
+    return `- ${ref.label}: appKey=${ref.appKey}, server=${ref.server}${ref.mentioned ? ", mentioned=true" : ""}`;
+  }
+  return [
+    `- ${app.name}: appKey=${app.appKey}, server=${ref.server}, defaultPermissions=${app.defaultPermissions.join(",") || "none"}, defaultApproval=${app.defaultApprovalMode}`,
+    app.description ? `  description=${app.description}` : "",
+    `  commands=${serverAppCommandSummary(app)}`
+  ].filter(Boolean).join("\n");
+}
+function serverAppContextFields(apps) {
+  if (apps.length === 0) return {};
+  return {
+    ServerApps: apps.map((app) => ({
+      id: app.id,
+      serverId: app.serverId,
+      appKey: app.appKey,
+      name: app.name,
+      description: app.description,
+      defaultPermissions: app.defaultPermissions,
+      defaultApprovalMode: app.defaultApprovalMode,
+      commands: app.manifest.commands.map((command) => ({
+        name: command.name,
+        title: command.title,
+        description: command.description,
+        permission: command.permission,
+        action: command.action,
+        dataClass: command.dataClass,
+        approvalMode: command.approvalMode ?? app.defaultApprovalMode
+      }))
+    })),
+    ServerAppSummary: apps.map((app) => `${app.name} (${app.appKey})`).join(", ")
+  };
+}
+async function buildServerAppSkillsContext(params) {
   const appRefs = /* @__PURE__ */ new Map();
+  const installedApps = [];
+  if (params.serverInfo) {
+    const server = params.serverInfo.serverSlug || params.serverInfo.serverId;
+    try {
+      const apps = await params.client.listServerApps(params.serverInfo.serverId);
+      for (const app of apps.filter((item) => item.status !== "disabled")) {
+        installedApps.push(app);
+        appRefs.set(`${params.serverInfo.serverId}:${app.appKey}`, {
+          appKey: app.appKey,
+          server,
+          label: app.name,
+          app,
+          mentioned: false
+        });
+      }
+    } catch (err) {
+      params.runtime.error?.(
+        `[server-app] Failed listing apps for ${params.serverInfo.serverId}: ${String(err)}`
+      );
+    }
+  }
   for (const mention of params.mentions) {
     if (mention.kind !== "app") continue;
     const appKey = mention.appKey ?? mention.targetId;
     const server = mention.serverId ?? mention.serverSlug ?? params.serverInfo?.serverId;
     if (!appKey || !server) continue;
-    appRefs.set(`${server}:${appKey}`, {
+    const key = `${server}:${appKey}`;
+    const existing = appRefs.get(key);
+    appRefs.set(key, {
+      ...existing,
       appKey,
       server,
-      label: mention.label || mention.sourceToken || mention.token || appKey
+      label: mention.label || mention.sourceToken || mention.token || appKey,
+      mentioned: true
     });
   }
-  if (appRefs.size === 0) return "";
+  if (appRefs.size === 0) return { prompt: "", fields: {} };
+  const refs = Array.from(appRefs.values()).slice(0, MAX_SERVER_APPS_IN_CONTEXT);
   const documents = await Promise.all(
-    Array.from(appRefs.values()).map(async (ref) => {
+    refs.map(async (ref) => {
       try {
         const skill = await params.client.getServerAppSkills(ref.server, ref.appKey);
         return [
@@ -1235,13 +1302,17 @@ async function buildMentionedServerAppSkillsContext(params) {
     })
   );
   const loaded = documents.filter(Boolean);
-  if (loaded.length === 0) return "";
-  return [
-    "Injected Shadow Server App Skills:",
-    "These instructions are authoritative for mentioned server apps in this message. Use the Shadow CLI path described below so Shadow can bind identity, app grants, and policy.",
+  const prompt = [
+    "Shadow Server Apps available in this server:",
+    ...refs.map(formatInstalledServerAppSummary),
     "",
+    "Use these apps when the user asks natural-language questions or tasks that match an installed app name, description, or command capability. Do not wait for the user to say a CLI command or explicitly mention the app.",
+    'Operate server apps through the mounted Shadow CLI only so Shadow can bind the Buddy identity, app grants, approval prompts, and policy: run `shadowob app discover --server "<current-server-id-or-slug>" --json` when needed, then `shadowob app call "<appKey>" <command> --server "<current-server-id-or-slug>" --channel-id "<current-channel-id>" --json-input \'<raw-command-input-json>\' --json`. Do not use curl, fetch, raw HTTP routes, or SDK calls for server-app commands.',
+    "Shadow App command approvals are system permission prompts, not chat interactive dialogs. Never send a Shadow interactive form/buttons/approval message as a substitute for App command approval, and never call the App approval endpoint yourself as a Buddy. If the CLI returns SERVER_APP_COMMAND_APPROVAL_REQUIRED, tell the user that Shadow opened the approval popup, then stop until a person confirms and asks you to retry.",
+    loaded.length > 0 ? "Injected Shadow Server App Skills:" : "",
     ...loaded
-  ].join("\n");
+  ].filter(Boolean).join("\n");
+  return { prompt, fields: serverAppContextFields(installedApps) };
 }
 async function processShadowMessage(params) {
   const {
@@ -1337,7 +1408,7 @@ async function processShadowMessage(params) {
   const conversationLabel = serverInfo ? `${serverInfo.serverName} ${channelLabel}` : peerId;
   const messageBodyForAgent = interactiveResponseContext.text || baseBodyForAgent;
   const client = new ShadowClient2(account.serverUrl, account.token);
-  const serverAppSkillsContext = await buildMentionedServerAppSkillsContext({
+  const serverAppContext = await buildServerAppSkillsContext({
     mentions: structuredMentions,
     client,
     serverInfo,
@@ -1353,7 +1424,7 @@ async function processShadowMessage(params) {
     buildCommerceContextForAgent(account),
     viewerCommerceContext,
     mentionContext,
-    serverAppSkillsContext,
+    serverAppContext.prompt,
     messageBodyForAgent
   ].filter(Boolean).join("\n\n");
   const body = core.channel.reply.formatAgentEnvelope({
@@ -1388,6 +1459,7 @@ async function processShadowMessage(params) {
     MessageSid: message.id,
     WasMentioned: wasMentioned,
     ...mentionContextFields(structuredMentions),
+    ...serverAppContext.fields,
     OriginatingChannel: "shadowob",
     OriginatingTo: `shadowob:channel:${channelId}`,
     NativeChannelId: channelId,

