activeclaw 2026.2.12 → 2026.2.13

package/dist/{update-cli-CBXp-c4C.js → update-cli-Wb1GB3rL.js}

@@ -1,76 +1,76 @@
-import { X as resolveStateDir, k as theme, p as defaultRuntime } from "./entry.js";
-import "./auth-profiles-CcJ3hrog.js";
-import { n as replaceCliName, r as resolveCliName, t as formatCliCommand } from "./command-format-ayFsmwwz.js";
-import { h as pathExists } from "./utils-Dk86IbEs.js";
-import { t as runCommandWithTimeout } from "./exec-B8JKbXKW.js";
+import { A as theme, Z as resolveStateDir, p as defaultRuntime } from "./entry.js";
+import "./auth-profiles-ByNs3eEm.js";
+import { n as replaceCliName, r as resolveCliName, t as formatCliCommand } from "./command-format-Bxe0mWee.js";
+import { h as pathExists } from "./utils-BLJAc3ZV.js";
+import { t as runCommandWithTimeout } from "./exec-CACT5OAW.js";
 import { t as resolveOpenClawPackageRoot } from "./openclaw-root-BNlEap4i.js";
-import "./agent-scope-RCSw6gHy.js";
-import "./github-copilot-token-SLWintYd.js";
+import "./agent-scope-CsRbLH4l.js";
+import "./github-copilot-token-Cfs0Wxr8.js";
 import "./pi-model-discovery-DzEIEgHL.js";
-import { c as writeConfigFile, o as readConfigFileSnapshot } from "./config-B7sno9eI.js";
-import "./manifest-registry-BTgLN_W2.js";
-import "./server-context-fX4xiYRh.js";
-import "./chrome-yIKmOzCO.js";
-import "./control-service-B2er20Ke.js";
-import "./tailscale-DU6DgqVy.js";
-import "./auth-BcNHFK-i.js";
-import "./client-D7wrC1Ug.js";
-import "./call-Yxns4CVq.js";
-import "./message-channel-BlgPSDAh.js";
-import { t as formatDocsLink } from "./links-7M-j83As.js";
-import "./plugin-auto-enable-BY4CqJbD.js";
-import "./plugins-3GyCj5KL.js";
+import { c as writeConfigFile, o as readConfigFileSnapshot } from "./config-Bdhomfei.js";
+import "./manifest-registry-u0okVSkU.js";
+import "./server-context-BGpGs3qd.js";
+import "./chrome-foEwx3lN.js";
+import "./auth-9x3lqfIY.js";
+import "./control-auth-8Cf4WXpR.js";
+import "./control-service-DKnttEus.js";
+import "./client-CTwXnRl7.js";
+import "./call-DVYCIV8m.js";
+import "./message-channel-C_MmebBt.js";
+import { t as formatDocsLink } from "./links-B8LAzWwg.js";
+import "./plugin-auto-enable-Bqhc3w5n.js";
+import "./plugins-4Hqd1WGf.js";
 import "./logging-CfEk_PnX.js";
-import "./accounts-DbzMEfKN.js";
-import { zn as trimLogTail } from "./loader-Caow9TPA.js";
-import "./progress-Da1ehW-x.js";
-import { n as stylePromptMessage, t as stylePromptHint } from "./prompt-style-Dc0C5HC9.js";
-import "./note-Ci08TSbV.js";
+import "./accounts-DCDeFTra.js";
+import { Fn as trimLogTail } from "./loader-KjT074JR.js";
+import "./progress-DWqhRakV.js";
+import { n as stylePromptMessage, t as stylePromptHint } from "./prompt-style-BFH5D5LN.js";
+import "./note-hhtubr2j.js";
 import "./archive-D0z3LZDK.js";
-import "./skill-scanner-C_fQzVDu.js";
-import "./installs-NS0VMPN7.js";
-import "./manager-DseK7RWj.js";
-import "./paths-IivnSNkP.js";
-import "./sqlite-B7FPASCO.js";
-import "./redact-DuEEf1p1.js";
-import "./routes-BqxA3ZYr.js";
-import "./pi-embedded-helpers-Uan-3N1T.js";
-import "./deliver-DzcxEcza.js";
-import "./fetch-timeout-B2KlHXi3.js";
-import "./sandbox-B0K9e6Fw.js";
-import "./tui-formatters-C_baVYUz.js";
-import "./wsl-B-H6Z5wp.js";
-import "./skills-BvPUNjxo.js";
-import "./image-LxFvu0wL.js";
+import "./skill-scanner-rHMtUHtP.js";
+import "./installs-CrLcWYHe.js";
+import "./deliver-CIU9Npgs.js";
+import "./manager-T1XfGchB.js";
+import "./paths-DLINmNFQ.js";
+import "./sqlite-BINzs1U0.js";
+import "./redact-Br9GfacZ.js";
+import "./routes-DewK5tq2.js";
+import "./pi-embedded-helpers-DfwkwPYD.js";
+import "./fetch-timeout-DTK9vxex.js";
+import "./sandbox-BKYnhYQH.js";
+import "./tui-formatters-DePhZK3J.js";
+import "./wsl-BUOkxKJu.js";
+import "./skills-DRjfSQT3.js";
+import "./image-DgtfXMcX.js";
 import { r as formatDurationPrecise } from "./format-duration-Bo9zNKwO.js";
-import "./tool-display-sHJa3kRs.js";
