@swarmclawai/swarmclaw 0.4.0 → 0.5.0

package/README.md

@@ -25,7 +25,10 @@ Inspired by [OpenClaw](https://github.com/openclaw).
 
 - **15 Built-in Providers** — Claude Code CLI, OpenAI Codex CLI, OpenCode CLI, Anthropic, OpenAI, Google Gemini, DeepSeek, Groq, Together AI, Mistral AI, xAI (Grok), Fireworks AI, Ollama, plus custom OpenAI-compatible endpoints
 - **OpenClaw Gateway** — Per-agent toggle to connect any agent to a local or remote OpenClaw gateway. Each agent gets its own gateway URL and token — run a swarm of OpenClaws from one dashboard. The `openclaw` CLI ships as a bundled dependency (no separate install needed)
+- **OpenClaw Control Plane** — Built-in gateway connection controls, reload mode switching (hot/hybrid/full), config issue detection/repair, remote history sync, and live execution approval handling
 - **Agent Builder** — Create agents with custom personalities (soul), system prompts, tools, and skills. AI-powered generation from a description
+- **Agent Inspector Panel** — Per-agent side panel for OpenClaw file editing (`SOUL.md`, `IDENTITY.md`, `USER.md`, etc.), guided personality editing, skill install/enable/remove, permission presets, sandbox env allowlist, and cron automations
+- **Agent Fleet Management** — Avatar seeds with generated avatars, running/approval fleet filters, soft-delete agent trash with restore/permanent delete, and approval counters in agent cards
 - **Agent Tools** — Shell, process control for long-running commands, files, edit file, send file, web search, web fetch, CLI delegation (Claude/Codex/OpenCode), Playwright browser automation, persistent memory, and sandboxed code execution (JS/TS via Deno, Python)
 - **Platform Tools** — Agents can manage other agents, tasks, schedules, skills, connectors, sessions, and encrypted secrets via built-in platform tools
 - **Orchestration** — Multi-agent workflows powered by LangGraph with automatic sub-agent routing, checkpointed execution, and rich delegation cards that link to sub-agent chat threads
@@ -35,8 +38,11 @@ Inspired by [OpenClaw](https://github.com/openclaw).
 - **Scheduling** — Cron-based agent scheduling with human-friendly presets
 - **Loop Runtime Controls** — Switch between bounded and ongoing loops with configurable step caps, runtime guards, heartbeat cadence, and timeout budgets
 - **Session Run Queue** — Per-session queued runs with followup/steer/collect modes, collect coalescing for bursty inputs, and run-state APIs
+- **Chat Iteration Workflow** — Edit-and-resend user turns, fork a new session from any message, bookmark key messages, use contextual follow-up suggestion chips, and auto-continue after tool access grants
+- **Live Chat Telemetry** — Thinking/tool/responding stream phases, live main-loop status badges, connector activity presence, tone indicator, and optional sound notifications
+- **Preview-Rich Chat UI** — Side preview panel for tool outputs (image/browser/html/code), inline code/PDF previews for attachments, and image lightbox support
 - **Voice Settings** — Per-instance ElevenLabs API key + voice ID for TTS replies, plus configurable speech recognition language for chat input
-- **Chat Connectors** — Bridge agents to Discord, Slack, Telegram, and WhatsApp with media-aware inbound handling
+- **Chat Connectors** — Bridge agents to Discord, Slack, Telegram, WhatsApp, BlueBubbles (iMessage), Signal, Microsoft Teams, Google Chat, Matrix, and OpenClaw with media-aware inbound handling
 - **Skills System** — Discover local skills, import skills from URL, and load OpenClaw `SKILL.md` files (frontmatter-compatible)
 - **Execution Logging** — Structured audit trail for triggers, tool calls, file ops, commits, and errors in a dedicated `logs.db`
 - **Context Management** — Auto-compaction of conversation history when approaching context limits, with manual `context_status` and `context_summarize` tools for agents
@@ -53,7 +59,7 @@ Inspired by [OpenClaw](https://github.com/openclaw).
