@swarmclawai/swarmclaw 0.7.2 → 0.7.3

package/src/lib/server/ws-hub.ts

@@ -1,6 +1,7 @@
 import { WebSocketServer, WebSocket } from 'ws'
 import type { IncomingMessage } from 'http'
 import { validateAccessKey } from './storage'
+import { AUTH_COOKIE_NAME, getCookieValue } from '@/lib/auth'
 
 interface WsClient {
   ws: WebSocket
@@ -29,9 +30,10 @@ export function initWsServer() {
   ;(globalThis as any)[GK] = hub
 
   wss.on('connection', (ws: WebSocket, req: IncomingMessage) => {
-    // Auth: validate ?key= from upgrade URL
-    const url = new URL(req.url || '/', `http://${req.headers.host || 'localhost'}`)
-    const key = url.searchParams.get('key') || ''
+    const headerKey = req.headers['x-access-key']
+    const key = (Array.isArray(headerKey) ? headerKey[0] : headerKey)
+      || getCookieValue(req.headers.cookie, AUTH_COOKIE_NAME)
+      || ''
     if (!validateAccessKey(key)) {
       ws.close(4001, 'Unauthorized')
       return

package/src/lib/validation/schemas.test.ts

@@ -0,0 +1,26 @@
+import { describe, it } from 'node:test'
+import assert from 'node:assert/strict'
+import { AgentCreateSchema } from './schemas'
+
+describe('AgentCreateSchema', () => {
+  it('defaults platformAssignScope to self', () => {
+    const parsed = AgentCreateSchema.parse({
+      name: 'Solo Agent',
+      provider: 'openai',
+    })
+
+    assert.equal(parsed.platformAssignScope, 'self')
+  })
+
+  it('accepts explicit all-scope delegation without relying on legacy orchestrator flags', () => {
+    const parsed = AgentCreateSchema.parse({
+      name: 'Coordinator',
+      provider: 'openai',
+      platformAssignScope: 'all',
+      isOrchestrator: false,
+    })
+
+    assert.equal(parsed.platformAssignScope, 'all')
+    assert.equal(parsed.isOrchestrator, false)
+  })
+})

package/src/lib/validation/schemas.ts

@@ -9,6 +9,7 @@ export const AgentCreateSchema = z.object({
   credentialId: z.string().nullable().optional().default(null),
   apiEndpoint: z.string().nullable().optional().default(null),
   isOrchestrator: z.boolean().optional().default(false),
+  platformAssignScope: z.enum(['self', 'all']).optional().default('self'),
   subAgentIds: z.array(z.string()).optional().default([]),
   plugins: z.array(z.string()).optional().default([]),
   /** @deprecated Use plugins */
@@ -16,6 +17,12 @@ export const AgentCreateSchema = z.object({
   capabilities: z.array(z.string()).optional().default([]),
   thinkingLevel: z.string().optional(),
   soul: z.string().optional(),
+  identityState: z.record(z.string(), z.unknown()).nullable().optional().default(null),
+  sessionResetMode: z.enum(['idle', 'daily']).nullable().optional().default(null),
+  sessionIdleTimeoutSec: z.number().int().nonnegative().nullable().optional().default(null),
+  sessionMaxAgeSec: z.number().int().nonnegative().nullable().optional().default(null),
+  sessionDailyResetAt: z.string().nullable().optional().default(null),
+  sessionResetTimezone: z.string().nullable().optional().default(null),
   autoRecovery: z.boolean().optional().default(false),
   monthlyBudget: z.number().positive().nullable().optional().default(null),
   dailyBudget: z.number().positive().nullable().optional().default(null),

package/src/lib/ws-client.ts

@@ -1,15 +1,15 @@
 type WsCallback = () => void
 
 let ws: WebSocket | null = null
-let accessKey = ''
+let wsEnabled = false
 let reconnectTimer: ReturnType<typeof setTimeout> | null = null
 let reconnectDelay = 1000
 const MAX_RECONNECT_DELAY = 30_000
 const listeners = new Map<string, Set<WsCallback>>()
 let connected = false
 