-import "./channel-selection-BoQ7GurB.js";
-import "./session-cost-usage-CL8gnHRN.js";
-import "./runner-C1G8RFWl.js";
-import "./commands-BG25qku5.js";
-import "./pairing-store-fIWI3pXG.js";
-import "./login-qr-CAk9D-FM.js";
-import "./pairing-labels-Bin1K7_f.js";
-import "./channels-status-issues-Ca9--azp.js";
-import "./register.subclis-BpX3ulH1.js";
-import { r as installCompletion } from "./completion-cli-C4zxjkC1.js";
-import "./deps-Cva7QM_t.js";
-import { g as parseSemver } from "./daemon-runtime-BHF5NjQ7.js";
-import "./service-DNcIZ5Kp.js";
-import "./systemd-CNTodvCO.js";
-import "./shared-CtP9K-o2.js";
-import { r as runDaemonRestart } from "./daemon-cli-DF6Rxjy6.js";
-import "./service-audit-uhZSlxeb.js";
-import { t as renderTable } from "./table-oJQPTUL6.js";
-import "./health-format-gLMfE2wf.js";
-import { C as resolveEffectiveUpdateChannel, S as normalizeUpdateChannel, _ as resolveNpmChannelTag, a as globalInstallArgs, b as channelToNpmTag, c as formatUpdateOneLiner, d as checkShellCompletionStatus, g as fetchNpmTagVersion, h as compareSemverStrings, i as detectGlobalInstallManagerForRoot, m as checkUpdateStatus, n as cleanupGlobalRenameDirs, o as resolveGlobalPackageRoot, p as ensureCompletionCacheExists, r as detectGlobalInstallManagerByPresence, s as formatUpdateAvailableHint, t as runGatewayUpdate, u as resolveUpdateAvailability, v as DEFAULT_GIT_CHANNEL, x as formatUpdateChannelLabel, y as DEFAULT_PACKAGE_CHANNEL } from "./update-runner-BLsqC24J.js";
-import "./logging-D0MyqUlV.js";
-import "./skills-status-DJDaA2Ur.js";
-import "./auth-health-zZ9dnQGC.js";
-import { n as updateNpmInstalledPlugins, t as syncPluginsForUpdateChannel } from "./update-uwUWrKFu.js";
-import { t as formatHelpExamples } from "./help-format-DUy1KRxq.js";
-import "./systemd-linger-CArPbmvv.js";
-import { t as doctorCommand } from "./doctor-BZfxDGUg.js";
+import "./tool-display-ClRud3pg.js";
+import "./channel-selection-D4D6ImhN.js";
+import "./session-cost-usage-D9hHANWI.js";
+import "./runner-CY0nmVme.js";
+import "./commands-BX_OIIVR.js";
+import "./pairing-store-Dp5_JGnG.js";
+import "./login-qr-CuvemJj4.js";
+import "./pairing-labels-CgNHnjzT.js";
+import "./channels-status-issues-D7GSV1GS.js";
+import "./register.subclis-C02e4zuJ.js";
+import { r as installCompletion } from "./completion-cli-CR77-jyv.js";
+import "./deps-QSwGcoNZ.js";
+import { g as parseSemver } from "./daemon-runtime-B0tg_LsX.js";
+import "./service-99RDXwX4.js";
+import "./systemd-C0VZriGM.js";
+import "./shared-ICqOZibV.js";
+import { r as runDaemonRestart } from "./daemon-cli-cNSF93-v.js";
+import "./service-audit-ckBaRCVC.js";
+import { t as renderTable } from "./table-CwulTLQp.js";
+import "./health-format-LZDxu3rv.js";
+import { C as resolveEffectiveUpdateChannel, S as normalizeUpdateChannel, _ as resolveNpmChannelTag, a as globalInstallArgs, b as channelToNpmTag, c as formatUpdateOneLiner, d as checkShellCompletionStatus, g as fetchNpmTagVersion, h as compareSemverStrings, i as detectGlobalInstallManagerForRoot, m as checkUpdateStatus, n as cleanupGlobalRenameDirs, o as resolveGlobalPackageRoot, p as ensureCompletionCacheExists, r as detectGlobalInstallManagerByPresence, s as formatUpdateAvailableHint, t as runGatewayUpdate, u as resolveUpdateAvailability, v as DEFAULT_GIT_CHANNEL, x as formatUpdateChannelLabel, y as DEFAULT_PACKAGE_CHANNEL } from "./update-runner--ixK4J3W.js";
+import "./logging-CRq4h04P.js";
+import "./skills-status-TDIgVd1K.js";
+import "./auth-health-j6epgQbq.js";
+import { n as updateNpmInstalledPlugins, t as syncPluginsForUpdateChannel } from "./update-DU1geolI.js";
+import { t as formatHelpExamples } from "./help-format-R5fLToDw.js";
+import "./systemd-linger-xdn3BdPh.js";
+import { t as doctorCommand } from "./doctor-sYG5V4Co.js";
 import { spawnSync } from "node:child_process";
 import path from "node:path";
 import os from "node:os";

