@swarmclawai/swarmclaw 1.5.3 → 1.5.33

package/src/lib/server/storage-auth-docker.test.ts

@@ -0,0 +1,244 @@
+import assert from 'node:assert/strict'
+import { describe, it, beforeEach, afterEach } from 'node:test'
+import fs from 'node:fs'
+import path from 'node:path'
+import os from 'node:os'
+
+/**
+ * End-to-end simulation of the Docker key persistence fix.
+ *
+ * Simulates a Docker container lifecycle where:
+ * 1. .env.local is NOT writable (baked into the image, not volume-mounted)
+ * 2. DATA_DIR IS writable (volume-mounted at ./data:/app/data)
+ * 3. Keys should persist across container restarts via DATA_DIR/.env.generated
+ */
+
+// Replicate the core logic from storage-auth.ts
+function loadEnvFile(filePath: string, env: Record<string, string>): void {
+  if (!fs.existsSync(filePath)) return
+  fs.readFileSync(filePath, 'utf8').split(/\r?\n/).forEach(line => {
+    const [k, ...v] = line.split('=')
+    if (k && v.length) env[k.trim()] = v.join('=').trim()
+  })
+}
+
+function appendEnvKeyIfMissing(envPath: string, key: string, value: string): void {
+  const existing = fs.existsSync(envPath) ? fs.readFileSync(envPath, 'utf8') : ''
+  const keyPattern = new RegExp(`^${key}=`, 'm')
+  if (keyPattern.test(existing)) return
+  fs.appendFileSync(envPath, `\n${key}=${value}\n`)
+}
+
+function persistEnvKey(
+  key: string,
+  value: string,
+  envLocalPath: string,
+  generatedEnvPath: string,
+): boolean {
+  try {
+    appendEnvKeyIfMissing(envLocalPath, key, value)
+    return true
+  } catch {
+    // .env.local not writable
+  }
+  try {
+    fs.mkdirSync(path.dirname(generatedEnvPath), { recursive: true })
+    appendEnvKeyIfMissing(generatedEnvPath, key, value)
+    return true
+  } catch {
+    return false
+  }
+}
+
+/** Simulate a complete container lifecycle: boot, generate keys, restart, verify keys persist. */
+function simulateContainerBoot(
+  envLocalPath: string,
+  generatedEnvPath: string,
+): { accessKey: string; credentialSecret: string } {
+  const env: Record<string, string> = {}
+
+  // Step 1: loadEnv — read both locations
+  loadEnvFile(envLocalPath, env)
+  loadEnvFile(generatedEnvPath, env)
+
+  // Step 2: auto-generate if missing
+  if (!env.CREDENTIAL_SECRET) {
+    const secret = 'test-secret-' + Date.now()
+    env.CREDENTIAL_SECRET = secret
+    persistEnvKey('CREDENTIAL_SECRET', secret, envLocalPath, generatedEnvPath)
+  }
+  if (!env.ACCESS_KEY) {
+    const key = 'test-key-' + Date.now()
+    env.ACCESS_KEY = key
+    persistEnvKey('ACCESS_KEY', key, envLocalPath, generatedEnvPath)
+  }
+
+  return { accessKey: env.ACCESS_KEY, credentialSecret: env.CREDENTIAL_SECRET }
+}
+
+describe('Docker container key persistence (end-to-end simulation)', () => {
+  let tmpDir: string
+  let dataDir: string
+  let readOnlyDir: string
+  let envLocalPath: string
+  let generatedEnvPath: string
+
+  beforeEach(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'docker-sim-'))
+    // Simulate Docker: data dir is writable (volume-mounted)
+    dataDir = path.join(tmpDir, 'data')
+    fs.mkdirSync(dataDir, { recursive: true })
+    generatedEnvPath = path.join(dataDir, '.env.generated')
+
+    // Simulate Docker: .env.local dir is NOT writable (inside container image)
+    readOnlyDir = path.join(tmpDir, 'readonly')
+    fs.mkdirSync(readOnlyDir, { recursive: true })
+    envLocalPath = path.join(readOnlyDir, '.env.local')
+    // Make the directory read-only to simulate Docker container filesystem
+    fs.chmodSync(readOnlyDir, 0o555)
+  })
+
+  afterEach(() => {
+    // Restore permissions before cleanup
+    try { fs.chmodSync(readOnlyDir, 0o755) } catch { /* ok */ }
+    fs.rmSync(tmpDir, { recursive: true, force: true })
+  })
+
+  it('first boot generates keys and persists to data dir fallback', () => {
+    const boot1 = simulateContainerBoot(envLocalPath, generatedEnvPath)
+
+    assert.ok(boot1.accessKey, 'ACCESS_KEY should be generated')
+    assert.ok(boot1.credentialSecret, 'CREDENTIAL_SECRET should be generated')
+    assert.ok(fs.existsSync(generatedEnvPath), '.env.generated should exist in data dir')
+
+    const content = fs.readFileSync(generatedEnvPath, 'utf8')
+    assert.ok(content.includes('ACCESS_KEY='), 'ACCESS_KEY should be in .env.generated')
+    assert.ok(content.includes('CREDENTIAL_SECRET='), 'CREDENTIAL_SECRET should be in .env.generated')
+  })
+
+  it('keys survive container restart (same data dir)', () => {
+    // First boot
+    const boot1 = simulateContainerBoot(envLocalPath, generatedEnvPath)
+
+    // Simulate container restart: keys from .env.generated should be reloaded
+    const boot2 = simulateContainerBoot(envLocalPath, generatedEnvPath)
+
+    assert.equal(boot2.accessKey, boot1.accessKey, 'ACCESS_KEY should persist across restart')
