@swarmclawai/swarmclaw 0.3.1 → 0.4.5

package/README.md

@@ -13,16 +13,10 @@ Inspired by [OpenClaw](https://github.com/openclaw).
 
 **[Documentation](https://swarmclaw.ai/docs)** | **[Website](https://swarmclaw.ai)**
 
-Org avatar files: `public/branding/swarmclaw-org-avatar.png` (upload-ready), `public/branding/swarmclaw-org-avatar.svg` (source)
-
 ![Dashboard](public/screenshots/dashboard.png)
 ![Agent Builder](public/screenshots/agents.png)
 ![Task Board](public/screenshots/tasks.png)
 
-## Security Warning
-
-SwarmClaw can spawn **Claude Code CLI** processes with full shell access on your machine. This means agents can read, write, and execute anything your user account can. **Do not run this on a shared server or expose it to the public internet without understanding the risks.**
-
 - Always use the access key authentication (generated on first run)
 - Never expose port 3456 without a reverse proxy + TLS
 - Review agent system prompts before giving them shell or browser tools
@@ -32,17 +26,17 @@ SwarmClaw can spawn **Claude Code CLI** processes with full shell access on your
 - **15 Built-in Providers** — Claude Code CLI, OpenAI Codex CLI, OpenCode CLI, Anthropic, OpenAI, Google Gemini, DeepSeek, Groq, Together AI, Mistral AI, xAI (Grok), Fireworks AI, Ollama, plus custom OpenAI-compatible endpoints
 - **OpenClaw Gateway** — Per-agent toggle to connect any agent to a local or remote OpenClaw gateway. Each agent gets its own gateway URL and token — run a swarm of OpenClaws from one dashboard. The `openclaw` CLI ships as a bundled dependency (no separate install needed)
 - **Agent Builder** — Create agents with custom personalities (soul), system prompts, tools, and skills. AI-powered generation from a description
-- **Agent Tools** — Shell, process control for long-running commands, files, edit file, send file, web search, web fetch, CLI delegation (Claude/Codex/OpenCode), Playwright browser automation, and persistent memory
+- **Agent Tools** — Shell, process control for long-running commands, files, edit file, send file, web search, web fetch, CLI delegation (Claude/Codex/OpenCode), Playwright browser automation, persistent memory, and sandboxed code execution (JS/TS via Deno, Python)
 - **Platform Tools** — Agents can manage other agents, tasks, schedules, skills, connectors, sessions, and encrypted secrets via built-in platform tools
-- **Orchestration** — Multi-agent workflows powered by LangGraph with automatic sub-agent routing
+- **Orchestration** — Multi-agent workflows powered by LangGraph with automatic sub-agent routing, checkpointed execution, and rich delegation cards that link to sub-agent chat threads
 - **Agentic Execution Policy** — Tool-first autonomous action loop with progress updates, evidence-driven answers, and better use of platform tools for long-lived work
-- **Task Board** — Queue and track agent tasks with status, comments, results, and archiving (soft delete with show/hide toggle)
+- **Task Board** — Queue and track agent tasks with status, comments, results, and archiving. Strict capability policy pauses tasks for human approval before tool execution
 - **Background Daemon** — Auto-processes queued tasks and scheduled jobs with a 30s heartbeat plus recurring health monitoring
 - **Scheduling** — Cron-based agent scheduling with human-friendly presets
 - **Loop Runtime Controls** — Switch between bounded and ongoing loops with configurable step caps, runtime guards, heartbeat cadence, and timeout budgets
 - **Session Run Queue** — Per-session queued runs with followup/steer/collect modes, collect coalescing for bursty inputs, and run-state APIs