package/dist/{update-runner-BLsqC24J.js → update-runner--ixK4J3W.js}

@@ -1,14 +1,14 @@
-import { r as resolveCliName, t as formatCliCommand } from "./command-format-ayFsmwwz.js";
-import { h as pathExists } from "./utils-Dk86IbEs.js";
-import { t as runCommandWithTimeout } from "./exec-B8JKbXKW.js";
+import { r as resolveCliName, t as formatCliCommand } from "./command-format-Bxe0mWee.js";
+import { h as pathExists } from "./utils-BLJAc3ZV.js";
+import { t as runCommandWithTimeout } from "./exec-CACT5OAW.js";
 import { t as resolveOpenClawPackageRoot } from "./openclaw-root-BNlEap4i.js";
-import { M as VERSION } from "./config-B7sno9eI.js";
-import { zn as trimLogTail } from "./loader-Caow9TPA.js";
-import { t as note } from "./note-Ci08TSbV.js";
-import { t as fetchWithTimeout } from "./fetch-timeout-B2KlHXi3.js";
-import { a as resolveCompletionCachePath, i as isCompletionInstalled, o as resolveShellFromEnv, r as installCompletion, s as usesSlowDynamicCompletion, t as completionCacheExists } from "./completion-cli-C4zxjkC1.js";
-import { g as parseSemver } from "./daemon-runtime-BHF5NjQ7.js";
-import { i as resolveControlUiDistIndexPathForRoot, r as resolveControlUiDistIndexHealth } from "./health-format-gLMfE2wf.js";
+import { M as VERSION } from "./config-Bdhomfei.js";
+import { Fn as trimLogTail } from "./loader-KjT074JR.js";
+import { t as note } from "./note-hhtubr2j.js";
+import { t as fetchWithTimeout } from "./fetch-timeout-DTK9vxex.js";
+import { a as resolveCompletionCachePath, i as isCompletionInstalled, o as resolveShellFromEnv, r as installCompletion, s as usesSlowDynamicCompletion, t as completionCacheExists } from "./completion-cli-CR77-jyv.js";
+import { g as parseSemver } from "./daemon-runtime-B0tg_LsX.js";
+import { i as resolveControlUiDistIndexPathForRoot, r as resolveControlUiDistIndexHealth } from "./health-format-LZDxu3rv.js";
 import { spawnSync } from "node:child_process";
 import path from "node:path";
 import os from "node:os";

package/dist/{update-runner-C_FDpmA3.js → update-runner-7Qa1T9y6.js}

@@ -1,14 +1,14 @@
-import { g as pathExists } from "./utils-BHPdZE4h.js";
-import { Y as trimLogTail } from "./reply-m467_fOC.js";
-import { t as runCommandWithTimeout } from "./exec-DXtR2fhb.js";
+import { g as pathExists } from "./utils-Cd9QdCHh.js";
+import { Y as trimLogTail } from "./reply-DICXkh_C.js";
+import { t as runCommandWithTimeout } from "./exec-YIosokWE.js";
 import { t as resolveOpenClawPackageRoot } from "./openclaw-root-1VeFrph_.js";
 import { r as resolveCliName, t as formatCliCommand } from "./command-format-ChfKqObn.js";
-import { M as VERSION } from "./config-DH9TLUNc.js";
-import { r as fetchWithTimeout } from "./fetch-CqZP8jwB.js";
-import { _ as parseSemver } from "./daemon-runtime-B05PME1z.js";
-import { t as note } from "./note-CAM9PbSJ.js";
-import { i as resolveControlUiDistIndexPathForRoot, r as resolveControlUiDistIndexHealth } from "./health-format-C0C_Apce.js";
-import { a as resolveCompletionCachePath, i as isCompletionInstalled, o as resolveShellFromEnv, r as installCompletion, s as usesSlowDynamicCompletion, t as completionCacheExists } from "./completion-cli-DECEgBWR.js";
+import { M as VERSION } from "./config-aFQssWKX.js";
+import { r as fetchWithTimeout } from "./fetch-DmiOpALK.js";
+import { _ as parseSemver } from "./daemon-runtime-Bsjeut6m.js";
+import { t as note } from "./note-BhRSeNeu.js";
+import { i as resolveControlUiDistIndexPathForRoot, r as resolveControlUiDistIndexHealth } from "./health-format-KGPokKJH.js";
+import { a as resolveCompletionCachePath, i as isCompletionInstalled, o as resolveShellFromEnv, r as installCompletion, s as usesSlowDynamicCompletion, t as completionCacheExists } from "./completion-cli-DnjpxAag.js";
 import os from "node:os";
 import path from "node:path";
 import fs from "node:fs/promises";

package/dist/{utils-Dk86IbEs.js → utils-BLJAc3ZV.js}

@@ -1,4 +1,4 @@
-import { J as resolveOAuthDir, dt as expandHomePrefix, ft as resolveEffectiveHomeDir, pt as resolveRequiredHomeDir, w as shouldLogVerbose, x as logVerbose } from "./entry.js";
+import { S as logVerbose, T as shouldLogVerbose, Y as resolveOAuthDir, ht as resolveRequiredHomeDir, mt as resolveEffectiveHomeDir, pt as expandHomePrefix } from "./entry.js";
 import path from "node:path";
 import os from "node:os";
 import fs from "node:fs";

package/dist/{utils-BHPdZE4h.js → utils-Cd9QdCHh.js}

@@ -1,5 +1,5 @@
 import { _ as expandHomePrefix, m as resolveOAuthDir, v as resolveEffectiveHomeDir, y as resolveRequiredHomeDir } from "./paths-DVBShlw6.js";
-import { A as logVerbose, N as shouldLogVerbose } from "./subsystem-Bv7dGhES.js";
+import { A as logVerbose, N as shouldLogVerbose } from "./subsystem-BoExtIHo.js";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";