+    assert.equal(boot2.credentialSecret, boot1.credentialSecret, 'CREDENTIAL_SECRET should persist across restart')
+  })
+
+  it('three consecutive restarts all return the same keys', () => {
+    const boot1 = simulateContainerBoot(envLocalPath, generatedEnvPath)
+    const boot2 = simulateContainerBoot(envLocalPath, generatedEnvPath)
+    const boot3 = simulateContainerBoot(envLocalPath, generatedEnvPath)
+
+    assert.equal(boot1.accessKey, boot2.accessKey)
+    assert.equal(boot2.accessKey, boot3.accessKey)
+    assert.equal(boot1.credentialSecret, boot2.credentialSecret)
+    assert.equal(boot2.credentialSecret, boot3.credentialSecret)
+  })
+
+  it('.env.local is never written when read-only', () => {
+    simulateContainerBoot(envLocalPath, generatedEnvPath)
+
+    assert.ok(!fs.existsSync(envLocalPath), '.env.local should NOT be created in read-only dir')
+  })
+})
+
+describe('Local dev key persistence (writable .env.local)', () => {
+  let tmpDir: string
+  let dataDir: string
+  let envLocalPath: string
+  let generatedEnvPath: string
+
+  beforeEach(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'local-dev-sim-'))
+    dataDir = path.join(tmpDir, 'data')
+    fs.mkdirSync(dataDir, { recursive: true })
+    generatedEnvPath = path.join(dataDir, '.env.generated')
+    envLocalPath = path.join(tmpDir, '.env.local')
+  })
+
+  afterEach(() => {
+    fs.rmSync(tmpDir, { recursive: true, force: true })
+  })
+
+  it('writes keys to .env.local when writable (local dev mode)', () => {
+    const boot = simulateContainerBoot(envLocalPath, generatedEnvPath)
+
+    assert.ok(boot.accessKey)
+    assert.ok(fs.existsSync(envLocalPath), '.env.local should be created')
+    const content = fs.readFileSync(envLocalPath, 'utf8')
+    assert.ok(content.includes('ACCESS_KEY='), 'ACCESS_KEY should be in .env.local')
+  })
+
+  it('does not create .env.generated when .env.local is writable', () => {
+    simulateContainerBoot(envLocalPath, generatedEnvPath)
+
+    assert.ok(!fs.existsSync(generatedEnvPath), '.env.generated should NOT be created when .env.local works')
+  })
+
+  it('pre-existing .env.local keys are preserved', () => {
+    fs.writeFileSync(envLocalPath, 'ACCESS_KEY=preset-key\nCREDENTIAL_SECRET=preset-secret\n')
+
+    const boot = simulateContainerBoot(envLocalPath, generatedEnvPath)
+
+    assert.equal(boot.accessKey, 'preset-key', 'pre-existing ACCESS_KEY should be loaded')
+    assert.equal(boot.credentialSecret, 'preset-secret', 'pre-existing CREDENTIAL_SECRET should be loaded')
+  })
+
+  it('.env.local takes precedence over .env.generated when both exist', () => {
+    // Simulate: .env.generated has old auto-generated keys
+    fs.writeFileSync(generatedEnvPath, 'ACCESS_KEY=auto-old\nCREDENTIAL_SECRET=auto-old-secret\n')
+    // User creates .env.local with their own custom keys
+    fs.writeFileSync(envLocalPath, 'ACCESS_KEY=user-custom\nCREDENTIAL_SECRET=user-custom-secret\n')
+
+    const env: Record<string, string> = {}
+    // Load order must match storage-auth.ts: .env.generated first, then .env.local
+    loadEnvFile(generatedEnvPath, env)
+    loadEnvFile(envLocalPath, env)
+
+    assert.equal(env.ACCESS_KEY, 'user-custom', '.env.local should override .env.generated')
+    assert.equal(env.CREDENTIAL_SECRET, 'user-custom-secret', '.env.local should override .env.generated')
+  })
+})
+
+describe('Windows line endings in .env files', () => {
+  let tmpDir: string
+
+  beforeEach(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'crlf-test-'))
+  })
+
+  afterEach(() => {
+    fs.rmSync(tmpDir, { recursive: true, force: true })
+  })
+
+  it('parses .env.local with CRLF endings correctly', () => {
+    const envPath = path.join(tmpDir, '.env.local')
+    // Write with Windows-style line endings
+    fs.writeFileSync(envPath, 'ACCESS_KEY=win-key-123\r\nCREDENTIAL_SECRET=win-secret-456\r\n')
+
+    const env: Record<string, string> = {}
+    loadEnvFile(envPath, env)
+
+    assert.equal(env.ACCESS_KEY, 'win-key-123', 'No trailing \\r on ACCESS_KEY')
+    assert.equal(env.CREDENTIAL_SECRET, 'win-secret-456', 'No trailing \\r on CREDENTIAL_SECRET')
+
+    // Double-check no \r characters
+    assert.ok(!env.ACCESS_KEY.includes('\r'))
+    assert.ok(!env.CREDENTIAL_SECRET.includes('\r'))
+  })
+
+  it('key from CRLF file matches expected value for auth validation', () => {
+    const envPath = path.join(tmpDir, '.env.local')
+    fs.writeFileSync(envPath, 'ACCESS_KEY=test-auth-key\r\n')
+
+    const env: Record<string, string> = {}
+    loadEnvFile(envPath, env)
+
+    // Simulate validateAccessKey logic
+    const userInput = 'test-auth-key'
+    assert.equal(env.ACCESS_KEY, userInput, 'Key from CRLF file should match user input exactly')
+  })
+})

