activeclaw 2026.2.11 → 2026.2.13

package/CHANGELOG.md

@@ -2,6 +2,104 @@
 
 Docs: https://docs.openclaw.ai
 
+## 2026.2.13 (Unreleased)
+
+### Fixes
+
+- Onboarding/CLI: restore terminal state without resuming paused `stdin`, so onboarding exits cleanly after choosing Web UI and the installer returns instead of appearing stuck.
+
+## 2026.2.12
+
+### Changes
+
+- CLI/Plugins: add `openclaw plugins uninstall <id>` with `--dry-run`, `--force`, and `--keep-files` options, including safe uninstall path handling and plugin uninstall docs. (#5985) Thanks @JustasMonkev.
+- CLI: add `openclaw logs --local-time` to display log timestamps in local timezone. (#13818) Thanks @xialonglee.
+- Telegram: render blockquotes as native `<blockquote>` tags instead of stripping them. (#14608)
+- Telegram: expose `/compact` in the native command menu. (#10352) Thanks @akramcodez.
+- Discord: add role-based allowlists and role-based agent routing. (#10650) Thanks @Minidoracat.
+- Config: avoid redacting `maxTokens`-like fields during config snapshot redaction, preventing round-trip validation failures in `/config`. (#14006) Thanks @constansino.
+
+### Breaking
+
+- Hooks: `POST /hooks/agent` now rejects payload `sessionKey` overrides by default. To keep fixed hook context, set `hooks.defaultSessionKey` (recommended with `hooks.allowedSessionKeyPrefixes: ["hook:"]`). If you need legacy behavior, explicitly set `hooks.allowRequestSessionKey: true`. Thanks @alpernae for reporting.
+
+### Fixes
+
+- Gateway/OpenResponses: harden URL-based `input_file`/`input_image` handling with explicit SSRF deny policy, hostname allowlists (`files.urlAllowlist` / `images.urlAllowlist`), per-request URL input caps (`maxUrlParts`), blocked-fetch audit logging, and regression coverage/docs updates.
+- Security: fix unauthenticated Nostr profile API remote config tampering. (#13719) Thanks @coygeek.
+- Security: remove bundled soul-evil hook. (#14757) Thanks @Imccccc.
+- Security/Audit: add hook session-routing hardening checks (`hooks.defaultSessionKey`, `hooks.allowRequestSessionKey`, and prefix allowlists), and warn when HTTP API endpoints allow explicit session-key routing.
+- Security/Sandbox: confine mirrored skill sync destinations to the sandbox `skills/` root and stop using frontmatter-controlled skill names as filesystem destination paths. Thanks @1seal.
+- Security/Web tools: treat browser/web content as untrusted by default (wrapped outputs for browser snapshot/tabs/console and structured external-content metadata for web tools), and strip `toolResult.details` from model-facing transcript/compaction inputs to reduce prompt-injection replay risk.
+- Security/Hooks: harden webhook and device token verification with shared constant-time secret comparison, and add per-client auth-failure throttling for hook endpoints (`429` + `Retry-After`). Thanks @akhmittra.
+- Security/Browser: require auth for loopback browser control HTTP routes, auto-generate `gateway.auth.token` when browser control starts without auth, and add a security-audit check for unauthenticated browser control. Thanks @tcusolle.
+- Sessions/Gateway: harden transcript path resolution and reject unsafe session IDs/file paths so session operations stay within agent sessions directories. Thanks @akhmittra.
+- Gateway: raise WS payload/buffer limits so 5,000,000-byte image attachments work reliably. (#14486) Thanks @0xRaini.
+- Logging/CLI: use local timezone timestamps for console prefixing, and include `±HH:MM` offsets when using `openclaw logs --local-time` to avoid ambiguity. (#14771) Thanks @0xRaini.
+- Gateway: drain active turns before restart to prevent message loss. (#13931) Thanks @0xRaini.
+- Gateway: auto-generate auth token during install to prevent launchd restart loops. (#13813) Thanks @cathrynlavery.
+- Gateway: prevent `undefined`/missing token in auth config. (#13809) Thanks @asklee-klawd.
+- Gateway: handle async `EPIPE` on stdout/stderr during shutdown. (#13414) Thanks @keshav55.
+- Gateway/Control UI: resolve missing dashboard assets when `openclaw` is installed globally via symlink-based Node managers (nvm/fnm/n/Homebrew). (#14919) Thanks @aynorica.
+- Cron: use requested `agentId` for isolated job auth resolution. (#13983) Thanks @0xRaini.
+- Cron: prevent cron jobs from skipping execution when `nextRunAtMs` advances. (#14068) Thanks @WalterSumbon.
+- Cron: pass `agentId` to `runHeartbeatOnce` for main-session jobs. (#14140) Thanks @ishikawa-pro.
+- Cron: re-arm timers when `onTimer` fires while a job is still executing. (#14233) Thanks @tomron87.
+- Cron: prevent duplicate fires when multiple jobs trigger simultaneously. (#14256) Thanks @xinhuagu.
+- Cron: isolate scheduler errors so one bad job does not break all jobs. (#14385) Thanks @MarvinDontPanic.
+- Cron: prevent one-shot `at` jobs from re-firing on restart after skipped/errored runs. (#13878) Thanks @lailoo.
+- Heartbeat: prevent scheduler stalls on unexpected run errors and avoid immediate rerun loops after `requests-in-flight` skips. (#14901) Thanks @joeykrug.
+- Cron: honor stored session model overrides for isolated-agent runs while preserving `hooks.gmail.model` precedence for Gmail hook sessions. (#14983) Thanks @shtse8.
+- Logging/Browser: fall back to `os.tmpdir()/openclaw` for default log, browser trace, and browser download temp paths when `/tmp/openclaw` is unavailable.
+- WhatsApp: convert Markdown bold/strikethrough to WhatsApp formatting. (#14285) Thanks @Raikan10.
+- WhatsApp: allow media-only sends and normalize leading blank payloads. (#14408) Thanks @karimnaguib.
+- WhatsApp: default MIME type for voice messages when Baileys omits it. (#14444) Thanks @mcaxtr.