package/dist/{webhooks-cli-BpBKXL7W.js → webhooks-cli-DgcMy7RG.js}

@@ -1,15 +1,15 @@
-import { F as CONFIG_PATH, W as resolveGatewayPort, k as theme, p as defaultRuntime, v as danger } from "./entry.js";
-import "./auth-profiles-CcJ3hrog.js";
-import { t as formatCliCommand } from "./command-format-ayFsmwwz.js";
-import { a as displayPath } from "./utils-Dk86IbEs.js";
-import { t as runCommandWithTimeout } from "./exec-B8JKbXKW.js";
-import "./agent-scope-RCSw6gHy.js";
-import "./github-copilot-token-SLWintYd.js";
-import { c as writeConfigFile, i as loadConfig, l as validateConfigObjectWithPlugins, o as readConfigFileSnapshot } from "./config-B7sno9eI.js";
-import "./manifest-registry-BTgLN_W2.js";
-import { t as formatDocsLink } from "./links-7M-j83As.js";
-import "./skills-BvPUNjxo.js";
-import { C as normalizeServePath, S as normalizeHooksPath, T as resolveGmailHookRuntimeConfig, _ as buildGogWatchServeArgs, a as ensureTopic, b as generateHookToken, c as DEFAULT_GMAIL_LABEL, d as DEFAULT_GMAIL_SERVE_BIND, f as DEFAULT_GMAIL_SERVE_PATH, g as buildDefaultHookUrl, h as DEFAULT_GMAIL_TOPIC, i as ensureTailscaleEndpoint, l as DEFAULT_GMAIL_MAX_BYTES, m as DEFAULT_GMAIL_SUBSCRIPTION, n as ensureGcloudAuth, o as resolveProjectIdFromGogCredentials, p as DEFAULT_GMAIL_SERVE_PORT, r as ensureSubscription, s as runGcloud, t as ensureDependency, u as DEFAULT_GMAIL_RENEW_MINUTES, v as buildGogWatchStartArgs, w as parseTopicPath, x as mergeHookPresets, y as buildTopicPath } from "./gmail-setup-utils-WDyf1gTU.js";
+import { A as theme, G as resolveGatewayPort, I as CONFIG_PATH, p as defaultRuntime, v as danger } from "./entry.js";
+import "./auth-profiles-ByNs3eEm.js";
+import { t as formatCliCommand } from "./command-format-Bxe0mWee.js";
+import { a as displayPath } from "./utils-BLJAc3ZV.js";
+import { t as runCommandWithTimeout } from "./exec-CACT5OAW.js";
+import "./agent-scope-CsRbLH4l.js";
+import "./github-copilot-token-Cfs0Wxr8.js";
+import { c as writeConfigFile, i as loadConfig, l as validateConfigObjectWithPlugins, o as readConfigFileSnapshot } from "./config-Bdhomfei.js";
+import "./manifest-registry-u0okVSkU.js";
+import { t as formatDocsLink } from "./links-B8LAzWwg.js";
+import "./skills-DRjfSQT3.js";
+import { C as normalizeServePath, S as normalizeHooksPath, T as resolveGmailHookRuntimeConfig, _ as buildGogWatchServeArgs, a as ensureTopic, b as generateHookToken, c as DEFAULT_GMAIL_LABEL, d as DEFAULT_GMAIL_SERVE_BIND, f as DEFAULT_GMAIL_SERVE_PATH, g as buildDefaultHookUrl, h as DEFAULT_GMAIL_TOPIC, i as ensureTailscaleEndpoint, l as DEFAULT_GMAIL_MAX_BYTES, m as DEFAULT_GMAIL_SUBSCRIPTION, n as ensureGcloudAuth, o as resolveProjectIdFromGogCredentials, p as DEFAULT_GMAIL_SERVE_PORT, r as ensureSubscription, s as runGcloud, t as ensureDependency, u as DEFAULT_GMAIL_RENEW_MINUTES, v as buildGogWatchStartArgs, w as parseTopicPath, x as mergeHookPresets, y as buildTopicPath } from "./gmail-setup-utils-DJb-_5kO.js";
 import { spawn } from "node:child_process";
 
