@swarmclawai/swarmclaw 0.3.1 → 0.4.5

package/src/lib/server/queue.ts

@@ -1,11 +1,14 @@
-import crypto from 'crypto'
+import { genId } from '@/lib/id'
 import { loadTasks, saveTasks, loadQueue, saveQueue, loadAgents, loadSchedules, saveSchedules, loadSessions, saveSessions, loadSettings } from './storage'
+import { notify } from './ws-hub'
+import { WORKSPACE_DIR } from './data-dir'
 import { createOrchestratorSession, executeOrchestrator } from './orchestrator'
 import { formatValidationFailure, validateTaskCompletion } from './task-validation'
 import { ensureTaskCompletionReport } from './task-reports'
 import { pushMainLoopEventToMainSessions } from './main-agent-loop'
 import { executeSessionChatTurn } from './chat-execution'
 import { extractTaskResult, formatResultBody } from './task-result'
+import { getCheckpointSaver } from './langgraph-checkpoint'
 import type { Agent, BoardTask, Message } from '@/types'
 
 let processing = false
@@ -119,7 +122,7 @@ async function executeTaskRun(
 ): Promise<string> {
   const prompt = task.description || task.title
   if (agent?.isOrchestrator) {
-    return executeOrchestrator(agent, prompt, sessionId)
+    return executeOrchestrator(agent, prompt, sessionId, task.id)
   }
 
   const run = await executeSessionChatTurn({
@@ -152,7 +155,11 @@ function notifyMainChatScheduleResult(task: BoardTask): void {
   const fallbackText = runSession ? latestAssistantText(runSession) : ''
 
   // Zod-validated structured extraction: one pass to get summary + all artifacts
-  const taskResult = extractTaskResult(runSession, task.result || fallbackText || null)
+  const taskResult = extractTaskResult(
+    runSession,
+    task.result || fallbackText || null,
+    { sinceTime: typeof task.startedAt === 'number' ? task.startedAt : null },
+  )
   const resultBody = formatResultBody(taskResult)
 
   const statusLabel = task.status === 'completed' ? 'completed' : 'failed'
@@ -221,7 +228,11 @@ function notifyAgentThreadTaskResult(task: BoardTask): void {
   const runSessionId = typeof task.sessionId === 'string' ? task.sessionId : ''
   const runSession = runSessionId ? sessions[runSessionId] : null
   const fallbackText = runSession ? latestAssistantText(runSession) : ''
-  const taskResult = extractTaskResult(runSession, task.result || fallbackText || null)
+  const taskResult = extractTaskResult(
+    runSession,
+    task.result || fallbackText || null,
+    { sinceTime: typeof task.startedAt === 'number' ? task.startedAt : null },
+  )
   const resultBody = formatResultBody(taskResult)
 
   const statusLabel = task.status === 'completed' ? 'completed' : 'failed'
@@ -371,7 +382,7 @@ export function validateCompletedTasksQueue() {
     task.updatedAt = now
     if (!task.comments) task.comments = []
     task.comments.push({
-      id: crypto.randomBytes(4).toString('hex'),
+      id: genId(),
       author: 'System',
       text: `Task auto-failed completed-queue validation.\n\n${validation.reasons.map((r) => `- ${r}`).join('\n')}`,
       createdAt: now,
@@ -389,7 +400,7 @@ export function validateCompletedTasksQueue() {
     }
   }
 