+- Telegram: handle no-text message in model picker editMessageText. (#14397) Thanks @0xRaini.
+- Telegram: surface REACTION_INVALID as non-fatal warning. (#14340) Thanks @0xRaini.
+- BlueBubbles: fix webhook auth bypass via loopback proxy trust. (#13787) Thanks @coygeek.
+- Slack: change default replyToMode from "off" to "all". (#14364) Thanks @nm-de.
+- Slack: detect control commands when channel messages start with bot mention prefixes (for example, `@Bot /new`). (#14142) Thanks @beefiker.
+- Signal: enforce E.164 validation for the Signal bot account prompt so mistyped numbers are caught early. (#15063) Thanks @Duartemartins.
+- Discord: process DM reactions instead of silently dropping them. (#10418) Thanks @mcaxtr.
+- Discord: treat Administrator as full permissions in channel permission checks. Thanks @thewilloftheshadow.
+- Discord: respect replyToMode in threads. (#11062) Thanks @cordx56.
+- Browser: add Chrome launch flag `--disable-blink-features=AutomationControlled` to reduce `navigator.webdriver` automation detection issues on reCAPTCHA-protected sites. (#10735) Thanks @Milofax.
+- Heartbeat: filter noise-only system events so scheduled reminder notifications do not fire when cron runs carry only heartbeat markers. (#13317) Thanks @pvtclawn.
+- Signal: render mention placeholders as `@uuid`/`@phone` so mention gating and Clawdbot targeting work. (#2013) Thanks @alexgleason.
+- Discord: omit empty content fields for media-only messages while preserving caption whitespace. (#9507) Thanks @leszekszpunar.
+- Onboarding/Providers: add Z.AI endpoint-specific auth choices (`zai-coding-global`, `zai-coding-cn`, `zai-global`, `zai-cn`) and expand default Z.AI model wiring. (#13456) Thanks @tomsun28.
+- Onboarding/Providers: update MiniMax API default/recommended models from M2.1 to M2.5, add M2.5/M2.5-Lightning model entries, and include `minimax-m2.5` in modern model filtering. (#14865) Thanks @adao-max.
+- Ollama: use configured `models.providers.ollama.baseUrl` for model discovery and normalize `/v1` endpoints to the native Ollama API root. (#14131) Thanks @shtse8.
+- Voice Call: pass Twilio stream auth token via `<Parameter>` instead of query string. (#14029) Thanks @mcwigglesmcgee.
+- Feishu: pass `Buffer` directly to the Feishu SDK upload APIs instead of `Readable.from(...)` to avoid form-data upload failures. (#10345) Thanks @youngerstyle.
+- Feishu: trigger mention-gated group handling only when the bot itself is mentioned (not just any mention). (#11088) Thanks @openperf.
+- Feishu: probe status uses the resolved account context for multi-account credential checks. (#11233) Thanks @onevcat.
+- Feishu: add streaming card replies via Card Kit API and preserve `renderMode=auto` fallback behavior for plain-text responses. (#10379) Thanks @xzq-xu.
+- Feishu DocX: preserve top-level converted block order using `firstLevelBlockIds` when writing/appending documents. (#13994) Thanks @Cynosure159.
+- Feishu plugin packaging: remove `workspace:*` `openclaw` dependency from `extensions/feishu` and sync lockfile for install compatibility. (#14423) Thanks @jackcooper2015.
+- CLI/Wizard: exit with code 1 when `configure`, `agents add`, or interactive `onboard` wizards are canceled, so `set -e` automation stops correctly. (#14156) Thanks @0xRaini.
+- Media: strip `MEDIA:` lines with local paths instead of leaking as visible text. (#14399) Thanks @0xRaini.
+- Config/Cron: exclude `maxTokens` from config redaction and honor `deleteAfterRun` on skipped cron jobs. (#13342) Thanks @niceysam.
+- Config: ignore `meta` field changes in config file watcher. (#13460) Thanks @brandonwise.
+- Cron: use requested `agentId` for isolated job auth resolution. (#13983) Thanks @0xRaini.
+- Cron: pass `agentId` to `runHeartbeatOnce` for main-session jobs. (#14140) Thanks @ishikawa-pro.
+- Cron: prevent cron jobs from skipping execution when `nextRunAtMs` advances. (#14068) Thanks @WalterSumbon.
+- Cron: re-arm timers when `onTimer` fires while a job is still executing. (#14233) Thanks @tomron87.
+- Cron: prevent duplicate fires when multiple jobs trigger simultaneously. (#14256) Thanks @xinhuagu.
+- Cron: isolate scheduler errors so one bad job does not break all jobs. (#14385) Thanks @MarvinDontPanic.
+- Cron: prevent one-shot `at` jobs from re-firing on restart after skipped/errored runs. (#13878) Thanks @lailoo.
+- Daemon: suppress `EPIPE` error when restarting LaunchAgent. (#14343) Thanks @0xRaini.
+- Antigravity: add opus 4.6 forward-compat model and bypass thinking signature sanitization. (#14218) Thanks @jg-noncelogic.
+- Agents: prevent file descriptor leaks in child process cleanup. (#13565) Thanks @KyleChen26.
+- Agents: prevent double compaction caused by cache TTL bypassing guard. (#13514) Thanks @taw0002.
+- Agents: use last API call's cache tokens for context display instead of accumulated sum. (#13805) Thanks @akari-musubi.
+- Agents: keep followup-runner session `totalTokens` aligned with post-compaction context by using last-call usage and shared token-accounting logic. (#14979) Thanks @shtse8.
+- Hooks/Plugins: wire 9 previously unwired plugin lifecycle hooks into core runtime paths (session, compaction, gateway, and outbound message hooks). (#14882) Thanks @shtse8.
+- Hooks/Tools: dispatch `before_tool_call` and `after_tool_call` hooks from both tool execution paths with rebased conflict fixes. (#15012) Thanks @Patrick-Barletta, @Takhoffman.
+- Discord: allow channel-edit to archive/lock threads and set auto-archive duration. (#5542) Thanks @stumct.
+- Discord tests: use a partial @buape/carbon mock in slash command coverage. (#13262) Thanks @arosstale.
+- Tests: update thread ID handling in Slack message collection tests. (#14108) Thanks @swizzmagik.
+
 ## 2026.2.9
 