 - **Voice Settings** — Per-instance ElevenLabs API key + voice ID for TTS replies, plus configurable speech recognition language for chat input
-- **Chat Connectors** — Bridge agents to Discord, Slack, Telegram, and WhatsApp with media-aware inbound handling
+- **Chat Connectors** — Bridge agents to Discord, Slack, Telegram, WhatsApp, BlueBubbles (iMessage), Signal, Microsoft Teams, Google Chat, Matrix, and OpenClaw with media-aware inbound handling
 - **Skills System** — Discover local skills, import skills from URL, and load OpenClaw `SKILL.md` files (frontmatter-compatible)
 - **Execution Logging** — Structured audit trail for triggers, tool calls, file ops, commits, and errors in a dedicated `logs.db`
 - **Context Management** — Auto-compaction of conversation history when approaching context limits, with manual `context_status` and `context_summarize` tools for agents
@@ -52,6 +46,9 @@ SwarmClaw can spawn **Claude Code CLI** processes with full shell access on your
 - **Plugin System** — Extend agent behavior with JS plugins (hooks: beforeAgentStart, afterAgentComplete, beforeToolExec, afterToolExec, onMessage)
 - **Secrets Vault** — Encrypted storage for API keys and service tokens
 - **Custom Providers** — Add any OpenAI-compatible API as a provider
+- **MCP Servers** — Connect agents to any Model Context Protocol server. Per-agent server selection with tool discovery and per-tool disable toggles
+- **Sandboxed Code Execution** — Agents can write and run JS/TS (Deno) or Python scripts in an isolated sandbox with network access, scoped filesystem, and artifact output
+- **Real-Time Sync** — WebSocket push notifications for instant UI updates across tabs and devices (fallback to polling when WS is unavailable)
 - **Mobile-First UI** — Responsive glass-themed dark interface, works on phone and desktop
 
 ## Requirements
@@ -64,6 +61,15 @@ SwarmClaw can spawn **Claude Code CLI** processes with full shell access on your
 
 ## Quick Start
 
+### npm (recommended)
+
+```bash
+npm i -g @swarmclawai/swarmclaw
+swarmclaw
+```
+
+### Install script
+
 ```bash
 curl -fsSL https://raw.githubusercontent.com/swarmclawai/swarmclaw/main/install.sh | bash
 ```
@@ -134,7 +140,9 @@ ACCESS_KEY=<your-access-key>       # Auth key for the dashboard
 CREDENTIAL_SECRET=<auto-generated> # AES-256 encryption key for stored credentials
 ```
 
-Data is stored in `data/swarmclaw.db` (SQLite with WAL mode), `data/memory.db` (agent memory with FTS5 + vector embeddings), and `data/logs.db` (execution audit trail). Back the `data/` directory up if you care about your sessions, agents, and credentials. Existing JSON file data is auto-migrated to SQLite on first run.
+Data is stored in `data/swarmclaw.db` (SQLite with WAL mode), `data/memory.db` (agent memory with FTS5 + vector embeddings), `data/logs.db` (execution audit trail), and `data/langgraph-checkpoints.db` (orchestrator checkpoints). Back the `data/` directory up if you care about your sessions, agents, and credentials. Existing JSON file data is auto-migrated to SQLite on first run.
+
+The app listens on two ports: `PORT` (default 3456) for the HTTP/SSE API, and `PORT + 1` (default 3457) for WebSocket push notifications. The WS port can be customized with `--ws-port`.
 
 ## Architecture
 
@@ -151,7 +159,6 @@ src/
 │   ├── layout/       # App shell, sidebar, mobile header
 │   ├── providers/    # Provider management
 │   ├── schedules/    # Cron scheduler
-│   ├── sessions/     # Session list + new session
 │   ├── skills/       # Skills manager
 │   ├── tasks/        # Task board
 │   └── shared/       # Reusable UI (BottomSheet, IconButton, etc.)