-  if (tasksDirty) saveTasks(tasks)
+  if (tasksDirty) { saveTasks(tasks); notify('tasks') }
   if (sessionsDirty) saveSessions(sessions)
   if (demoted > 0) {
     console.warn(`[queue] Demoted ${demoted} invalid completed task(s) to failed after validation audit`)
@@ -410,7 +421,7 @@ function scheduleRetryOrDeadLetter(task: BoardTask, reason: string): 'retry' | '
     task.error = `Retry scheduled after failure: ${reason}`.slice(0, 500)
     if (!task.comments) task.comments = []
     task.comments.push({
-      id: crypto.randomBytes(4).toString('hex'),
+      id: genId(),
       author: 'System',
       text: `Attempt ${task.attempts}/${task.maxAttempts} failed. Retrying in ${delaySec}s.\n\nReason: ${reason}`,
       createdAt: now,
@@ -425,7 +436,7 @@ function scheduleRetryOrDeadLetter(task: BoardTask, reason: string): 'retry' | '
   task.error = `Dead-lettered after ${task.attempts}/${task.maxAttempts} attempts: ${reason}`.slice(0, 500)
   if (!task.comments) task.comments = []
   task.comments.push({
-    id: crypto.randomBytes(4).toString('hex'),
+    id: genId(),
     author: 'System',
     text: `Task moved to dead-letter after ${task.attempts}/${task.maxAttempts} attempts.\n\nReason: ${reason}`,
     createdAt: now,
@@ -510,9 +521,12 @@ export async function processNext() {
       task.startedAt = Date.now()
       task.retryScheduledAt = null
       task.deadLetteredAt = null
+      // Clear transient failure fields so validation/error state reflects only this attempt.
+      task.error = null
+      task.validation = null
       task.updatedAt = Date.now()
 
-      const taskCwd = task.cwd || process.cwd()
+      const taskCwd = task.cwd || WORKSPACE_DIR
       let sessionId = ''
       const scheduleTask = task as ScheduleTaskMeta
       const isScheduleTask = scheduleTask.sourceType === 'schedule'
@@ -604,7 +618,11 @@ export async function processNext() {
           applyTaskPolicyDefaults(t2[taskId])
           // Structured extraction: Zod-validated result with typed artifacts
           const runSessions = loadSessions()
-          const taskResult = extractTaskResult(runSessions[sessionId], result || null)
+          const taskResult = extractTaskResult(
+            runSessions[sessionId],
+            result || null,
+            { sinceTime: typeof t2[taskId].startedAt === 'number' ? t2[taskId].startedAt : null },
+          )
           const enrichedResult = formatResultBody(taskResult)
           t2[taskId].result = enrichedResult.slice(0, 4000) || null
           t2[taskId].updatedAt = Date.now()
@@ -630,7 +648,7 @@ export async function processNext() {
               updatedAt: now,
             }
             t2[taskId].comments!.push({
-              id: crypto.randomBytes(4).toString('hex'),
+              id: genId(),
               author: agent.name,
               agentId: agent.id,
               text: `Task completed.\n\n${result?.slice(0, 1000) || 'No summary provided.'}`,
@@ -641,7 +659,7 @@ export async function processNext() {
             const retryState = scheduleRetryOrDeadLetter(t2[taskId], failureReason)
             t2[taskId].completedAt = retryState === 'dead_lettered' ? null : t2[taskId].completedAt
             t2[taskId].comments!.push({
-              id: crypto.randomBytes(4).toString('hex'),
+              id: genId(),
               author: agent.name,
               agentId: agent.id,
               text: `Task failed validation and was not marked completed.\n\n${validation.reasons.map((r) => `- ${r}`).join('\n')}`,
@@ -688,6 +706,8 @@ export async function processNext() {
           }
 
           saveTasks(t2)
+          notify('tasks')
+          notify('runs')
           disableSessionHeartbeat(t2[taskId].sessionId)
         }
         const doneTask = t2[taskId]
@@ -698,6 +718,10 @@ export async function processNext() {
           })
           notifyMainChatScheduleResult(doneTask)
           notifyAgentThreadTaskResult(doneTask)
+          // Clean up LangGraph checkpoints for completed tasks
+          getCheckpointSaver().deleteThread(taskId).catch((e) =>
+            console.warn(`[queue] Failed to clean up checkpoints for task ${taskId}:`, e)
+          )
           console.log(`[queue] Task "${task.title}" completed`)
         } else {
           if (doneTask?.status === 'queued') {
@@ -727,7 +751,7 @@ export async function processNext() {
           const isRepeatError = lastComment?.agentId === agent.id && lastComment?.text.startsWith('Task failed')
           if (!isRepeatError) {
             t2[taskId].comments!.push({
-              id: crypto.randomBytes(4).toString('hex'),
+              id: genId(),
               author: agent.name,
               agentId: agent.id,
               text: 'Task failed — see error details above.',
@@ -735,6 +759,8 @@ export async function processNext() {
             })
           }
           saveTasks(t2)
+          notify('tasks')
+          notify('runs')
           disableSessionHeartbeat(t2[taskId].sessionId)
           if (retryState === 'retry') {
             const qRetry = loadQueue()

