activeclaw 2026.2.12 → 2026.2.13

package/CHANGELOG.md

@@ -2,18 +2,38 @@
 
 Docs: https://docs.openclaw.ai
 
+## 2026.2.13 (Unreleased)
+
+### Fixes
+
+- Onboarding/CLI: restore terminal state without resuming paused `stdin`, so onboarding exits cleanly after choosing Web UI and the installer returns instead of appearing stuck.
+
 ## 2026.2.12
 
 ### Changes
 
+- CLI/Plugins: add `openclaw plugins uninstall <id>` with `--dry-run`, `--force`, and `--keep-files` options, including safe uninstall path handling and plugin uninstall docs. (#5985) Thanks @JustasMonkev.
 - CLI: add `openclaw logs --local-time` to display log timestamps in local timezone. (#13818) Thanks @xialonglee.
 - Telegram: render blockquotes as native `<blockquote>` tags instead of stripping them. (#14608)
+- Telegram: expose `/compact` in the native command menu. (#10352) Thanks @akramcodez.
+- Discord: add role-based allowlists and role-based agent routing. (#10650) Thanks @Minidoracat.
 - Config: avoid redacting `maxTokens`-like fields during config snapshot redaction, preventing round-trip validation failures in `/config`. (#14006) Thanks @constansino.
 
+### Breaking
+
+- Hooks: `POST /hooks/agent` now rejects payload `sessionKey` overrides by default. To keep fixed hook context, set `hooks.defaultSessionKey` (recommended with `hooks.allowedSessionKeyPrefixes: ["hook:"]`). If you need legacy behavior, explicitly set `hooks.allowRequestSessionKey: true`. Thanks @alpernae for reporting.
+
 ### Fixes
 
+- Gateway/OpenResponses: harden URL-based `input_file`/`input_image` handling with explicit SSRF deny policy, hostname allowlists (`files.urlAllowlist` / `images.urlAllowlist`), per-request URL input caps (`maxUrlParts`), blocked-fetch audit logging, and regression coverage/docs updates.
 - Security: fix unauthenticated Nostr profile API remote config tampering. (#13719) Thanks @coygeek.
 - Security: remove bundled soul-evil hook. (#14757) Thanks @Imccccc.
+- Security/Audit: add hook session-routing hardening checks (`hooks.defaultSessionKey`, `hooks.allowRequestSessionKey`, and prefix allowlists), and warn when HTTP API endpoints allow explicit session-key routing.
+- Security/Sandbox: confine mirrored skill sync destinations to the sandbox `skills/` root and stop using frontmatter-controlled skill names as filesystem destination paths. Thanks @1seal.
+- Security/Web tools: treat browser/web content as untrusted by default (wrapped outputs for browser snapshot/tabs/console and structured external-content metadata for web tools), and strip `toolResult.details` from model-facing transcript/compaction inputs to reduce prompt-injection replay risk.
+- Security/Hooks: harden webhook and device token verification with shared constant-time secret comparison, and add per-client auth-failure throttling for hook endpoints (`429` + `Retry-After`). Thanks @akhmittra.
+- Security/Browser: require auth for loopback browser control HTTP routes, auto-generate `gateway.auth.token` when browser control starts without auth, and add a security-audit check for unauthenticated browser control. Thanks @tcusolle.
+- Sessions/Gateway: harden transcript path resolution and reject unsafe session IDs/file paths so session operations stay within agent sessions directories. Thanks @akhmittra.
 - Gateway: raise WS payload/buffer limits so 5,000,000-byte image attachments work reliably. (#14486) Thanks @0xRaini.
 - Logging/CLI: use local timezone timestamps for console prefixing, and include `±HH:MM` offsets when using `openclaw logs --local-time` to avoid ambiguity. (#14771) Thanks @0xRaini.
 - Gateway: drain active turns before restart to prevent message loss. (#13931) Thanks @0xRaini.
@@ -28,6 +48,9 @@ Docs: https://docs.openclaw.ai
 - Cron: prevent duplicate fires when multiple jobs trigger simultaneously. (#14256) Thanks @xinhuagu.
 - Cron: isolate scheduler errors so one bad job does not break all jobs. (#14385) Thanks @MarvinDontPanic.
 - Cron: prevent one-shot `at` jobs from re-firing on restart after skipped/errored runs. (#13878) Thanks @lailoo.
+- Heartbeat: prevent scheduler stalls on unexpected run errors and avoid immediate rerun loops after `requests-in-flight` skips. (#14901) Thanks @joeykrug.
+- Cron: honor stored session model overrides for isolated-agent runs while preserving `hooks.gmail.model` precedence for Gmail hook sessions. (#14983) Thanks @shtse8.
+- Logging/Browser: fall back to `os.tmpdir()/openclaw` for default log, browser trace, and browser download temp paths when `/tmp/openclaw` is unavailable.
 - WhatsApp: convert Markdown bold/strikethrough to WhatsApp formatting. (#14285) Thanks @Raikan10.
 - WhatsApp: allow media-only sends and normalize leading blank payloads. (#14408) Thanks @karimnaguib.
 - WhatsApp: default MIME type for voice messages when Baileys omits it. (#14444) Thanks @mcaxtr.
@@ -36,12 +59,22 @@ Docs: https://docs.openclaw.ai
 - BlueBubbles: fix webhook auth bypass via loopback proxy trust. (#13787) Thanks @coygeek.
 - Slack: change default replyToMode from "off" to "all". (#14364) Thanks @nm-de.
 - Slack: detect control commands when channel messages start with bot mention prefixes (for example, `@Bot /new`). (#14142) Thanks @beefiker.
+- Signal: enforce E.164 validation for the Signal bot account prompt so mistyped numbers are caught early. (#15063) Thanks @Duartemartins.
+- Discord: process DM reactions instead of silently dropping them. (#10418) Thanks @mcaxtr.
+- Discord: treat Administrator as full permissions in channel permission checks. Thanks @thewilloftheshadow.
+- Discord: respect replyToMode in threads. (#11062) Thanks @cordx56.
+- Browser: add Chrome launch flag `--disable-blink-features=AutomationControlled` to reduce `navigator.webdriver` automation detection issues on reCAPTCHA-protected sites. (#10735) Thanks @Milofax.
+- Heartbeat: filter noise-only system events so scheduled reminder notifications do not fire when cron runs carry only heartbeat markers. (#13317) Thanks @pvtclawn.
+- Signal: render mention placeholders as `@uuid`/`@phone` so mention gating and Clawdbot targeting work. (#2013) Thanks @alexgleason.
+- Discord: omit empty content fields for media-only messages while preserving caption whitespace. (#9507) Thanks @leszekszpunar.
 - Onboarding/Providers: add Z.AI endpoint-specific auth choices (`zai-coding-global`, `zai-coding-cn`, `zai-global`, `zai-cn`) and expand default Z.AI model wiring. (#13456) Thanks @tomsun28.
+- Onboarding/Providers: update MiniMax API default/recommended models from M2.1 to M2.5, add M2.5/M2.5-Lightning model entries, and include `minimax-m2.5` in modern model filtering. (#14865) Thanks @adao-max.
 - Ollama: use configured `models.providers.ollama.baseUrl` for model discovery and normalize `/v1` endpoints to the native Ollama API root. (#14131) Thanks @shtse8.
 - Voice Call: pass Twilio stream auth token via `<Parameter>` instead of query string. (#14029) Thanks @mcwigglesmcgee.
 - Feishu: pass `Buffer` directly to the Feishu SDK upload APIs instead of `Readable.from(...)` to avoid form-data upload failures. (#10345) Thanks @youngerstyle.
 - Feishu: trigger mention-gated group handling only when the bot itself is mentioned (not just any mention). (#11088) Thanks @openperf.
 - Feishu: probe status uses the resolved account context for multi-account credential checks. (#11233) Thanks @onevcat.
+- Feishu: add streaming card replies via Card Kit API and preserve `renderMode=auto` fallback behavior for plain-text responses. (#10379) Thanks @xzq-xu.
 - Feishu DocX: preserve top-level converted block order using `firstLevelBlockIds` when writing/appending documents. (#13994) Thanks @Cynosure159.
 - Feishu plugin packaging: remove `workspace:*` `openclaw` dependency from `extensions/feishu` and sync lockfile for install compatibility. (#14423) Thanks @jackcooper2015.
 - CLI/Wizard: exit with code 1 when `configure`, `agents add`, or interactive `onboard` wizards are canceled, so `set -e` automation stops correctly. (#14156) Thanks @0xRaini.
@@ -60,6 +93,10 @@ Docs: https://docs.openclaw.ai
 - Agents: prevent file descriptor leaks in child process cleanup. (#13565) Thanks @KyleChen26.
 - Agents: prevent double compaction caused by cache TTL bypassing guard. (#13514) Thanks @taw0002.
 - Agents: use last API call's cache tokens for context display instead of accumulated sum. (#13805) Thanks @akari-musubi.
+- Agents: keep followup-runner session `totalTokens` aligned with post-compaction context by using last-call usage and shared token-accounting logic. (#14979) Thanks @shtse8.
+- Hooks/Plugins: wire 9 previously unwired plugin lifecycle hooks into core runtime paths (session, compaction, gateway, and outbound message hooks). (#14882) Thanks @shtse8.
+- Hooks/Tools: dispatch `before_tool_call` and `after_tool_call` hooks from both tool execution paths with rebased conflict fixes. (#15012) Thanks @Patrick-Barletta, @Takhoffman.
+- Discord: allow channel-edit to archive/lock threads and set auto-archive duration. (#5542) Thanks @stumct.
 - Discord tests: use a partial @buape/carbon mock in slash command coverage. (#13262) Thanks @arosstale.
 - Tests: update thread ID handling in Slack message collection tests. (#14108) Thanks @swizzmagik.
 

