activeclaw 2026.2.12 → 2026.2.13

package/dist/plugin-sdk/media/input-files.d.ts

@@ -1,3 +1,4 @@
+import type { SsrFPolicy } from "../infra/net/ssrf.js";
 export type InputImageContent = {
     type: "image";
     data: string;
@@ -15,6 +16,7 @@ export type InputPdfLimits = {
 };
 export type InputFileLimits = {
     allowUrl: boolean;
+    urlAllowlist?: string[];
     allowedMimes: Set<string>;
     maxBytes: number;
     maxChars: number;
@@ -24,6 +26,7 @@ export type InputFileLimits = {
 };
 export type InputImageLimits = {
     allowUrl: boolean;
+    urlAllowlist?: string[];
     allowedMimes: Set<string>;
     maxBytes: number;
     maxRedirects: number;
@@ -68,6 +71,8 @@ export declare function fetchWithGuard(params: {
     maxBytes: number;
     timeoutMs: number;
     maxRedirects: number;
+    policy?: SsrFPolicy;
+    auditContext?: string;
 }): Promise<InputFetchResult>;
 export declare function extractImageContentFromSource(source: InputImageSource, limits: InputImageLimits): Promise<InputImageContent>;
 export declare function extractFileContentFromSource(params: {

package/dist/plugin-sdk/routing/resolve-route.d.ts

@@ -15,6 +15,8 @@ export type ResolveAgentRouteInput = {
     parentPeer?: RoutePeer | null;
     guildId?: string | null;
     teamId?: string | null;
+    /** Discord member role IDs — used for role-based agent routing. */
+    memberRoleIds?: string[];
 };
 export type ResolvedAgentRoute = {
     agentId: string;
@@ -25,7 +27,7 @@ export type ResolvedAgentRoute = {
     /** Convenience alias for direct-chat collapse. */
     mainSessionKey: string;
     /** Match description for debugging/logging. */
-    matchedBy: "binding.peer" | "binding.peer.parent" | "binding.guild" | "binding.team" | "binding.account" | "binding.channel" | "default";
+    matchedBy: "binding.peer" | "binding.peer.parent" | "binding.guild+roles" | "binding.guild" | "binding.team" | "binding.account" | "binding.channel" | "default";
 };
 export { DEFAULT_ACCOUNT_ID, DEFAULT_AGENT_ID } from "./session-key.js";
 export declare function buildAgentSessionKey(params: {

package/dist/plugin-sdk/security/external-content.d.ts

@@ -11,7 +11,7 @@
  * Check if content contains suspicious patterns that may indicate injection.
  */
 export declare function detectSuspiciousPatterns(content: string): string[];
-export type ExternalContentSource = "email" | "webhook" | "api" | "channel_metadata" | "web_search" | "web_fetch" | "unknown";
+export type ExternalContentSource = "email" | "webhook" | "api" | "browser" | "channel_metadata" | "web_search" | "web_fetch" | "unknown";
 export type WrapExternalContentOptions = {
     /** Source of the external content */
     source: ExternalContentSource;

package/dist/plugin-sdk/security/secret-equal.d.ts

@@ -0,0 +1 @@
+export declare function safeEqualSecret(provided: string | undefined | null, expected: string | undefined | null): boolean;

package/dist/plugin-sdk/sessions/input-provenance.d.ts

@@ -0,0 +1,16 @@
+import type { AgentMessage } from "@mariozechner/pi-agent-core";
+export declare const INPUT_PROVENANCE_KIND_VALUES: readonly ["external_user", "inter_session", "internal_system"];
+export type InputProvenanceKind = (typeof INPUT_PROVENANCE_KIND_VALUES)[number];
+export type InputProvenance = {
+    kind: InputProvenanceKind;
+    sourceSessionKey?: string;
+    sourceChannel?: string;
+    sourceTool?: string;
+};
+export declare function normalizeInputProvenance(value: unknown): InputProvenance | undefined;
+export declare function applyInputProvenanceToUserMessage(message: AgentMessage, inputProvenance: InputProvenance | undefined): AgentMessage;
+export declare function isInterSessionInputProvenance(value: unknown): boolean;
+export declare function hasInterSessionUserProvenance(message: {
+    role?: unknown;
+    provenance?: unknown;
+} | undefined): boolean;