 //#region src/hooks/gmail-ops.ts

package/dist/{webhooks-cli-wNfhfKqm.js → webhooks-cli-aVzUcJY9.js}

@@ -1,18 +1,18 @@
 import { t as CONFIG_PATH, u as resolveGatewayPort } from "./paths-DVBShlw6.js";
-import { E as danger, R as theme, c as defaultRuntime } from "./subsystem-Bv7dGhES.js";
-import { o as displayPath } from "./utils-BHPdZE4h.js";
-import { t as runCommandWithTimeout } from "./exec-DXtR2fhb.js";
-import "./agent-scope---6LLHj0.js";
-import "./model-selection-unMJyUIE.js";
+import { E as danger, R as theme, c as defaultRuntime } from "./subsystem-BoExtIHo.js";
+import { o as displayPath } from "./utils-Cd9QdCHh.js";
+import { t as runCommandWithTimeout } from "./exec-YIosokWE.js";
+import "./agent-scope-CQCus0rI.js";
+import "./model-selection-BLuqsGVB.js";
 import "./github-copilot-token-BW-SEg7E.js";
 import { t as formatCliCommand } from "./command-format-ChfKqObn.js";
 import "./boolean-BgXe2hyu.js";
-import "./env-DE9xvYOL.js";
-import { c as writeConfigFile, i as loadConfig, l as validateConfigObjectWithPlugins, o as readConfigFileSnapshot } from "./config-DH9TLUNc.js";
-import "./manifest-registry-DFckk-L8.js";
-import "./skills-aFOsriMP.js";
-import { t as formatDocsLink } from "./links-CV4oki2u.js";
-import { C as normalizeServePath, S as normalizeHooksPath, T as resolveGmailHookRuntimeConfig, _ as buildGogWatchServeArgs, a as ensureTopic, b as generateHookToken, c as DEFAULT_GMAIL_LABEL, d as DEFAULT_GMAIL_SERVE_BIND, f as DEFAULT_GMAIL_SERVE_PATH, g as buildDefaultHookUrl, h as DEFAULT_GMAIL_TOPIC, i as ensureTailscaleEndpoint, l as DEFAULT_GMAIL_MAX_BYTES, m as DEFAULT_GMAIL_SUBSCRIPTION, n as ensureGcloudAuth, o as resolveProjectIdFromGogCredentials, p as DEFAULT_GMAIL_SERVE_PORT, r as ensureSubscription, s as runGcloud, t as ensureDependency, u as DEFAULT_GMAIL_RENEW_MINUTES, v as buildGogWatchStartArgs, w as parseTopicPath, x as mergeHookPresets, y as buildTopicPath } from "./gmail-setup-utils-Cgh0ptgA.js";
+import "./env-ONzUVAG2.js";
+import { c as writeConfigFile, i as loadConfig, l as validateConfigObjectWithPlugins, o as readConfigFileSnapshot } from "./config-aFQssWKX.js";
+import "./manifest-registry-CQhdnDBZ.js";
+import "./skills-DprQj9X2.js";
+import { t as formatDocsLink } from "./links-Eax1UO3w.js";
+import { C as normalizeServePath, S as normalizeHooksPath, T as resolveGmailHookRuntimeConfig, _ as buildGogWatchServeArgs, a as ensureTopic, b as generateHookToken, c as DEFAULT_GMAIL_LABEL, d as DEFAULT_GMAIL_SERVE_BIND, f as DEFAULT_GMAIL_SERVE_PATH, g as buildDefaultHookUrl, h as DEFAULT_GMAIL_TOPIC, i as ensureTailscaleEndpoint, l as DEFAULT_GMAIL_MAX_BYTES, m as DEFAULT_GMAIL_SUBSCRIPTION, n as ensureGcloudAuth, o as resolveProjectIdFromGogCredentials, p as DEFAULT_GMAIL_SERVE_PORT, r as ensureSubscription, s as runGcloud, t as ensureDependency, u as DEFAULT_GMAIL_RENEW_MINUTES, v as buildGogWatchStartArgs, w as parseTopicPath, x as mergeHookPresets, y as buildTopicPath } from "./gmail-setup-utils-Cfns8TQx.js";
 import { spawn } from "node:child_process";
 
 //#region src/hooks/gmail-ops.ts

package/dist/{widearea-dns-WVCWJTEb.js → widearea-dns-BaIgNEhY.js}

@@ -1,4 +1,4 @@
-import { s as ensureDir, t as CONFIG_DIR } from "./utils-Dk86IbEs.js";
+import { s as ensureDir, t as CONFIG_DIR } from "./utils-BLJAc3ZV.js";
 import path from "node:path";
 import os from "node:os";
 import fs from "node:fs";

package/dist/{widearea-dns-BWYPcfby.js → widearea-dns-DzuRdwk5.js}

@@ -1,4 +1,4 @@
-import { c as ensureDir, t as CONFIG_DIR } from "./utils-BHPdZE4h.js";
+import { c as ensureDir, t as CONFIG_DIR } from "./utils-Cd9QdCHh.js";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";

package/dist/{ws-log-Cafylho7.js → ws-log-CIXbLCka.js}

@@ -1,6 +1,6 @@
 import { b as isVerbose, d as shouldLogSubsystemToConsole, o as createSubsystemLogger } from "./entry.js";
 import { y as parseAgentSessionKey } from "./session-key-DVvxnFKg.js";
-import { n as redactSensitiveText, t as getDefaultRedactPatterns } from "./redact-DuEEf1p1.js";
+import { n as redactSensitiveText, t as getDefaultRedactPatterns } from "./redact-Br9GfacZ.js";
 import chalk from "chalk";
 