 ### Added
@@ -24,6 +122,7 @@ Docs: https://docs.openclaw.ai
 
 ### Fixes
 
+- Cron: prevent one-shot `at` jobs from re-firing on gateway restart when previously skipped or errored. (#13845)
 - Discord: add exec approval cleanup option to delete DMs after approval/denial/timeout. (#13205) Thanks @thewilloftheshadow.
 - Sessions: prune stale entries, cap session store size, rotate large stores, accept duration/size thresholds, default to warn-only maintenance, and prune cron run sessions after retention windows. (#13083) Thanks @skyfallsin, @Glucksberg, @gumadeiras.
 - CI: Implement pipeline and workflow order. Thanks @quotentiroler.
@@ -37,11 +136,14 @@ Docs: https://docs.openclaw.ai
 - Telegram: match DM `allowFrom` against sender user id (fallback to chat id) and clarify pairing logs. (#12779) Thanks @liuxiaopai-ai.
 - Pairing/Telegram: include the actual pairing code in approve commands, route Telegram pairing replies through the shared pairing message builder, and add regression checks to prevent `<code>` placeholder drift.
 - Onboarding: QuickStart now auto-installs shell completion (prompt only in Manual).
+- Onboarding/Providers: add LiteLLM provider onboarding and preserve custom LiteLLM proxy base URLs while enforcing API-key auth mode. (#12823) Thanks @ryan-crabbe.
 - Docker: make `docker-setup.sh` compatible with macOS Bash 3.2 and empty extra mounts. (#9441) Thanks @mateusz-michalik.
 - Auth: strip embedded line breaks from pasted API keys and tokens before storing/resolving credentials.
 - Agents: strip reasoning tags and downgraded tool markers from messaging tool and streaming output to prevent leakage. (#11053, #13453) Thanks @liebertar, @meaadore1221-afk, @gumadeiras.
 - Browser: prevent stuck `act:evaluate` from wedging the browser tool, and make cancellation stop waiting promptly. (#13498) Thanks @onutc.
+- Security/Gateway: default-deny missing connect `scopes` (no implicit `operator.admin`).
 - Web UI: make chat refresh smoothly scroll to the latest messages and suppress new-messages badge flash during manual refresh.
+- Web UI: coerce Form Editor values to schema types before `config.set` and `config.apply`, preventing numeric and boolean fields from being serialized as strings. (#13468) Thanks @mcaxtr.
 - Tools/web_search: include provider-specific settings in the web search cache key, and pass `inlineCitations` for Grok. (#12419) Thanks @tmchow.
 - Tools/web_search: fix Grok response parsing for xAI Responses API output blocks. (#13049) Thanks @ereid7.
 - Tools/web_search: normalize direct Perplexity model IDs while keeping OpenRouter model IDs unchanged. (#12795) Thanks @cdorsey.
@@ -53,11 +155,13 @@ Docs: https://docs.openclaw.ai
 - Gateway: fix multi-agent sessions.usage discovery. (#11523) Thanks @Takhoffman.
 - Agents: recover from context overflow caused by oversized tool results (pre-emptive capping + fallback truncation). (#11579) Thanks @tyler6204.
 - Subagents/compaction: stabilize announce timing and preserve compaction metrics across retries. (#11664) Thanks @tyler6204.
+- Subagents: report timeout-aborted runs as timed out instead of completed successfully in parent-session announcements. (#13996) Thanks @dario-github.
 - Cron: share isolated announce flow and harden scheduling/delivery reliability. (#11641) Thanks @tyler6204.
 - Cron tool: recover flat params when LLM omits the `job` wrapper for add requests. (#12124) Thanks @tyler6204.
 - Gateway/CLI: when `gateway.bind=lan`, use a LAN IP for probe URLs and Control UI links. (#11448) Thanks @AnonO6.
 - CLI: make `openclaw plugins list` output scannable by hoisting source roots and shortening bundled/global/workspace plugin paths.
 - Hooks: fix bundled hooks broken since 2026.2.2 (tsdown migration). (#9295) Thanks @patrickshao.
+- Security/Plugins: install plugin and hook dependencies with `--ignore-scripts` to prevent lifecycle script execution.
 - Routing: refresh bindings per message by loading config at route resolution so binding changes apply without restart. (#11372) Thanks @juanpablodlc.
 - Exec approvals: render forwarded commands in monospace for safer approval scanning. (#11937) Thanks @sebslight.
 - Config: clamp `maxTokens` to `contextWindow` to prevent invalid model configs. (#5516) Thanks @lailoo.
@@ -71,6 +175,8 @@ Docs: https://docs.openclaw.ai
 - Memory/QMD: run boot refresh in background by default, add configurable QMD maintenance timeouts, retry QMD after fallback failures, and scope QMD queries to OpenClaw-managed collections. (#9690, #9705, #10042) Thanks @vignesh07.
 - Memory/QMD: initialize QMD backend on gateway startup so background update timers restart after process reloads. (#10797) Thanks @vignesh07.
 - Config/Memory: auto-migrate legacy top-level `memorySearch` settings into `agents.defaults.memorySearch`. (#11278, #9143) Thanks @vignesh07.
+- Memory/QMD: treat plain-text `No results found` output from QMD as an empty result instead of throwing invalid JSON errors. (#9824)
+- Memory/QMD: add `memory.qmd.searchMode` to choose `query`, `search`, or `vsearch` recall mode. (#9967, #10084)
 - Media understanding: recognize `.caf` audio attachments for transcription. (#10982) Thanks @succ985.
 - State dir: honor `OPENCLAW_STATE_DIR` for default device identity and canvas storage paths. (#4824) Thanks @kossoy.
 

package/dist/{accounts-DbzMEfKN.js → accounts-DCDeFTra.js}

@@ -1,6 +1,6 @@
-import { A as getChildLogger, J as resolveOAuthDir, T as success, p as defaultRuntime, y as info } from "./entry.js";
+import { E as success, Y as resolveOAuthDir, j as getChildLogger, p as defaultRuntime, y as info } from "./entry.js";
 import { c as normalizeAccountId, t as DEFAULT_ACCOUNT_ID } from "./session-key-DVvxnFKg.js";
-import { p as jidToE164, y as resolveUserPath } from "./utils-Dk86IbEs.js";
+import { p as jidToE164, y as resolveUserPath } from "./utils-BLJAc3ZV.js";
 import path from "node:path";
 import fs from "node:fs";
 import fs$1 from "node:fs/promises";

package/dist/{accounts-C2elk6PC.js → accounts-DeqIQjo1.js}

@@ -1,6 +1,6 @@
 import { m as resolveOAuthDir } from "./paths-DVBShlw6.js";
-import { D as info, P as success, c as defaultRuntime, z as getChildLogger } from "./subsystem-Bh1Y_6Uv.js";
-import { b as resolveUserPath, m as jidToE164 } from "./utils-es4ygvQ-.js";
+import { D as info, P as success, c as defaultRuntime, z as getChildLogger } from "./subsystem-BoExtIHo.js";
+import { b as resolveUserPath, m as jidToE164 } from "./utils-Cd9QdCHh.js";
 import { c as normalizeAccountId, t as DEFAULT_ACCOUNT_ID } from "./session-key-BWxPj0z_.js";
 import fs from "node:fs";
 import path from "node:path";

package/dist/{acp-cli-CVFTdsQY.js → acp-cli-CeYI4XRd.js}

@@ -1,22 +1,21 @@
 import "./paths-DVBShlw6.js";
-import { R as theme, c as defaultRuntime } from "./subsystem-Bh1Y_6Uv.js";
-import "./utils-es4ygvQ-.js";
-import "./exec-Cv_Ofd1m.js";
-import "./agent-scope-CGmuusG9.js";
-import "./model-selection-BK7DuyH8.js";
+import { R as theme, c as defaultRuntime } from "./subsystem-BoExtIHo.js";
+import "./utils-Cd9QdCHh.js";
+import "./exec-YIosokWE.js";
+import "./agent-scope-CQCus0rI.js";
+import "./model-selection-BLuqsGVB.js";
 import "./github-copilot-token-BW-SEg7E.js";
 import "./boolean-BgXe2hyu.js";
-import "./env-BxRc6wWv.js";
-import { M as VERSION, i as loadConfig } from "./config--NUdpACy.js";
-import "./manifest-registry-3It8Z8yN.js";
-import { h as GATEWAY_CLIENT_NAMES, m as GATEWAY_CLIENT_MODES } from "./message-channel-Cu61-7H6.js";
-import { t as GatewayClient } from "./client-6xKrRC-1.js";
-import { t as buildGatewayConnectionDetails } from "./call-Bek1xlgk.js";
-import { t as formatDocsLink } from "./links-C591fM9M.js";
-import "./tailscale-Cu-2HNvU.js";
-import { t as isMainModule } from "./is-main-WWuz28Ip.js";
-import { t as ensureOpenClawCliOnPath } from "./path-env-BgLvMbz_.js";
-import { i as resolveGatewayAuth } from "./auth-BvIPpm7G.js";
+import "./env-ONzUVAG2.js";
+import { M as VERSION, i as loadConfig } from "./config-aFQssWKX.js";
+import "./manifest-registry-CQhdnDBZ.js";
+import { h as GATEWAY_CLIENT_NAMES, m as GATEWAY_CLIENT_MODES } from "./message-channel-BLi2a6Yw.js";
+import { t as GatewayClient } from "./client-BrYfyoDK.js";
+import { t as buildGatewayConnectionDetails } from "./call-SolyGS1r.js";
+import { t as formatDocsLink } from "./links-Eax1UO3w.js";
+import { i as resolveGatewayAuth } from "./auth-CQNl_IaI.js";
+import { t as isMainModule } from "./is-main-BWoXGz7p.js";
+import { t as ensureOpenClawCliOnPath } from "./path-env-CaYUVIML.js";
 import { fileURLToPath } from "node:url";
 import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";