package/dist/plugin-sdk/signal/monitor/event-handler.types.d.ts

@@ -16,10 +16,18 @@ export type SignalEnvelope = {
     syncMessage?: unknown;
     reactionMessage?: SignalReactionMessage | null;
 };
+export type SignalMention = {
+    name?: string | null;
+    number?: string | null;
+    uuid?: string | null;
+    start?: number | null;
+    length?: number | null;
+};
 export type SignalDataMessage = {
     timestamp?: number;
     message?: string | null;
     attachments?: Array<SignalAttachment>;
+    mentions?: Array<SignalMention> | null;
     groupInfo?: {
         groupId?: string | null;
         groupName?: string | null;

package/dist/plugin-sdk/signal/monitor/mentions.d.ts

@@ -0,0 +1,2 @@
+import type { SignalMention } from "./event-handler.types.js";
+export declare function renderSignalMentions(message: string, mentions?: SignalMention[] | null): string;

package/dist/{plugins-3GyCj5KL.js → plugins-4Hqd1WGf.js}

@@ -1,7 +1,7 @@
-import { Q as CHAT_CHANNEL_ORDER, ct as requireActivePluginRegistry, it as normalizeAnyChannelId, n as isTruthyEnvValue, ot as normalizeChatChannelId } from "./entry.js";
+import { ct as normalizeChatChannelId, et as CHAT_CHANNEL_ORDER, n as isTruthyEnvValue, ot as normalizeAnyChannelId, ut as requireActivePluginRegistry } from "./entry.js";
 import { c as normalizeAccountId, l as normalizeAgentId, t as DEFAULT_ACCOUNT_ID } from "./session-key-DVvxnFKg.js";
-import { m as normalizeE164 } from "./utils-Dk86IbEs.js";
-import { c as resolveDefaultAgentId } from "./agent-scope-RCSw6gHy.js";
+import { m as normalizeE164 } from "./utils-BLJAc3ZV.js";
+import { c as resolveDefaultAgentId } from "./agent-scope-CsRbLH4l.js";
 import fs from "node:fs";
 
 //#region src/discord/token.ts

package/dist/{plugins-BL9lIXSA.js → plugins-X7d_tfTE.js}

@@ -1,8 +1,8 @@
-import { S as normalizeChatChannelId, b as normalizeAnyChannelId, m as CHAT_CHANNEL_ORDER, w as requireActivePluginRegistry } from "./subsystem-Bv7dGhES.js";
-import { h as normalizeE164 } from "./utils-BHPdZE4h.js";
+import { S as normalizeChatChannelId, b as normalizeAnyChannelId, m as CHAT_CHANNEL_ORDER, w as requireActivePluginRegistry } from "./subsystem-BoExtIHo.js";
+import { h as normalizeE164 } from "./utils-Cd9QdCHh.js";
 import { c as normalizeAccountId, l as normalizeAgentId, t as DEFAULT_ACCOUNT_ID } from "./session-key-BWxPj0z_.js";
-import { c as resolveDefaultAgentId } from "./agent-scope---6LLHj0.js";
-import { t as isTruthyEnvValue } from "./env-DE9xvYOL.js";
+import { c as resolveDefaultAgentId } from "./agent-scope-CQCus0rI.js";
+import { t as isTruthyEnvValue } from "./env-ONzUVAG2.js";
 import fs from "node:fs";
 