package/src/lib/server/scheduler.ts

@@ -1,4 +1,4 @@
-import crypto from 'crypto'
+import { genId } from '@/lib/id'
 import { loadSchedules, saveSchedules, loadAgents, loadTasks, saveTasks } from './storage'
 import { enqueueTask } from './queue'
 import { CronExpressionParser } from 'cron-parser'
@@ -157,7 +157,7 @@ async function tick() {
       prev.runNumber = schedule.runNumber
     } else {
       // Create a new linked task (first run or previous task still in-flight)
-      taskId = crypto.randomBytes(4).toString('hex')
+      taskId = genId()
       tasks[taskId] = {
         id: taskId,
         title: `[Sched] ${schedule.name} (run #${schedule.runNumber})`,

package/src/lib/server/session-mailbox.ts

@@ -1,4 +1,4 @@
-import crypto from 'crypto'
+import { genId } from '@/lib/id'
 import { loadSessions, saveSessions } from './storage'
 
 export type MailboxStatus = 'new' | 'ack'
@@ -58,7 +58,7 @@ export function sendMailboxEnvelope(input: {
     ? Math.max(0, Math.min(7 * 24 * 3600, Math.trunc(input.ttlSec)))
     : null
   const envelope: MailboxEnvelope = {
-    id: crypto.randomBytes(6).toString('hex'),
+    id: genId(6),
     type: (input.type || 'message').trim() || 'message',
     payload: String(input.payload || ''),
     fromSessionId: input.fromSessionId || null,

package/src/lib/server/session-run-manager.ts

@@ -1,4 +1,4 @@
-import crypto from 'crypto'
+import { genId } from '@/lib/id'
 import type { SSEEvent } from '@/types'
 import { active, loadSessions } from './storage'
 import { executeSessionChatTurn, type ExecuteChatTurnResult } from './chat-execution'
@@ -31,6 +31,7 @@ interface QueueEntry {
   message: string
   imagePath?: string
   imageUrl?: string
+  attachedFiles?: string[]
   onEvents: Array<(event: SSEEvent) => void>
   signalController: AbortController
   maxRuntimeMs?: number
@@ -236,6 +237,7 @@ async function drainExecution(executionKey: string): Promise<void> {
       message: next.message,
       imagePath: next.imagePath,
       imageUrl: next.imageUrl,
+      attachedFiles: next.attachedFiles,
       internal: next.run.internal,
       source: next.run.source,
       runId: next.run.id,
@@ -333,6 +335,7 @@ export interface EnqueueSessionRunInput {
   message: string
   imagePath?: string
   imageUrl?: string
+  attachedFiles?: string[]
   internal?: boolean
   source?: string
   mode?: SessionQueueMode
@@ -384,7 +387,7 @@ export function enqueueSessionRun(input: EnqueueSessionRunInput): EnqueueSession
 
   const running = state.runningByExecution.get(executionKey)
   const q = queueForExecution(executionKey)
-  if (mode === 'collect' && !input.imagePath && !input.imageUrl) {
+  if (mode === 'collect' && !input.imagePath && !input.imageUrl && !input.attachedFiles?.length) {
     const nowMs = now()
     const candidate = q.at(-1)
     const canCoalesce = !!candidate
@@ -393,6 +396,7 @@ export function enqueueSessionRun(input: EnqueueSessionRunInput): EnqueueSession
       && candidate.run.source === source
       && !candidate.imagePath
       && !candidate.imageUrl
+      && !candidate.attachedFiles?.length
       && (nowMs - candidate.run.queuedAt) <= COLLECT_COALESCE_WINDOW_MS
 
     if (candidate && canCoalesce) {
@@ -416,7 +420,7 @@ export function enqueueSessionRun(input: EnqueueSessionRunInput): EnqueueSession
     }
   }
 