package/dist/{acp-cli-BpJwIyLl.js → acp-cli-rNbGXICg.js}

@@ -1,19 +1,18 @@
-import { k as theme, p as defaultRuntime } from "./entry.js";
-import "./auth-profiles-Bv1AEm-Y.js";
-import "./utils-Dk86IbEs.js";
-import "./exec-B8JKbXKW.js";
-import "./agent-scope-DQuy3dwI.js";
-import "./github-copilot-token-SLWintYd.js";
-import { M as VERSION, i as loadConfig } from "./config-B00lvFac.js";
-import "./manifest-registry-D5SiA3xq.js";
-import { t as ensureOpenClawCliOnPath } from "./path-env-CXWUFfFv.js";
-import "./tailscale-DU6DgqVy.js";
-import { i as resolveGatewayAuth } from "./auth-BcNHFK-i.js";
-import { t as GatewayClient } from "./client-DMloFP_O.js";
-import { t as buildGatewayConnectionDetails } from "./call-7yrB6v4I.js";
-import { h as GATEWAY_CLIENT_NAMES, m as GATEWAY_CLIENT_MODES } from "./message-channel-BlgPSDAh.js";
+import { A as theme, p as defaultRuntime } from "./entry.js";
+import "./auth-profiles-ByNs3eEm.js";
+import "./utils-BLJAc3ZV.js";
+import "./exec-CACT5OAW.js";
+import "./agent-scope-CsRbLH4l.js";
+import "./github-copilot-token-Cfs0Wxr8.js";
+import { M as VERSION, i as loadConfig } from "./config-Bdhomfei.js";
+import "./manifest-registry-u0okVSkU.js";
+import { i as resolveGatewayAuth } from "./auth-9x3lqfIY.js";
+import { t as ensureOpenClawCliOnPath } from "./path-env-CLvYNwtL.js";
+import { t as GatewayClient } from "./client-CTwXnRl7.js";
+import { t as buildGatewayConnectionDetails } from "./call-DVYCIV8m.js";
+import { h as GATEWAY_CLIENT_NAMES, m as GATEWAY_CLIENT_MODES } from "./message-channel-C_MmebBt.js";
 import { t as isMainModule } from "./is-main-qJ675wPV.js";
-import { t as formatDocsLink } from "./links-7M-j83As.js";
+import { t as formatDocsLink } from "./links-B8LAzWwg.js";
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { randomUUID } from "node:crypto";

package/dist/{agent-Bz1r5O8q.js → agent-BvNJF5QL.js}

@@ -1,19 +1,20 @@
-import { c as defaultRuntime, h as DEFAULT_CHAT_CHANNEL } from "./subsystem-Bh1Y_6Uv.js";
-import { H as normalizeThinkLevel, I as formatThinkingLevels, K as supportsXHighThinking, L as formatXHighModelHint, W as normalizeVerboseLevel } from "./pi-embedded-helpers-DYH6OWft.js";
-import { $t as getSkillsSnapshotVersion, Bt as getRemoteSkillEligibility, Cr as applyVerboseOverride, Gr as resolveAgentTimeoutMs, In as registerAgentRunContext, L as runWithModelFallback, M as resolveOutboundTarget, Mn as clearAgentRunContext, N as resolveSessionDeliveryTarget, Nn as emitAgentEvent, Or as loadModelCatalog, Sr as applyModelOverrideToSessionEntry, br as lookupContextTokens, i as runCliAgent, jn as AGENT_LANE_NESTED, l as runEmbeddedPiAgent, n as getCliSessionId, r as setCliSessionId, s as resolveSendPolicy, xr as clearSessionAuthProfileOverride } from "./reply--b7BsXGP.js";
+import { c as defaultRuntime, h as DEFAULT_CHAT_CHANNEL } from "./subsystem-BoExtIHo.js";
+import { J as supportsXHighThinking, K as normalizeVerboseLevel, R as formatThinkingLevels, W as normalizeThinkLevel, z as formatXHighModelHint } from "./pi-embedded-helpers-CMKLjW6X.js";
+import { $t as getSkillsSnapshotVersion, Bt as getRemoteSkillEligibility, Cr as clearSessionAuthProfileOverride, In as registerAgentRunContext, L as runWithModelFallback, M as resolveOutboundTarget, Mn as clearAgentRunContext, N as resolveSessionDeliveryTarget, Nn as emitAgentEvent, Sr as lookupContextTokens, Tr as applyVerboseOverride, Ur as resolveAgentTimeoutMs, i as runCliAgent, jn as AGENT_LANE_NESTED, l as runEmbeddedPiAgent, n as getCliSessionId, r as setCliSessionId, s as resolveSendPolicy, wr as applyModelOverrideToSessionEntry } from "./reply-DICXkh_C.js";
 import { d as resolveAgentIdFromSessionKey, l as normalizeAgentId, u as normalizeMainKey } from "./session-key-BWxPj0z_.js";
-import { a as resolveAgentModelPrimary, i as resolveAgentModelFallbacksOverride, o as resolveAgentSkillsFilter, r as resolveAgentDir, s as resolveAgentWorkspaceDir, t as listAgentIds, x as ensureAgentWorkspace } from "./agent-scope-CGmuusG9.js";
-import { Dt as DEFAULT_MODEL, Et as DEFAULT_CONTEXT_TOKENS, Ot as DEFAULT_PROVIDER, a as isCliProvider, d as resolveConfiguredModelRef, h as resolveThinkingDefault, ht as ensureAuthProfileStore, o as modelKey, t as buildAllowedModelSet } from "./model-selection-BK7DuyH8.js";
+import { a as resolveAgentModelPrimary, i as resolveAgentModelFallbacksOverride, o as resolveAgentSkillsFilter, r as resolveAgentDir, s as resolveAgentWorkspaceDir, t as listAgentIds, x as ensureAgentWorkspace } from "./agent-scope-CQCus0rI.js";
+import { Dt as DEFAULT_MODEL, Et as DEFAULT_CONTEXT_TOKENS, Ot as DEFAULT_PROVIDER, a as isCliProvider, d as resolveConfiguredModelRef, h as resolveThinkingDefault, ht as ensureAuthProfileStore, o as modelKey, t as buildAllowedModelSet } from "./model-selection-BLuqsGVB.js";
 import { t as formatCliCommand } from "./command-format-ChfKqObn.js";
-import { i as loadConfig } from "./config--NUdpACy.js";
-import { r as normalizeChannelId, t as getChannelPlugin } from "./plugins-CNaHNND_.js";
-import { A as resolveSessionResetPolicy, D as resolveSessionKey, I as resolveExplicitAgentSessionKey, O as evaluateSessionFreshness, T as normalizeAccountId, d as loadSessionStore, g as updateSessionStore, j as resolveSessionResetType, k as resolveChannelResetConfig } from "./sandbox-DqUO2K83.js";
-import { r as buildWorkspaceSkillSnapshot } from "./skills-ccAgQ3Ad.js";
-import { a as isInternalMessageChannel, d as resolveMessageChannel, i as isGatewayMessageChannel, l as normalizeMessageChannel, n as isDeliverableMessageChannel, t as INTERNAL_MESSAGE_CHANNEL } from "./message-channel-Cu61-7H6.js";
-import { n as resolveSessionFilePath, o as resolveStorePath } from "./paths-Bkhd_qY8.js";
-import { a as normalizeOutboundPayloadsForJson, i as normalizeOutboundPayloads, r as formatOutboundPayloadLog, t as deliverOutboundPayloads } from "./deliver-T9d44OpZ.js";
-import { l as deriveSessionTotalTokens, u as hasNonzeroUsage } from "./session-cost-usage-PvyVZz-g.js";
-import { t as createDefaultDeps } from "./deps-DFQdAWQc.js";
+import { i as loadConfig } from "./config-aFQssWKX.js";
+import { r as normalizeChannelId, t as getChannelPlugin } from "./plugins-X7d_tfTE.js";
+import { A as resolveSessionResetPolicy, D as resolveSessionKey, I as resolveExplicitAgentSessionKey, O as evaluateSessionFreshness, T as normalizeAccountId, d as loadSessionStore, g as updateSessionStore, j as resolveSessionResetType, k as resolveChannelResetConfig } from "./sandbox-Bhjnh1Xg.js";
+import { s as loadModelCatalog } from "./runner-D_dujMod.js";
+import { r as buildWorkspaceSkillSnapshot } from "./skills-DprQj9X2.js";
+import { a as isInternalMessageChannel, d as resolveMessageChannel, i as isGatewayMessageChannel, l as normalizeMessageChannel, n as isDeliverableMessageChannel, t as INTERNAL_MESSAGE_CHANNEL } from "./message-channel-BLi2a6Yw.js";
+import { n as resolveSessionFilePath, s as resolveStorePath } from "./paths-B49s6UZQ.js";
+import { a as normalizeOutboundPayloadsForJson, i as normalizeOutboundPayloads, r as formatOutboundPayloadLog, t as deliverOutboundPayloads } from "./deliver-LsxKETro.js";
+import { l as deriveSessionTotalTokens, u as hasNonzeroUsage } from "./session-cost-usage-D7HuoSSD.js";
+import { t as createDefaultDeps } from "./deps-lAAA2zYI.js";
 import crypto from "node:crypto";
 