 //#region src/channels/chat-type.ts

package/dist/{plugins-cli-Ce7VsvZh.js → plugins-cli-Bgku3EGj.js}

@@ -1,54 +1,58 @@
-import { k as theme, p as defaultRuntime } from "./entry.js";
-import "./auth-profiles-CcJ3hrog.js";
-import { S as shortenHomePath, g as resolveConfigDir, x as shortenHomeInString, y as resolveUserPath } from "./utils-Dk86IbEs.js";
-import "./exec-B8JKbXKW.js";
-import "./agent-scope-RCSw6gHy.js";
-import "./github-copilot-token-SLWintYd.js";
+import { A as theme, Z as resolveStateDir, p as defaultRuntime } from "./entry.js";
+import "./auth-profiles-ByNs3eEm.js";
+import { S as shortenHomePath, g as resolveConfigDir, x as shortenHomeInString, y as resolveUserPath } from "./utils-BLJAc3ZV.js";
+import "./exec-CACT5OAW.js";
+import "./agent-scope-CsRbLH4l.js";
+import "./github-copilot-token-Cfs0Wxr8.js";
 import "./pi-model-discovery-DzEIEgHL.js";
-import { c as writeConfigFile, i as loadConfig } from "./config-B7sno9eI.js";
-import { f as applyExclusiveSlotSelection, o as resolveBundledPluginsDir } from "./manifest-registry-BTgLN_W2.js";
-import "./server-context-fX4xiYRh.js";
-import "./chrome-yIKmOzCO.js";
-import "./control-service-B2er20Ke.js";
-import "./client-D7wrC1Ug.js";
-import "./call-Yxns4CVq.js";
-import "./message-channel-BlgPSDAh.js";
-import { t as formatDocsLink } from "./links-7M-j83As.js";
-import "./plugins-3GyCj5KL.js";
+import { c as writeConfigFile, i as loadConfig } from "./config-Bdhomfei.js";
+import { f as applyExclusiveSlotSelection, o as resolveBundledPluginsDir, p as defaultSlotIdForKey } from "./manifest-registry-u0okVSkU.js";
+import "./server-context-BGpGs3qd.js";
+import "./chrome-foEwx3lN.js";
+import { p as promptYesNo } from "./auth-9x3lqfIY.js";
+import "./control-auth-8Cf4WXpR.js";
+import "./control-service-DKnttEus.js";
+import "./client-CTwXnRl7.js";
+import "./call-DVYCIV8m.js";
+import "./message-channel-C_MmebBt.js";
+import { t as formatDocsLink } from "./links-B8LAzWwg.js";
+import "./plugins-4Hqd1WGf.js";
 import "./logging-CfEk_PnX.js";
-import "./accounts-DbzMEfKN.js";
-import "./loader-Caow9TPA.js";
-import "./progress-Da1ehW-x.js";
-import "./prompt-style-Dc0C5HC9.js";
+import "./accounts-DCDeFTra.js";
+import "./loader-KjT074JR.js";
+import "./progress-DWqhRakV.js";
+import "./prompt-style-BFH5D5LN.js";
 import { i as resolveArchiveKind } from "./archive-D0z3LZDK.js";