@@ -222,6 +229,12 @@ Bridge any agent to a chat platform:
 | Slack | @slack/bolt | Bot token + app token (Socket Mode) |
 | Telegram | grammy | Bot token from @BotFather |
 | WhatsApp | baileys | QR code pairing (shown in browser) |
+| BlueBubbles | Custom webhook bridge | Server URL + password/webhook secret |
+| Signal | signal-cli | `signal-cli` binary + linked phone |
+| Microsoft Teams | botbuilder | Bot Framework credentials + webhook ingress |
+| Google Chat | googleapis | Service account + webhook ingress |
+| Matrix | matrix-bot-sdk | Homeserver URL + access token |
+| OpenClaw | gateway protocol | OpenClaw connector credentials |
 
 Connector sessions preserve attachment visibility in chat context:
 - WhatsApp media is decoded and persisted to `/api/uploads/...` when possible
@@ -230,7 +243,12 @@ Connector sessions preserve attachment visibility in chat context:
 
 Agents automatically suppress replies to simple acknowledgments ("ok", "thanks", thumbs-up, etc.) via a `NO_MESSAGE` response — conversations feel natural without a forced reply to every message. This is handled at the connector layer, so agents can return `NO_MESSAGE` as their response content and the platform won't deliver anything to the channel.
 
-For proactive outreach, `connector_message_tool` supports text plus optional `imageUrl` / `fileUrl` / `mediaPath` (local file path) payloads. All four platforms (WhatsApp, Discord, Slack, Telegram) support local file sending via `mediaPath` with auto-detected MIME types.
+For proactive outreach, `connector_message_tool` supports text plus optional `imageUrl` / `fileUrl` / `mediaPath` (local file path) payloads. WhatsApp, Discord, Slack, and Telegram support local file sending via `mediaPath` with auto-detected MIME types.
+
+Connector ingress now also supports optional pairing/allowlist policy:
+- `dmPolicy: allowlist` blocks unknown senders until approved
+- `/pair` flow lets approved admins generate and approve pairing codes
+- `/think` command can set connector thread thinking level (`low`, `medium`, `high`)
 
 ## Agent Tools
 
@@ -248,6 +266,8 @@ Agents can use the following tools when enabled:
 | CLI Delegation | Delegate complex tasks to Claude Code, Codex CLI, or OpenCode CLI |
 | Browser | Playwright-powered web browsing via MCP (navigate, click, type, screenshot, PDF) |
 | Memory | Store and retrieve long-term memories with FTS5 + vector search, file references, image attachments, and linked memory graph traversal |
+| Sandbox | Run JS/TS (Deno) or Python code in an isolated sandbox. Created files are returned as downloadable artifacts |
+| MCP Servers | Connect to external Model Context Protocol servers. Tools from MCP servers are injected as first-class agent tools |
 
 ### Platform Tools
 

package/bin/server-cmd.js

@@ -177,16 +177,18 @@ function startServer(opts) {
   }
 
   const port = opts.port || '3456'
+  const wsPort = opts.wsPort || String(Number(port) + 1)
   const host = opts.host || '0.0.0.0'
 
   const env = {
     ...process.env,
     PORT: port,
+    WS_PORT: wsPort,
     HOSTNAME: host,
     DATA_DIR,
   }
 
-  log(`Starting server on ${host}:${port}...`)
+  log(`Starting server on ${host}:${port} (WebSocket: ${wsPort})...`)
   log(`Data directory: ${DATA_DIR}`)
 
   if (opts.detach) {
@@ -268,6 +270,7 @@ function showStatus() {
 
   log(`Home: ${SWARMCLAW_HOME}`)
   log(`Data: ${DATA_DIR}`)
+  log(`WebSocket port: ${process.env.WS_PORT || '(PORT + 1)'}`)
 
   if (fs.existsSync(BUILT_MARKER)) {
     try {
@@ -295,11 +298,12 @@ Commands:
   status         Show server status
 
 Options:
-  --build        Force rebuild before starting
-  -d, --detach   Start server in background
-  --port <port>  Server port (default: 3456)
-  --host <host>  Server host (default: 0.0.0.0)
-  -h, --help     Show this help message
+  --build           Force rebuild before starting
+  -d, --detach      Start server in background
+  --port <port>     Server port (default: 3456)
+  --ws-port <port>  WebSocket port (default: PORT + 1)