-  const runId = crypto.randomBytes(8).toString('hex')
+  const runId = genId(8)
   const run: SessionRunRecord = {
     id: runId,
     sessionId: input.sessionId,
@@ -444,6 +448,7 @@ export function enqueueSessionRun(input: EnqueueSessionRunInput): EnqueueSession
     message: input.message,
     imagePath: input.imagePath,
     imageUrl: input.imageUrl,
+    attachedFiles: input.attachedFiles,
     onEvents: input.onEvent ? [input.onEvent] : [],
     signalController: new AbortController(),
     maxRuntimeMs: effectiveMaxRuntimeMs > 0 ? effectiveMaxRuntimeMs : undefined,

package/src/lib/server/session-tools/connector.ts

@@ -58,6 +58,10 @@ export function buildConnectorTools(bctx: ToolBuildContext): StructuredToolInter
                 const outbound = connector.config?.outboundJid?.trim()
                 if (outbound) channelId = outbound
               }
+              if (!channelId) {
+                const outbound = connector.config?.outboundTarget?.trim()
+                if (outbound) channelId = outbound
+              }
               if (!channelId) {
                 const recentChannelId = getConnectorRecentChannelId(selected.id)
                 if (recentChannelId) channelId = recentChannelId
@@ -67,7 +71,11 @@ export function buildConnectorTools(bctx: ToolBuildContext): StructuredToolInter
                 if (allowed.length) channelId = allowed[0]
               }
               if (!channelId) {
-                return `Error: no target recipient configured. Provide "to", or set connector config "outboundJid"/"allowedJids".`
+                const allowed = connector.config?.allowFrom?.split(',').map((s: string) => s.trim()).filter(Boolean) || []
+                if (allowed.length) channelId = allowed[0]
+              }
+              if (!channelId) {
+                return `Error: no target recipient configured. Provide "to", or set connector config "outboundJid"/"allowedJids"/"outboundTarget"/"allowFrom".`
               }
               if (connector.platform === 'whatsapp') {
                 channelId = normalizeWhatsAppTarget(channelId)
@@ -93,6 +101,45 @@ export function buildConnectorTools(bctx: ToolBuildContext): StructuredToolInter
               })
             }
 
+            if (action === 'message_react' || action === 'message_edit' || action === 'message_pin' || action === 'message_delete') {
+              if (!connectorId) return 'Error: connectorId is required for rich messaging actions.'
+              const { getRunningInstance } = await import('../connectors/manager')
+              const inst = getRunningInstance(connectorId)
+              if (!inst) return `Error: connector "${connectorId}" is not running.`
+
+              const targetChannel = to?.trim() || ''
+              const targetMessageId = message?.trim() || ''
+              if (!targetMessageId) return 'Error: message parameter (used as messageId) is required for rich messaging actions.'
+
+              try {
+                if (action === 'message_react') {
+                  if (!inst.sendReaction) return 'Error: this connector does not support reactions.'
+                  const emoji = caption?.trim() || '👍'
+                  await inst.sendReaction(targetChannel, targetMessageId, emoji)
+                  return JSON.stringify({ status: 'reacted', connectorId, messageId: targetMessageId, emoji })
+                }
+                if (action === 'message_edit') {
+                  if (!inst.editMessage) return 'Error: this connector does not support message editing.'
+                  const newText = caption?.trim() || ''
+                  if (!newText) return 'Error: caption (new text) is required for message_edit.'
+                  await inst.editMessage(targetChannel, targetMessageId, newText)
+                  return JSON.stringify({ status: 'edited', connectorId, messageId: targetMessageId })
+                }
+                if (action === 'message_delete') {
+                  if (!inst.deleteMessage) return 'Error: this connector does not support message deletion.'
+                  await inst.deleteMessage(targetChannel, targetMessageId)
+                  return JSON.stringify({ status: 'deleted', connectorId, messageId: targetMessageId })
+                }
+                if (action === 'message_pin') {
+                  if (!inst.pinMessage) return 'Error: this connector does not support message pinning.'
+                  await inst.pinMessage(targetChannel, targetMessageId)
+                  return JSON.stringify({ status: 'pinned', connectorId, messageId: targetMessageId })
+                }
+              } catch (err: any) {
+                return `Error: ${err.message || String(err)}`
+              }
+            }
+
             return 'Unknown action. Use list_running, list_targets, or send.'
           } catch (err: any) {
             return `Error: ${err.message || String(err)}`
@@ -100,11 +147,11 @@ export function buildConnectorTools(bctx: ToolBuildContext): StructuredToolInter
         },
         {
           name: 'connector_message_tool',
-          description: 'Send proactive outbound messages through running connectors (for example WhatsApp status updates). Supports listing running connectors/targets and sending text plus optional media (URLs or local file paths).',
+          description: 'Send proactive outbound messages and perform rich messaging actions through running connectors. Supports listing running connectors/targets, sending text/media, and rich messaging (react, edit, delete, pin). For rich actions: connectorId + message (as messageId) required; caption carries emoji for react or new text for edit.',
           schema: z.object({
-            action: z.enum(['list_running', 'list_targets', 'send']).describe('connector messaging action'),
+            action: z.enum(['list_running', 'list_targets', 'send', 'message_react', 'message_edit', 'message_delete', 'message_pin']).describe('connector messaging action'),
             connectorId: z.string().optional().describe('Optional connector id. Defaults to the first running connector (or first for selected platform).'),
-            platform: z.string().optional().describe('Optional platform filter (whatsapp, telegram, slack, discord).'),
+            platform: z.string().optional().describe('Optional platform filter (whatsapp, telegram, slack, discord, bluebubbles, etc.).'),
             to: z.string().optional().describe('Target channel id / recipient. For WhatsApp, phone number or full JID.'),
             message: z.string().optional().describe('Message text to send (required for send action).'),
             imageUrl: z.string().optional().describe('Optional public image URL to attach/send where platform supports media.'),