package/dist/{accounts-DbzMEfKN.js → accounts-DCDeFTra.js}

@@ -1,6 +1,6 @@
-import { A as getChildLogger, J as resolveOAuthDir, T as success, p as defaultRuntime, y as info } from "./entry.js";
+import { E as success, Y as resolveOAuthDir, j as getChildLogger, p as defaultRuntime, y as info } from "./entry.js";
 import { c as normalizeAccountId, t as DEFAULT_ACCOUNT_ID } from "./session-key-DVvxnFKg.js";
-import { p as jidToE164, y as resolveUserPath } from "./utils-Dk86IbEs.js";
+import { p as jidToE164, y as resolveUserPath } from "./utils-BLJAc3ZV.js";
 import path from "node:path";
 import fs from "node:fs";
 import fs$1 from "node:fs/promises";

package/dist/{accounts-DimKrt7j.js → accounts-DeqIQjo1.js}

@@ -1,6 +1,6 @@
 import { m as resolveOAuthDir } from "./paths-DVBShlw6.js";
-import { D as info, P as success, c as defaultRuntime, z as getChildLogger } from "./subsystem-Bv7dGhES.js";
-import { b as resolveUserPath, m as jidToE164 } from "./utils-BHPdZE4h.js";
+import { D as info, P as success, c as defaultRuntime, z as getChildLogger } from "./subsystem-BoExtIHo.js";
+import { b as resolveUserPath, m as jidToE164 } from "./utils-Cd9QdCHh.js";
 import { c as normalizeAccountId, t as DEFAULT_ACCOUNT_ID } from "./session-key-BWxPj0z_.js";
 import fs from "node:fs";
 import path from "node:path";