package/src/lib/server/storage-auth.test.ts

@@ -0,0 +1,150 @@
+import assert from 'node:assert/strict'
+import { describe, it, beforeEach, afterEach } from 'node:test'
+import fs from 'node:fs'
+import path from 'node:path'
+import os from 'node:os'
+
+/**
+ * Tests for storage-auth helpers.
+ *
+ * We can't import the module directly (it has side-effects that touch the real
+ * filesystem), so we test the key parsing and persistence logic in isolation
+ * by reimplementing the pure functions and verifying the patterns they use.
+ */
+
+// Replicate the env-file parser from storage-auth.ts
+function parseEnvFile(content: string): Record<string, string> {
+  const vars: Record<string, string> = {}
+  content.split(/\r?\n/).forEach((line) => {
+    const [k, ...v] = line.split('=')
+    if (k && v.length) vars[k.trim()] = v.join('=').trim()
+  })
+  return vars
+}
+
+// Replicate appendEnvKeyIfMissing from storage-auth.ts
+function appendEnvKeyIfMissing(envPath: string, key: string, value: string): void {
+  const existing = fs.existsSync(envPath) ? fs.readFileSync(envPath, 'utf8') : ''
+  const keyPattern = new RegExp(`^${key}=`, 'm')
+  if (keyPattern.test(existing)) return
+  fs.appendFileSync(envPath, `\n${key}=${value}\n`)
+}
+
+describe('env file parsing', () => {
+  it('parses Unix line endings', () => {
+    const vars = parseEnvFile('ACCESS_KEY=abc123\nCREDENTIAL_SECRET=secret456\n')
+    assert.equal(vars.ACCESS_KEY, 'abc123')
+    assert.equal(vars.CREDENTIAL_SECRET, 'secret456')
+  })
+
+  it('parses Windows line endings without trailing \\r', () => {
+    const vars = parseEnvFile('ACCESS_KEY=abc123\r\nCREDENTIAL_SECRET=secret456\r\n')
+    assert.equal(vars.ACCESS_KEY, 'abc123')
+    assert.equal(vars.CREDENTIAL_SECRET, 'secret456')
+    // Verify no \r is left on the values
+    assert.ok(!vars.ACCESS_KEY.includes('\r'), 'ACCESS_KEY should not contain \\r')
+    assert.ok(!vars.CREDENTIAL_SECRET.includes('\r'), 'CREDENTIAL_SECRET should not contain \\r')
+  })
+
+  it('handles mixed line endings', () => {
+    const vars = parseEnvFile('A=1\r\nB=2\nC=3\r\n')
+    assert.equal(vars.A, '1')
+    assert.equal(vars.B, '2')
+    assert.equal(vars.C, '3')
+  })
+
+  it('preserves values containing equals signs', () => {
+    const vars = parseEnvFile('SECRET=abc=def=ghi\n')
+    assert.equal(vars.SECRET, 'abc=def=ghi')
+  })
+
+  it('skips empty lines and comment-like lines without =', () => {
+    const vars = parseEnvFile('\n# comment line\nKEY=val\n\n')
+    assert.equal(Object.keys(vars).length, 1)
+    assert.equal(vars.KEY, 'val')
+  })
+
+  it('trims whitespace from keys and values', () => {
+    const vars = parseEnvFile('  MY_KEY  =  my_value  \n')
+    assert.equal(vars.MY_KEY, 'my_value')
+  })
+})
+
+describe('appendEnvKeyIfMissing', () => {
+  let tmpDir: string
+
+  beforeEach(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'storage-auth-test-'))