package/src/lib/server/session-tools/crud.ts

@@ -2,7 +2,7 @@ import { z } from 'zod'
 import { tool, type StructuredToolInterface } from '@langchain/core/tools'
 import fs from 'fs'
 import path from 'path'
-import crypto from 'crypto'
+import { genId } from '@/lib/id'
 import { spawnSync } from 'child_process'
 import * as cheerio from 'cheerio'
 import {
@@ -342,7 +342,7 @@ export function buildCrudTools(bctx: ToolBuildContext): StructuredToolInterface[
                   })
                 }
               }
-              const newId = crypto.randomBytes(4).toString('hex')
+              const newId = genId()
               const entry = {
                 id: newId,
                 ...parsed,
@@ -565,7 +565,7 @@ export function buildCrudTools(bctx: ToolBuildContext): StructuredToolInterface[
               const content = trimDocumentContent(extracted.text)
               if (!content) return 'Error: extracted document text is empty.'
 
-              const docId = crypto.randomBytes(6).toString('hex')
+              const docId = genId(6)
               const now = Date.now()
               const parsedMetadata = metadata && typeof metadata === 'string'
                 ? (() => {

package/src/lib/server/session-tools/delegate.ts

@@ -1,6 +1,6 @@
 import { z } from 'zod'
 import { tool, type StructuredToolInterface } from '@langchain/core/tools'
-import crypto from 'crypto'
+import { genId } from '@/lib/id'
 import { spawn, spawnSync } from 'child_process'
 import { loadAgents, loadTasks, upsertTask } from '../storage'
 import { log } from '../logger'
@@ -619,8 +619,8 @@ export function buildDelegateTools(bctx: ToolBuildContext): StructuredToolInterf
     }
   }
 
-  // delegate_to_agent: requires orchestrator capability to be enabled
-  if (bctx.activeTools.includes('orchestrator') && ctx?.agentId) {
+  // delegate_to_agent: requires "Assign to Other Agents" (platformAssignScope: 'all')
+  if (ctx?.platformAssignScope === 'all' && ctx?.agentId) {
     tools.push(
       tool(
         async ({ agentId: targetAgentId, task: taskPrompt, description: taskDesc, startImmediately }) => {
@@ -640,7 +640,7 @@ export function buildDelegateTools(bctx: ToolBuildContext): StructuredToolInterf
             }
             if (!target) return `Error: Agent "${targetAgentId}" not found. Use the agent directory in your system prompt to find valid agent IDs.`
 