package/dist/{acp-cli-Cs1ai4XO.js → acp-cli-CeYI4XRd.js}

@@ -1,22 +1,21 @@
 import "./paths-DVBShlw6.js";
-import { R as theme, c as defaultRuntime } from "./subsystem-Bv7dGhES.js";
-import "./utils-BHPdZE4h.js";
-import "./exec-DXtR2fhb.js";
-import "./agent-scope---6LLHj0.js";
-import "./model-selection-unMJyUIE.js";
+import { R as theme, c as defaultRuntime } from "./subsystem-BoExtIHo.js";
+import "./utils-Cd9QdCHh.js";
+import "./exec-YIosokWE.js";
+import "./agent-scope-CQCus0rI.js";
+import "./model-selection-BLuqsGVB.js";
 import "./github-copilot-token-BW-SEg7E.js";
 import "./boolean-BgXe2hyu.js";
-import "./env-DE9xvYOL.js";
-import { M as VERSION, i as loadConfig } from "./config-DH9TLUNc.js";
-import "./manifest-registry-DFckk-L8.js";
-import { h as GATEWAY_CLIENT_NAMES, m as GATEWAY_CLIENT_MODES } from "./message-channel-0717wOz-.js";
-import { t as GatewayClient } from "./client-B0_GiCjB.js";
-import { t as buildGatewayConnectionDetails } from "./call-C9az806y.js";
-import { t as formatDocsLink } from "./links-CV4oki2u.js";
-import "./tailscale-DHfcfRCx.js";
-import { t as isMainModule } from "./is-main-CE1eOBYb.js";
-import { t as ensureOpenClawCliOnPath } from "./path-env-C5FR_Eay.js";
-import { i as resolveGatewayAuth } from "./auth-jrfLXze7.js";
+import "./env-ONzUVAG2.js";
+import { M as VERSION, i as loadConfig } from "./config-aFQssWKX.js";
+import "./manifest-registry-CQhdnDBZ.js";
+import { h as GATEWAY_CLIENT_NAMES, m as GATEWAY_CLIENT_MODES } from "./message-channel-BLi2a6Yw.js";
+import { t as GatewayClient } from "./client-BrYfyoDK.js";
+import { t as buildGatewayConnectionDetails } from "./call-SolyGS1r.js";
+import { t as formatDocsLink } from "./links-Eax1UO3w.js";
+import { i as resolveGatewayAuth } from "./auth-CQNl_IaI.js";
+import { t as isMainModule } from "./is-main-BWoXGz7p.js";
+import { t as ensureOpenClawCliOnPath } from "./path-env-CaYUVIML.js";
 import { fileURLToPath } from "node:url";
 import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";

package/dist/{acp-cli-oV2dodPg.js → acp-cli-rNbGXICg.js}

@@ -1,19 +1,18 @@
-import { k as theme, p as defaultRuntime } from "./entry.js";
-import "./auth-profiles-CcJ3hrog.js";
-import "./utils-Dk86IbEs.js";
-import "./exec-B8JKbXKW.js";
-import "./agent-scope-RCSw6gHy.js";
-import "./github-copilot-token-SLWintYd.js";
-import { M as VERSION, i as loadConfig } from "./config-B7sno9eI.js";
-import "./manifest-registry-BTgLN_W2.js";
-import { t as ensureOpenClawCliOnPath } from "./path-env-CXWUFfFv.js";
-import "./tailscale-DU6DgqVy.js";
-import { i as resolveGatewayAuth } from "./auth-BcNHFK-i.js";
-import { t as GatewayClient } from "./client-D7wrC1Ug.js";
-import { t as buildGatewayConnectionDetails } from "./call-Yxns4CVq.js";
-import { h as GATEWAY_CLIENT_NAMES, m as GATEWAY_CLIENT_MODES } from "./message-channel-BlgPSDAh.js";
+import { A as theme, p as defaultRuntime } from "./entry.js";
+import "./auth-profiles-ByNs3eEm.js";
+import "./utils-BLJAc3ZV.js";
+import "./exec-CACT5OAW.js";
+import "./agent-scope-CsRbLH4l.js";
+import "./github-copilot-token-Cfs0Wxr8.js";
+import { M as VERSION, i as loadConfig } from "./config-Bdhomfei.js";
+import "./manifest-registry-u0okVSkU.js";
+import { i as resolveGatewayAuth } from "./auth-9x3lqfIY.js";
+import { t as ensureOpenClawCliOnPath } from "./path-env-CLvYNwtL.js";
+import { t as GatewayClient } from "./client-CTwXnRl7.js";
+import { t as buildGatewayConnectionDetails } from "./call-DVYCIV8m.js";
+import { h as GATEWAY_CLIENT_NAMES, m as GATEWAY_CLIENT_MODES } from "./message-channel-C_MmebBt.js";
 import { t as isMainModule } from "./is-main-qJ675wPV.js";
-import { t as formatDocsLink } from "./links-7M-j83As.js";
+import { t as formatDocsLink } from "./links-B8LAzWwg.js";
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { randomUUID } from "node:crypto";