-import "./skill-scanner-C_fQzVDu.js";
-import { n as installPluginFromNpmSpec, r as installPluginFromPath, t as recordPluginInstall } from "./installs-NS0VMPN7.js";
-import "./manager-DseK7RWj.js";
-import "./paths-IivnSNkP.js";
-import "./sqlite-B7FPASCO.js";
-import "./redact-DuEEf1p1.js";
-import "./routes-BqxA3ZYr.js";
-import "./pi-embedded-helpers-Uan-3N1T.js";
-import "./deliver-DzcxEcza.js";
-import "./fetch-timeout-B2KlHXi3.js";
-import "./sandbox-B0K9e6Fw.js";
-import "./tui-formatters-C_baVYUz.js";
-import "./wsl-B-H6Z5wp.js";
-import "./skills-BvPUNjxo.js";
-import "./image-LxFvu0wL.js";
-import "./tool-display-sHJa3kRs.js";
-import "./channel-selection-BoQ7GurB.js";
-import "./session-cost-usage-CL8gnHRN.js";
-import "./runner-C1G8RFWl.js";
-import "./commands-BG25qku5.js";
-import "./pairing-store-fIWI3pXG.js";
-import "./login-qr-CAk9D-FM.js";
-import "./pairing-labels-Bin1K7_f.js";
-import { t as renderTable } from "./table-oJQPTUL6.js";
-import { t as buildPluginStatusReport } from "./status-B2Yr-2J5.js";
-import { n as updateNpmInstalledPlugins } from "./update-uwUWrKFu.js";
+import "./skill-scanner-rHMtUHtP.js";
+import { i as resolvePluginInstallDir, n as installPluginFromNpmSpec, r as installPluginFromPath, t as recordPluginInstall } from "./installs-CrLcWYHe.js";
+import "./deliver-CIU9Npgs.js";
+import "./manager-T1XfGchB.js";
+import "./paths-DLINmNFQ.js";
+import "./sqlite-BINzs1U0.js";
+import "./redact-Br9GfacZ.js";
+import "./routes-DewK5tq2.js";
+import "./pi-embedded-helpers-DfwkwPYD.js";
+import "./fetch-timeout-DTK9vxex.js";
+import "./sandbox-BKYnhYQH.js";
+import "./tui-formatters-DePhZK3J.js";
+import "./wsl-BUOkxKJu.js";
+import "./skills-DRjfSQT3.js";
+import "./image-DgtfXMcX.js";
+import "./tool-display-ClRud3pg.js";
+import "./channel-selection-D4D6ImhN.js";
+import "./session-cost-usage-D9hHANWI.js";
+import "./runner-CY0nmVme.js";
+import "./commands-BX_OIIVR.js";
+import "./pairing-store-Dp5_JGnG.js";
+import "./login-qr-CuvemJj4.js";
+import "./pairing-labels-CgNHnjzT.js";
+import { t as renderTable } from "./table-CwulTLQp.js";
+import { t as buildPluginStatusReport } from "./status-BKGkKC_v.js";
+import { n as updateNpmInstalledPlugins } from "./update-DU1geolI.js";
 import path from "node:path";
+import os from "node:os";
 import fs from "node:fs";
+import fs$1 from "node:fs/promises";
 