+  })
+
+  afterEach(() => {
+    fs.rmSync(tmpDir, { recursive: true, force: true })
+  })
+
+  it('appends key to empty file', () => {
+    const envPath = path.join(tmpDir, '.env.local')
+    fs.writeFileSync(envPath, '', 'utf8')
+    appendEnvKeyIfMissing(envPath, 'ACCESS_KEY', 'test123')
+    const content = fs.readFileSync(envPath, 'utf8')
+    assert.ok(content.includes('ACCESS_KEY=test123'))
+  })
+
+  it('creates file if it does not exist', () => {
+    const envPath = path.join(tmpDir, '.env.local')
+    appendEnvKeyIfMissing(envPath, 'ACCESS_KEY', 'test123')
+    assert.ok(fs.existsSync(envPath))
+    const content = fs.readFileSync(envPath, 'utf8')
+    assert.ok(content.includes('ACCESS_KEY=test123'))
+  })
+
+  it('does not duplicate an existing key', () => {
+    const envPath = path.join(tmpDir, '.env.local')
+    fs.writeFileSync(envPath, 'ACCESS_KEY=original\n', 'utf8')
+    appendEnvKeyIfMissing(envPath, 'ACCESS_KEY', 'should-not-appear')
+    const content = fs.readFileSync(envPath, 'utf8')
+    assert.equal(content, 'ACCESS_KEY=original\n')
+  })
+
+  it('appends a second key without overwriting the first', () => {
+    const envPath = path.join(tmpDir, '.env.local')
+    fs.writeFileSync(envPath, 'FIRST=1\n', 'utf8')
+    appendEnvKeyIfMissing(envPath, 'SECOND', '2')
+    const vars = parseEnvFile(fs.readFileSync(envPath, 'utf8'))
+    assert.equal(vars.FIRST, '1')
+    assert.equal(vars.SECOND, '2')
+  })
+})
+
+describe('Docker key persistence fallback', () => {
+  let tmpDir: string
+
+  beforeEach(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'storage-auth-docker-test-'))
+  })
+
+  afterEach(() => {
+    fs.rmSync(tmpDir, { recursive: true, force: true })
+  })
+
+  it('keys written to fallback file survive simulated container restart', () => {
+    // Simulate: write keys to a "data dir" fallback (like DATA_DIR/.env.generated)
+    const generatedEnvPath = path.join(tmpDir, '.env.generated')
+    appendEnvKeyIfMissing(generatedEnvPath, 'ACCESS_KEY', 'docker-key-123')
+    appendEnvKeyIfMissing(generatedEnvPath, 'CREDENTIAL_SECRET', 'docker-secret-456')
+
+    // Simulate restart: re-read the file (as loadEnvFile would)
+    const vars = parseEnvFile(fs.readFileSync(generatedEnvPath, 'utf8'))
+    assert.equal(vars.ACCESS_KEY, 'docker-key-123')
+    assert.equal(vars.CREDENTIAL_SECRET, 'docker-secret-456')
+  })
+
+  it('fallback file does not overwrite keys that already exist', () => {
+    const generatedEnvPath = path.join(tmpDir, '.env.generated')
+    appendEnvKeyIfMissing(generatedEnvPath, 'ACCESS_KEY', 'original')
+
+    // Second call should not overwrite
+    appendEnvKeyIfMissing(generatedEnvPath, 'ACCESS_KEY', 'new-value')
+    const vars = parseEnvFile(fs.readFileSync(generatedEnvPath, 'utf8'))
+    assert.equal(vars.ACCESS_KEY, 'original')
+  })
+})