package/dist/{agent-BndgzkUe.js → agent-BvNJF5QL.js}

@@ -1,20 +1,20 @@
-import { c as defaultRuntime, h as DEFAULT_CHAT_CHANNEL } from "./subsystem-Bv7dGhES.js";
-import { J as supportsXHighThinking, K as normalizeVerboseLevel, R as formatThinkingLevels, W as normalizeThinkLevel, z as formatXHighModelHint } from "./pi-embedded-helpers-CmftU5Zj.js";
-import { $t as getSkillsSnapshotVersion, Bt as getRemoteSkillEligibility, Cr as clearSessionAuthProfileOverride, In as registerAgentRunContext, L as runWithModelFallback, M as resolveOutboundTarget, Mn as clearAgentRunContext, N as resolveSessionDeliveryTarget, Nn as emitAgentEvent, Sr as lookupContextTokens, Tr as applyVerboseOverride, Ur as resolveAgentTimeoutMs, i as runCliAgent, jn as AGENT_LANE_NESTED, l as runEmbeddedPiAgent, n as getCliSessionId, r as setCliSessionId, s as resolveSendPolicy, wr as applyModelOverrideToSessionEntry } from "./reply-m467_fOC.js";
+import { c as defaultRuntime, h as DEFAULT_CHAT_CHANNEL } from "./subsystem-BoExtIHo.js";
+import { J as supportsXHighThinking, K as normalizeVerboseLevel, R as formatThinkingLevels, W as normalizeThinkLevel, z as formatXHighModelHint } from "./pi-embedded-helpers-CMKLjW6X.js";
+import { $t as getSkillsSnapshotVersion, Bt as getRemoteSkillEligibility, Cr as clearSessionAuthProfileOverride, In as registerAgentRunContext, L as runWithModelFallback, M as resolveOutboundTarget, Mn as clearAgentRunContext, N as resolveSessionDeliveryTarget, Nn as emitAgentEvent, Sr as lookupContextTokens, Tr as applyVerboseOverride, Ur as resolveAgentTimeoutMs, i as runCliAgent, jn as AGENT_LANE_NESTED, l as runEmbeddedPiAgent, n as getCliSessionId, r as setCliSessionId, s as resolveSendPolicy, wr as applyModelOverrideToSessionEntry } from "./reply-DICXkh_C.js";
 import { d as resolveAgentIdFromSessionKey, l as normalizeAgentId, u as normalizeMainKey } from "./session-key-BWxPj0z_.js";
-import { a as resolveAgentModelPrimary, i as resolveAgentModelFallbacksOverride, o as resolveAgentSkillsFilter, r as resolveAgentDir, s as resolveAgentWorkspaceDir, t as listAgentIds, x as ensureAgentWorkspace } from "./agent-scope---6LLHj0.js";
-import { Dt as DEFAULT_MODEL, Et as DEFAULT_CONTEXT_TOKENS, Ot as DEFAULT_PROVIDER, a as isCliProvider, d as resolveConfiguredModelRef, h as resolveThinkingDefault, ht as ensureAuthProfileStore, o as modelKey, t as buildAllowedModelSet } from "./model-selection-unMJyUIE.js";
+import { a as resolveAgentModelPrimary, i as resolveAgentModelFallbacksOverride, o as resolveAgentSkillsFilter, r as resolveAgentDir, s as resolveAgentWorkspaceDir, t as listAgentIds, x as ensureAgentWorkspace } from "./agent-scope-CQCus0rI.js";
+import { Dt as DEFAULT_MODEL, Et as DEFAULT_CONTEXT_TOKENS, Ot as DEFAULT_PROVIDER, a as isCliProvider, d as resolveConfiguredModelRef, h as resolveThinkingDefault, ht as ensureAuthProfileStore, o as modelKey, t as buildAllowedModelSet } from "./model-selection-BLuqsGVB.js";
 import { t as formatCliCommand } from "./command-format-ChfKqObn.js";
-import { i as loadConfig } from "./config-DH9TLUNc.js";
-import { r as normalizeChannelId, t as getChannelPlugin } from "./plugins-BL9lIXSA.js";
-import { A as resolveSessionResetPolicy, D as resolveSessionKey, I as resolveExplicitAgentSessionKey, O as evaluateSessionFreshness, T as normalizeAccountId, d as loadSessionStore, g as updateSessionStore, j as resolveSessionResetType, k as resolveChannelResetConfig } from "./sandbox-BW8Xnkw1.js";
-import { s as loadModelCatalog } from "./runner-CInKPsiP.js";
-import { r as buildWorkspaceSkillSnapshot } from "./skills-aFOsriMP.js";
-import { a as isInternalMessageChannel, d as resolveMessageChannel, i as isGatewayMessageChannel, l as normalizeMessageChannel, n as isDeliverableMessageChannel, t as INTERNAL_MESSAGE_CHANNEL } from "./message-channel-0717wOz-.js";
-import { n as resolveSessionFilePath, o as resolveStorePath } from "./paths-RITJT4UY.js";
-import { a as normalizeOutboundPayloadsForJson, i as normalizeOutboundPayloads, r as formatOutboundPayloadLog, t as deliverOutboundPayloads } from "./deliver-B1jsU2r7.js";
-import { l as deriveSessionTotalTokens, u as hasNonzeroUsage } from "./session-cost-usage-HU4OeRgw.js";
-import { t as createDefaultDeps } from "./deps-B6602Wid.js";
+import { i as loadConfig } from "./config-aFQssWKX.js";
+import { r as normalizeChannelId, t as getChannelPlugin } from "./plugins-X7d_tfTE.js";
+import { A as resolveSessionResetPolicy, D as resolveSessionKey, I as resolveExplicitAgentSessionKey, O as evaluateSessionFreshness, T as normalizeAccountId, d as loadSessionStore, g as updateSessionStore, j as resolveSessionResetType, k as resolveChannelResetConfig } from "./sandbox-Bhjnh1Xg.js";
+import { s as loadModelCatalog } from "./runner-D_dujMod.js";
+import { r as buildWorkspaceSkillSnapshot } from "./skills-DprQj9X2.js";
+import { a as isInternalMessageChannel, d as resolveMessageChannel, i as isGatewayMessageChannel, l as normalizeMessageChannel, n as isDeliverableMessageChannel, t as INTERNAL_MESSAGE_CHANNEL } from "./message-channel-BLi2a6Yw.js";
+import { n as resolveSessionFilePath, s as resolveStorePath } from "./paths-B49s6UZQ.js";
+import { a as normalizeOutboundPayloadsForJson, i as normalizeOutboundPayloads, r as formatOutboundPayloadLog, t as deliverOutboundPayloads } from "./deliver-LsxKETro.js";
+import { l as deriveSessionTotalTokens, u as hasNonzeroUsage } from "./session-cost-usage-D7HuoSSD.js";
+import { t as createDefaultDeps } from "./deps-lAAA2zYI.js";
 import crypto from "node:crypto";
 
