agent-messenger 2.34.0 → 2.36.0

package/dist/src/shared/utils/markdown-to-html.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown-to-html.js","sourceRoot":"","sources":["../../../../src/shared/utils/markdown-to-html.ts"],"names":[],"mappings":"AAAA,MAAM,wBAAwB,GAAG,QAAQ,CAAA;AACzC,MAAM,yBAAyB,GAAG,SAAS,CAAA;AAE3C,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IACnD,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAA;IACtD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC9B,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,IAAI,SAAS,GAAa,EAAE,CAAA;IAE5B,MAAM,cAAc,GAAG,GAAG,EAAE;QAC1B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAM;QACR,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAA;QACxE,SAAS,GAAG,EAAE,CAAA;IAChB,CAAC,CAAA;IAED,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,GAAI,CAAC;QAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAA;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAE3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,cAAc,EAAE,CAAA;YAChB,KAAK,EAAE,CAAA;YACP,SAAQ;QACV,CAAC;QAED,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,cAAc,EAAE,CAAA;YAChB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACpB,KAAK,EAAE,CAAA;YACP,SAAQ;QACV,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAA;QACpD,IAAI,YAAY,EAAE,CAAC;YACjB,cAAc,EAAE,CAAA;YAChB,MAAM,CAAC,IAAI,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;YACzG,KAAK,EAAE,CAAA;YACP,SAAQ;QACV,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,cAAc,EAAE,CAAA;YAChB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACnB,KAAK,EAAE,CAAA;YACP,SAAQ;QACV,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,cAAc,EAAE,CAAA;YAChB,MAAM,UAAU,GAAa,EAAE,CAAA;YAC/B,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC1D,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAA;gBAClD,KAAK,EAAE,CAAA;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,eAAe,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,eAAe,CAAC,CAAA;YACvG,SAAQ;QACV,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,cAAc,EAAE,CAAA;YAChB,MAAM,KAAK,GAAa,EAAE,CAAA;YAC1B,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC1D,KAAK,CAAC,IAAI,CAAC,OAAO,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAA;gBAC1E,KAAK,EAAE,CAAA;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAA;YACzC,SAAQ;QACV,CAAC;QAED,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,cAAc,EAAE,CAAA;YAChB,MAAM,KAAK,GAAa,EAAE,CAAA;YAC1B,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC9D,KAAK,CAAC,IAAI,CAAC,OAAO,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAA;gBAC9E,KAAK,EAAE,CAAA;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAA;YACzC,SAAQ;QACV,CAAC;QAED,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACpB,KAAK,EAAE,CAAA;IACT,CAAC;IAED,cAAc,EAAE,CAAA;IAEhB,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,CAAA;AACzD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,OAAO,QAAQ;SACZ,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC;SACvB,OAAO,CAAC,uCAAuC,EAAE,CAAC,CAAC,EAAE,SAA6B,EAAE,IAAY,EAAE,EAAE;QACnG,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAChC,CAAC,CAAC;SACD,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;SACtB,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC;SAC7B,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;SACtB,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;SACtB,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC;SAC1B,OAAO,CAAC,4BAA4B,EAAE,IAAI,CAAC;SAC3C,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC;SAC7B,OAAO,CAAC,wBAAwB,EAAE,IAAI,CAAC;SACvC,OAAO,CAAC,oBAAoB,EAAE,IAAI,CAAC;SACnC,OAAO,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAA;AACxD,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,YAAY,GAAa,EAAE,CAAA;IACjC,IAAI,IAAI,GAAG,QAAQ,CAAA;IAEnB,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,IAAY,EAAE,EAAE;QACtD,OAAO,uBAAuB,CAAC,YAAY,EAAE,SAAS,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAClF,CAAC,CAAC,CAAA;IAEF,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,4BAA4B,EAAE,CAAC,CAAC,EAAE,KAAa,EAAE,GAAW,EAAE,EAAE;QAClF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,OAAO,aAAa,CAAC,KAAK,CAAC,CAAA;QAC7B,CAAC;QACD,OAAO,uBAAuB,CAAC,YAAY,EAAE,YAAY,UAAU,CAAC,GAAG,CAAC,KAAK,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAC1G,CAAC,CAAC,CAAA;IAEF,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IACvB,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE,8BAA8B,CAAC,CAAA;IAC7E,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,qBAAqB,CAAC,CAAA;IAChE,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,kCAAkC,EAAE,eAAe,CAAC,CAAA;IAExE,OAAO,cAAc,CAAC,IAAI,EAAE,YAAY,CAAC,CAAA;AAC3C,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB;IACzC,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAC3B,wCAAwC,EACxC,CAAC,CAAC,EAAE,QAA4B,EAAE,IAAY,EAAE,EAAE;QAChD,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,oBAAoB,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;QAC7E,OAAO,sBAAsB,CAAC,MAAM,EAAE,aAAa,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IAClG,CAAC,CACF,CAAA;IAED,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;AACzB,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAgB,EAAE,IAAY;IAC5D,MAAM,KAAK,GAAG,GAAG,wBAAwB,GAAG,MAAM,CAAC,MAAM,GAAG,CAAA;IAC5D,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACjB,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,uBAAuB,CAAC,YAAsB,EAAE,IAAY;IACnE,MAAM,KAAK,GAAG,GAAG,yBAAyB,GAAG,YAAY,CAAC,MAAM,GAAG,CAAA;IACnE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACvB,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,IAAI,MAAM,CAAC,IAAI,wBAAwB,cAAc,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAC3E,CAAC;AAED,0EAA0E;AAC1E,4EAA4E;AAC5E,yEAAyE;AACzE,4EAA4E;AAC5E,2CAA2C;AAC3C,SAAS,aAAa,CAAC,IAAY,EAAE,MAAgB;IACnD,IAAI,QAAQ,GAAG,IAAI,CAAA;IACnB,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9C,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,wBAAwB,GAAG,KAAK,GAAG,EAAE,KAAK,CAAC,CAAA;IAC/E,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,YAAsB;IAC1D,IAAI,QAAQ,GAAG,IAAI,CAAA;IACnB,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC;QACpD,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,yBAAyB,GAAG,KAAK,GAAG,EAAE,KAAK,CAAC,CAAA;IAChF,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,gBAAgB,GAAG,0BAA0B,CAAA;AAEnD,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;AAC1C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,KAAK;SACT,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;AAC7B,CAAC"}

package/docs/content/docs/cli/kakaotalk.mdx

@@ -94,6 +94,16 @@ agent-kakaotalk auth logout
 agent-kakaotalk auth logout --account <account-id>
 ```
 
+`auth status` checks stored credential state only. Kakao validates the access token when a command opens a LOCO session. If the token has expired or been revoked, commands retain the existing error output shape with a specific message:
+
+```json
+{
+  "error": "KakaoTalk LOGINLIST invalid access token (status -950)"
+}
+```
+
+Run `agent-kakaotalk auth login` before retrying. Other explicit server rejections identify the returned status in the error message. Connection closes and timeouts remain transport failures and keep their existing messages.
+
 ## Multi-Account
 
 KakaoTalk supports multiple accounts. Each login stores credentials separately, keyed by user ID.

package/docs/content/docs/sdk/kakaotalk.mdx

@@ -32,6 +32,28 @@ import { KakaoTalkClient } from 'agent-messenger/kakaotalk'
 const client = await new KakaoTalkClient().login()
 ```
 
+### Login errors
+
+The first operation opens the LOCO session lazily. If Kakao rejects `LOGINLIST`, `KakaoTalkError` preserves a typed code and safe numeric server status:
+
+```typescript
+import { KakaoTalkError } from 'agent-messenger/kakaotalk'
+
+try {
+  await client.getChats()
+} catch (error) {
+  if (error instanceof KakaoTalkError && error.code === 'invalid_access_token') {
+    console.error(error.serverStatus) // -950
+  }
+}
+```
+
+- `invalid_access_token`: Kakao returned status `-950`; re-authenticate before retrying.
+- `login_rejected`: Kakao returned another explicit authentication rejection.
+- `login_failed`: booking, check-in, socket close, timeout, or another transport/protocol failure.
+
+Rejected authentication closes the provisional session and never continues to `LCHATLIST` or sync-state work.
+
 ### Chat Rooms
 
 ```typescript
@@ -172,6 +194,38 @@ client.close()
 
 Once closed, any subsequent method call throws a `KakaoTalkError` with code `client_closed`. Create a new client if you need to reconnect.
 
+## OAuth Token Refresh
+
+`refreshKakaoOAuthToken()` explicitly exchanges a stored Android sub-device refresh token for a new token set. It is stateless and caller-invoked: it does not update credential files, retry `LOGINLIST`, or run automatically after an authentication failure.
