@stagewhisper/stagewhisper 0.61.0 → 0.64.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 StageWhisper
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -68,6 +68,13 @@ The plugin reads from `channels.stagewhisper` or `plugins.entries.stagewhisper.c
 | `relayToken` | Yes | Relay token from pairing |
 | `label` | No | Display label (default: "StageWhisper") |
 
+When the plugin accepts tasks over HTTP (loopback transport), two opt-in environment variables widen the default localhost-only posture for remote setups such as `tailscale serve`:
+
+| Variable | Default | Purpose |
+|----------|---------|---------|
+| `STAGEWHISPER_ALLOW_INGRESS_HOSTS` | unset | Comma-separated `Host` names accepted in addition to localhost. Set to your tailnet name when reaching the plugin through `tailscale serve`. |
+| `STAGEWHISPER_ALLOW_CALLBACK_URLS` | unset | Comma-separated exact origins (scheme + host + port) the plugin may POST replies to. Loopback is trusted implicitly only while `STAGEWHISPER_ALLOW_INGRESS_HOSTS` is unset; once remote ingress is enabled, every callback origin (loopback included) must be listed here. |
+
 ## Architecture
 
 ```

package/dist/index.js

@@ -3990,7 +3990,7 @@ var stagewhisperPlugin = {
 // src/http-transport.ts
 import http from "node:http";
 import { Buffer as Buffer2 } from "node:buffer";
-import { timingSafeEqual } from "node:crypto";
+import { randomUUID, timingSafeEqual } from "node:crypto";
 
 // src/core.ts
 var TASK_ID_REGEX = /^[0-9a-f-]{36}$/;
@@ -4001,7 +4001,7 @@ var ALLOWED_REASONS = /* @__PURE__ */ new Set([
   "system_prelude"
 ]);
 var MAX_BODY_BYTES = 262144;
-var MAX_PAYLOAD_TEXT_CHARS = 8e3;
+var MAX_PAYLOAD_TEXT_CHARS = 16e3;
 var MAX_SESSION_ID_CHARS = 128;
 var ALLOWED_HOSTNAMES = /* @__PURE__ */ new Set(["127.0.0.1", "localhost"]);
 function isTestTask(task) {
@@ -4055,6 +4055,42 @@ async function dispatchTaskToAgent(options) {
 function isLoopbackCallbackUrl(url) {
   return LOOPBACK_CALLBACK_URL_REGEX.test(url);
 }
+function normalizeOrigin(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return null;
+  return parsed.origin.toLowerCase();
+}
+function allowedCallbackOrigins() {
+  const raw = process.env["STAGEWHISPER_ALLOW_CALLBACK_URLS"];
+  if (!raw) return /* @__PURE__ */ new Set();
+  const origins = raw.split(",").map((entry) => normalizeOrigin(entry.trim())).filter((origin) => origin !== null);
+  return new Set(origins);
+}
+function isAllowedCallbackUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return false;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return false;
+  if (parsed.pathname !== "/" && parsed.pathname !== "") return false;
+  if (parsed.search || parsed.hash) return false;
+  if (allowedCallbackOrigins().has(parsed.origin.toLowerCase())) return true;
+  if (allowedIngressHosts().size === 0 && isLoopbackCallbackUrl(url)) return true;
+  return false;
+}
+function allowedIngressHosts() {
+  const raw = process.env["STAGEWHISPER_ALLOW_INGRESS_HOSTS"];
+  if (!raw) return /* @__PURE__ */ new Set();
+  const hosts = raw.split(",").map((entry) => entry.trim().toLowerCase()).filter((entry) => entry.length > 0);
+  return new Set(hosts);
+}
 function isAllowedHostHeader(host) {
   if (!host) return false;
   const trimmed = host.trim().toLowerCase();
@@ -4062,9 +4098,9 @@ function isAllowedHostHeader(host) {
   const colonIdx = trimmed.lastIndexOf(":");
   const hostname = colonIdx === -1 ? trimmed : trimmed.slice(0, colonIdx);
   const port = colonIdx === -1 ? "" : trimmed.slice(colonIdx + 1);
-  if (!ALLOWED_HOSTNAMES.has(hostname)) return false;
   if (port && !/^\d+$/.test(port)) return false;
-  return true;
+  if (ALLOWED_HOSTNAMES.has(hostname)) return true;
+  return allowedIngressHosts().has(hostname);
 }
 function buildChatId(sessionId, reason) {
   if (reason === "transcript_chunk") return `sw:${sessionId}:reasoning`;
@@ -4139,10 +4175,10 @@ function validateHttpTaskRequest(body) {
     if (typeof cbUrl !== "string" || cbUrl.length === 0) {
       return { ok: false, error: "callback.url must be a non-empty string" };
     }
-    if (!isLoopbackCallbackUrl(cbUrl)) {
+    if (!isAllowedCallbackUrl(cbUrl)) {
       return {
         ok: false,
-        error: "callback.url must be a loopback base URL (http://127.0.0.1:PORT or http://localhost:PORT) with no path"
+        error: "callback.url must be a loopback base URL (http://127.0.0.1:PORT) or an origin listed in STAGEWHISPER_ALLOW_CALLBACK_URLS, with no path"
       };
     }