 //#region src/cli/outbound-send-deps.ts
@@ -249,6 +250,7 @@ function resolveAgentRunContext(opts) {
 async function updateSessionStoreAfterAgentRun(params) {
 	const { cfg, sessionId, sessionKey, storePath, sessionStore, defaultProvider, defaultModel, fallbackProvider, fallbackModel, result } = params;
 	const usage = result.meta.agentMeta?.usage;
+	const promptTokens = result.meta.agentMeta?.promptTokens;
 	const compactionsThisRun = Math.max(0, result.meta.agentMeta?.compactionCount ?? 0);
 	const modelUsed = result.meta.agentMeta?.model ?? fallbackModel ?? defaultModel;
 	const providerUsed = result.meta.agentMeta?.provider ?? fallbackProvider ?? defaultProvider;
@@ -277,7 +279,8 @@ async function updateSessionStoreAfterAgentRun(params) {
 		next.outputTokens = output;
 		next.totalTokens = deriveSessionTotalTokens({
 			usage,
-			contextTokens
+			contextTokens,
+			promptTokens
 		}) ?? input;
 	}
 	if (compactionsThisRun > 0) next.compactionCount = (entry.compactionCount ?? 0) + compactionsThisRun;
@@ -642,6 +645,7 @@ async function agentCommand(opts, runtime = defaultRuntime, deps = createDefault
 						lane: opts.lane,
 						abortSignal: opts.abortSignal,
 						extraSystemPrompt: opts.extraSystemPrompt,
+						inputProvenance: opts.inputProvenance,
 						streamParams: opts.streamParams,
 						agentDir,
 						onAgentEvent: (evt) => {