package/src/lib/server/storage-auth.ts

@@ -7,21 +7,30 @@ import { log } from '@/lib/server/logger'
 
 const TAG = 'storage-auth'
 
+// Fallback env file inside the data directory — survives Docker container restarts
+// because DATA_DIR is volume-mounted, unlike process.cwd()/.env.local.
+const GENERATED_ENV_PATH = path.join(DATA_DIR, '.env.generated')
+
 // --- .env loading ---
+function loadEnvFile(filePath: string): void {
+  if (!fs.existsSync(filePath)) return
+  fs.readFileSync(filePath, 'utf8').split(/\r?\n/).forEach(line => {
+    const [k, ...v] = line.split('=')
+    if (k && v.length) process.env[k.trim()] = v.join('=').trim()
+  })
+}
+
 function loadEnv() {
-  const envPath = path.join(process.cwd(), '.env.local')
-  if (fs.existsSync(envPath)) {
-    fs.readFileSync(envPath, 'utf8').split('\n').forEach(line => {
-      const [k, ...v] = line.split('=')
-      if (k && v.length) process.env[k.trim()] = v.join('=').trim()
-    })
-  }
+  // Load fallback first so that .env.local values take precedence.
+  // .env.generated is auto-created in Docker where .env.local isn't writable.
+  loadEnvFile(GENERATED_ENV_PATH)
+  loadEnvFile(path.join(process.cwd(), '.env.local'))
 }
 if (!IS_BUILD_BOOTSTRAP) {
   loadEnv()
 }
 
-/** Append a key=value to .env.local only if the key doesn't already exist in the file. */
+/** Append a key=value to a file only if the key doesn't already exist in it. */
 function appendEnvKeyIfMissing(envPath: string, key: string, value: string): void {
   const existing = fs.existsSync(envPath) ? fs.readFileSync(envPath, 'utf8') : ''
   const keyPattern = new RegExp(`^${key}=`, 'm')
@@ -29,23 +38,42 @@ function appendEnvKeyIfMissing(envPath: string, key: string, value: string): voi
   fs.appendFileSync(envPath, `\n${key}=${value}\n`)
 }
 
+/** Try to persist a key to .env.local, falling back to DATA_DIR/.env.generated. */
+function persistEnvKey(key: string, value: string): void {
+  const envLocalPath = path.join(process.cwd(), '.env.local')
+  // Try .env.local first (works for local dev, npm run dev)
+  try {
+    appendEnvKeyIfMissing(envLocalPath, key, value)
+    return
+  } catch {
+    // .env.local not writable — expected in Docker containers
+  }
+  // Fall back to the data directory (volume-mounted in Docker)
+  try {
+    fs.mkdirSync(path.dirname(GENERATED_ENV_PATH), { recursive: true })
+    appendEnvKeyIfMissing(GENERATED_ENV_PATH, key, value)
+  } catch (err) {
+    log.warn(TAG, `Could not persist ${key} to disk. It will be regenerated on restart.`, {
+      error: err instanceof Error ? err.message : String(err),
+    })
+  }
+}
+
 // Auto-generate CREDENTIAL_SECRET if missing
 if (!IS_BUILD_BOOTSTRAP && !process.env.CREDENTIAL_SECRET) {
   const secret = crypto.randomBytes(32).toString('hex')
-  const envPath = path.join(process.cwd(), '.env.local')
-  appendEnvKeyIfMissing(envPath, 'CREDENTIAL_SECRET', secret)
   process.env.CREDENTIAL_SECRET = secret
-  log.info(TAG, 'Generated CREDENTIAL_SECRET in .env.local')
+  persistEnvKey('CREDENTIAL_SECRET', secret)
+  log.info(TAG, 'Generated CREDENTIAL_SECRET')
 }
 