     if (typeof cbToken !== "string" || cbToken.length < 16) {
@@ -4212,7 +4248,14 @@ var IDEMPOTENCY_TTL_MS = 5 * 60 * 1e3;
 var CALLBACK_TIMEOUT_MS = 5e3;
 var CALLBACK_MAX_ATTEMPTS = 4;
 var CALLBACK_RETRY_BASE_MS = 250;
-var SUBAGENT_WAIT_TIMEOUT_MS = 12e4;
+var POLL_INTERVAL_MS = 500;
+function resolveRuntimeEvents(api) {
+  const runtime = api.runtime;
+  const events = runtime?.events;
+  if (!events) return null;
+  if (typeof events.onSessionTranscriptUpdate !== "function") return null;
+  return events;
+}
 var INCOMING_PATH = "/v1/incoming";
 var PING_PATH = "/v1/ping";
 function constantTimeTokenEqual(provided, expected) {
@@ -4227,7 +4270,7 @@ function constantTimeTokenEqual(provided, expected) {
 }
 function extractBearerToken(header) {
   if (!header) return null;
-  const match = /^Bearer\s+(.+)$/i.exec(header.trim());
+  const match = /^Bearer\s+(\S.*)$/i.exec(header.trim());
   if (!match) return null;
   return match[1]?.trim() ?? null;
 }
@@ -4320,34 +4363,34 @@ function createHttpTransport(options) {
     if (prelude !== void 0) pendingPreludes.delete(sessionId);
     return prelude;
   }
-  async function extractReplyForChatTask(sessionKey, taskId, userMessageId, maxAttempts = 3) {
-    const markers = [`StageWhisper task: ${taskId}`];
-    if (userMessageId) markers.push(`[StageWhisper chat: ${userMessageId}]`);
-    for (let attempt = 0; attempt < maxAttempts; attempt++) {
-      if (attempt > 0) {
-        await new Promise((r) => setTimeout(r, 1e3));
+  async function collectAssistantRepliesAfterMarker(sessionKey, markers) {
+    const session = await api.runtime.subagent.getSessionMessages({
+      sessionKey,
+      limit: 100
+    });
+    const messages = session.messages;
+    let markerIndex = -1;
+    for (let i = messages.length - 1; i >= 0; i--) {
+      const msg = messages[i];
+      if (msg["role"] !== "user") continue;
+      const text = extractContentFromMessage(msg) ?? "";
+      if (markers.some((m) => text.includes(m))) {
+        markerIndex = i;
+        break;
       }
-      const session = await api.runtime.subagent.getSessionMessages({
-        sessionKey,
-        limit: 50
-      });
-      const messages = session.messages;
-      for (let i = 0; i < messages.length; i++) {
-        const msg = messages[i];
-        if (msg["role"] !== "user") continue;
-        const text = extractContentFromMessage(msg) ?? "";
-        if (!markers.some((m) => text.includes(m))) continue;
-        for (let j = i + 1; j < messages.length; j++) {
-          const reply = messages[j];
-          const role = reply["role"];
-          if (role === "assistant" || role === "model") {
-            return extractContentFromMessage(reply);
-          }
-          if (role === "user") break;
-        }
+    }
+    if (markerIndex === -1) return [];
+    const replies = [];
+    for (let j = markerIndex + 1; j < messages.length; j++) {
+      const msg = messages[j];
+      const role = msg["role"];
+      if (role === "user") break;
+      if (role === "assistant" || role === "model") {
+        const text = extractContentFromMessage(msg);
+        if (text) replies.push(text);
       }
     }
-    return null;
+    return replies;
   }
   async function postCallback(callback, taskId, body) {
     const url = buildCallbackUrl(callback.url, taskId);
@@ -4428,11 +4471,27 @@ function createHttpTransport(options) {
     });
     const chatIdReason = kind === "chat" ? "chat_message" : "transcript_chunk";
     const chatId = taskRequest.chat_id ?? buildChatId(taskRequest.session_id, chatIdReason);
-    const occurredAt = (/* @__PURE__ */ new Date()).toISOString();
-    const sendCallback = async (body) => {
+    const markers = [`StageWhisper task: ${taskRequest.task_id}`];
+    if (userMessageId) markers.push(`[StageWhisper chat: ${userMessageId}]`);
+    let forwardedCount = 0;
+    const postMessage = async (replyText) => {
+      const messageId = randomUUID();
+      const body = {
+        task_id: taskRequest.task_id,
+        session_id: taskRequest.session_id,
+        chat_id: chatId,
+        user_message_id: userMessageId ?? null,
+        message_id: messageId,
+        status: "message",
+        reply_text: replyText,
+        occurred_at: (/* @__PURE__ */ new Date()).toISOString()
+      };
       recordTerminalCallback(taskRequest.task_id, callback, body);
       try {
         await postCallback(callback, taskRequest.task_id, body);
+        api.logger.info(