package/dist/{agent-22-R4bNS.js → agent-CyMxTyrG.js}

@@ -1,19 +1,20 @@
-import { $ as DEFAULT_CHAT_CHANNEL, p as defaultRuntime } from "./entry.js";
-import { C as buildAllowedModelSet, Ct as DEFAULT_CONTEXT_TOKENS, D as isCliProvider, L as resolveThinkingDefault, N as resolveConfiguredModelRef, O as modelKey, Tt as DEFAULT_PROVIDER, _ as ensureAuthProfileStore, wt as DEFAULT_MODEL } from "./auth-profiles-Bv1AEm-Y.js";
-import { t as formatCliCommand } from "./command-format-ayFsmwwz.js";
+import { p as defaultRuntime, tt as DEFAULT_CHAT_CHANNEL } from "./entry.js";
+import { C as buildAllowedModelSet, Ct as DEFAULT_CONTEXT_TOKENS, D as isCliProvider, L as resolveThinkingDefault, N as resolveConfiguredModelRef, O as modelKey, Tt as DEFAULT_PROVIDER, _ as ensureAuthProfileStore, wt as DEFAULT_MODEL } from "./auth-profiles-ByNs3eEm.js";
+import { t as formatCliCommand } from "./command-format-Bxe0mWee.js";
 import { d as resolveAgentIdFromSessionKey, l as normalizeAgentId, u as normalizeMainKey } from "./session-key-DVvxnFKg.js";
-import { a as resolveAgentModelPrimary, i as resolveAgentModelFallbacksOverride, o as resolveAgentSkillsFilter, r as resolveAgentDir, s as resolveAgentWorkspaceDir, t as listAgentIds, x as ensureAgentWorkspace } from "./agent-scope-DQuy3dwI.js";
-import { i as loadConfig } from "./config-B00lvFac.js";
-import { a as isInternalMessageChannel, d as resolveMessageChannel, i as isGatewayMessageChannel, l as normalizeMessageChannel, n as isDeliverableMessageChannel, t as INTERNAL_MESSAGE_CHANNEL } from "./message-channel-BlgPSDAh.js";
-import { r as normalizeChannelId, t as getChannelPlugin } from "./plugins-Db5BiELK.js";
-import { An as runWithModelFallback, At as runEmbeddedPiAgent, En as resolveSessionDeliveryTarget, G as setCliSessionId, Ht as resolveAgentTimeoutMs, K as runCliAgent, Qt as applyModelOverrideToSessionEntry, Tn as resolveOutboundTarget, Ut as clearAgentRunContext, W as getCliSessionId, Wt as emitAgentEvent, X as getRemoteSkillEligibility, Xt as AGENT_LANE_NESTED, Y as resolveSendPolicy, Zt as loadModelCatalog, dt as clearSessionAuthProfileOverride, ft as applyVerboseOverride, gn as lookupContextTokens, lt as getSkillsSnapshotVersion, qt as registerAgentRunContext } from "./loader-wXwp4rZJ.js";
-import { n as resolveSessionFilePath, o as resolveStorePath } from "./paths-IivnSNkP.js";
-import { B as normalizeThinkLevel, F as formatXHighModelHint, H as normalizeVerboseLevel, P as formatThinkingLevels, W as supportsXHighThinking } from "./pi-embedded-helpers-Bkpd4fTr.js";
-import { a as normalizeOutboundPayloadsForJson, i as normalizeOutboundPayloads, r as formatOutboundPayloadLog, t as deliverOutboundPayloads } from "./deliver-hf-WKyWd.js";
-import { A as resolveSessionResetType, D as evaluateSessionFreshness, E as resolveSessionKey, F as resolveExplicitAgentSessionKey, O as resolveChannelResetConfig, T as normalizeAccountId, d as loadSessionStore, g as updateSessionStore, k as resolveSessionResetPolicy } from "./sandbox-Aks-9EcZ.js";
-import { r as buildWorkspaceSkillSnapshot } from "./skills-D5UZZZSY.js";
-import { l as deriveSessionTotalTokens, u as hasNonzeroUsage } from "./session-cost-usage-CcCEQNuc.js";
-import { t as createDefaultDeps } from "./deps-Bv1kLtwo.js";
+import { a as resolveAgentModelPrimary, i as resolveAgentModelFallbacksOverride, o as resolveAgentSkillsFilter, r as resolveAgentDir, s as resolveAgentWorkspaceDir, t as listAgentIds, x as ensureAgentWorkspace } from "./agent-scope-CsRbLH4l.js";
+import { i as loadConfig } from "./config-Bdhomfei.js";
+import { a as isInternalMessageChannel, d as resolveMessageChannel, i as isGatewayMessageChannel, l as normalizeMessageChannel, n as isDeliverableMessageChannel, t as INTERNAL_MESSAGE_CHANNEL } from "./message-channel-C_MmebBt.js";
+import { r as normalizeChannelId, t as getChannelPlugin } from "./plugins-4Hqd1WGf.js";
+import { At as runEmbeddedPiAgent, Cn as runWithModelFallback, G as setCliSessionId, Gt as applyModelOverrideToSessionEntry, It as resolveAgentTimeoutMs, K as runCliAgent, Lt as clearAgentRunContext, Rt as emitAgentEvent, Vt as registerAgentRunContext, W as getCliSessionId, Wt as AGENT_LANE_NESTED, X as getRemoteSkillEligibility, Y as resolveSendPolicy, dt as clearSessionAuthProfileOverride, ft as applyVerboseOverride, ln as lookupContextTokens, lt as getSkillsSnapshotVersion, vn as resolveOutboundTarget, yn as resolveSessionDeliveryTarget } from "./loader-KjT074JR.js";
+import { a as normalizeOutboundPayloadsForJson, i as normalizeOutboundPayloads, r as formatOutboundPayloadLog, t as deliverOutboundPayloads } from "./deliver-CIU9Npgs.js";
+import { n as resolveSessionFilePath, s as resolveStorePath } from "./paths-DLINmNFQ.js";
+import { H as normalizeThinkLevel, I as formatThinkingLevels, K as supportsXHighThinking, L as formatXHighModelHint, W as normalizeVerboseLevel } from "./pi-embedded-helpers-DfwkwPYD.js";
+import { A as resolveSessionResetType, D as evaluateSessionFreshness, E as resolveSessionKey, F as resolveExplicitAgentSessionKey, O as resolveChannelResetConfig, T as normalizeAccountId, d as loadSessionStore, g as updateSessionStore, k as resolveSessionResetPolicy } from "./sandbox-BKYnhYQH.js";
+import { r as buildWorkspaceSkillSnapshot } from "./skills-DRjfSQT3.js";
+import { l as deriveSessionTotalTokens, u as hasNonzeroUsage } from "./session-cost-usage-D9hHANWI.js";
+import { _ as loadModelCatalog } from "./runner-CY0nmVme.js";
+import { t as createDefaultDeps } from "./deps-QSwGcoNZ.js";
 import crypto from "node:crypto";
 
 //#region src/cli/outbound-send-deps.ts
@@ -249,6 +250,7 @@ function resolveAgentRunContext(opts) {
 async function updateSessionStoreAfterAgentRun(params) {
 	const { cfg, sessionId, sessionKey, storePath, sessionStore, defaultProvider, defaultModel, fallbackProvider, fallbackModel, result } = params;
 	const usage = result.meta.agentMeta?.usage;
+	const promptTokens = result.meta.agentMeta?.promptTokens;
 	const compactionsThisRun = Math.max(0, result.meta.agentMeta?.compactionCount ?? 0);
 	const modelUsed = result.meta.agentMeta?.model ?? fallbackModel ?? defaultModel;
 	const providerUsed = result.meta.agentMeta?.provider ?? fallbackProvider ?? defaultProvider;
@@ -277,7 +279,8 @@ async function updateSessionStoreAfterAgentRun(params) {
 		next.outputTokens = output;
 		next.totalTokens = deriveSessionTotalTokens({
 			usage,
-			contextTokens
+			contextTokens,
+			promptTokens
 		}) ?? input;
 	}
 	if (compactionsThisRun > 0) next.compactionCount = (entry.compactionCount ?? 0) + compactionsThisRun;
@@ -642,6 +645,7 @@ async function agentCommand(opts, runtime = defaultRuntime, deps = createDefault
 						lane: opts.lane,
 						abortSignal: opts.abortSignal,
 						extraSystemPrompt: opts.extraSystemPrompt,
+						inputProvenance: opts.inputProvenance,
 						streamParams: opts.streamParams,
 						agentDir,
 						onAgentEvent: (evt) => {

package/dist/{agent-scope-D8miw9q_.js → agent-scope-BIEhVP4_.js}

@@ -1,13 +1,177 @@
 import { s as resolveStateDir, u as resolveRequiredHomeDir } from "./paths-BZtyHNCi.js";
-import { g as parseAgentSessionKey, h as isSubagentSessionKey, l as normalizeAgentId, n as DEFAULT_AGENT_ID } from "./session-key-nXYQSv-a.js";
-import { g as resolveUserPath, p as pathExists } from "./utils-dp_OM900.js";
-import { t as runCommandWithTimeout } from "./exec-CijMSZd9.js";
+import { I as pathExists, t as runCommandWithTimeout, z as resolveUserPath } from "./exec-B8lXct-k.js";
 import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import fs$1 from "node:fs";
 import { fileURLToPath } from "node:url";
 