+  --host <host>     Server host (default: 0.0.0.0)
+  -h, --help        Show this help message
 `.trim()
   console.log(help)
 }
@@ -310,6 +314,7 @@ function main() {
   let forceBuild = false
   let detach = false
   let port = null
+  let wsPort = null
   let host = null
 
   for (let i = 0; i < args.length; i++) {
@@ -326,6 +331,8 @@ function main() {
       detach = true
     } else if (arg === '--port' && i + 1 < args.length) {
       port = args[++i]
+    } else if (arg === '--ws-port' && i + 1 < args.length) {
+      wsPort = args[++i]
     } else if (arg === '--host' && i + 1 < args.length) {
       host = args[++i]
     } else if (arg === '-h' || arg === '--help') {
@@ -353,7 +360,7 @@ function main() {
     runBuild()
   }
 
-  startServer({ port, host, detach })
+  startServer({ port, wsPort, host, detach })
 }
 
 main()

package/bin/swarmclaw.js

@@ -4,9 +4,11 @@
 const path = require('node:path')
 const { spawnSync } = require('node:child_process')
 
-// Route 'server' subcommand to the CJS server script (no TS dependency)
+// Route 'server' and 'update' subcommands to CJS scripts (no TS dependency)
 if (process.argv[2] === 'server') {
   require('./server-cmd.js')
+} else if (process.argv[2] === 'update') {
+  require('./update-cmd.js')
 } else {
   const cliPath = path.join(__dirname, '..', 'src', 'cli', 'index.ts')
 

package/bin/update-cmd.js

@@ -0,0 +1,120 @@
+#!/usr/bin/env node
+'use strict'
+
+const { execSync } = require('node:child_process')
+const path = require('node:path')
+
+const PKG_ROOT = path.resolve(__dirname, '..')
+const RELEASE_TAG_RE = /^v\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/
+
+function run(cmd) {
+  return execSync(cmd, { encoding: 'utf-8', cwd: PKG_ROOT, timeout: 60_000 }).trim()
+}
+
+function log(msg) {
+  process.stdout.write(`[swarmclaw] ${msg}\n`)
+}
+
+function logError(msg) {
+  process.stderr.write(`[swarmclaw] ${msg}\n`)
+}
+
+function getLatestStableTag() {
+  const tags = run("git tag --list 'v*' --sort=-v:refname")
+    .split('\n')
+    .map((l) => l.trim())
+    .filter(Boolean)
+  return tags.find((t) => RELEASE_TAG_RE.test(t)) || null
+}
+
+function main() {
+  const args = process.argv.slice(3)
+  if (args.includes('-h') || args.includes('--help')) {
+    console.log(`
+Usage: swarmclaw update
+
+Pull the latest SwarmClaw release via git.
+Prefers stable release tags (v*); falls back to origin/main.
+Runs npm install if package files changed.
+`.trim())
+    process.exit(0)
+  }
+
+  // Verify we're in a git repo
+  try {
+    run('git rev-parse --git-dir')
+  } catch {
+    logError('Not a git repository. Cannot update.')
+    process.exit(1)
+  }
+
+  const beforeRef = run('git rev-parse HEAD')
+  const beforeSha = run('git rev-parse --short HEAD')
+
+  log('Fetching latest releases...')
+  try {
+    run('git fetch --tags origin --quiet')
+  } catch (err) {
+    logError(`Fetch failed: ${err.message}`)
+    process.exit(1)
+  }
+
+  const latestTag = getLatestStableTag()
+  let channel = 'main'
+  let pullOutput = ''
+
+  if (latestTag) {
+    channel = 'stable'
+    const targetSha = run(`git rev-parse ${latestTag}^{commit}`)
+    if (targetSha === beforeRef) {
+      log(`Already up to date (${latestTag}, ${beforeSha}).`)
+      process.exit(0)
+    }
+
+    // Check for uncommitted changes
+    const dirty = run('git status --porcelain')
+    if (dirty) {
+      logError('Local changes detected. Commit or stash them first, then retry.')
+      process.exit(1)
+    }
+
+    log(`Updating to ${latestTag}...`)
+    run(`git checkout -B stable ${latestTag}^{commit}`)
+    pullOutput = `Updated to stable release ${latestTag}.`
+  } else {
+    // Fallback: pull from origin/main
+    const behindCount = parseInt(run('git rev-list HEAD..origin/main --count'), 10) || 0
+    if (behindCount === 0) {
+      log(`Already up to date (${beforeSha}).`)
+      process.exit(0)
+    }
+
+    const dirty = run('git status --porcelain')
+    if (dirty) {
+      logError('Local changes detected. Commit or stash them first, then retry.')