 // Auto-generate ACCESS_KEY if missing (used for simple auth)
 const SETUP_FLAG = path.join(DATA_DIR, '.setup_pending')
 if (!IS_BUILD_BOOTSTRAP && !process.env.ACCESS_KEY) {
   const key = crypto.randomBytes(16).toString('hex')
-  const envPath = path.join(process.cwd(), '.env.local')
-  appendEnvKeyIfMissing(envPath, 'ACCESS_KEY', key)
   process.env.ACCESS_KEY = key
-  fs.writeFileSync(SETUP_FLAG, key)
+  persistEnvKey('ACCESS_KEY', key)
+  try { fs.writeFileSync(SETUP_FLAG, key) } catch { /* non-fatal */ }
   log.info(TAG, `ACCESS KEY: ${key} — Use this key to connect from the browser.`)
 }
 
@@ -65,15 +93,22 @@ export function markSetupComplete(): void {
   if (fs.existsSync(SETUP_FLAG)) fs.unlinkSync(SETUP_FLAG)
 }
 
-/** Replace the access key in memory and in .env.local (first-time setup override). */
+/** Replace the access key in memory and on disk (first-time setup override). */
 export function replaceAccessKey(newKey: string): void {
-  const envPath = path.join(process.cwd(), '.env.local')
-  if (fs.existsSync(envPath)) {
-    const contents = fs.readFileSync(envPath, 'utf-8')
-    const updated = contents.replace(/^ACCESS_KEY=.*$/m, `ACCESS_KEY=${newKey}`)
-    fs.writeFileSync(envPath, updated)
-  } else {
-    fs.appendFileSync(envPath, `\nACCESS_KEY=${newKey}\n`)
+  // Update in both possible locations
+  for (const envPath of [path.join(process.cwd(), '.env.local'), GENERATED_ENV_PATH]) {
+    try {
+      if (fs.existsSync(envPath)) {
+        const contents = fs.readFileSync(envPath, 'utf-8')
+        if (/^ACCESS_KEY=/m.test(contents)) {
+          fs.writeFileSync(envPath, contents.replace(/^ACCESS_KEY=.*$/m, `ACCESS_KEY=${newKey}`))
+          continue
+        }
+      }
+      appendEnvKeyIfMissing(envPath, 'ACCESS_KEY', newKey)
+    } catch {
+      // Not writable — try the other location
+    }
   }
   process.env.ACCESS_KEY = newKey
 }

package/src/lib/server/storage-normalization.ts

@@ -649,6 +649,25 @@ function normalizeStoredRecordInner(
   if (session.geminiSessionId === undefined) session.geminiSessionId = null
   // Default copilotSessionId for new field
   if (session.copilotSessionId === undefined) session.copilotSessionId = null
+  if (session.cursorSessionId === undefined) session.cursorSessionId = null
+  if (session.qwenSessionId === undefined) session.qwenSessionId = null
+  if (session.acpSessionId === undefined) session.acpSessionId = null
+  if (!session.delegateResumeIds || typeof session.delegateResumeIds !== 'object') {
+    session.delegateResumeIds = {
+      claudeCode: null,
+      codex: null,
+      opencode: null,
+      gemini: null,
+      copilot: null,
+      cursor: null,
+      qwen: null,
+    }
+  } else {
+    const resumeIds = session.delegateResumeIds as Record<string, unknown>
+    if (resumeIds.copilot === undefined) resumeIds.copilot = null
+    if (resumeIds.cursor === undefined) resumeIds.cursor = null
+    if (resumeIds.qwen === undefined) resumeIds.qwen = null
+  }
   // Default injectedMemoryIds for proactive recall dedup
   if (!session.injectedMemoryIds || typeof session.injectedMemoryIds !== 'object') {
     session.injectedMemoryIds = {}