-            const taskId = crypto.randomBytes(4).toString('hex')
+            const taskId = genId()
             const now = Date.now()
             const newTask = {
               id: taskId,
@@ -653,7 +653,7 @@ export function buildDelegateTools(bctx: ToolBuildContext): StructuredToolInterf
               createdAt: now,
               updatedAt: now,
               comments: [{
-                id: crypto.randomBytes(4).toString('hex'),
+                id: genId(),
                 author: agents[ctx.agentId!]?.name || 'Agent',
                 agentId: ctx.agentId!,
                 text: `Delegated from ${agents[ctx.agentId!]?.name || ctx.agentId}`,

package/src/lib/server/session-tools/file.ts

@@ -44,10 +44,15 @@ export function buildFileTools(bctx: ToolBuildContext): StructuredToolInterface[
   if (canWriteFiles) {
     tools.push(
       tool(
-        async ({ filePath, content }) => {
+        async ({ filePath, content, encoding }) => {
           try {
             const resolved = safePath(bctx.cwd, filePath)
             fs.mkdirSync(path.dirname(resolved), { recursive: true })
+            if (encoding === 'base64') {
+              const buf = Buffer.from(content, 'base64')
+              fs.writeFileSync(resolved, buf)
+              return `File written: ${filePath} (${buf.length} bytes, binary)`
+            }
             fs.writeFileSync(resolved, content, 'utf-8')
             return `File written: ${filePath} (${content.length} bytes)`
           } catch (err: any) {
@@ -56,10 +61,11 @@ export function buildFileTools(bctx: ToolBuildContext): StructuredToolInterface[
         },
         {
           name: 'write_file',
-          description: 'Write content to a file in the session working directory. Creates directories if needed.',
+          description: 'Write content to a file in the session working directory. Creates directories if needed. For PDFs and styled reports, use the create_document tool instead. For other binary files (Excel, images, zip, etc.), set encoding to "base64" and pass base64-encoded content.',
           schema: z.object({
             filePath: z.string().describe('Relative path to the file'),
-            content: z.string().describe('The content to write'),
+            content: z.string().describe('The content to write. For binary files, this must be a base64-encoded string.'),
+            encoding: z.enum(['utf-8', 'base64']).optional().describe('Encoding of the content. Use "base64" for binary files like PDF, Excel, images, zip archives. Defaults to "utf-8" for plain text.'),
           }),
         },
       ),
@@ -229,6 +235,173 @@ export function buildFileTools(bctx: ToolBuildContext): StructuredToolInterface[
     )
   }
 