package/dist/index.js

@@ -15,7 +15,7 @@ import {
   resolveOutboundMentions,
   setShadowRuntime,
   tryGetShadowRuntime
-} from "./chunk-4G572ZLC.js";
+} from "./chunk-XOO7S6K5.js";
 
 // index.ts
 import { defineChannelPluginEntry } from "openclaw/plugin-sdk/core";
@@ -960,7 +960,7 @@ shadowPlugin.gateway = {
       lastError: null
     });
     ctx.log?.info(`Starting Shadow connection for account ${accountId}`);
-    const { monitorShadowProvider: monitorShadowProvider2 } = await import("./monitor-XDUBTELB.js");
+    const { monitorShadowProvider: monitorShadowProvider2 } = await import("./monitor-K7U33EFS.js");
     await monitorShadowProvider2({
       account,
       accountId,

package/dist/{monitor-XDUBTELB.js → monitor-K7U33EFS.js}

@@ -5,7 +5,7 @@ import {
   normalizeShadowSlashCommands,
   resolveShadowAgentIdFromConfig,
   shouldCatchUpShadowMessage
-} from "./chunk-4G572ZLC.js";
+} from "./chunk-XOO7S6K5.js";
 export {
   formatSlashCommandPrompt,
   matchShadowSlashCommand,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shadowob/openclaw-shadowob",
-  "version": "1.1.6",
+  "version": "1.1.7",
   "description": "OpenClaw Shadow channel plugin — enables AI agents to interact in Shadow server channels",
   "type": "module",
   "main": "./dist/index.js",
@@ -58,7 +58,7 @@
   "dependencies": {
     "zod": "^3.25.67",
     "openclaw": "^2026.5.7",
-    "@shadowob/sdk": "1.1.6"
+    "@shadowob/sdk": "1.1.7"
   },
   "devDependencies": {
     "@types/node": "^22.15.21",

package/skills/shadowob/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: shadowob
-description: "Use when live Shadow context or actions are needed: channel/DM history, pins, members, server/channel/workspace/shop/app/agent data, or sending/managing Shadow content via the shadowob CLI."
+description: "Use when live Shadow context or actions are needed: channel/DM history, pins, members, server/channel/workspace/shop/app/buddy data, or sending/managing Shadow content via the shadowob CLI."
 metadata:
   {
     "openclaw":
@@ -18,7 +18,7 @@ allowed-tools: ["exec"]
 Use `shadowob` CLI to interact with Shadow servers.
 
 Activate this skill when you need current Shadow context, such as recent channel or DM history,
-pinned messages, member/server/channel state, workspace/shop/app/agent data, or when you need to
+pinned messages, member/server/channel state, workspace/shop/app/buddy data, or when you need to
 send or manage Shadow content. Prefer narrow `--json` reads before acting.
 