 
 ## Requirements
 
-- **Node.js** 20+
+- **Node.js** 22.6+
 - **npm** 10+
 - **Claude Code CLI** (optional, for `claude-cli` provider) — [Install](https://docs.anthropic.com/en/docs/claude-code/overview)
 - **OpenAI Codex CLI** (optional, for `codex-cli` provider) — [Install](https://github.com/openai/codex)
@@ -75,7 +81,7 @@ curl -fsSL https://raw.githubusercontent.com/swarmclawai/swarmclaw/main/install.
 ```
 
 The installer resolves the latest stable release tag and installs that version by default.
-To pin a version: `SWARMCLAW_VERSION=v0.1.0 curl ... | bash`
+To pin a version: `SWARMCLAW_VERSION=v0.5.0 curl ... | bash`
 
 Or run locally from the repo (friendly for non-technical users):
 
@@ -229,6 +235,12 @@ Bridge any agent to a chat platform:
 | Slack | @slack/bolt | Bot token + app token (Socket Mode) |
 | Telegram | grammy | Bot token from @BotFather |
 | WhatsApp | baileys | QR code pairing (shown in browser) |
+| BlueBubbles | Custom webhook bridge | Server URL + password/webhook secret |
+| Signal | signal-cli | `signal-cli` binary + linked phone |
+| Microsoft Teams | botbuilder | Bot Framework credentials + webhook ingress |
+| Google Chat | googleapis | Service account + webhook ingress |
+| Matrix | matrix-bot-sdk | Homeserver URL + access token |
+| OpenClaw | gateway protocol | OpenClaw connector credentials |
 
 Connector sessions preserve attachment visibility in chat context:
 - WhatsApp media is decoded and persisted to `/api/uploads/...` when possible
@@ -237,7 +249,12 @@ Connector sessions preserve attachment visibility in chat context:
 
 Agents automatically suppress replies to simple acknowledgments ("ok", "thanks", thumbs-up, etc.) via a `NO_MESSAGE` response — conversations feel natural without a forced reply to every message. This is handled at the connector layer, so agents can return `NO_MESSAGE` as their response content and the platform won't deliver anything to the channel.
 
-For proactive outreach, `connector_message_tool` supports text plus optional `imageUrl` / `fileUrl` / `mediaPath` (local file path) payloads. All four platforms (WhatsApp, Discord, Slack, Telegram) support local file sending via `mediaPath` with auto-detected MIME types.
+For proactive outreach, `connector_message_tool` supports text plus optional `imageUrl` / `fileUrl` / `mediaPath` (local file path) payloads. WhatsApp, Discord, Slack, and Telegram support local file sending via `mediaPath` with auto-detected MIME types.
+
+Connector ingress now also supports optional pairing/allowlist policy:
+- `dmPolicy: allowlist` blocks unknown senders until approved
+- `/pair` flow lets approved admins generate and approve pairing codes
+- `/think` command can set connector thread thinking level (`low`, `medium`, `high`)
 
 ## Agent Tools
 

package/bin/server-cmd.js

@@ -17,14 +17,15 @@ const PID_FILE = path.join(SWARMCLAW_HOME, 'server.pid')
 const LOG_FILE = path.join(SWARMCLAW_HOME, 'server.log')
 const DATA_DIR = path.join(SWARMCLAW_HOME, 'data')
 
-// Files/directories to symlink from the npm package into SWARMCLAW_HOME
-const SYMLINKS = [
+// Files/directories to copy from the npm package into SWARMCLAW_HOME
+const BUILD_COPY_ENTRIES = [
   'src',
   'public',
   'next.config.ts',
   'tsconfig.json',
   'postcss.config.mjs',
   'package.json',
+  'package-lock.json',
 ]
 
 // ---------------------------------------------------------------------------
@@ -61,16 +62,13 @@ function isProcessRunning(pid) {
   }
 }
 
-function symlink(src, dest) {
-  // Remove existing symlink/file if present
-  try {
-    const stat = fs.lstatSync(dest)
-    if (stat.isSymbolicLink() || stat.isFile()) {
-      fs.unlinkSync(dest)
-    }
-  } catch {
-    // doesn't exist
-  }
+function copyPath(src, dest, { dereference = true } = {}) {
+  fs.rmSync(dest, { recursive: true, force: true })
+  fs.cpSync(src, dest, { recursive: true, dereference })
+}
+
+function symlinkPath(src, dest) {
+  fs.rmSync(dest, { recursive: true, force: true })
   fs.symlinkSync(src, dest)
 }
 
@@ -89,8 +87,9 @@ function runBuild() {
   ensureDir(SWARMCLAW_HOME)
   ensureDir(DATA_DIR)
 
-  // Create symlinks from PKG_ROOT into SWARMCLAW_HOME
-  for (const entry of SYMLINKS) {
+  // Copy source/config into SWARMCLAW_HOME. Turbopack build currently rejects
+  // app source symlinks that point outside the workspace root.