+
+```typescript
+import { refreshKakaoOAuthToken } from 'agent-messenger/kakaotalk'
+
+if (!account.refresh_token) throw new Error('No KakaoTalk refresh token')
+
+const refreshed = await refreshKakaoOAuthToken(
+  {
+    accessToken: account.oauth_token,
+    refreshToken: account.refresh_token,
+    deviceUuid: account.device_uuid,
+  },
+  { timeoutMs: 15_000 },
+)
+
+const nextAccount = {
+  ...account,
+  oauth_token: refreshed.accessToken,
+  refresh_token: refreshed.refreshToken,
+  updated_at: new Date().toISOString(),
+}
+
+await persistAccountAtomically(nextAccount) // Application-defined durable storage
+```
+
+The result always includes both tokens. Kakao may rotate the refresh token, so persist the entire returned token set atomically before the process exits or another client uses the credential. Never refresh a copied production credential and discard the result.
+
+Failures throw `KakaoOAuthRefreshError` with a safe `code` and optional `serverStatus` or `httpStatus`; token values and raw response bodies are not retained. This uses an undocumented Android endpoint and may change without notice.
+
 ## KakaoTalkListener
 
 Real-time event listener that receives push events from KakaoTalk via the LOCO protocol. Subscribes to the underlying client's LOCO session.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-messenger",
-  "version": "2.34.0",
+  "version": "2.36.0",
   "description": "Multi-platform messaging CLI for AI agents (Slack, Discord, Teams, Webex, Telegram, Telegram Bot, WhatsApp, LINE, iMessage, Instagram, KakaoTalk, Channel Talk)",
   "repository": {
     "type": "git",

package/skills/agent-channeltalk/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-channeltalk
 description: Interact with Channel Talk using extracted desktop app or browser credentials - read chats, send messages, search messages, manage groups
-version: 2.34.0
+version: 2.36.0
 allowed-tools: Bash(agent-channeltalk:*)
 metadata:
   openclaw:

package/skills/agent-channeltalkbot/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-channeltalkbot
 description: Interact with Channel Talk workspaces using API credentials - send messages, read chats, manage groups and bots
-version: 2.34.0
+version: 2.36.0
 allowed-tools: Bash(agent-channeltalkbot:*)
 metadata:
   openclaw:

package/skills/agent-discord/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-discord
 description: Interact with Discord servers - send messages, read channels, manage reactions
-version: 2.34.0
+version: 2.36.0
 allowed-tools: Bash(agent-discord:*)
 metadata:
   openclaw:

package/skills/agent-discordbot/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-discordbot
 description: Interact with Discord servers using bot tokens - send messages, read channels, manage reactions
-version: 2.34.0
+version: 2.36.0
 allowed-tools: Bash(agent-discordbot:*)
 metadata:
   openclaw:

package/skills/agent-imessage/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-imessage
 description: Interact with iMessage on a Mac via the imsg tool - send messages, read chats, watch for new messages
-version: 2.34.0
+version: 2.36.0
 allowed-tools: Bash(agent-imessage:*)
 metadata:
   openclaw:

package/skills/agent-instagram/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-instagram
 description: Interact with Instagram DMs - send messages, read conversations, manage accounts
-version: 2.34.0
+version: 2.36.0
 allowed-tools: Bash(agent-instagram:*)
 metadata:
   openclaw:

package/skills/agent-kakaotalk/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-kakaotalk
 description: Interact with KakaoTalk - send messages, read chats, manage conversations
-version: 2.34.0
+version: 2.36.0
 allowed-tools: Bash(agent-kakaotalk:*)
 metadata:
   openclaw:
@@ -599,6 +599,32 @@ if (!account) throw new Error('Not authenticated')
 const client = await new KakaoTalkClient().login({ oauthToken: account.oauth_token, userId: account.user_id, deviceUuid: account.device_uuid })
 ```
 
+For caller-managed token renewal, use the explicit SDK primitive:
+
+```typescript
+import { refreshKakaoOAuthToken } from 'agent-messenger/kakaotalk'
+
+if (!account.refresh_token) throw new Error('No KakaoTalk refresh token')
+
+const refreshed = await refreshKakaoOAuthToken({
+  accessToken: account.oauth_token,
+  refreshToken: account.refresh_token,
+  deviceUuid: account.device_uuid,
+})
+
+const nextAccount = {
+  ...account,
+  oauth_token: refreshed.accessToken,
+  refresh_token: refreshed.refreshToken,
+  updated_at: new Date().toISOString(),
+}
+
+// Persist nextAccount atomically before another client uses this credential.
+// The refresh primitive intentionally does not write credential files or retry login.
+```
+
+Kakao can rotate the refresh token. Never refresh a copied production credential and discard the returned token set. See [references/authentication.md](references/authentication.md) for error codes and the controlled canary procedure.