+//#region src/sessions/session-key-utils.ts
+function parseAgentSessionKey(sessionKey) {
+	const raw = (sessionKey ?? "").trim();
+	if (!raw) return null;
+	const parts = raw.split(":").filter(Boolean);
+	if (parts.length < 3) return null;
+	if (parts[0] !== "agent") return null;
+	const agentId = parts[1]?.trim();
+	const rest = parts.slice(2).join(":");
+	if (!agentId || !rest) return null;
+	return {
+		agentId,
+		rest
+	};
+}
+function isSubagentSessionKey(sessionKey) {
+	const raw = (sessionKey ?? "").trim();
+	if (!raw) return false;
+	if (raw.toLowerCase().startsWith("subagent:")) return true;
+	const parsed = parseAgentSessionKey(raw);
+	return Boolean((parsed?.rest ?? "").toLowerCase().startsWith("subagent:"));
+}
+function isAcpSessionKey(sessionKey) {
+	const raw = (sessionKey ?? "").trim();
+	if (!raw) return false;
+	if (raw.toLowerCase().startsWith("acp:")) return true;
+	const parsed = parseAgentSessionKey(raw);
+	return Boolean((parsed?.rest ?? "").toLowerCase().startsWith("acp:"));
+}
+const THREAD_SESSION_MARKERS = [":thread:", ":topic:"];
+function resolveThreadParentSessionKey(sessionKey) {
+	const raw = (sessionKey ?? "").trim();
+	if (!raw) return null;
+	const normalized = raw.toLowerCase();
+	let idx = -1;
+	for (const marker of THREAD_SESSION_MARKERS) {
+		const candidate = normalized.lastIndexOf(marker);
+		if (candidate > idx) idx = candidate;
+	}
+	if (idx <= 0) return null;
+	const parent = raw.slice(0, idx).trim();
+	return parent ? parent : null;
+}
+
+//#endregion
+//#region src/routing/session-key.ts
+const DEFAULT_AGENT_ID = "main";
+const DEFAULT_MAIN_KEY = "main";
+const DEFAULT_ACCOUNT_ID = "default";
+const VALID_ID_RE = /^[a-z0-9][a-z0-9_-]{0,63}$/i;
+const INVALID_CHARS_RE = /[^a-z0-9_-]+/g;
+const LEADING_DASH_RE = /^-+/;
+const TRAILING_DASH_RE = /-+$/;
+function normalizeToken(value) {
+	return (value ?? "").trim().toLowerCase();
+}
+function normalizeMainKey(value) {
+	const trimmed = (value ?? "").trim();
+	return trimmed ? trimmed.toLowerCase() : DEFAULT_MAIN_KEY;
+}
+function resolveAgentIdFromSessionKey(sessionKey) {
+	return normalizeAgentId(parseAgentSessionKey(sessionKey)?.agentId ?? DEFAULT_AGENT_ID);
+}
+function classifySessionKeyShape(sessionKey) {
+	const raw = (sessionKey ?? "").trim();
+	if (!raw) return "missing";
+	if (parseAgentSessionKey(raw)) return "agent";
+	return raw.toLowerCase().startsWith("agent:") ? "malformed_agent" : "legacy_or_alias";
+}
+function normalizeAgentId(value) {
+	const trimmed = (value ?? "").trim();
+	if (!trimmed) return DEFAULT_AGENT_ID;
+	if (VALID_ID_RE.test(trimmed)) return trimmed.toLowerCase();
+	return trimmed.toLowerCase().replace(INVALID_CHARS_RE, "-").replace(LEADING_DASH_RE, "").replace(TRAILING_DASH_RE, "").slice(0, 64) || DEFAULT_AGENT_ID;
+}
+function sanitizeAgentId(value) {
+	const trimmed = (value ?? "").trim();
+	if (!trimmed) return DEFAULT_AGENT_ID;
+	if (VALID_ID_RE.test(trimmed)) return trimmed.toLowerCase();
+	return trimmed.toLowerCase().replace(INVALID_CHARS_RE, "-").replace(LEADING_DASH_RE, "").replace(TRAILING_DASH_RE, "").slice(0, 64) || DEFAULT_AGENT_ID;
+}
+function normalizeAccountId(value) {
+	const trimmed = (value ?? "").trim();
+	if (!trimmed) return DEFAULT_ACCOUNT_ID;
+	if (VALID_ID_RE.test(trimmed)) return trimmed.toLowerCase();
+	return trimmed.toLowerCase().replace(INVALID_CHARS_RE, "-").replace(LEADING_DASH_RE, "").replace(TRAILING_DASH_RE, "").slice(0, 64) || DEFAULT_ACCOUNT_ID;
+}
+function buildAgentMainSessionKey(params) {
+	return `agent:${normalizeAgentId(params.agentId)}:${normalizeMainKey(params.mainKey)}`;
+}
+function buildAgentPeerSessionKey(params) {
+	const peerKind = params.peerKind ?? "direct";
+	if (peerKind === "direct") {
+		const dmScope = params.dmScope ?? "main";
+		let peerId = (params.peerId ?? "").trim();
+		const linkedPeerId = dmScope === "main" ? null : resolveLinkedPeerId({
+			identityLinks: params.identityLinks,
+			channel: params.channel,
+			peerId
+		});
+		if (linkedPeerId) peerId = linkedPeerId;
+		peerId = peerId.toLowerCase();
+		if (dmScope === "per-account-channel-peer" && peerId) {
+			const channel = (params.channel ?? "").trim().toLowerCase() || "unknown";
+			const accountId = normalizeAccountId(params.accountId);
+			return `agent:${normalizeAgentId(params.agentId)}:${channel}:${accountId}:direct:${peerId}`;
+		}
+		if (dmScope === "per-channel-peer" && peerId) {
+			const channel = (params.channel ?? "").trim().toLowerCase() || "unknown";
+			return `agent:${normalizeAgentId(params.agentId)}:${channel}:direct:${peerId}`;
+		}
+		if (dmScope === "per-peer" && peerId) return `agent:${normalizeAgentId(params.agentId)}:direct:${peerId}`;
+		return buildAgentMainSessionKey({
+			agentId: params.agentId,
+			mainKey: params.mainKey
+		});
+	}
+	const channel = (params.channel ?? "").trim().toLowerCase() || "unknown";
+	const peerId = ((params.peerId ?? "").trim() || "unknown").toLowerCase();
+	return `agent:${normalizeAgentId(params.agentId)}:${channel}:${peerKind}:${peerId}`;
+}
+function resolveLinkedPeerId(params) {
+	const identityLinks = params.identityLinks;
+	if (!identityLinks) return null;
+	const peerId = params.peerId.trim();
+	if (!peerId) return null;
+	const candidates = /* @__PURE__ */ new Set();
+	const rawCandidate = normalizeToken(peerId);
+	if (rawCandidate) candidates.add(rawCandidate);
+	const channel = normalizeToken(params.channel);
+	if (channel) {
+		const scopedCandidate = normalizeToken(`${channel}:${peerId}`);
+		if (scopedCandidate) candidates.add(scopedCandidate);
+	}
+	if (candidates.size === 0) return null;
+	for (const [canonical, ids] of Object.entries(identityLinks)) {
+		const canonicalName = canonical.trim();
+		if (!canonicalName) continue;
+		if (!Array.isArray(ids)) continue;
+		for (const id of ids) {
+			const normalized = normalizeToken(id);
+			if (normalized && candidates.has(normalized)) return canonicalName;
+		}
+	}
+	return null;
+}
+function buildGroupHistoryKey(params) {
+	const channel = normalizeToken(params.channel) || "unknown";
+	const accountId = normalizeAccountId(params.accountId);
+	const peerId = params.peerId.trim().toLowerCase() || "unknown";
+	return `${channel}:${accountId}:${params.peerKind}:${peerId}`;
+}
+function resolveThreadSessionKeys(params) {
+	const threadId = (params.threadId ?? "").trim();
+	if (!threadId) return {
+		sessionKey: params.baseSessionKey,
+		parentSessionKey: void 0
+	};
+	const normalizedThreadId = threadId.toLowerCase();
+	return {
+		sessionKey: params.useSuffix ?? true ? `${params.baseSessionKey}:thread:${normalizedThreadId}` : params.baseSessionKey,
+		parentSessionKey: params.parentSessionKey
+	};
+}
+
+//#endregion
 //#region src/infra/openclaw-root.ts
 const CORE_PACKAGE_NAMES = new Set(["openclaw", "activeclaw"]);
 async function readPackageName(dir) {
@@ -53,6 +217,10 @@ function findPackageRootSync(startDir, maxDepth = 12) {
 function candidateDirsFromArgv1(argv1) {
 	const normalized = path.resolve(argv1);
 	const candidates = [path.dirname(normalized)];
+	try {
+		const resolved = fs$1.realpathSync(normalized);
+		if (resolved !== normalized) candidates.push(path.dirname(resolved));
+	} catch {}
 	const parts = normalized.split(path.sep);
 	const binIndex = parts.lastIndexOf(".bin");
 	if (binIndex > 0 && parts[binIndex - 1] === "node_modules") {
@@ -439,4 +607,4 @@ function resolveAgentDir(cfg, agentId) {
 }
 