-function getWsUrl(key: string): string {
-  if (typeof window === 'undefined') return `ws://localhost:3457/ws?key=${encodeURIComponent(key)}`
+function getWsUrl(): string {
+  if (typeof window === 'undefined') return 'ws://localhost:3457/ws'
 
   const protocol = window.location.protocol === 'https:' ? 'wss' : 'ws'
   const pagePort = window.location.port
@@ -22,7 +22,7 @@ function getWsUrl(key: string): string {
   const behindProxy = !pagePort || pagePort === '80' || pagePort === '443' || pagePort !== appPort
   const wsHost = behindProxy ? window.location.host : `${window.location.hostname}:${buildPort}`
 
-  return `${protocol}://${wsHost}/ws?key=${encodeURIComponent(key)}`
+  return `${protocol}://${wsHost}/ws`
 }
 
 function handleMessage(event: MessageEvent) {
@@ -44,17 +44,18 @@ function scheduleReconnect() {
   const jitter = Math.random() * 2000
   reconnectTimer = setTimeout(() => {
     reconnectTimer = null
-    if (!accessKey) return
-    connect(accessKey)
+    if (!wsEnabled) return
+    connect()
   }, reconnectDelay + jitter)
   reconnectDelay = Math.min(reconnectDelay * 2, MAX_RECONNECT_DELAY)
 }
 
-function connect(key: string) {
+function connect() {
+  if (!wsEnabled) return
   if (ws && (ws.readyState === WebSocket.OPEN || ws.readyState === WebSocket.CONNECTING)) return
 
   try {
-    ws = new WebSocket(getWsUrl(key))
+    ws = new WebSocket(getWsUrl())
   } catch {
     scheduleReconnect()
     return
@@ -75,7 +76,7 @@ function connect(key: string) {
   ws.onclose = () => {
     connected = false
     ws = null
-    if (accessKey) scheduleReconnect()
+    if (wsEnabled) scheduleReconnect()
   }
 
   ws.onerror = () => {
@@ -84,13 +85,14 @@ function connect(key: string) {
 }
 
 export function connectWs(key: string) {
-  accessKey = key
+  void key
+  wsEnabled = true
   reconnectDelay = 1000
-  connect(key)
+  connect()
 }
 
 export function disconnectWs() {
-  accessKey = ''
+  wsEnabled = false
   if (reconnectTimer) {
     clearTimeout(reconnectTimer)
     reconnectTimer = null

package/src/proxy.ts

@@ -1,5 +1,6 @@
 import { NextResponse } from 'next/server'
 import type { NextRequest } from 'next/server'
+import { AUTH_COOKIE_NAME } from '@/lib/auth'
 
 /* ------------------------------------------------------------------ */
 /*  Rate-limit state — HMR-safe via globalThis                        */
@@ -44,7 +45,7 @@ function getClientIp(request: NextRequest): string {
 /* ------------------------------------------------------------------ */
 
 /** Access key auth proxy with brute-force rate limiting.
- *  Checks X-Access-Key header or ?key= param on all /api/ routes except /api/auth.
+ *  Checks X-Access-Key header or auth cookie on all /api/ routes except /api/auth.
  *  The key is validated against the ACCESS_KEY env var.
  *  After 5 failed attempts from a single IP the client is locked out for 15 minutes.
  */
@@ -55,11 +56,10 @@ export function proxy(request: NextRequest) {
   const isConnectorWebhook = request.method === 'POST'
     && /^\/api\/connectors\/[^/]+\/webhook\/?$/.test(pathname)
 
-  // Only protect API routes (not auth, uploads served as static assets, or inbound webhooks)
+  // Only protect API routes (not auth or inbound webhooks)
   if (
     !pathname.startsWith('/api/')
     || pathname === '/api/auth'
-    || pathname.startsWith('/api/uploads/')
     || isWebhookTrigger
     || isConnectorWebhook
   ) {
@@ -88,8 +88,8 @@ export function proxy(request: NextRequest) {
   }
 
   const providedKey =
-    request.headers.get('x-access-key')
-    || request.nextUrl.searchParams.get('key')
+    request.headers.get('x-access-key')?.trim()
+    || request.cookies.get(AUTH_COOKIE_NAME)?.value?.trim()
     || ''
 
   if (providedKey !== accessKey) {

package/src/stores/use-app-store.ts

@@ -43,9 +43,6 @@ interface AppState {
   settingsOpen: boolean
   setSettingsOpen: (open: boolean) => void
 