 //#region src/plugins/source-display.ts
 function tryRelative(root, filePath) {
@@ -92,6 +96,144 @@ function formatPluginSourceForTable(plugin, roots) {
 	return { value: shortenHomeInString(raw) };
 }
 
+//#endregion
+//#region src/plugins/uninstall.ts
+function resolveUninstallDirectoryTarget(params) {
+	if (!params.hasInstall) return null;
+	if (params.installRecord?.source === "path") return null;
+	let defaultPath;
+	try {
+		defaultPath = resolvePluginInstallDir(params.pluginId, params.extensionsDir);
+	} catch {
+		return null;
+	}
+	const configuredPath = params.installRecord?.installPath;
+	if (!configuredPath) return defaultPath;
+	if (path.resolve(configuredPath) === path.resolve(defaultPath)) return configuredPath;
+	return defaultPath;
+}
+/**
+* Remove plugin references from config (pure config mutation).
+* Returns a new config with the plugin removed from entries, installs, allow, load.paths, and slots.
+*/
+function removePluginFromConfig(cfg, pluginId) {
+	const actions = {
+		entry: false,
+		install: false,
+		allowlist: false,
+		loadPath: false,
+		memorySlot: false
+	};
+	const pluginsConfig = cfg.plugins ?? {};
+	let entries = pluginsConfig.entries;
+	if (entries && pluginId in entries) {
+		const { [pluginId]: _, ...rest } = entries;
+		entries = Object.keys(rest).length > 0 ? rest : void 0;
+		actions.entry = true;
+	}
+	let installs = pluginsConfig.installs;
+	const installRecord = installs?.[pluginId];
+	if (installs && pluginId in installs) {
+		const { [pluginId]: _, ...rest } = installs;
+		installs = Object.keys(rest).length > 0 ? rest : void 0;
+		actions.install = true;
+	}
+	let allow = pluginsConfig.allow;
+	if (Array.isArray(allow) && allow.includes(pluginId)) {
+		allow = allow.filter((id) => id !== pluginId);
+		if (allow.length === 0) allow = void 0;
+		actions.allowlist = true;
+	}
+	let load = pluginsConfig.load;
+	if (installRecord?.source === "path" && installRecord.sourcePath) {
+		const sourcePath = installRecord.sourcePath;
+		const loadPaths = load?.paths;
+		if (Array.isArray(loadPaths) && loadPaths.includes(sourcePath)) {
+			const nextLoadPaths = loadPaths.filter((p) => p !== sourcePath);
+			load = nextLoadPaths.length > 0 ? {
+				...load,
+				paths: nextLoadPaths
+			} : void 0;
+			actions.loadPath = true;
+		}
+	}
+	let slots = pluginsConfig.slots;
+	if (slots?.memory === pluginId) {
+		slots = {
+			...slots,
+			memory: defaultSlotIdForKey("memory")
+		};
+		actions.memorySlot = true;
+	}
+	if (slots && Object.keys(slots).length === 0) slots = void 0;
+	const cleanedPlugins = {
+		...pluginsConfig,
+		entries,
+		installs,
+		allow,
+		load,
+		slots
+	};
+	if (cleanedPlugins.entries === void 0) delete cleanedPlugins.entries;
+	if (cleanedPlugins.installs === void 0) delete cleanedPlugins.installs;
+	if (cleanedPlugins.allow === void 0) delete cleanedPlugins.allow;
+	if (cleanedPlugins.load === void 0) delete cleanedPlugins.load;
+	if (cleanedPlugins.slots === void 0) delete cleanedPlugins.slots;
+	return {
+		config: {
+			...cfg,
+			plugins: Object.keys(cleanedPlugins).length > 0 ? cleanedPlugins : void 0
+		},
+		actions
+	};
+}
+/**
+* Uninstall a plugin by removing it from config and optionally deleting installed files.
+* Linked plugins (source === "path") never have their source directory deleted.
+*/
+async function uninstallPlugin(params) {
+	const { config, pluginId, deleteFiles = true, extensionsDir } = params;
+	const hasEntry = pluginId in (config.plugins?.entries ?? {});
+	const hasInstall = pluginId in (config.plugins?.installs ?? {});
+	if (!hasEntry && !hasInstall) return {
+		ok: false,
+		error: `Plugin not found: ${pluginId}`
+	};
+	const installRecord = config.plugins?.installs?.[pluginId];
+	const isLinked = installRecord?.source === "path";
+	const { config: newConfig, actions: configActions } = removePluginFromConfig(config, pluginId);
+	const actions = {
+		...configActions,
+		directory: false
+	};
+	const warnings = [];
+	const deleteTarget = deleteFiles && !isLinked ? resolveUninstallDirectoryTarget({
+		pluginId,
+		hasInstall,
+		installRecord,
+		extensionsDir
+	}) : null;
+	if (deleteTarget) {
+		const existed = await fs$1.access(deleteTarget).then(() => true).catch(() => false) ?? false;
+		try {
+			await fs$1.rm(deleteTarget, {
+				recursive: true,
+				force: true
+			});