 //#endregion
-export { resolveOpenClawPackageRootSync as C, resolveOpenClawPackageRoot as S, DEFAULT_TOOLS_FILENAME as _, resolveAgentModelPrimary as a, filterBootstrapFilesForSession as b, resolveDefaultAgentId as c, DEFAULT_AGENTS_FILENAME as d, DEFAULT_AGENT_WORKSPACE_DIR as f, DEFAULT_SOUL_FILENAME as g, DEFAULT_IDENTITY_FILENAME as h, resolveAgentModelFallbacksOverride as i, resolveSessionAgentId as l, DEFAULT_HEARTBEAT_FILENAME as m, resolveAgentConfig as n, resolveAgentSkillsFilter as o, DEFAULT_BOOTSTRAP_FILENAME as p, resolveAgentDir as r, resolveAgentWorkspaceDir as s, listAgentIds as t, resolveSessionAgentIds as u, DEFAULT_USER_FILENAME as v, loadWorkspaceBootstrapFiles as x, ensureAgentWorkspace as y };
+export { classifySessionKeyShape as A, resolveThreadParentSessionKey as B, resolveOpenClawPackageRootSync as C, buildAgentMainSessionKey as D, DEFAULT_MAIN_KEY as E, resolveThreadSessionKeys as F, sanitizeAgentId as I, isAcpSessionKey as L, normalizeAgentId as M, normalizeMainKey as N, buildAgentPeerSessionKey as O, resolveAgentIdFromSessionKey as P, isSubagentSessionKey as R, resolveOpenClawPackageRoot as S, DEFAULT_AGENT_ID as T, DEFAULT_TOOLS_FILENAME as _, resolveAgentModelPrimary as a, filterBootstrapFilesForSession as b, resolveDefaultAgentId as c, DEFAULT_AGENTS_FILENAME as d, DEFAULT_AGENT_WORKSPACE_DIR as f, DEFAULT_SOUL_FILENAME as g, DEFAULT_IDENTITY_FILENAME as h, resolveAgentModelFallbacksOverride as i, normalizeAccountId as j, buildGroupHistoryKey as k, resolveSessionAgentId as l, DEFAULT_HEARTBEAT_FILENAME as m, resolveAgentConfig as n, resolveAgentSkillsFilter as o, DEFAULT_BOOTSTRAP_FILENAME as p, resolveAgentDir as r, resolveAgentWorkspaceDir as s, listAgentIds as t, resolveSessionAgentIds as u, DEFAULT_USER_FILENAME as v, DEFAULT_ACCOUNT_ID as w, loadWorkspaceBootstrapFiles as x, ensureAgentWorkspace as y, parseAgentSessionKey as z };

package/dist/{agent-scope-CGmuusG9.js → agent-scope-CQCus0rI.js}

@@ -1,8 +1,8 @@
 import { g as resolveStateDir, y as resolveRequiredHomeDir } from "./paths-DVBShlw6.js";
-import { b as resolveUserPath, g as pathExists } from "./utils-es4ygvQ-.js";
+import { b as resolveUserPath, g as pathExists } from "./utils-Cd9QdCHh.js";
 import { l as normalizeAgentId, n as DEFAULT_AGENT_ID, v as isSubagentSessionKey, y as parseAgentSessionKey } from "./session-key-BWxPj0z_.js";
-import { t as runCommandWithTimeout } from "./exec-Cv_Ofd1m.js";
-import { t as resolveOpenClawPackageRoot } from "./openclaw-root-JLDMp6ux.js";
+import { t as runCommandWithTimeout } from "./exec-YIosokWE.js";
+import { t as resolveOpenClawPackageRoot } from "./openclaw-root-1VeFrph_.js";
 import { fileURLToPath } from "node:url";
 import os from "node:os";
 import path from "node:path";

package/dist/{agent-scope-DQuy3dwI.js → agent-scope-CsRbLH4l.js}

@@ -1,8 +1,8 @@
-import { X as resolveStateDir, pt as resolveRequiredHomeDir } from "./entry.js";
+import { Z as resolveStateDir, ht as resolveRequiredHomeDir } from "./entry.js";
 import { l as normalizeAgentId, n as DEFAULT_AGENT_ID, v as isSubagentSessionKey, y as parseAgentSessionKey } from "./session-key-DVvxnFKg.js";
-import { h as pathExists, y as resolveUserPath } from "./utils-Dk86IbEs.js";
-import { t as runCommandWithTimeout } from "./exec-B8JKbXKW.js";
-import { t as resolveOpenClawPackageRoot } from "./openclaw-root-Dw6gumSU.js";
+import { h as pathExists, y as resolveUserPath } from "./utils-BLJAc3ZV.js";
+import { t as runCommandWithTimeout } from "./exec-CACT5OAW.js";
+import { t as resolveOpenClawPackageRoot } from "./openclaw-root-BNlEap4i.js";
 import path from "node:path";
 import os from "node:os";
 import fs from "node:fs/promises";