-  newSessionOpen: boolean
-  setNewSessionOpen: (open: boolean) => void
-
   activeView: AppView
   setActiveView: (view: AppView) => void
 
@@ -325,9 +322,6 @@ export const useAppStore = create<AppState>((set, get) => ({
   settingsOpen: false,
   setSettingsOpen: (open) => set({ settingsOpen: open }),
 
-  newSessionOpen: false,
-  setNewSessionOpen: (open) => set({ newSessionOpen: open }),
-
   activeView: 'home',
   setActiveView: (view) => set({ activeView: view }),
 

package/src/stores/use-chat-store.ts

@@ -3,6 +3,7 @@
 import { create } from 'zustand'
 import type { Message, DevServerStatus, SSEEvent, ChatTraceBlock } from '../types'
 import { streamChat } from '../lib/chat'
+import { mergeCompletedAssistantMessage } from '../lib/chat-streaming-state'
 import { speak } from '../lib/tts'
 import { getStoredAccessKey } from '../lib/api-client'
 import { useAppStore } from './use-app-store'
@@ -306,6 +307,11 @@ export const useChatStore = create<ChatState>((set, get) => ({
       } else if (event.t === 'tool_call') {
         const id = `tc-${++toolCallCounter}`
         set((s) => ({
+          ...(s.toolEvents[s.toolEvents.length - 1]?.name === (event.toolName || 'unknown')
+            && s.toolEvents[s.toolEvents.length - 1]?.input === (event.toolInput || '')
+            && s.toolEvents[s.toolEvents.length - 1]?.status === 'running'
+              ? {}
+              : {
           streamPhase: 'tool' as const,
           streamToolName: event.toolName || 'unknown',
           toolEvents: [...s.toolEvents, {
@@ -314,6 +320,7 @@ export const useChatStore = create<ChatState>((set, get) => ({
             input: event.toolInput || '',
             status: 'running',
           }],
+              }),
         }))
       } else if (event.t === 'tool_result') {
         const soundOn = get().soundEnabled
@@ -322,6 +329,22 @@ export const useChatStore = create<ChatState>((set, get) => ({
           const idx = events.findLastIndex(
             (e) => e.name === event.toolName && e.status === 'running',
           )
+          if (idx === -1) {
+            const last = events[events.length - 1]
+            const output = event.toolOutput || ''
+            const isError = /^(Error:|error:|ECONNREFUSED|ETIMEDOUT|timeout|failed)/i.test(output.trim())
+              || output.includes('ECONNREFUSED')
+              || output.includes('ETIMEDOUT')
+              || output.includes('Error:')
+            if (
+              last
+              && last.name === event.toolName
+              && last.output === output
+              && last.status === (isError ? 'error' : 'done')
+            ) {
+              return { toolEvents: events }
+            }
+          }
           if (idx !== -1) {
             const output = event.toolOutput || ''
             const isError = /^(Error:|error:|ECONNREFUSED|ETIMEDOUT|timeout|failed)/i.test(output.trim())
@@ -348,7 +371,13 @@ export const useChatStore = create<ChatState>((set, get) => ({
       } else if (event.t === 'status') {
         try {
           const parsed = JSON.parse(event.text || '{}')
-          set({ agentStatus: parsed })
+          if (
+            parsed
+            && typeof parsed === 'object'
+            && ['goal', 'status', 'summary', 'nextAction'].some((key) => key in parsed)
+          ) {
+            set({ agentStatus: parsed })
+          }
         } catch {
           // ignore malformed status
         }
@@ -377,7 +406,7 @@ export const useChatStore = create<ChatState>((set, get) => ({
         suggestions: suggestions || undefined,
       }
       set((s) => ({
-        messages: [...s.messages, assistantMsg],
+        messages: mergeCompletedAssistantMessage(s.messages, assistantMsg),
         streaming: false,
         streamingSessionId: null,
         streamText: '',