+  for (const entry of BUILD_COPY_ENTRIES) {
     const src = path.join(PKG_ROOT, entry)
     const dest = path.join(SWARMCLAW_HOME, entry)
 
@@ -99,23 +98,33 @@ function runBuild() {
       continue
     }
 
-    symlink(src, dest)
+    copyPath(src, dest)
   }
 
-  // Symlink node_modules
+  // Reuse package dependencies via symlink to avoid multi-GB duplication in
+  // SWARMCLAW_HOME. Build runs with webpack mode for symlink compatibility.
   const nmSrc = path.join(PKG_ROOT, 'node_modules')
   const nmDest = path.join(SWARMCLAW_HOME, 'node_modules')
   if (fs.existsSync(nmSrc)) {
-    symlink(nmSrc, nmDest)
+    symlinkPath(nmSrc, nmDest)
   } else {
     // If node_modules doesn't exist at PKG_ROOT, install
     log('Installing dependencies...')
-    execSync('npm install --omit=dev', { cwd: SWARMCLAW_HOME, stdio: 'inherit' })
+    execSync('npm install', { cwd: SWARMCLAW_HOME, stdio: 'inherit' })
   }
 
   // Run Next.js build
   log('Building Next.js application (this may take a minute)...')
-  execSync('npx next build', { cwd: SWARMCLAW_HOME, stdio: 'inherit' })
+  // Use webpack for production build reliability in packaged/fresh-install
+  // environments (Turbopack has intermittently failed during prerender).
+  execSync('npx next build --webpack', {
+    cwd: SWARMCLAW_HOME,
+    stdio: 'inherit',
+    env: {
+      ...process.env,
+      SWARMCLAW_BUILD_MODE: '1',
+    },
+  })
 
   // Write built marker
   fs.writeFileSync(BUILT_MARKER, JSON.stringify({ builtAt: new Date().toISOString(), version: getVersion() }))

package/next.config.ts

@@ -11,6 +11,11 @@ function getGitSha(): string {
 
 const nextConfig: NextConfig = {
   output: 'standalone',
+  experimental: {
+    // Disable Turbopack persistent cache — concurrent HMR writes cause
+    // "Another write batch or compaction is already active" errors
+    turbopackFileSystemCacheForDev: false,
+  },
   env: {
     NEXT_PUBLIC_GIT_SHA: getGitSha(),
     NEXT_PUBLIC_WS_PORT: String((Number(process.env.PORT) || 3456) + 1),
@@ -30,6 +35,14 @@ const nextConfig: NextConfig = {
     '127.0.0.1',
     '0.0.0.0',
   ],
+  async rewrites() {
+    return [
+      {
+        source: '/:view(agents|schedules|memory|tasks|secrets|providers|skills|connectors|webhooks|mcp-servers|knowledge|plugins|usage|runs|logs|settings|projects)',
+        destination: '/',
+      },
+    ]
+  },
 };
 
 export default nextConfig;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@swarmclawai/swarmclaw",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Self-hosted AI agent orchestration dashboard — manage LLM providers, orchestrate agent swarms, schedule tasks, and bridge agents to chat platforms.",
   "license": "MIT",
   "repository": {
@@ -58,6 +58,7 @@
     "@langchain/core": "^1.1.26",
     "@langchain/langgraph": "^1.1.5",
     "@langchain/openai": "^1.2.8",
+    "@multiavatar/multiavatar": "^1.0.7",
     "@playwright/mcp": "^0.0.68",
     "@slack/bolt": "^4.6.0",
     "@whiskeysockets/baileys": "^7.0.0-rc.9",
@@ -69,6 +70,7 @@
     "cron-parser": "^5.5.0",
     "cronstrue": "^3.12.0",
     "discord.js": "^14.25.1",
+    "exceljs": "^4.4.0",
     "grammy": "^1.40.0",
     "highlight.js": "^11.11.1",