 //#region src/gateway/ws-logging.ts

package/dist/{ws-log-DTUOUVgR.js → ws-log-DcQFZByi.js}

@@ -1,4 +1,4 @@
-import { O as isVerbose, o as shouldLogSubsystemToConsole, t as createSubsystemLogger } from "./subsystem-Bv7dGhES.js";
+import { O as isVerbose, o as shouldLogSubsystemToConsole, t as createSubsystemLogger } from "./subsystem-BoExtIHo.js";
 import { y as parseAgentSessionKey } from "./session-key-BWxPj0z_.js";
 import { n as redactSensitiveText, t as getDefaultRedactPatterns } from "./redact-BRsnXqwD.js";
 import chalk from "chalk";

package/dist/{wsl-B-H6Z5wp.js → wsl-BUOkxKJu.js}

@@ -1,5 +1,5 @@
-import { c as escapeRegExp } from "./utils-Dk86IbEs.js";
-import { t as registerBrowserRoutes } from "./routes-BqxA3ZYr.js";
+import { c as escapeRegExp } from "./utils-BLJAc3ZV.js";
+import { t as registerBrowserRoutes } from "./routes-DewK5tq2.js";
 import { execFile } from "node:child_process";
 import os from "node:os";
 import { readFileSync } from "node:fs";

package/docs/automation/webhook.md

@@ -37,7 +37,7 @@ Every request must include the hook token. Prefer headers:
 
 - `Authorization: Bearer <token>` (recommended)
 - `x-openclaw-token: <token>`
-- `?token=<token>` (deprecated; logs a warning and will be removed in a future major release)
+- Query-string tokens are rejected (`?token=...` returns `400`).
 
 ## Endpoints
 
@@ -80,7 +80,7 @@ Payload:
 - `message` **required** (string): The prompt or message for the agent to process.
 - `name` optional (string): Human-readable name for the hook (e.g., "GitHub"), used as a prefix in session summaries.
 - `agentId` optional (string): Route this hook to a specific agent. Unknown IDs fall back to the default agent. When set, the hook runs using the resolved agent's workspace and configuration.
-- `sessionKey` optional (string): The key used to identify the agent's session. Defaults to a random `hook:<uuid>`. Using a consistent key allows for a multi-turn conversation within the hook context.
+- `sessionKey` optional (string): The key used to identify the agent's session. By default this field is rejected unless `hooks.allowRequestSessionKey=true`.
 - `wakeMode` optional (`now` | `next-heartbeat`): Whether to trigger an immediate heartbeat (default `now`) or wait for the next periodic check.
 - `deliver` optional (boolean): If `true`, the agent's response will be sent to the messaging channel. Defaults to `true`. Responses that are only heartbeat acknowledgments are automatically skipped.
 - `channel` optional (string): The messaging channel for delivery. One of: `last`, `whatsapp`, `telegram`, `discord`, `slack`, `mattermost` (plugin), `signal`, `imessage`, `msteams`. Defaults to `last`.
@@ -95,6 +95,40 @@ Effect:
 - Always posts a summary into the **main** session
 - If `wakeMode=now`, triggers an immediate heartbeat
 
+## Session key policy (breaking change)
+
+`/hooks/agent` payload `sessionKey` overrides are disabled by default.
+
+- Recommended: set a fixed `hooks.defaultSessionKey` and keep request overrides off.
+- Optional: allow request overrides only when needed, and restrict prefixes.
+
+Recommended config:
+
+```json5
+{
+  hooks: {
+    enabled: true,
+    token: "${OPENCLAW_HOOKS_TOKEN}",
+    defaultSessionKey: "hook:ingress",
+    allowRequestSessionKey: false,
+    allowedSessionKeyPrefixes: ["hook:"],
+  },
+}
+```
+
+Compatibility config (legacy behavior):
+
+```json5
+{
+  hooks: {
+    enabled: true,
+    token: "${OPENCLAW_HOOKS_TOKEN}",
+    allowRequestSessionKey: true,
+    allowedSessionKeyPrefixes: ["hook:"], // strongly recommended
+  },
+}
+```
+
 ### `POST /hooks/<name>` (mapped)
 
 Custom hook names are resolved via `hooks.mappings` (see configuration). A mapping can
@@ -112,6 +146,9 @@ Mapping options (summary):
   (`channel` defaults to `last` and falls back to WhatsApp).
 - `agentId` routes the hook to a specific agent; unknown IDs fall back to the default agent.
 - `hooks.allowedAgentIds` restricts explicit `agentId` routing. Omit it (or include `*`) to allow any agent. Set `[]` to deny explicit `agentId` routing.
+- `hooks.defaultSessionKey` sets the default session for hook agent runs when no explicit key is provided.
+- `hooks.allowRequestSessionKey` controls whether `/hooks/agent` payloads may set `sessionKey` (default: `false`).
+- `hooks.allowedSessionKeyPrefixes` optionally restricts explicit `sessionKey` values from request payloads and mappings.
 - `allowUnsafeExternalContent: true` disables the external content safety wrapper for that hook
   (dangerous; only for trusted internal sources).
 - `openclaw webhooks gmail setup` writes `hooks.gmail` config for `openclaw webhooks gmail run`.
@@ -122,6 +159,7 @@ Mapping options (summary):
 - `200` for `/hooks/wake`
 - `202` for `/hooks/agent` (async run started)
 - `401` on auth failure
+- `429` after repeated auth failures from the same client (check `Retry-After`)
 - `400` on invalid payload
 - `413` on oversized payloads
 