 //#region src/cli/outbound-send-deps.ts
@@ -250,6 +250,7 @@ function resolveAgentRunContext(opts) {
 async function updateSessionStoreAfterAgentRun(params) {
 	const { cfg, sessionId, sessionKey, storePath, sessionStore, defaultProvider, defaultModel, fallbackProvider, fallbackModel, result } = params;
 	const usage = result.meta.agentMeta?.usage;
+	const promptTokens = result.meta.agentMeta?.promptTokens;
 	const compactionsThisRun = Math.max(0, result.meta.agentMeta?.compactionCount ?? 0);
 	const modelUsed = result.meta.agentMeta?.model ?? fallbackModel ?? defaultModel;
 	const providerUsed = result.meta.agentMeta?.provider ?? fallbackProvider ?? defaultProvider;
@@ -278,7 +279,8 @@ async function updateSessionStoreAfterAgentRun(params) {
 		next.outputTokens = output;
 		next.totalTokens = deriveSessionTotalTokens({
 			usage,
-			contextTokens
+			contextTokens,
+			promptTokens
 		}) ?? input;
 	}
 	if (compactionsThisRun > 0) next.compactionCount = (entry.compactionCount ?? 0) + compactionsThisRun;
@@ -643,6 +645,7 @@ async function agentCommand(opts, runtime = defaultRuntime, deps = createDefault
 						lane: opts.lane,
 						abortSignal: opts.abortSignal,
 						extraSystemPrompt: opts.extraSystemPrompt,
+						inputProvenance: opts.inputProvenance,
 						streamParams: opts.streamParams,
 						agentDir,
 						onAgentEvent: (evt) => {

package/dist/{agent-DZvDwqnd.js → agent-CyMxTyrG.js}

@@ -1,20 +1,20 @@
-import { $ as DEFAULT_CHAT_CHANNEL, p as defaultRuntime } from "./entry.js";
-import { C as buildAllowedModelSet, Ct as DEFAULT_CONTEXT_TOKENS, D as isCliProvider, L as resolveThinkingDefault, N as resolveConfiguredModelRef, O as modelKey, Tt as DEFAULT_PROVIDER, _ as ensureAuthProfileStore, wt as DEFAULT_MODEL } from "./auth-profiles-CcJ3hrog.js";
-import { t as formatCliCommand } from "./command-format-ayFsmwwz.js";
+import { p as defaultRuntime, tt as DEFAULT_CHAT_CHANNEL } from "./entry.js";
+import { C as buildAllowedModelSet, Ct as DEFAULT_CONTEXT_TOKENS, D as isCliProvider, L as resolveThinkingDefault, N as resolveConfiguredModelRef, O as modelKey, Tt as DEFAULT_PROVIDER, _ as ensureAuthProfileStore, wt as DEFAULT_MODEL } from "./auth-profiles-ByNs3eEm.js";
+import { t as formatCliCommand } from "./command-format-Bxe0mWee.js";
 import { d as resolveAgentIdFromSessionKey, l as normalizeAgentId, u as normalizeMainKey } from "./session-key-DVvxnFKg.js";
-import { a as resolveAgentModelPrimary, i as resolveAgentModelFallbacksOverride, o as resolveAgentSkillsFilter, r as resolveAgentDir, s as resolveAgentWorkspaceDir, t as listAgentIds, x as ensureAgentWorkspace } from "./agent-scope-RCSw6gHy.js";
-import { i as loadConfig } from "./config-B7sno9eI.js";
-import { a as isInternalMessageChannel, d as resolveMessageChannel, i as isGatewayMessageChannel, l as normalizeMessageChannel, n as isDeliverableMessageChannel, t as INTERNAL_MESSAGE_CHANNEL } from "./message-channel-BlgPSDAh.js";
-import { r as normalizeChannelId, t as getChannelPlugin } from "./plugins-3GyCj5KL.js";
-import { At as runEmbeddedPiAgent, Bt as resolveAgentTimeoutMs, Cn as resolveSessionDeliveryTarget, Dn as runWithModelFallback, G as setCliSessionId, Gt as registerAgentRunContext, Ht as emitAgentEvent, Jt as AGENT_LANE_NESTED, K as runCliAgent, Sn as resolveOutboundTarget, Vt as clearAgentRunContext, W as getCliSessionId, X as getRemoteSkillEligibility, Y as resolveSendPolicy, Yt as applyModelOverrideToSessionEntry, dt as clearSessionAuthProfileOverride, ft as applyVerboseOverride, lt as getSkillsSnapshotVersion, pn as lookupContextTokens } from "./loader-Caow9TPA.js";
-import { n as resolveSessionFilePath, o as resolveStorePath } from "./paths-IivnSNkP.js";
-import { H as normalizeThinkLevel, I as formatThinkingLevels, K as supportsXHighThinking, L as formatXHighModelHint, W as normalizeVerboseLevel } from "./pi-embedded-helpers-Uan-3N1T.js";
-import { a as normalizeOutboundPayloadsForJson, i as normalizeOutboundPayloads, r as formatOutboundPayloadLog, t as deliverOutboundPayloads } from "./deliver-DzcxEcza.js";
-import { A as resolveSessionResetType, D as evaluateSessionFreshness, E as resolveSessionKey, F as resolveExplicitAgentSessionKey, O as resolveChannelResetConfig, T as normalizeAccountId, d as loadSessionStore, g as updateSessionStore, k as resolveSessionResetPolicy } from "./sandbox-B0K9e6Fw.js";
-import { r as buildWorkspaceSkillSnapshot } from "./skills-BvPUNjxo.js";
-import { l as deriveSessionTotalTokens, u as hasNonzeroUsage } from "./session-cost-usage-CL8gnHRN.js";
-import { _ as loadModelCatalog } from "./runner-C1G8RFWl.js";
-import { t as createDefaultDeps } from "./deps-Cva7QM_t.js";
+import { a as resolveAgentModelPrimary, i as resolveAgentModelFallbacksOverride, o as resolveAgentSkillsFilter, r as resolveAgentDir, s as resolveAgentWorkspaceDir, t as listAgentIds, x as ensureAgentWorkspace } from "./agent-scope-CsRbLH4l.js";
+import { i as loadConfig } from "./config-Bdhomfei.js";
+import { a as isInternalMessageChannel, d as resolveMessageChannel, i as isGatewayMessageChannel, l as normalizeMessageChannel, n as isDeliverableMessageChannel, t as INTERNAL_MESSAGE_CHANNEL } from "./message-channel-C_MmebBt.js";
+import { r as normalizeChannelId, t as getChannelPlugin } from "./plugins-4Hqd1WGf.js";
+import { At as runEmbeddedPiAgent, Cn as runWithModelFallback, G as setCliSessionId, Gt as applyModelOverrideToSessionEntry, It as resolveAgentTimeoutMs, K as runCliAgent, Lt as clearAgentRunContext, Rt as emitAgentEvent, Vt as registerAgentRunContext, W as getCliSessionId, Wt as AGENT_LANE_NESTED, X as getRemoteSkillEligibility, Y as resolveSendPolicy, dt as clearSessionAuthProfileOverride, ft as applyVerboseOverride, ln as lookupContextTokens, lt as getSkillsSnapshotVersion, vn as resolveOutboundTarget, yn as resolveSessionDeliveryTarget } from "./loader-KjT074JR.js";
+import { a as normalizeOutboundPayloadsForJson, i as normalizeOutboundPayloads, r as formatOutboundPayloadLog, t as deliverOutboundPayloads } from "./deliver-CIU9Npgs.js";
+import { n as resolveSessionFilePath, s as resolveStorePath } from "./paths-DLINmNFQ.js";
+import { H as normalizeThinkLevel, I as formatThinkingLevels, K as supportsXHighThinking, L as formatXHighModelHint, W as normalizeVerboseLevel } from "./pi-embedded-helpers-DfwkwPYD.js";
+import { A as resolveSessionResetType, D as evaluateSessionFreshness, E as resolveSessionKey, F as resolveExplicitAgentSessionKey, O as resolveChannelResetConfig, T as normalizeAccountId, d as loadSessionStore, g as updateSessionStore, k as resolveSessionResetPolicy } from "./sandbox-BKYnhYQH.js";
+import { r as buildWorkspaceSkillSnapshot } from "./skills-DRjfSQT3.js";
+import { l as deriveSessionTotalTokens, u as hasNonzeroUsage } from "./session-cost-usage-D9hHANWI.js";
+import { _ as loadModelCatalog } from "./runner-CY0nmVme.js";
+import { t as createDefaultDeps } from "./deps-QSwGcoNZ.js";
 import crypto from "node:crypto";
 