     "lucide-react": "^0.574.0",

package/src/app/api/agents/[id]/route.ts

@@ -1,33 +1,50 @@
 import { NextResponse } from 'next/server'
-import { loadAgents, saveAgents, deleteAgent } from '@/lib/server/storage'
+import { loadAgents, saveAgents, loadSessions, saveSessions } from '@/lib/server/storage'
 import { normalizeProviderEndpoint } from '@/lib/openclaw-endpoint'
-import { notify } from '@/lib/server/ws-hub'
+import { mutateItem, notFound, type CollectionOps } from '@/lib/server/collection-helpers'
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+const ops: CollectionOps<any> = { load: () => loadAgents({ includeTrashed: true }), save: saveAgents, topic: 'agents' }
 
 export async function PUT(req: Request, { params }: { params: Promise<{ id: string }> }) {
   const { id } = await params
   const body = await req.json()
-  const agents = loadAgents()
-  if (!agents[id]) return new NextResponse(null, { status: 404 })
-
-  Object.assign(agents[id], body, { updatedAt: Date.now() })
-  if (body.apiEndpoint !== undefined) {
-    agents[id].apiEndpoint = normalizeProviderEndpoint(
-      body.provider || agents[id].provider,
-      body.apiEndpoint,
-    )
-  }
-  delete (agents[id] as Record<string, unknown>).id // prevent id overwrite
-  agents[id].id = id
-  saveAgents(agents)
-  notify('agents')
-  return NextResponse.json(agents[id])
+  const result = mutateItem(ops, id, (agent) => {
+    Object.assign(agent, body, { updatedAt: Date.now() })
+    if (body.apiEndpoint !== undefined) {
+      agent.apiEndpoint = normalizeProviderEndpoint(
+        body.provider || agent.provider,
+        body.apiEndpoint,
+      )
+    }
+    delete (agent as Record<string, unknown>).id
+    agent.id = id
+    return agent
+  })
+  if (!result) return notFound()
+  return NextResponse.json(result)
 }
 
 export async function DELETE(_req: Request, { params }: { params: Promise<{ id: string }> }) {
   const { id } = await params
-  const agents = loadAgents()
-  if (!agents[id]) return new NextResponse(null, { status: 404 })
-  deleteAgent(id)
-  notify('agents')
-  return NextResponse.json('ok')
+  // Soft delete — set trashedAt instead of removing the record
+  const result = mutateItem(ops, id, (agent) => {
+    agent.trashedAt = Date.now()
+    return agent
+  })
+  if (!result) return notFound()
+
+  // Detach sessions from the trashed agent
+  const sessions = loadSessions()
+  let detachedSessions = 0
+  for (const session of Object.values(sessions) as Array<Record<string, unknown>>) {
+    if (!session || session.agentId !== id) continue
+    session.agentId = null
+    detachedSessions += 1
+  }
+  if (detachedSessions > 0) {
+    saveSessions(sessions)
+  }
+
+  return NextResponse.json({ ok: true, detachedSessions })
 }

package/src/app/api/agents/[id]/thread/route.ts

@@ -1,5 +1,5 @@
 import { NextResponse } from 'next/server'
-import crypto from 'crypto'
+import { genId } from '@/lib/id'
 import { loadAgents, saveAgents, loadSessions, saveSessions } from '@/lib/server/storage'
 import { WORKSPACE_DIR } from '@/lib/server/data-dir'
 
@@ -32,7 +32,7 @@ export async function POST(req: Request, { params }: { params: Promise<{ id: str
   }
 