+          `[stagewhisper-http] ${kind} task ${taskRequest.task_id} forwarded message ${messageId}`
+        );
       } catch (err) {
         const errMsg = err instanceof Error ? err.message : String(err);
         api.logger.error(
@@ -4440,6 +4499,79 @@ function createHttpTransport(options) {
         );
       }
     };
+    const postTyping = async () => {
+      try {
+        await postCallback(callback, taskRequest.task_id, {
+          task_id: taskRequest.task_id,
+          session_id: taskRequest.session_id,
+          chat_id: chatId,
+          user_message_id: userMessageId ?? null,
+          status: "typing",
+          label: "thinking"
+        });
+      } catch (err) {
+        const errMsg = err instanceof Error ? err.message : String(err);
+        api.logger.warn(
+          `[stagewhisper-http] typing callback failed for ${taskRequest.task_id}: ${errMsg}`
+        );
+      }
+    };
+    const events = resolveRuntimeEvents(api);
+    let unsubscribeTranscript = null;
+    let pollDone = false;
+    let flushing = null;
+    let flushQueued = false;
+    let wakePoll = () => {
+    };
+    const sleepUntilPoll = () => new Promise((resolve) => {
+      const timer = setTimeout(() => {
+        wakePoll = () => {
+        };
+        resolve();
+      }, POLL_INTERVAL_MS);
+      wakePoll = () => {
+        clearTimeout(timer);
+        wakePoll = () => {
+        };
+        resolve();
+      };
+    });
+    const runFlushOnce = async () => {
+      try {
+        const replies = await collectAssistantRepliesAfterMarker(
+          sessionKey,
+          markers
+        );
+        while (forwardedCount < replies.length) {
+          const reply = replies[forwardedCount];
+          forwardedCount += 1;
+          if (reply.trim()) await postMessage(reply);
+        }
+      } catch (err) {
+        api.logger.warn(
+          `[stagewhisper-http] session flush failed for ${taskRequest.task_id}: ${err}`
+        );
+      }
+    };
+    const flushFromSession = async () => {
+      if (flushing) {
+        flushQueued = true;
+        await flushing;
+        return;
+      }
+      flushing = (async () => {
+        await runFlushOnce();
+        while (flushQueued) {
+          flushQueued = false;
+          await runFlushOnce();
+        }
+      })();
+      try {
+        await flushing;
+      } finally {
+        flushing = null;
+      }
+    };
     try {
       const dispatch = await dispatchTaskToAgent({
         api,
@@ -4451,87 +4583,84 @@ function createHttpTransport(options) {
       api.logger.info(
         `[stagewhisper-http] ${kind} task ${taskRequest.task_id} dispatched (runId: ${dispatch.runId})`
       );
+      const runId = dispatch.runId;
+      await postTyping();
+      if (events?.onSessionTranscriptUpdate) {
+        unsubscribeTranscript = events.onSessionTranscriptUpdate((update) => {
+          if (update.sessionKey && update.sessionKey !== sessionKey) return;
+          const message = update.message;
+          const role = message?.["role"];
+          if (role !== void 0 && role !== "assistant" && role !== "model") {
+            return;
+          }
+          void flushFromSession();
+        });
+      }
+      let pollLoop = Promise.resolve();
+      if (!events?.onSessionTranscriptUpdate) {
+        pollLoop = (async () => {
+          while (!pollDone) {
+            await sleepUntilPoll();
+            if (pollDone) break;
+            await flushFromSession();
+          }
+        })();
+      }
       const waitResult = await api.runtime.subagent.waitForRun({
-        runId: dispatch.runId,
-        timeoutMs: SUBAGENT_WAIT_TIMEOUT_MS
+        runId
       });
-      if (waitResult.status === "ok") {
-        const reply = await extractReplyForChatTask(
-          sessionKey,
-          taskRequest.task_id,
-          userMessageId
+      pollDone = true;
+      wakePoll();
+      await pollLoop;
+      await flushFromSession();
+      if (waitResult.status === "error") {
+        api.logger.error(
+          `[stagewhisper-http] ${kind} task ${taskRequest.task_id} agent error: ${waitResult.error}`
         );
-        if (reply) {
-          await sendCallback({
-            task_id: taskRequest.task_id,
-            session_id: taskRequest.session_id,
-            chat_id: chatId,
-            user_message_id: userMessageId ?? null,
-            status: "completed",
-            reply_text: reply,
-            occurred_at: occurredAt
-          });
-          api.logger.info(