package/src/lib/server/storage.ts

@@ -655,6 +655,9 @@ if (!IS_BUILD_BOOTSTRAP) {
     'claude_code',
     'codex_cli',
     'opencode_cli',
+    'gemini_cli',
+    'cursor_cli',
+    'qwen_code_cli',
   ]
   const count = (db.prepare('SELECT COUNT(*) as c FROM agents').get() as { c: number }).c
   if (count === 0) {

package/src/lib/server/tasks/task-resume.ts

@@ -5,6 +5,8 @@ export interface TaskResumeState {
   claudeSessionId: string | null
   codexThreadId: string | null
   opencodeSessionId: string | null
+  cursorSessionId?: string | null
+  qwenSessionId?: string | null
   delegateResumeIds: NonNullable<Session['delegateResumeIds']>
 }
 
@@ -26,6 +28,9 @@ function buildEmptyDelegateResumeIds(): NonNullable<Session['delegateResumeIds']
     codex: null,
     opencode: null,
     gemini: null,
+    copilot: null,
+    cursor: null,
+    qwen: null,
   }
 }
 
@@ -43,6 +48,8 @@ function hasResumeState(state: TaskResumeState | null | undefined): state is Tas
     || state.delegateResumeIds.codex
     || state.delegateResumeIds.opencode
     || state.delegateResumeIds.gemini
+    || state.delegateResumeIds.cursor
+    || state.delegateResumeIds.qwen
   )
 }
 
@@ -59,16 +66,22 @@ export function extractTaskResumeState(task: Partial<BoardTask> | null | undefin
     || (legacyProvider === 'opencode-cli' ? legacyResumeId : null)
   const geminiSessionId = normalizeResumeHandle(task.geminiResumeId)
     || (legacyProvider === 'gemini-cli' ? legacyResumeId : null)
+  const cursorSessionId = legacyProvider === 'cursor-cli' ? legacyResumeId : null
+  const qwenSessionId = legacyProvider === 'qwen-code-cli' ? legacyResumeId : null
 
   const resume = {
     claudeSessionId,
     codexThreadId,
     opencodeSessionId,
+    cursorSessionId,
+    qwenSessionId,
     delegateResumeIds: {
       claudeCode: claudeSessionId,
       codex: codexThreadId,
       opencode: opencodeSessionId,
       gemini: geminiSessionId,
+      cursor: cursorSessionId,
+      qwen: qwenSessionId,
     },
   } satisfies TaskResumeState
 
@@ -81,6 +94,8 @@ export function extractSessionResumeState(session: Partial<Session> | null | und
   const claudeSessionId = normalizeResumeHandle(session.claudeSessionId)
   const codexThreadId = normalizeResumeHandle(session.codexThreadId)
   const opencodeSessionId = normalizeResumeHandle(session.opencodeSessionId)
+  const cursorSessionId = normalizeResumeHandle(session.cursorSessionId)
+  const qwenSessionId = normalizeResumeHandle(session.qwenSessionId)
   const delegateResumeIds = session.delegateResumeIds && typeof session.delegateResumeIds === 'object'
     ? { ...buildEmptyDelegateResumeIds(), ...session.delegateResumeIds }
     : buildEmptyDelegateResumeIds()
@@ -89,11 +104,16 @@ export function extractSessionResumeState(session: Partial<Session> | null | und
     claudeSessionId,
     codexThreadId,
     opencodeSessionId,
+    cursorSessionId,
+    qwenSessionId,
     delegateResumeIds: {
       claudeCode: normalizeResumeHandle(delegateResumeIds.claudeCode) || claudeSessionId,
       codex: normalizeResumeHandle(delegateResumeIds.codex) || codexThreadId,
       opencode: normalizeResumeHandle(delegateResumeIds.opencode) || opencodeSessionId,
       gemini: normalizeResumeHandle(delegateResumeIds.gemini),
+      cursor: normalizeResumeHandle(delegateResumeIds.cursor) || cursorSessionId,
+      qwen: normalizeResumeHandle(delegateResumeIds.qwen) || qwenSessionId,
+      copilot: normalizeResumeHandle(delegateResumeIds.copilot),
     },
   } satisfies TaskResumeState
 