   // Create a new thread session
-  const sessionId = `agent-thread-${agentId}-${crypto.randomBytes(4).toString('hex')}`
+  const sessionId = `agent-thread-${agentId}-${genId()}`
   const now = Date.now()
   const session = {
     id: sessionId,

package/src/app/api/agents/route.ts

@@ -1,5 +1,5 @@
 import { NextResponse } from 'next/server'
-import crypto from 'crypto'
+import { genId } from '@/lib/id'
 import { loadAgents, saveAgents } from '@/lib/server/storage'
 import { normalizeProviderEndpoint } from '@/lib/openclaw-endpoint'
 import { notify } from '@/lib/server/ws-hub'
@@ -12,7 +12,7 @@ export async function GET(_req: Request) {
 
 export async function POST(req: Request) {
   const body = await req.json()
-  const id = crypto.randomBytes(4).toString('hex')
+  const id = genId()
   const now = Date.now()
   const agents = loadAgents()
   agents[id] = {
@@ -28,6 +28,7 @@ export async function POST(req: Request) {
     subAgentIds: body.subAgentIds || [],
     tools: body.tools || [],
     capabilities: body.capabilities || [],
+    thinkingLevel: body.thinkingLevel || undefined,
     createdAt: now,
     updatedAt: now,
   }

package/src/app/api/agents/trash/route.ts

@@ -0,0 +1,44 @@
+import { NextResponse } from 'next/server'
+import { loadTrashedAgents, loadAgents, saveAgents, deleteAgent } from '@/lib/server/storage'
+import { notify } from '@/lib/server/ws-hub'
+import { badRequest, notFound } from '@/lib/server/collection-helpers'
+
+/** GET — list trashed agents */
+export async function GET() {
+  return NextResponse.json(loadTrashedAgents())
+}
+
+/** POST { id } — restore a trashed agent */
+export async function POST(req: Request) {
+  const body = await req.json()
+  const id = body?.id as string | undefined
+  if (!id) return badRequest('Missing agent id')
+
+  const all = loadAgents({ includeTrashed: true })
+  const agent = all[id]
+  if (!agent) return notFound()
+  if (!agent.trashedAt) return badRequest('Agent is not trashed')
+
+  delete agent.trashedAt
+  agent.updatedAt = Date.now()
+  all[id] = agent
+  saveAgents(all)
+  notify('agents')
+  return NextResponse.json(agent)
+}
+
+/** DELETE { id } — permanently delete a trashed agent */
+export async function DELETE(req: Request) {
+  const body = await req.json()
+  const id = body?.id as string | undefined
+  if (!id) return badRequest('Missing agent id')
+
+  const all = loadAgents({ includeTrashed: true })
+  const agent = all[id]
+  if (!agent) return notFound()
+  if (!agent.trashedAt) return badRequest('Agent must be trashed before permanent deletion')
+
+  deleteAgent(id)
+  notify('agents')
+  return NextResponse.json({ ok: true })
+}

package/src/app/api/clawhub/install/route.ts

@@ -1,5 +1,5 @@
 import { NextResponse } from 'next/server'
-import crypto from 'crypto'
+import { genId } from '@/lib/id'
 import { loadSkills, saveSkills } from '@/lib/server/storage'
 import { fetchSkillContent } from '@/lib/server/clawhub-client'
 
@@ -20,7 +20,7 @@ export async function POST(req: Request) {
   }
 
   const skills = loadSkills()
-  const id = crypto.randomBytes(4).toString('hex')
+  const id = genId()
   skills[id] = {
     id,
     name,