 //#region src/cli/outbound-send-deps.ts
@@ -250,6 +250,7 @@ function resolveAgentRunContext(opts) {
 async function updateSessionStoreAfterAgentRun(params) {
 	const { cfg, sessionId, sessionKey, storePath, sessionStore, defaultProvider, defaultModel, fallbackProvider, fallbackModel, result } = params;
 	const usage = result.meta.agentMeta?.usage;
+	const promptTokens = result.meta.agentMeta?.promptTokens;
 	const compactionsThisRun = Math.max(0, result.meta.agentMeta?.compactionCount ?? 0);
 	const modelUsed = result.meta.agentMeta?.model ?? fallbackModel ?? defaultModel;
 	const providerUsed = result.meta.agentMeta?.provider ?? fallbackProvider ?? defaultProvider;
@@ -278,7 +279,8 @@ async function updateSessionStoreAfterAgentRun(params) {
 		next.outputTokens = output;
 		next.totalTokens = deriveSessionTotalTokens({
 			usage,
-			contextTokens
+			contextTokens,
+			promptTokens
 		}) ?? input;
 	}
 	if (compactionsThisRun > 0) next.compactionCount = (entry.compactionCount ?? 0) + compactionsThisRun;
@@ -643,6 +645,7 @@ async function agentCommand(opts, runtime = defaultRuntime, deps = createDefault
 						lane: opts.lane,
 						abortSignal: opts.abortSignal,
 						extraSystemPrompt: opts.extraSystemPrompt,
+						inputProvenance: opts.inputProvenance,
 						streamParams: opts.streamParams,
 						agentDir,
 						onAgentEvent: (evt) => {

package/dist/{agent-scope-rXQ7WARN.js → agent-scope-BIEhVP4_.js}

@@ -1,5 +1,5 @@
 import { s as resolveStateDir, u as resolveRequiredHomeDir } from "./paths-BZtyHNCi.js";
-import { I as pathExists, t as runCommandWithTimeout, z as resolveUserPath } from "./exec-4WHuOniw.js";
+import { I as pathExists, t as runCommandWithTimeout, z as resolveUserPath } from "./exec-B8lXct-k.js";
 import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";

package/dist/{agent-scope---6LLHj0.js → agent-scope-CQCus0rI.js}

@@ -1,7 +1,7 @@
 import { g as resolveStateDir, y as resolveRequiredHomeDir } from "./paths-DVBShlw6.js";
-import { b as resolveUserPath, g as pathExists } from "./utils-BHPdZE4h.js";
+import { b as resolveUserPath, g as pathExists } from "./utils-Cd9QdCHh.js";
 import { l as normalizeAgentId, n as DEFAULT_AGENT_ID, v as isSubagentSessionKey, y as parseAgentSessionKey } from "./session-key-BWxPj0z_.js";
-import { t as runCommandWithTimeout } from "./exec-DXtR2fhb.js";
+import { t as runCommandWithTimeout } from "./exec-YIosokWE.js";
 import { t as resolveOpenClawPackageRoot } from "./openclaw-root-1VeFrph_.js";
 import { fileURLToPath } from "node:url";
 import os from "node:os";