@@ -165,7 +203,10 @@ curl -X POST http://127.0.0.1:18789/hooks/gmail \
 
 - Keep hook endpoints behind loopback, tailnet, or trusted reverse proxy.
 - Use a dedicated hook token; do not reuse gateway auth tokens.
+- Repeated auth failures are rate-limited per client address to slow brute-force attempts.
 - If you use multi-agent routing, set `hooks.allowedAgentIds` to limit explicit `agentId` selection.
+- Keep `hooks.allowRequestSessionKey=false` unless you require caller-selected sessions.
+- If you enable request `sessionKey`, restrict `hooks.allowedSessionKeyPrefixes` (for example, `["hook:"]`).
 - Avoid including sensitive raw payloads in webhook logs.
 - Hook payloads are treated as untrusted and wrapped with safety boundaries by default.
   If you must disable this for a specific hook, set `allowUnsafeExternalContent: true`

package/docs/channels/discord.md

@@ -28,7 +28,7 @@ Status: ready for DMs and guild channels via the official Discord gateway.
     Create an application in the Discord Developer Portal, add a bot, then enable:
 
     - **Message Content Intent**
-    - **Server Members Intent** (recommended for name-to-ID lookups and allowlist matching)
+    - **Server Members Intent** (required for role allowlists and role-based routing; recommended for name-to-ID allowlist matching)
 
   </Step>
 
@@ -121,6 +121,7 @@ Token resolution is account-aware. Config token values win over env fallback. `D
     `allowlist` behavior:
 
     - guild must match `channels.discord.guilds` (`id` preferred, slug accepted)
+    - optional sender allowlists: `users` (IDs or names) and `roles` (role IDs only); if either is configured, senders are allowed when they match `users` OR `roles`
     - if a guild has `channels` configured, non-listed channels are denied
     - if a guild has no `channels` block, all channels in that allowlisted guild are allowed
 
@@ -135,6 +136,7 @@ Token resolution is account-aware. Config token values win over env fallback. `D
         "123456789012345678": {
           requireMention: true,
           users: ["987654321098765432"],
+          roles: ["123456789012345678"],
           channels: {
             general: { allow: true },
             help: { allow: true, requireMention: true },
@@ -169,6 +171,32 @@ Token resolution is account-aware. Config token values win over env fallback. `D
   </Tab>
 </Tabs>
 
+### Role-based agent routing
+
+Use `bindings[].match.roles` to route Discord guild members to different agents by role ID. Role-based bindings accept role IDs only and are evaluated after peer or parent-peer bindings and before guild-only bindings.
+
+```json5
+{
+  bindings: [
+    {
+      agentId: "opus",
+      match: {
+        channel: "discord",
+        guildId: "123456789012345678",
+        roles: ["111111111111111111"],
+      },
+    },
+    {
+      agentId: "sonnet",
+      match: {
+        channel: "discord",
+        guildId: "123456789012345678",
+      },
+    },
+  ],
+}
+```
+
 ## Developer Portal setup
 
 <AccordionGroup>

package/docs/cli/plugins.md

@@ -1,5 +1,5 @@
 ---
-summary: "CLI reference for `openclaw plugins` (list, install, enable/disable, doctor)"
+summary: "CLI reference for `openclaw plugins` (list, install, uninstall, enable/disable, doctor)"
 read_when:
   - You want to install or manage in-process Gateway plugins
   - You want to debug plugin load failures
@@ -23,6 +23,7 @@ openclaw plugins list
 openclaw plugins info <id>
 openclaw plugins enable <id>
 openclaw plugins disable <id>
+openclaw plugins uninstall <id>
 openclaw plugins doctor
 openclaw plugins update <id>
 openclaw plugins update --all
@@ -51,6 +52,24 @@ Use `--link` to avoid copying a local directory (adds to `plugins.load.paths`):
 openclaw plugins install -l ./my-plugin
 ```
 
+### Uninstall
+
+```bash
+openclaw plugins uninstall <id>
+openclaw plugins uninstall <id> --dry-run
+openclaw plugins uninstall <id> --keep-files
+```
+
+`uninstall` removes plugin records from `plugins.entries`, `plugins.installs`,
+the plugin allowlist, and linked `plugins.load.paths` entries when applicable.
+For active memory plugins, the memory slot resets to `memory-core`.
+
+By default, uninstall also removes the plugin install directory under the active
+state dir extensions root (`$OPENCLAW_STATE_DIR/extensions/<id>`). Use
+`--keep-files` to keep files on disk.
+
+`--keep-config` is supported as a deprecated alias for `--keep-files`.
+
 ### Update
 
 ```bash

package/docs/cli/security.md

@@ -24,3 +24,4 @@ openclaw security audit --fix
 
 The audit warns when multiple DM senders share the main session and recommends **secure DM mode**: `session.dmScope="per-channel-peer"` (or `per-account-channel-peer` for multi-account channels) for shared inboxes.
 It also warns when small models (`<=300B`) are used without sandboxing and with web/browser tools enabled.
+For webhook ingress, it warns when `hooks.defaultSessionKey` is unset, when request `sessionKey` overrides are enabled, and when overrides are enabled without `hooks.allowedSessionKeyPrefixes`.

package/docs/concepts/session-tool.md

@@ -94,6 +94,7 @@ Behavior:
 - Announce delivery runs after the primary run completes and is best-effort; `status: "ok"` does not guarantee the announce was delivered.
 - Waits via gateway `agent.wait` (server-side) so reconnects don't drop the wait.
 - Agent-to-agent message context is injected for the primary run.
+- Inter-session messages are persisted with `message.provenance.kind = "inter_session"` so transcript readers can distinguish routed agent instructions from external user input.
 - After the primary run completes, OpenClaw runs a **reply-back loop**:
   - Round 2+ alternates between requester and target agents.
   - Reply exactly `REPLY_SKIP` to stop the ping‑pong.

package/docs/gateway/configuration-reference.md

@@ -1934,6 +1934,10 @@ See [Plugins](/tools/plugin).
 