+      process.exit(1)
+    }
+
+    log(`Pulling ${behindCount} commit(s) from origin/main...`)
+    pullOutput = run('git pull --ff-only origin main')
+  }
+
+  const newSha = run('git rev-parse --short HEAD')
+  log(pullOutput)
+
+  // Install deps if package files changed
+  try {
+    const diff = run(`git diff --name-only ${beforeSha}..HEAD`)
+    if (diff.includes('package-lock.json') || diff.includes('package.json')) {
+      log('Package files changed — running npm install...')
+      execSync('npm install --omit=dev', { cwd: PKG_ROOT, stdio: 'inherit', timeout: 120_000 })
+    }
+  } catch {
+    // If diff fails, skip install check
+  }
+
+  log(`Done (${beforeSha} → ${newSha}, channel: ${channel}).`)
+  log('Restart the server to apply changes: swarmclaw server stop && swarmclaw server start')
+}
+
+main()

package/next.config.ts

@@ -13,9 +13,11 @@ const nextConfig: NextConfig = {
   output: 'standalone',
   env: {
     NEXT_PUBLIC_GIT_SHA: getGitSha(),
+    NEXT_PUBLIC_WS_PORT: String((Number(process.env.PORT) || 3456) + 1),
   },
   // Allow external network access
   serverExternalPackages: [
+    'ws',
     'highlight.js', 'better-sqlite3',
     'discord.js', '@discordjs/ws', '@discordjs/rest',
     'grammy',
@@ -28,6 +30,14 @@ const nextConfig: NextConfig = {
     '127.0.0.1',
     '0.0.0.0',
   ],
+  async rewrites() {
+    return [
+      {
+        source: '/:view(agents|schedules|memory|tasks|secrets|providers|skills|connectors|webhooks|mcp-servers|knowledge|plugins|usage|runs|logs|settings|projects)',
+        destination: '/',
+      },
+    ]
+  },
 };
 
 export default nextConfig;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@swarmclawai/swarmclaw",
-  "version": "0.3.1",
+  "version": "0.4.5",
   "description": "Self-hosted AI agent orchestration dashboard — manage LLM providers, orchestrate agent swarms, schedule tasks, and bridge agents to chat platforms.",
   "license": "MIT",
   "repository": {
@@ -69,16 +69,19 @@
     "cron-parser": "^5.5.0",
     "cronstrue": "^3.12.0",
     "discord.js": "^14.25.1",
+    "exceljs": "^4.4.0",
     "grammy": "^1.40.0",
     "highlight.js": "^11.11.1",
     "lucide-react": "^0.574.0",
     "next": "16.1.6",
     "next-themes": "^0.4.6",
     "openclaw": "^2026.2.26",
+    "pdf-parse": "^2.4.5",
     "qrcode": "^1.5.4",
     "radix-ui": "^1.4.3",
     "react": "19.2.3",
     "react-dom": "19.2.3",
+    "react-icons": "^5.5.0",
     "react-markdown": "^10.1.0",
     "rehype-highlight": "^7.0.2",
     "remark-gfm": "^4.0.1",

package/src/app/api/agents/[id]/route.ts

@@ -1,30 +1,32 @@
 import { NextResponse } from 'next/server'
 import { loadAgents, saveAgents, deleteAgent } from '@/lib/server/storage'
 import { normalizeProviderEndpoint } from '@/lib/openclaw-endpoint'
+import { mutateItem, deleteItem, notFound, type CollectionOps } from '@/lib/server/collection-helpers'
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+const ops: CollectionOps<any> = { load: loadAgents, save: saveAgents, deleteFn: deleteAgent, topic: 'agents' }
 
 export async function PUT(req: Request, { params }: { params: Promise<{ id: string }> }) {
   const { id } = await params
   const body = await req.json()
-  const agents = loadAgents()
-  if (!agents[id]) return new NextResponse(null, { status: 404 })
-
-  Object.assign(agents[id], body, { updatedAt: Date.now() })
-  if (body.apiEndpoint !== undefined) {
-    agents[id].apiEndpoint = normalizeProviderEndpoint(
-      body.provider || agents[id].provider,
-      body.apiEndpoint,
-    )
-  }