+			actions.directory = existed;
+		} catch (error) {
+			warnings.push(`Failed to remove plugin directory ${deleteTarget}: ${error instanceof Error ? error.message : String(error)}`);
+		}
+	}
+	return {
+		ok: true,
+		config: newConfig,
+		pluginId,
+		actions,
+		warnings
+	};
+}
+
 //#endregion
 //#region src/cli/plugins-cli.ts
 function formatPluginLine(plugin, verbose = false) {
@@ -302,6 +444,71 @@ function registerPluginsCli(program) {
 		});
 		defaultRuntime.log(`Disabled plugin "${id}". Restart the gateway to apply.`);
 	});
+	plugins.command("uninstall").description("Uninstall a plugin").argument("<id>", "Plugin id").option("--keep-files", "Keep installed files on disk", false).option("--keep-config", "Deprecated alias for --keep-files", false).option("--force", "Skip confirmation prompt", false).option("--dry-run", "Show what would be removed without making changes", false).action(async (id, opts) => {
+		const cfg = loadConfig();
+		const report = buildPluginStatusReport({ config: cfg });
+		const extensionsDir = path.join(resolveStateDir(process.env, os.homedir), "extensions");
+		const keepFiles = Boolean(opts.keepFiles || opts.keepConfig);
+		if (opts.keepConfig) defaultRuntime.log(theme.warn("`--keep-config` is deprecated, use `--keep-files`."));
+		const plugin = report.plugins.find((p) => p.id === id || p.name === id);
+		const pluginId = plugin?.id ?? id;
+		const hasEntry = pluginId in (cfg.plugins?.entries ?? {});
+		const hasInstall = pluginId in (cfg.plugins?.installs ?? {});
+		if (!hasEntry && !hasInstall) {
+			if (plugin) defaultRuntime.error(`Plugin "${pluginId}" is not managed by plugins config/install records and cannot be uninstalled.`);
+			else defaultRuntime.error(`Plugin not found: ${id}`);
+			process.exit(1);
+		}
+		const install = cfg.plugins?.installs?.[pluginId];
+		const isLinked = install?.source === "path";
+		const preview = [];
+		if (hasEntry) preview.push("config entry");
+		if (hasInstall) preview.push("install record");
+		if (cfg.plugins?.allow?.includes(pluginId)) preview.push("allowlist entry");
+		if (isLinked && install?.sourcePath && cfg.plugins?.load?.paths?.includes(install.sourcePath)) preview.push("load path");
+		if (cfg.plugins?.slots?.memory === pluginId) preview.push(`memory slot (will reset to "memory-core")`);
+		const deleteTarget = !keepFiles ? resolveUninstallDirectoryTarget({
+			pluginId,
+			hasInstall,
+			installRecord: install,
+			extensionsDir
+		}) : null;
+		if (deleteTarget) preview.push(`directory: ${shortenHomePath(deleteTarget)}`);
+		const pluginName = plugin?.name || pluginId;
+		defaultRuntime.log(`Plugin: ${theme.command(pluginName)}${pluginName !== pluginId ? theme.muted(` (${pluginId})`) : ""}`);
+		defaultRuntime.log(`Will remove: ${preview.length > 0 ? preview.join(", ") : "(nothing)"}`);
+		if (opts.dryRun) {
+			defaultRuntime.log(theme.muted("Dry run, no changes made."));
+			return;
+		}
+		if (!opts.force) {
+			if (!await promptYesNo(`Uninstall plugin "${pluginId}"?`)) {
+				defaultRuntime.log("Cancelled.");
+				return;
+			}
+		}
+		const result = await uninstallPlugin({
+			config: cfg,
+			pluginId,
+			deleteFiles: !keepFiles,
+			extensionsDir
+		});
+		if (!result.ok) {
+			defaultRuntime.error(result.error);
+			process.exit(1);
+		}
+		for (const warning of result.warnings) defaultRuntime.log(theme.warn(warning));
+		await writeConfigFile(result.config);
+		const removed = [];
+		if (result.actions.entry) removed.push("config entry");
+		if (result.actions.install) removed.push("install record");
+		if (result.actions.allowlist) removed.push("allowlist");
+		if (result.actions.loadPath) removed.push("load path");
+		if (result.actions.memorySlot) removed.push("memory slot");
+		if (result.actions.directory) removed.push("directory");
+		defaultRuntime.log(`Uninstalled plugin "${pluginId}". Removed: ${removed.length > 0 ? removed.join(", ") : "nothing"}.`);
+		defaultRuntime.log("Restart the gateway to apply changes.");
+	});
 	plugins.command("install").description("Install a plugin (path, archive, or npm spec)").argument("<path-or-spec>", "Path (.ts/.js/.zip/.tgz/.tar.gz) or an npm package spec").option("-l, --link", "Link a local path instead of copying", false).action(async (raw, opts) => {
 		const resolved = resolveUserPath(raw);
 		const cfg = loadConfig();