-            `[stagewhisper-http] ${kind} task ${taskRequest.task_id} callback delivered`
-          );
-        } else if (kind === "reasoning") {
-          await sendCallback({
-            task_id: taskRequest.task_id,
-            session_id: taskRequest.session_id,
-            chat_id: chatId,
-            user_message_id: userMessageId ?? null,
-            status: "silent",
-            occurred_at: occurredAt
-          });
-          api.logger.info(
-            `[stagewhisper-http] reasoning task ${taskRequest.task_id} produced no signal (silent)`
-          );
-        } else {
-          await sendCallback({
+        try {
+          await postCallback(callback, taskRequest.task_id, {
             task_id: taskRequest.task_id,
             session_id: taskRequest.session_id,
             chat_id: chatId,
             user_message_id: userMessageId ?? null,
             status: "errored",
-            error_code: "no_reply",
-            error_message: "Agent run produced no reply",
-            occurred_at: occurredAt
+            error_code: "agent_error",
+            error_message: waitResult.error ?? "agent run error"
           });
-          api.logger.warn(
-            `[stagewhisper-http] ${kind} task ${taskRequest.task_id} produced no reply`
+        } catch (postErr) {
+          api.logger.error(
+            `[stagewhisper-http] errored callback failed for ${taskRequest.task_id}: ${postErr}`
           );
         }
       } else {
-        await sendCallback({
+        api.logger.info(
+          `[stagewhisper-http] ${kind} task ${taskRequest.task_id} turn settled (${waitResult.status})`
+        );
+      }
+    } catch (err) {
+      const errMsg = err instanceof Error ? err.message : String(err);
+      api.logger.error(
+        `[stagewhisper-http] ${kind} task ${taskRequest.task_id} threw: ${errMsg}`
+      );
+      try {
+        await postCallback(callback, taskRequest.task_id, {
           task_id: taskRequest.task_id,
           session_id: taskRequest.session_id,
           chat_id: chatId,
           user_message_id: userMessageId ?? null,
           status: "errored",
-          error_code: "agent_error",
-          error_message: waitResult.error ?? `agent run ${waitResult.status}`,
-          occurred_at: occurredAt
+          error_code: "execution_error",
+          error_message: errMsg
         });
+      } catch (postErr) {
         api.logger.error(
-          `[stagewhisper-http] ${kind} task ${taskRequest.task_id} agent failed: ${waitResult.error}`
+          `[stagewhisper-http] errored callback failed for ${taskRequest.task_id}: ${postErr}`
         );
       }
-    } catch (err) {
-      const errMsg = err instanceof Error ? err.message : String(err);
-      api.logger.error(
-        `[stagewhisper-http] ${kind} task ${taskRequest.task_id} threw: ${errMsg}`
-      );
-      await sendCallback({
-        task_id: taskRequest.task_id,
-        session_id: taskRequest.session_id,
-        chat_id: chatId,
-        user_message_id: userMessageId ?? null,
-        status: "errored",
-        error_code: "execution_error",
-        error_message: errMsg,
-        occurred_at: occurredAt
-      });
     } finally {
+      pollDone = true;
+      wakePoll();
+      unsubscribeTranscript?.();
       inflight.delete(taskRequest.task_id);
     }
   }
@@ -4848,7 +4977,7 @@ var getRuntime = runtimeStore.getRuntime;
 
 // src/service.ts
 init_client();
-import { randomUUID } from "node:crypto";
+import { randomUUID as randomUUID2 } from "node:crypto";
 
 // src/health.ts
 var DEGRADED_THRESHOLD = 3;
@@ -5382,7 +5511,7 @@ function createRelayService(api) {
       sessionKey,
       message: messageContent,
       deliver: false,
-      idempotencyKey: randomUUID()
+      idempotencyKey: randomUUID2()
     });
     api.logger.info(`Test task ${task.id} dispatched (runId: ${result.runId})`);
     const waitResult = await api.runtime.subagent.waitForRun({

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "stagewhisper",
   "name": "StageWhisper",
   "description": "Turn live call moments into assistant tasks via StageWhisper",
-  "version": "0.61.0",
+  "version": "0.64.0",
   "channels": [
     "stagewhisper"
   ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stagewhisper/stagewhisper",
-  "version": "0.61.0",
+  "version": "0.64.0",
   "type": "module",
   "description": "OpenClaw channel plugin that connects StageWhisper live calls to your AI assistant",
   "license": "MIT",