-  delete (agents[id] as Record<string, unknown>).id // prevent id overwrite
-  agents[id].id = id
-  saveAgents(agents)
-  return NextResponse.json(agents[id])
+  const result = mutateItem(ops, id, (agent) => {
+    Object.assign(agent, body, { updatedAt: Date.now() })
+    if (body.apiEndpoint !== undefined) {
+      agent.apiEndpoint = normalizeProviderEndpoint(
+        body.provider || agent.provider,
+        body.apiEndpoint,
+      )
+    }
+    delete (agent as Record<string, unknown>).id
+    agent.id = id
+    return agent
+  })
+  if (!result) return notFound()
+  return NextResponse.json(result)
 }
 
 export async function DELETE(_req: Request, { params }: { params: Promise<{ id: string }> }) {
   const { id } = await params
-  const agents = loadAgents()
-  if (!agents[id]) return new NextResponse(null, { status: 404 })
-  deleteAgent(id)
-  return NextResponse.json('ok')
+  if (!deleteItem(ops, id)) return notFound()
+  return NextResponse.json({ ok: true })
 }

package/src/app/api/agents/[id]/thread/route.ts

@@ -1,6 +1,7 @@
 import { NextResponse } from 'next/server'
-import crypto from 'crypto'
+import { genId } from '@/lib/id'
 import { loadAgents, saveAgents, loadSessions, saveSessions } from '@/lib/server/storage'
+import { WORKSPACE_DIR } from '@/lib/server/data-dir'
 
 export async function POST(req: Request, { params }: { params: Promise<{ id: string }> }) {
   const { id: agentId } = await params
@@ -31,12 +32,12 @@ export async function POST(req: Request, { params }: { params: Promise<{ id: str
   }
 
   // Create a new thread session
-  const sessionId = `agent-thread-${agentId}-${crypto.randomBytes(4).toString('hex')}`
+  const sessionId = `agent-thread-${agentId}-${genId()}`
   const now = Date.now()
   const session = {
     id: sessionId,
     name: `agent-thread:${agentId}`,
-    cwd: process.cwd(),
+    cwd: WORKSPACE_DIR,
     user: user,
     provider: agent.provider,
     model: agent.model,

package/src/app/api/agents/route.ts

@@ -1,15 +1,18 @@
 import { NextResponse } from 'next/server'
-import crypto from 'crypto'
+import { genId } from '@/lib/id'
 import { loadAgents, saveAgents } from '@/lib/server/storage'
 import { normalizeProviderEndpoint } from '@/lib/openclaw-endpoint'
+import { notify } from '@/lib/server/ws-hub'
+export const dynamic = 'force-dynamic'
 
-export async function GET() {
+
+export async function GET(_req: Request) {
   return NextResponse.json(loadAgents())
 }
 
 export async function POST(req: Request) {
   const body = await req.json()
-  const id = crypto.randomBytes(4).toString('hex')
+  const id = genId()
   const now = Date.now()
   const agents = loadAgents()
   agents[id] = {
@@ -25,9 +28,11 @@ export async function POST(req: Request) {
     subAgentIds: body.subAgentIds || [],
     tools: body.tools || [],
     capabilities: body.capabilities || [],
+    thinkingLevel: body.thinkingLevel || undefined,
     createdAt: now,
     updatedAt: now,
   }
   saveAgents(agents)
+  notify('agents')
   return NextResponse.json(agents[id])
 }

package/src/app/api/auth/route.ts

@@ -1,9 +1,11 @@
 import { NextResponse } from 'next/server'
 import { validateAccessKey, getAccessKey, isFirstTimeSetup, markSetupComplete } from '@/lib/server/storage'
 import { ensureDaemonStarted } from '@/lib/server/daemon-state'
+export const dynamic = 'force-dynamic'
+
 
 /** GET /api/auth — check if this is a first-time setup (returns key for initial display) */
-export async function GET() {
+export async function GET(_req: Request) {
   if (isFirstTimeSetup()) {