package/src/app/api/connectors/[id]/route.ts

@@ -1,21 +1,25 @@
 import { NextResponse } from 'next/server'
 import { loadConnectors, saveConnectors } from '@/lib/server/storage'
 import { notify } from '@/lib/server/ws-hub'
+import { notFound } from '@/lib/server/collection-helpers'
 
 export async function GET(_req: Request, { params }: { params: Promise<{ id: string }> }) {
   const { id } = await params
   const connectors = loadConnectors()
   const connector = connectors[id]
-  if (!connector) return NextResponse.json({ error: 'Not found' }, { status: 404 })
+  if (!connector) return notFound()
 
-  // Merge runtime status and QR code
+  // Merge runtime status, QR code, and presence
   try {
-    const { getConnectorStatus, getConnectorQR, isConnectorAuthenticated, hasConnectorCredentials } = await import('@/lib/server/connectors/manager')
+    const { getConnectorStatus, getConnectorQR, isConnectorAuthenticated, hasConnectorCredentials, getConnectorPresence } = await import('@/lib/server/connectors/manager')
     connector.status = getConnectorStatus(id)
     const qr = getConnectorQR(id)
     if (qr) connector.qrDataUrl = qr
     connector.authenticated = isConnectorAuthenticated(id)
     connector.hasCredentials = hasConnectorCredentials(id)
+    if (connector.status === 'running') {
+      connector.presence = getConnectorPresence(id)
+    }
   } catch { /* ignore */ }
 
   return NextResponse.json(connector)
@@ -26,7 +30,7 @@ export async function PUT(req: Request, { params }: { params: Promise<{ id: stri
   const body = await req.json()
   const connectors = loadConnectors()
   const connector = connectors[id]
-  if (!connector) return NextResponse.json({ error: 'Not found' }, { status: 404 })
+  if (!connector) return notFound()
 
   // Handle start/stop/repair actions — these modify connector state internally,
   // so re-read from storage after to avoid overwriting with stale data
@@ -40,10 +44,10 @@ export async function PUT(req: Request, { params }: { params: Promise<{ id: stri
       } else {
         await manager.repairConnector(id)
       }
-    } catch (err: any) {
+    } catch (err: unknown) {
       // Re-read to get the error state saved by startConnector
       const fresh = loadConnectors()
-      return NextResponse.json(fresh[id] || { error: err.message }, { status: 500 })
+      return NextResponse.json(fresh[id] || { error: err instanceof Error ? err.message : String(err) }, { status: 500 })
     }
     // Re-read the connector after manager modified it
     const fresh = loadConnectors()
@@ -68,7 +72,7 @@ export async function PUT(req: Request, { params }: { params: Promise<{ id: stri
 export async function DELETE(_req: Request, { params }: { params: Promise<{ id: string }> }) {
   const { id } = await params
   const connectors = loadConnectors()
-  if (!connectors[id]) return NextResponse.json({ error: 'Not found' }, { status: 404 })
+  if (!connectors[id]) return notFound()
 
   // Stop if running
   try {
@@ -76,6 +80,12 @@ export async function DELETE(_req: Request, { params }: { params: Promise<{ id:
     await stopConnector(id)
   } catch { /* ignore */ }
 
+  // Clear persisted pairing state when connector is deleted.