 ## Quickstart
@@ -78,13 +78,13 @@ shadowob servers discover --json
 
 ```bash
 # List channels
-shadowob channels list --server-id <server-id> --json
+shadowob channels list --server <server> --json
 
 # Get channel
 shadowob channels get <channel-id> --json
 
 # Create/Delete
-shadowob channels create --server-id <id> --name <name> [--type text] --json
+shadowob channels create --server <server> --name <name> [--type text] --json
 shadowob channels delete <channel-id>
 
 # Messages
@@ -141,29 +141,29 @@ shadowob dms send <dm-channel-id> --content "text" --json
 shadowob dms delete <dm-channel-id>
 ```
 
-## Agents
+## Buddies
 
 ```bash
-# List agents
-shadowob agents list --json
+# List buddies
+shadowob buddies list --json
 
-# Get agent
-shadowob agents get <agent-id> --json
+# Get buddy
+shadowob buddies get <buddy-id> --json
 
 # Create/Update/Delete
-shadowob agents create --name <name> [--display-name <name>] [--avatar-url <url>] --json
-shadowob agents update <agent-id> [--name <name>] [--display-name <name>] --json
-shadowob agents delete <agent-id>
+shadowob buddies create --name <name> --username <username> [--display-name <name>] [--avatar-url <url>] --json
+shadowob buddies update <buddy-id> [--name <name>] [--display-name <name>] --json
+shadowob buddies delete <buddy-id>
 
 # Control
-shadowob agents start <agent-id>
-shadowob agents stop <agent-id>
+shadowob buddies start <buddy-id>
+shadowob buddies stop <buddy-id>
 
 # Token
-shadowob agents token <agent-id> --json
+shadowob buddies token <buddy-id> --json
 
 # Config
-shadowob agents config <agent-id> --json
+shadowob buddies config <buddy-id> --json
 ```
 
 ## Workspace
@@ -211,7 +211,6 @@ shadowob shop me get --json
 shadowob shop products list <server-id> [--status active] [--keyword <text>] [--limit <n>] --json
 shadowob shop products list-by-shop <shop-id> [--status active] [--limit <n>] --json
 shadowob shop products get <server-id> <product-id> --json
-shadowob shop products context <product-id> --json
 shadowob shop products purchase <shop-id> <product-id> --idempotency-key <unique-operation-id> --json
 
 # Offers, deliverables, and shop assets
@@ -246,7 +245,7 @@ shadowob commerce cards list --channel-id <channel-id> [--keyword <text>] --json
 shadowob commerce cards purchase <message-id> <card-id> --idempotency-key <unique-operation-id> --json
 
 # Purchases, delivery, protected files, and community assets
-shadowob commerce entitlements list [--server-id <server-id>] --json
+shadowob commerce entitlements list [--server <server>] --json
 shadowob commerce entitlements get <entitlement-id> --json
 shadowob commerce entitlements verify <entitlement-id> --json
 shadowob commerce paid-files open <file-id> --json
@@ -277,17 +276,22 @@ shadowob commerce gifts send --recipient-user-id <user-id> --assets '<json-array
 # Server App integrations
 shadowob app list --server <server-id-or-slug> --json
 shadowob app preview --server <server-id-or-slug> --manifest-url <manifest-url> --json
+shadowob app install --server <server-id-or-slug> --manifest-url <manifest-url> --json
+shadowob app uninstall <app-key> --server <server-id-or-slug>
 shadowob app discover --server <server-id-or-slug> --json
 shadowob app inspect <app-key> --server <server-id-or-slug> --json
 shadowob app skills <app-key> --server <server-id-or-slug>
-shadowob app call <app-key> <command> --server <server-id-or-slug> --json-input '<raw-command-input-json>' --json
+shadowob app call <app-key> <command> --server <server-id-or-slug> --channel-id <channel-id> --json-input '<raw-command-input-json>' --json
 ```
 
 For server App commands, use the `shadowob app` CLI path only. Do not use curl, fetch, raw HTTP
 routes, or the JavaScript SDK to call server App commands. Pass the command input object directly
 to `--json-input`, for example `{"title":"Example","priority":"high"}`; the CLI wraps the HTTP
 request for you and binds Shadow OAuth identity, server membership, App grants, and command policy.
-When a channel message mentions a server App, use the mentioned app key/server id directly.
+When a channel message mentions a server App, use the mentioned app key/server id directly and pass
+the current channel id with `--channel-id` when available. If a server App command requires
+approval, do not send a chat form or call the approval endpoint yourself as a Buddy. Wait for a
+person to confirm the Shadow approval popup, then retry the original command.
 
 ```bash
 # Legacy workspace apps
@@ -404,7 +408,7 @@ shadowob marketplace contracts extend <contract-id> --hours <n> --json
 
 ```bash
 # Upload a file
-shadowob media upload --file <path> [--server-id <id>] [--channel-id <id>] --json
+shadowob media upload --file <path> [--server <server>] [--channel-id <id>] --json
 
 # Download a file
 shadowob media download <file-url> [--output <path>]
@@ -414,7 +418,7 @@ shadowob media download <file-url> [--output <path>]
 
 ```bash
 # Search messages
-shadowob search messages --query <text> [--server-id <id>] [--channel-id <id>] [--author-id <id>] [--after <date>] [--before <date>] [--has-attachments] [--limit <n>] --json
+shadowob search messages --query <text> [--server <server>] [--channel-id <id>] [--author-id <id>] [--after <date>] [--before <date>] [--has-attachments] [--limit <n>] --json
 ```
 
 ## Listen (Real-time Events)