@@ -140,10 +160,12 @@ export function applyTaskResumeStateToSession(session: Session, resume: TaskResu
   if (!hasResumeState(resume)) return false
 
   let changed = false
-  const directFields: Array<['claudeSessionId' | 'codexThreadId' | 'opencodeSessionId', string | null]> = [
+  const directFields: Array<['claudeSessionId' | 'codexThreadId' | 'opencodeSessionId' | 'cursorSessionId' | 'qwenSessionId', string | null]> = [
     ['claudeSessionId', resume.claudeSessionId],
     ['codexThreadId', resume.codexThreadId],
     ['opencodeSessionId', resume.opencodeSessionId],
+    ['cursorSessionId', resume.cursorSessionId ?? null],
+    ['qwenSessionId', resume.qwenSessionId ?? null],
   ]
   for (const [key, value] of directFields) {
     if (!value || session[key] === value) continue

package/src/lib/server/tool-aliases.ts

@@ -5,7 +5,7 @@ const EXTENSION_ALIAS_GROUPS: string[][] = [
   ['edit_file'],
   ['web', 'web_search', 'web_fetch', 'http_request', 'http'],
   ['browser', 'openclaw_browser'],
-  ['delegate', 'claude_code', 'codex_cli', 'opencode_cli', 'gemini_cli', 'delegate_to_claude_code', 'delegate_to_codex_cli', 'delegate_to_opencode_cli', 'delegate_to_gemini_cli'],
+  ['delegate', 'claude_code', 'codex_cli', 'opencode_cli', 'gemini_cli', 'copilot_cli', 'cursor_cli', 'qwen_code_cli', 'delegate_to_claude_code', 'delegate_to_codex_cli', 'delegate_to_opencode_cli', 'delegate_to_gemini_cli', 'delegate_to_copilot_cli', 'delegate_to_cursor_cli', 'delegate_to_qwen_code_cli'],
   ['manage_platform'],
   ['manage_agents'],
   ['manage_projects'],

package/src/lib/server/tool-capability-policy.ts

@@ -53,11 +53,14 @@ const TOOL_DESCRIPTORS: Record<string, ToolDescriptor> = {
   web_search: { categories: ['network'], concreteTools: ['web_search'] },
   web_fetch: { categories: ['network'], concreteTools: ['web_fetch'] },
   browser: { categories: ['browser', 'network'], concreteTools: ['browser', 'openclaw_browser'] },
-  delegate: { categories: ['delegation', 'execution'], concreteTools: ['delegate', 'delegate_to_claude_code', 'delegate_to_codex_cli', 'delegate_to_opencode_cli', 'delegate_to_gemini_cli'] },
+  delegate: { categories: ['delegation', 'execution'], concreteTools: ['delegate', 'delegate_to_claude_code', 'delegate_to_codex_cli', 'delegate_to_opencode_cli', 'delegate_to_gemini_cli', 'delegate_to_copilot_cli', 'delegate_to_cursor_cli', 'delegate_to_qwen_code_cli'] },
   claude_code: { categories: ['delegation', 'execution'], concreteTools: ['delegate_to_claude_code'] },
   codex_cli: { categories: ['delegation', 'execution'], concreteTools: ['delegate_to_codex_cli'] },
   opencode_cli: { categories: ['delegation', 'execution'], concreteTools: ['delegate_to_opencode_cli'] },
   gemini_cli: { categories: ['delegation', 'execution'], concreteTools: ['delegate_to_gemini_cli'] },
+  copilot_cli: { categories: ['delegation', 'execution'], concreteTools: ['delegate_to_copilot_cli'] },
+  cursor_cli: { categories: ['delegation', 'execution'], concreteTools: ['delegate_to_cursor_cli'] },
+  qwen_code_cli: { categories: ['delegation', 'execution'], concreteTools: ['delegate_to_qwen_code_cli'] },
   memory: { categories: ['memory'], concreteTools: ['memory', 'memory_tool', 'memory_search', 'memory_get', 'memory_store', 'memory_update', 'context_status', 'context_summarize'] },
   // http_request consolidated into web 'api' action — no separate descriptor
   monitor: { categories: ['execution'], concreteTools: ['monitor', 'monitor_tool'] },