package/dist/{agent-scope-RCSw6gHy.js → agent-scope-CsRbLH4l.js}

@@ -1,7 +1,7 @@
-import { X as resolveStateDir, pt as resolveRequiredHomeDir } from "./entry.js";
+import { Z as resolveStateDir, ht as resolveRequiredHomeDir } from "./entry.js";
 import { l as normalizeAgentId, n as DEFAULT_AGENT_ID, v as isSubagentSessionKey, y as parseAgentSessionKey } from "./session-key-DVvxnFKg.js";
-import { h as pathExists, y as resolveUserPath } from "./utils-Dk86IbEs.js";
-import { t as runCommandWithTimeout } from "./exec-B8JKbXKW.js";
+import { h as pathExists, y as resolveUserPath } from "./utils-BLJAc3ZV.js";
+import { t as runCommandWithTimeout } from "./exec-CACT5OAW.js";
 import { t as resolveOpenClawPackageRoot } from "./openclaw-root-BNlEap4i.js";
 import path from "node:path";
 import os from "node:os";

package/dist/{agent-scope-CN8DM4Xb.js → agent-scope-DPIFau3f.js}

@@ -1,5 +1,5 @@
 import { s as resolveStateDir, u as resolveRequiredHomeDir } from "./paths-rb94mUrR.js";
-import { F as pathExists, R as resolveUserPath, t as runCommandWithTimeout } from "./exec-D12IZYtJ.js";
+import { F as pathExists, R as resolveUserPath, t as runCommandWithTimeout } from "./exec-CJFFoM7H.js";
 import path from "node:path";
 import fs from "node:fs";
 import os from "node:os";

package/dist/{audio-preflight-SZRntkxo.js → audio-preflight-BU8W7uxc.js}

@@ -1,17 +1,17 @@
 import "./paths-rb94mUrR.js";
-import "./agent-scope-CN8DM4Xb.js";
-import { J as logVerbose, X as shouldLogVerbose } from "./exec-D12IZYtJ.js";
-import "./model-selection-B9Y7dKQd.js";
+import "./agent-scope-DPIFau3f.js";
+import { J as logVerbose, X as shouldLogVerbose } from "./exec-CJFFoM7H.js";
+import "./model-selection-C1GmkTAV.js";
 import "./github-copilot-token-wCk9Fg_E.js";
-import "./pi-embedded-helpers-CfXnSIFx.js";
-import "./config-D50SQVar.js";
+import "./pi-embedded-helpers-CUzTc1v6.js";
+import "./config-QYrbd7x7.js";
 import "./pi-model-discovery-EhM2JAQo.js";
-import "./chrome-BCPPeLQ6.js";
-import "./paths-CB2fqqbX.js";
-import "./image-B4mDPdyz.js";
+import "./chrome-DL0avO8n.js";
+import "./paths-D0O87MfH.js";
+import "./image-RKwc3fsL.js";
 import "./redact-BIMJ3ntQ.js";
-import "./fetch-timeout-ohY5QmsW.js";
-import { a as runCapability, l as isAudioAttachment, n as createMediaAttachmentCache, r as normalizeMediaAttachments, t as buildProviderRegistry } from "./runner-Cwfn-VOM.js";
+import "./fetch-timeout-DEoXG_SF.js";
+import { a as runCapability, l as isAudioAttachment, n as createMediaAttachmentCache, r as normalizeMediaAttachments, t as buildProviderRegistry } from "./runner-DrGYLH5K.js";
 
 //#region src/media-understanding/audio-preflight.ts
 /**

package/dist/{audio-preflight-ClVNINDs.js → audio-preflight-CGsumMzb.js}

@@ -1,17 +1,17 @@
 import "./paths-BZtyHNCi.js";
-import "./agent-scope-rXQ7WARN.js";
-import { Y as logVerbose, Z as shouldLogVerbose } from "./exec-4WHuOniw.js";
-import "./pi-embedded-helpers-Bri9tk9g.js";
-import "./model-auth-CbqRVYRp.js";
-import "./config-BuF7vm-v.js";
+import "./agent-scope-BIEhVP4_.js";
+import { Y as logVerbose, Z as shouldLogVerbose } from "./exec-B8lXct-k.js";
+import "./pi-embedded-helpers-WDwx99UA.js";
+import "./model-auth-CabXIF6O.js";
+import "./config-BvMsmctM.js";
 import "./github-copilot-token-DkiRbJdR.js";
 import "./pi-model-discovery-DqgqUyAv.js";
-import "./chrome-svgmQ8T_.js";
-import "./paths-DwKNqk_S.js";
-import "./image-Dkawt9Kg.js";
+import "./chrome-BfB6JdKF.js";
+import "./paths-B0a4ywSO.js";
+import "./image-Brk1sJbw.js";
 import "./redact-BrXLgslJ.js";
-import "./fetch-timeout-4UKsdtE1.js";
-import { a as runCapability, l as isAudioAttachment, n as createMediaAttachmentCache, r as normalizeMediaAttachments, t as buildProviderRegistry } from "./runner-BCBs8JKA.js";
+import "./fetch-timeout-BEtUjM1S.js";
+import { a as runCapability, l as isAudioAttachment, n as createMediaAttachmentCache, r as normalizeMediaAttachments, t as buildProviderRegistry } from "./runner-Cfm5nTMc.js";
 