+  try {
+    const { clearConnectorPairingState } = await import('@/lib/server/connectors/pairing')
+    clearConnectorPairingState(id)
+  } catch { /* ignore */ }
+
   delete connectors[id]
   saveConnectors(connectors)
   notify('connectors')

package/src/app/api/connectors/[id]/webhook/route.ts

@@ -0,0 +1,103 @@
+import { NextResponse } from 'next/server'
+import { loadConnectors } from '@/lib/server/storage'
+
+export const dynamic = 'force-dynamic'
+
+function readSecret(req: Request): string {
+  const url = new URL(req.url)
+  return (
+    req.headers.get('x-connector-secret')
+    || url.searchParams.get('secret')
+    || ''
+  ).trim()
+}
+
+function parseWebhookBody(rawBody: string): Record<string, unknown> {
+  const trimmed = rawBody.trim()
+  if (!trimmed) return {}
+
+  try {
+    const parsed = JSON.parse(trimmed)
+    if (Array.isArray(parsed)) return { data: parsed }
+    return parsed && typeof parsed === 'object' ? parsed as Record<string, unknown> : {}
+  } catch {
+    // Fall back to URL-encoded payloads used by some webhook providers.
+    const params = new URLSearchParams(rawBody)
+    const nested = params.get('payload') || params.get('data') || params.get('message') || ''
+    if (nested) {
+      try {
+        const parsedNested = JSON.parse(nested)
+        if (Array.isArray(parsedNested)) return { data: parsedNested }
+        return parsedNested && typeof parsedNested === 'object'
+          ? parsedNested as Record<string, unknown>
+          : {}
+      } catch {
+        // Ignore malformed nested JSON and return flat map below.
+      }
+    }
+    const out: Record<string, unknown> = {}
+    for (const [key, value] of params.entries()) out[key] = value
+    return out
+  }
+}
+
+export async function POST(req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params
+  const connectors = loadConnectors()
+  const connector = connectors[id]
+  if (!connector) return NextResponse.json({ error: 'Connector not found' }, { status: 404 })
+
+  const requiredSecret = String(connector.config?.webhookSecret || '').trim()
+  if (requiredSecret && readSecret(req) !== requiredSecret) {
+    return NextResponse.json({ error: 'Invalid connector webhook secret' }, { status: 401 })
+  }
+
+  const rawBody = await req.text().catch(() => '')
+  const payload = parseWebhookBody(rawBody)
+
+  try {
+    if (connector.platform === 'teams') {
+      const handlerKey = `__swarmclaw_teams_handler_${connector.id}__`
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- dynamic globalThis handler registered at runtime by connector
+      const handler = (globalThis as any)[handlerKey]
+      if (typeof handler !== 'function') {
+        return NextResponse.json({ error: 'Teams connector is not running or not ready' }, { status: 409 })
+      }
+      await handler(payload)
+      return NextResponse.json({ ok: true })
+    }
+
+    if (connector.platform === 'googlechat') {
+      const handlerKey = `__swarmclaw_googlechat_handler_${connector.id}__`
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- dynamic globalThis handler registered at runtime by connector
+      const handler = (globalThis as any)[handlerKey]
+      if (typeof handler !== 'function') {
+        return NextResponse.json({ error: 'Google Chat connector is not running or not ready' }, { status: 409 })
+      }
+      const result = await handler(payload)
+      if (result && typeof result === 'object' && Object.keys(result).length > 0) {
+        return NextResponse.json(result)
+      }
+      return NextResponse.json({})
+    }
+
+    if (connector.platform === 'bluebubbles') {
+      const handlerKey = `__swarmclaw_bluebubbles_handler_${connector.id}__`
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- dynamic globalThis handler registered at runtime by connector
+      const handler = (globalThis as any)[handlerKey]
+      if (typeof handler !== 'function') {
+        return NextResponse.json({ error: 'BlueBubbles connector is not running or not ready' }, { status: 409 })
+      }
+      const result = await handler(payload)
+      if (result && typeof result === 'object' && Object.keys(result).length > 0) {