     return NextResponse.json({ firstTime: true, key: getAccessKey() })
   }

package/src/app/api/claude-skills/route.ts

@@ -2,9 +2,11 @@ import { NextResponse } from 'next/server'
 import fs from 'fs'
 import path from 'path'
 import os from 'os'
+export const dynamic = 'force-dynamic'
+
 
 /** GET /api/claude-skills — discover skills from ~/.claude/skills/ */
-export async function GET() {
+export async function GET(_req: Request) {
   const skillsDir = path.join(os.homedir(), '.claude', 'skills')
   const skills: { id: string; name: string; description: string }[] = []
 

package/src/app/api/clawhub/install/route.ts

@@ -1,5 +1,5 @@
 import { NextResponse } from 'next/server'
-import crypto from 'crypto'
+import { genId } from '@/lib/id'
 import { loadSkills, saveSkills } from '@/lib/server/storage'
 import { fetchSkillContent } from '@/lib/server/clawhub-client'
 
@@ -20,7 +20,7 @@ export async function POST(req: Request) {
   }
 
   const skills = loadSkills()
-  const id = crypto.randomBytes(4).toString('hex')
+  const id = genId()
   skills[id] = {
     id,
     name,

package/src/app/api/connectors/[id]/route.ts

@@ -1,11 +1,13 @@
 import { NextResponse } from 'next/server'
 import { loadConnectors, saveConnectors } from '@/lib/server/storage'
+import { notify } from '@/lib/server/ws-hub'
+import { notFound } from '@/lib/server/collection-helpers'
 
 export async function GET(_req: Request, { params }: { params: Promise<{ id: string }> }) {
   const { id } = await params
   const connectors = loadConnectors()
   const connector = connectors[id]
-  if (!connector) return NextResponse.json({ error: 'Not found' }, { status: 404 })
+  if (!connector) return notFound()
 
   // Merge runtime status and QR code
   try {
@@ -25,7 +27,7 @@ export async function PUT(req: Request, { params }: { params: Promise<{ id: stri
   const body = await req.json()
   const connectors = loadConnectors()
   const connector = connectors[id]
-  if (!connector) return NextResponse.json({ error: 'Not found' }, { status: 404 })
+  if (!connector) return notFound()
 
   // Handle start/stop/repair actions — these modify connector state internally,
   // so re-read from storage after to avoid overwriting with stale data
@@ -46,6 +48,7 @@ export async function PUT(req: Request, { params }: { params: Promise<{ id: stri
     }
     // Re-read the connector after manager modified it
     const fresh = loadConnectors()
+    notify('connectors')
     return NextResponse.json(fresh[id])
   }
 
@@ -59,13 +62,14 @@ export async function PUT(req: Request, { params }: { params: Promise<{ id: stri
 
   connectors[id] = connector
   saveConnectors(connectors)
+  notify('connectors')
   return NextResponse.json(connector)
 }
 
 export async function DELETE(_req: Request, { params }: { params: Promise<{ id: string }> }) {
   const { id } = await params
   const connectors = loadConnectors()
-  if (!connectors[id]) return NextResponse.json({ error: 'Not found' }, { status: 404 })
+  if (!connectors[id]) return notFound()
 
   // Stop if running
   try {
@@ -73,7 +77,14 @@ export async function DELETE(_req: Request, { params }: { params: Promise<{ id:
     await stopConnector(id)
   } catch { /* ignore */ }
 
+  // Clear persisted pairing state when connector is deleted.
+  try {
+    const { clearConnectorPairingState } = await import('@/lib/server/connectors/pairing')
+    clearConnectorPairingState(id)
+  } catch { /* ignore */ }
+
   delete connectors[id]
   saveConnectors(connectors)
+  notify('connectors')
   return NextResponse.json({ ok: true })
 }