 //#region src/media-understanding/audio-preflight.ts
 /**

package/dist/{audio-preflight-txAP3v-C.js → audio-preflight-SLmkJI6-.js}

@@ -1,31 +1,31 @@
 import "./paths-DVBShlw6.js";
-import { A as logVerbose, N as shouldLogVerbose } from "./subsystem-Bv7dGhES.js";
-import "./utils-BHPdZE4h.js";
-import "./pi-embedded-helpers-CmftU5Zj.js";
-import "./exec-DXtR2fhb.js";
-import "./agent-scope---6LLHj0.js";
-import "./model-selection-unMJyUIE.js";
+import { A as logVerbose, N as shouldLogVerbose } from "./subsystem-BoExtIHo.js";
+import "./utils-Cd9QdCHh.js";
+import "./pi-embedded-helpers-CMKLjW6X.js";
+import "./exec-YIosokWE.js";
+import "./agent-scope-CQCus0rI.js";
+import "./model-selection-BLuqsGVB.js";
 import "./github-copilot-token-BW-SEg7E.js";
 import "./boolean-BgXe2hyu.js";
-import "./env-DE9xvYOL.js";
-import "./config-DH9TLUNc.js";
-import "./manifest-registry-DFckk-L8.js";
-import "./plugins-BL9lIXSA.js";
-import "./sandbox-BW8Xnkw1.js";
-import { a as runCapability, l as isAudioAttachment, n as createMediaAttachmentCache, r as normalizeMediaAttachments, t as buildProviderRegistry } from "./runner-CInKPsiP.js";
-import "./image-DI9s9eEx.js";
+import "./env-ONzUVAG2.js";
+import "./config-aFQssWKX.js";
+import "./manifest-registry-CQhdnDBZ.js";
+import "./plugins-X7d_tfTE.js";
+import "./sandbox-Bhjnh1Xg.js";
+import { a as runCapability, l as isAudioAttachment, n as createMediaAttachmentCache, r as normalizeMediaAttachments, t as buildProviderRegistry } from "./runner-D_dujMod.js";
+import "./image-C4Nn2p3e.js";
 import "./pi-model-discovery-EwKVHlZB.js";
-import "./chrome-juQxt0zf.js";
-import "./skills-aFOsriMP.js";
-import "./routes-82Ywfho6.js";
-import "./server-context-Lb-eUZG_.js";
-import "./message-channel-0717wOz-.js";
+import "./chrome-Cvr-57lg.js";
+import "./skills-DprQj9X2.js";
+import "./routes-CmOI1hIH.js";
+import "./server-context-Cl0U0vE3.js";
+import "./message-channel-BLi2a6Yw.js";
 import "./logging-fywhKCmE.js";
-import "./accounts-DimKrt7j.js";
-import "./paths-RITJT4UY.js";
+import "./accounts-DeqIQjo1.js";
+import "./paths-B49s6UZQ.js";
 import "./redact-BRsnXqwD.js";
-import "./tool-display-Na-EVL83.js";
-import "./fetch-CqZP8jwB.js";
+import "./tool-display-CZRIDMRm.js";
+import "./fetch-DmiOpALK.js";
 
 //#region src/media-understanding/audio-preflight.ts
 /**

package/dist/{audio-preflight-BP6s-UPp.js → audio-preflight-jZc5mFCZ.js}

@@ -1,28 +1,28 @@
-import { w as shouldLogVerbose, x as logVerbose } from "./entry.js";
-import "./auth-profiles-CcJ3hrog.js";
-import "./utils-Dk86IbEs.js";
-import "./exec-B8JKbXKW.js";
-import "./agent-scope-RCSw6gHy.js";
-import "./github-copilot-token-SLWintYd.js";
+import { S as logVerbose, T as shouldLogVerbose } from "./entry.js";
+import "./auth-profiles-ByNs3eEm.js";
+import "./utils-BLJAc3ZV.js";
+import "./exec-CACT5OAW.js";
+import "./agent-scope-CsRbLH4l.js";
+import "./github-copilot-token-Cfs0Wxr8.js";
 import "./pi-model-discovery-DzEIEgHL.js";
-import "./config-B7sno9eI.js";
-import "./manifest-registry-BTgLN_W2.js";
-import "./server-context-fX4xiYRh.js";
-import "./chrome-yIKmOzCO.js";
-import "./message-channel-BlgPSDAh.js";
-import "./plugins-3GyCj5KL.js";
+import "./config-Bdhomfei.js";
+import "./manifest-registry-u0okVSkU.js";
+import "./server-context-BGpGs3qd.js";
+import "./chrome-foEwx3lN.js";
+import "./message-channel-C_MmebBt.js";
+import "./plugins-4Hqd1WGf.js";
 import "./logging-CfEk_PnX.js";
-import "./accounts-DbzMEfKN.js";
-import "./paths-IivnSNkP.js";
-import "./redact-DuEEf1p1.js";
-import "./routes-BqxA3ZYr.js";
-import "./pi-embedded-helpers-Uan-3N1T.js";
-import "./fetch-timeout-B2KlHXi3.js";
-import "./sandbox-B0K9e6Fw.js";
-import "./skills-BvPUNjxo.js";
-import "./image-LxFvu0wL.js";
-import "./tool-display-sHJa3kRs.js";
-import { a as runCapability, n as createMediaAttachmentCache, o as isAudioAttachment, r as normalizeMediaAttachments, t as buildProviderRegistry } from "./runner-C1G8RFWl.js";
+import "./accounts-DCDeFTra.js";
+import "./paths-DLINmNFQ.js";
+import "./redact-Br9GfacZ.js";
+import "./routes-DewK5tq2.js";
+import "./pi-embedded-helpers-DfwkwPYD.js";
+import "./fetch-timeout-DTK9vxex.js";
+import "./sandbox-BKYnhYQH.js";
+import "./skills-DRjfSQT3.js";
+import "./image-DgtfXMcX.js";
+import "./tool-display-ClRud3pg.js";
+import { a as runCapability, n as createMediaAttachmentCache, o as isAudioAttachment, r as normalizeMediaAttachments, t as buildProviderRegistry } from "./runner-CY0nmVme.js";
 
 //#region src/media-understanding/audio-preflight.ts
 /**