 - Chat Completions: disabled by default. Enable with `gateway.http.endpoints.chatCompletions.enabled: true`.
 - Responses API: `gateway.http.endpoints.responses.enabled`.
+- Responses URL-input hardening:
+  - `gateway.http.endpoints.responses.maxUrlParts`
+  - `gateway.http.endpoints.responses.files.urlAllowlist`
+  - `gateway.http.endpoints.responses.images.urlAllowlist`
 
 ### Multi-instance isolation
 
@@ -1960,6 +1964,9 @@ See [Multiple Gateways](/gateway/multiple-gateways).
     token: "shared-secret",
     path: "/hooks",
     maxBodyBytes: 262144,
+    defaultSessionKey: "hook:ingress",
+    allowRequestSessionKey: false,
+    allowedSessionKeyPrefixes: ["hook:"],
     allowedAgentIds: ["hooks", "main"],
     presets: ["gmail"],
     transformsDir: "~/.openclaw/hooks",
@@ -1987,6 +1994,7 @@ Auth: `Authorization: Bearer <token>` or `x-openclaw-token: <token>`.
 
 - `POST /hooks/wake` → `{ text, mode?: "now"|"next-heartbeat" }`
 - `POST /hooks/agent` → `{ message, name?, agentId?, sessionKey?, wakeMode?, deliver?, channel?, to?, model?, thinking?, timeoutSeconds? }`
+  - `sessionKey` from request payload is accepted only when `hooks.allowRequestSessionKey=true` (default: `false`).
 - `POST /hooks/<name>` → resolved via `hooks.mappings`
 
 <Accordion title="Mapping details">
@@ -1997,6 +2005,9 @@ Auth: `Authorization: Bearer <token>` or `x-openclaw-token: <token>`.
 - `transform` can point to a JS/TS module returning a hook action.
 - `agentId` routes to a specific agent; unknown IDs fall back to default.
 - `allowedAgentIds`: restricts explicit routing (`*` or omitted = allow all, `[]` = deny all).
+- `defaultSessionKey`: optional fixed session key for hook agent runs without explicit `sessionKey`.
+- `allowRequestSessionKey`: allow `/hooks/agent` callers to set `sessionKey` (default: `false`).
+- `allowedSessionKeyPrefixes`: optional prefix allowlist for explicit `sessionKey` values (request + mapping), e.g. `["hook:"]`.
 - `deliver: true` sends final reply to a channel; `channel` defaults to `last`.
 - `model` overrides LLM for this hook run (must be allowed if model catalog is set).
 

package/docs/gateway/configuration.md

@@ -262,6 +262,9 @@ When validation fails:
         enabled: true,
         token: "shared-secret",
         path: "/hooks",
+        defaultSessionKey: "hook:ingress",
+        allowRequestSessionKey: false,
+        allowedSessionKeyPrefixes: ["hook:"],
         mappings: [
           {
             match: { path: "gmail" },

package/docs/gateway/openresponses-http-api.md

@@ -186,7 +186,11 @@ URL fetch defaults:
 
 - `files.allowUrl`: `true`
 - `images.allowUrl`: `true`
+- `maxUrlParts`: `8` (total URL-based `input_file` + `input_image` parts per request)
 - Requests are guarded (DNS resolution, private IP blocking, redirect caps, timeouts).
+- Optional hostname allowlists are supported per input type (`files.urlAllowlist`, `images.urlAllowlist`).
+  - Exact host: `"cdn.example.com"`
+  - Wildcard subdomains: `"*.assets.example.com"` (does not match apex)
 
 ## File + image limits (config)
 
@@ -200,8 +204,10 @@ Defaults can be tuned under `gateway.http.endpoints.responses`:
         responses: {
           enabled: true,
           maxBodyBytes: 20000000,
+          maxUrlParts: 8,
           files: {
             allowUrl: true,
+            urlAllowlist: ["cdn.example.com", "*.assets.example.com"],
             allowedMimes: [
               "text/plain",
               "text/markdown",
@@ -222,6 +228,7 @@ Defaults can be tuned under `gateway.http.endpoints.responses`:
           },
           images: {
             allowUrl: true,
+            urlAllowlist: ["images.example.com"],
             allowedMimes: ["image/jpeg", "image/png", "image/gif", "image/webp"],
             maxBytes: 10485760,
             maxRedirects: 3,
@@ -237,6 +244,7 @@ Defaults can be tuned under `gateway.http.endpoints.responses`:
 Defaults when omitted:
 
 - `maxBodyBytes`: 20MB
+- `maxUrlParts`: 8
 - `files.maxBytes`: 5MB
 - `files.maxChars`: 200k
 - `files.maxRedirects`: 3
@@ -248,6 +256,13 @@ Defaults when omitted:
 - `images.maxRedirects`: 3
 - `images.timeoutMs`: 10s
 
+Security note:
+
+- URL allowlists are enforced before fetch and on redirect hops.
+- Allowlisting a hostname does not bypass private/internal IP blocking.
+- For internet-exposed gateways, apply network egress controls in addition to app-level guards.
+  See [Security](/gateway/security).
+
 ## Streaming (SSE)
 
 Set `stream: true` to receive Server-Sent Events (SSE):