+        return NextResponse.json(result)
+      }
+      return NextResponse.json({})
+    }
+
+    return NextResponse.json({ error: `Platform "${connector.platform}" does not support connector webhook ingress.` }, { status: 400 })
+  } catch (err: unknown) {
+    const message = err instanceof Error ? err.message : 'Webhook processing failed'
+    return NextResponse.json({ error: message }, { status: 500 })
+  }
+}

package/src/app/api/connectors/route.ts

@@ -1,5 +1,5 @@
 import { NextResponse } from 'next/server'
-import crypto from 'crypto'
+import { genId } from '@/lib/id'
 import { loadConnectors, saveConnectors } from '@/lib/server/storage'
 import { notify } from '@/lib/server/ws-hub'
 import type { Connector } from '@/types'
@@ -27,7 +27,7 @@ export async function GET(_req: Request) {
 export async function POST(req: Request) {
   const body = await req.json()
   const connectors = loadConnectors()
-  const id = crypto.randomBytes(4).toString('hex')
+  const id = genId()
 
   const connector: Connector = {
     id,
@@ -48,7 +48,10 @@ export async function POST(req: Request) {
   notify('connectors')
 
   // Auto-start if connector has credentials (or is WhatsApp which uses QR)
-  const hasCredentials = connector.platform === 'whatsapp' || connector.platform === 'openclaw' || !!connector.credentialId
+  const hasCredentials = connector.platform === 'whatsapp'
+    || connector.platform === 'openclaw'
+    || (connector.platform === 'bluebubbles' && (!!connector.credentialId || !!connector.config.password))
+    || !!connector.credentialId
   if (hasCredentials && body.autoStart !== false) {
     try {
       const { startConnector } = await import('@/lib/server/connectors/manager')

package/src/app/api/credentials/[id]/route.ts

@@ -1,11 +1,12 @@
 import { NextResponse } from 'next/server'
 import { loadCredentials, saveCredentials } from '@/lib/server/storage'
+import { notFound } from '@/lib/server/collection-helpers'
 
 export async function DELETE(_req: Request, { params }: { params: Promise<{ id: string }> }) {
   const { id: credId } = await params
   const creds = loadCredentials()
   if (!creds[credId]) {
-    return new NextResponse(null, { status: 404 })
+    return notFound()
   }
   delete creds[credId]
   saveCredentials(creds)

package/src/app/api/credentials/route.ts

@@ -1,5 +1,5 @@
 import { NextResponse } from 'next/server'
-import crypto from 'crypto'
+import { genId } from '@/lib/id'
 import { loadCredentials, saveCredentials, encryptKey } from '@/lib/server/storage'
 export const dynamic = 'force-dynamic'
 
@@ -18,7 +18,7 @@ export async function POST(req: Request) {
   if (!provider || !apiKey) {
     return NextResponse.json({ error: 'provider and apiKey are required' }, { status: 400 })
   }
-  const id = 'cred_' + crypto.randomBytes(6).toString('hex')
+  const id = 'cred_' + genId(6)
   const creds = loadCredentials()
   creds[id] = {
     id,

package/src/app/api/documents/route.ts

@@ -1,4 +1,4 @@
-import crypto from 'crypto'
+import { genId } from '@/lib/id'
 import { NextResponse } from 'next/server'
 import { loadDocuments, saveDocuments } from '@/lib/server/storage'
 
@@ -69,7 +69,7 @@ export async function POST(req: Request) {
   const body = await req.json().catch(() => ({}))
   const now = Date.now()
   const docs = loadDocuments()
-  const id = body.id || crypto.randomBytes(6).toString('hex')
+  const id = body.id || genId(6)
   const fileName = body.fileName || body.filename || ''
   const title = body.title || fileName || 'Untitled Document'
   const content = typeof body.content === 'string' ? body.content : ''

package/src/app/api/files/serve/route.ts

@@ -21,6 +21,14 @@ const MIME_MAP: Record<string, string> = {
   '.jsx': 'text/plain',
   '.py': 'text/plain',
   '.sh': 'text/plain',
+  '.pdf': 'application/pdf',
+  '.csv': 'text/csv',
+  '.xml': 'application/xml',
+  '.zip': 'application/zip',
+  '.doc': 'application/msword',
+  '.docx': 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+  '.xls': 'application/vnd.ms-excel',
+  '.xlsx': 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
 }
 
 const MAX_SIZE = 10 * 1024 * 1024 // 10MB