+  if (canSendFiles || canWriteFiles) {
+    // create_document: markdown → pdf / html / png / jpg
+    tools.push(
+      tool(
+        async ({ content, title, filename, format }) => {
+          try {
+            const fmt = format || 'pdf'
+            const { marked } = await import('marked')
+            const html = await marked.parse(content)
+            const safeTitle = (title || 'Document').replace(/</g, '&lt;')
+            const fullHtml = `<!DOCTYPE html>
+<html><head><meta charset="utf-8"><title>${safeTitle}</title>
+<style>
+body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;max-width:800px;margin:40px auto;padding:0 20px;color:#1a1a1a;line-height:1.6}
+h1{font-size:28px;border-bottom:2px solid #e5e7eb;padding-bottom:8px}
+h2{font-size:22px;margin-top:32px}
+h3{font-size:18px;margin-top:24px}
+pre{background:#f3f4f6;padding:16px;border-radius:8px;overflow-x:auto;font-size:13px}
+code{background:#f3f4f6;padding:2px 6px;border-radius:4px;font-size:13px}
+pre code{background:none;padding:0}
+table{border-collapse:collapse;width:100%}
+th,td{border:1px solid #d1d5db;padding:8px 12px;text-align:left}
+th{background:#f9fafb;font-weight:600}
+blockquote{border-left:4px solid #d1d5db;margin:16px 0;padding:8px 16px;color:#4b5563}
+img{max-width:100%}
+</style></head><body>${html}</body></html>`
+
+            const defaultBase = (title || 'document').replace(/[^a-zA-Z0-9_-]/g, '_')
+
+            if (fmt === 'html') {
+              const outName = filename || `${defaultBase}.html`
+              const resolved = safePath(bctx.cwd, outName)
+              fs.mkdirSync(path.dirname(resolved), { recursive: true })
+              fs.writeFileSync(resolved, fullHtml, 'utf-8')
+              return `HTML document created: ${outName} (${fullHtml.length} bytes)`
+            }
+
+            const { chromium } = await import('playwright')
+            const browser = await chromium.launch({ headless: true })
+            try {
+              const page = await browser.newPage()
+              await page.setContent(fullHtml, { waitUntil: 'networkidle' })
+
+              if (fmt === 'pdf') {
+                const outName = filename || `${defaultBase}.pdf`
+                const resolved = safePath(bctx.cwd, outName)
+                fs.mkdirSync(path.dirname(resolved), { recursive: true })
+                await page.pdf({ path: resolved, format: 'A4', margin: { top: '40px', bottom: '40px', left: '40px', right: '40px' }, printBackground: true })
+                return `PDF created: ${outName}`
+              }
+
+              // png or jpg screenshot
+              const ext = fmt === 'jpg' ? 'jpeg' : 'png'
+              const outName = filename || `${defaultBase}.${fmt}`
+              const resolved = safePath(bctx.cwd, outName)
+              fs.mkdirSync(path.dirname(resolved), { recursive: true })
+              await page.screenshot({ path: resolved, type: ext, fullPage: true })
+              const size = fs.statSync(resolved).size
+              return `Image created: ${outName} (${(size / 1024).toFixed(1)} KB)`
+            } finally {
+              await browser.close()
+            }
+          } catch (err: any) {
+            return `Error creating document: ${err.message}`
+          }
+        },
+        {
+          name: 'create_document',
+          description: 'Create a document from markdown content. Renders markdown with professional styling and outputs as PDF, HTML, or image. Use this instead of write_file for PDFs, reports, styled pages, or document screenshots. After creating, use send_file to deliver it to the user.',
+          schema: z.object({
+            content: z.string().describe('Markdown content for the document'),
+            title: z.string().optional().describe('Document title (shown in header and used for default filename)'),
+            filename: z.string().optional().describe('Output filename (defaults to title-based name with appropriate extension)'),
+            format: z.enum(['pdf', 'html', 'png', 'jpg']).optional().describe('Output format. "pdf" (default) for print-ready documents, "html" for web pages, "png"/"jpg" for images.'),
+          }),
+        },
+      ),
+    )
+
+    // create_spreadsheet: JSON data → xlsx or csv
+    tools.push(
+      tool(
+        async ({ data, headers, sheetName, filename, format }) => {
+          try {
+            const fmt = format || 'xlsx'
+            let rows: Record<string, unknown>[]
+            try {
+              rows = JSON.parse(data)
+              if (!Array.isArray(rows)) return 'Error: data must be a JSON array of objects'
+            } catch {
+              return 'Error: data is not valid JSON. Pass a JSON array of objects, e.g. [{"name":"Alice","age":30}]'
+            }
+
+            if (!rows.length) return 'Error: data array is empty'
+
+            // Resolve column headers: explicit headers, or keys from first row
+            const cols = headers?.length
+              ? headers
+              : Object.keys(rows[0] && typeof rows[0] === 'object' ? rows[0] : {})
+            if (!cols.length) return 'Error: could not determine column headers. Pass headers or use objects with keys.'
+
+            const defaultBase = (sheetName || 'spreadsheet').replace(/[^a-zA-Z0-9_-]/g, '_')
+
+            if (fmt === 'csv') {
+              const escapeCsv = (val: unknown): string => {
+                const s = val == null ? '' : String(val)
+                return s.includes(',') || s.includes('"') || s.includes('\n')
+                  ? `"${s.replace(/"/g, '""')}"`
+                  : s
+              }
+              const lines = [cols.map(escapeCsv).join(',')]
+              for (const row of rows) {
+                const r = Array.isArray(row) ? row : cols.map((c) => (row as Record<string, unknown>)[c])
+                lines.push(r.map(escapeCsv).join(','))
+              }
+              const outName = filename || `${defaultBase}.csv`
+              const resolved = safePath(bctx.cwd, outName)
+              fs.mkdirSync(path.dirname(resolved), { recursive: true })
+              fs.writeFileSync(resolved, lines.join('\n'), 'utf-8')
+              return `CSV created: ${outName} (${rows.length} rows, ${cols.length} columns)`
+            }
+
+            // xlsx via exceljs
+            const ExcelJS = await import('exceljs')
+            const workbook = new ExcelJS.default.Workbook()
+            const sheet = workbook.addWorksheet(sheetName || 'Sheet1')
+
+            sheet.columns = cols.map((c) => ({ header: c, key: c, width: Math.max(12, c.length + 4) }))
+            // Style header row
+            sheet.getRow(1).font = { bold: true }
+            sheet.getRow(1).fill = { type: 'pattern', pattern: 'solid', fgColor: { argb: 'FFF3F4F6' } }
+
+            for (const row of rows) {
+              if (Array.isArray(row)) {
+                const obj: Record<string, unknown> = {}
+                cols.forEach((c, i) => { obj[c] = row[i] })
+                sheet.addRow(obj)
+              } else {
+                sheet.addRow(row)
+              }
+            }
+
+            const outName = filename || `${defaultBase}.xlsx`
+            const resolved = safePath(bctx.cwd, outName)
+            fs.mkdirSync(path.dirname(resolved), { recursive: true })
+            await workbook.xlsx.writeFile(resolved)
+            const size = fs.statSync(resolved).size
+            return `Excel spreadsheet created: ${outName} (${rows.length} rows, ${cols.length} columns, ${(size / 1024).toFixed(1)} KB)`
+          } catch (err: any) {
+            return `Error creating spreadsheet: ${err.message}`
+          }
+        },
+        {
+          name: 'create_spreadsheet',
+          description: 'Create an Excel (.xlsx) or CSV file from structured data. Pass data as a JSON array of objects. Use this for tables, reports, data exports, and any tabular data the user requests. After creating, use send_file to deliver it to the user.',
+          schema: z.object({
+            data: z.string().describe('JSON array of objects, e.g. [{"name":"Alice","score":95},{"name":"Bob","score":87}]'),
+            headers: z.array(z.string()).optional().describe('Column headers in display order. If omitted, keys from the first object are used.'),
+            sheetName: z.string().optional().describe('Worksheet name (default "Sheet1")'),
+            filename: z.string().optional().describe('Output filename (defaults to sheetName-based name with extension)'),
+            format: z.enum(['xlsx', 'csv']).optional().describe('Output format: "xlsx" (default) for Excel, "csv" for plain CSV.'),
+          }),
+        },
+      ),
+    )
+  }
+
   if (bctx.hasTool('edit_file')) {
     tools.push(
       tool(

package/src/lib/server/session-tools/index.ts

@@ -14,6 +14,8 @@ import { buildCrudTools } from './crud'
 import { buildSessionInfoTools } from './session-info'
 import { buildConnectorTools } from './connector'
 import { buildContextTools } from './context-mgmt'
+import { buildSandboxTools } from './sandbox'
+import { buildOpenClawNodeTools } from './openclaw-nodes'
 
 export type { ToolContext, SessionToolsResult }
 export { sweepOrphanedBrowsers, cleanupSessionBrowser, getActiveBrowserCount, hasActiveBrowser }
@@ -93,6 +95,8 @@ export async function buildSessionTools(cwd: string, enabledTools: string[], ctx
     ...buildSessionInfoTools(bctx),
     ...buildConnectorTools(bctx),
     ...buildContextTools(bctx),
+    ...buildSandboxTools(bctx),
+    ...buildOpenClawNodeTools(bctx),
   )
 
   // ---------------------------------------------------------------------------

package/src/lib/server/session-tools/memory.ts

@@ -1,7 +1,7 @@
 import { z } from 'zod'
 import { tool, type StructuredToolInterface } from '@langchain/core/tools'
 import fs from 'fs'
-import crypto from 'crypto'
+import { genId } from '@/lib/id'
 import { getMemoryDb, getMemoryLookupLimits, storeMemoryImageAsset } from '../memory-db'
 import { loadSettings } from '../storage'
 import type { ToolBuildContext } from './context'
@@ -81,7 +81,7 @@ export function buildMemoryTools(bctx: ToolBuildContext): StructuredToolInterfac
                   return `Error: image file not found: ${imagePath}`
                 }
                 try {
-                  storedImage = await storeMemoryImageAsset(imagePath, crypto.randomBytes(6).toString('hex'))
+                  storedImage = await storeMemoryImageAsset(imagePath, genId(6))
                 } catch {
                   return `Error: failed to process image at ${imagePath}`
                 }