+
 ### Example
 
 ```typescript

package/skills/agent-kakaotalk/references/authentication.md

@@ -77,6 +77,22 @@ Re-run with `--device-type pc --force` or `--device-type tablet --force`.
 
 Check email/password and try again.
 
+### Runtime authentication failures
+
+Stored credentials are validated by Kakao only when a command opens a LOCO session. `auth status` confirms that a credential is present; it does not prove that the access token is still accepted by the server.
+
+An expired or revoked access token keeps the existing CLI error shape and reports the server status in the message:
+
+```json
+{
+  "error": "KakaoTalk LOGINLIST invalid access token (status -950)"
+}
+```
+
+Run `agent-kakaotalk auth login` to replace the credential before retrying the command. Other non-zero Kakao authentication responses preserve the returned status in the error message.
+
+A socket close, timeout, or other interrupted `LOGINLIST` remains a transport failure and must not be treated as an invalid token. Rejected authentication closes the provisional connection and does not continue to `LCHATLIST` or sync-state work.
+
 ### Device Slots
 
 KakaoTalk allows these simultaneous sessions:
@@ -246,6 +262,49 @@ KakaoTalk OAuth tokens can expire or be invalidated when:
 - The token naturally expires
 - KakaoTalk's server revokes the session
 
+### Explicit SDK Refresh
+
+The SDK exports `refreshKakaoOAuthToken()` for callers that need to exchange a stored Android sub-device refresh token for a new token set:
+
+```typescript
+import { refreshKakaoOAuthToken } from 'agent-messenger/kakaotalk'
+
+const refreshed = await refreshKakaoOAuthToken({
+  accessToken: account.oauth_token,
+  refreshToken: account.refresh_token,
+  deviceUuid: account.device_uuid,
+})
+```
+
+This is an explicit, stateless operation. It does not retry `LOGINLIST`, update the credentials file, or run automatically when a command receives `invalid_access_token`.
+
+The result always contains an access token and refresh token. Kakao may rotate the refresh token; if the response omits it, the SDK preserves the input refresh token in the returned value. The caller must persist both returned tokens atomically before the process exits or another client uses the same credential.
+
+Do not refresh a copied production credential and discard the result. A successful refresh can invalidate the previously stored refresh token on the server.
+
+#### Controlled Live Canary
+
+Use a dedicated test account and device when possible. If a production credential is the only available canary, use this sequence:
+
+1. Stop every collector, CLI process, and service that can use the credential. Confirm there is only one refresh caller.
+2. Prepare an atomic persistence path before making the request. Credential files must keep `0600` permissions.
+3. Call `refreshKakaoOAuthToken()` exactly once. Record only success, token-rotation booleans, and expiry metadata — never tokens, authorization headers, account IDs, or the raw response.
+4. If a token set is returned, immediately persist both returned tokens with a temporary file, `fsync`, and atomic rename. Do not let the process exit or another client start first.
+5. Start a fresh process, reload the persisted credential, and verify that `LOGINLIST` and a minimal chat-list request succeed.
+6. Scan application logs and temporary files for the old and new token values, confirm the credential still has `0600` permissions, then restart the stopped caller.
+
+If the refresh request fails before returning a token set, leave the stored credential unchanged and stop the canary. Do not loop blindly: an ambiguous network failure may have occurred after server-side rotation, in which case re-authentication can be required.
+
+Failures throw `KakaoOAuthRefreshError` with safe metadata only:
+
+- `refresh_credentials_missing` — an access token, refresh token, or device UUID was not provided.
+- `refresh_rejected` — Kakao returned an explicit non-zero status; inspect `serverStatus`.
+- `refresh_http_error` — the endpoint returned an HTTP failure without a Kakao status; inspect `httpStatus`.
+- `refresh_timeout` / `refresh_request_failed` — the request did not complete.
+- `refresh_malformed_response` — a successful response did not contain a usable access token.
+
+Token values, authorization headers, and raw response bodies are not included in these errors. The endpoint is an undocumented Android API and can change without notice.
+
 ### Re-authentication
 
 If commands start failing with auth errors:

package/skills/agent-kakaotalk/references/common-patterns.md

@@ -497,6 +497,14 @@ The `deviceType` determines the LOCO protocol identity: `'tablet'` sends `os: 'a
 
 Reconnect only triggers on actual session death. Operation-level errors (invalid chat ID, server rejection, etc.) are thrown immediately without retry, so side effects like `sendMessage` or `sendAttachment` are never duplicated.
 
+Initial `LOGINLIST` failures are classified separately from reconnectable session death:
+
+- `invalid_access_token` with `serverStatus === -950`: the stored Kakao access token has expired or been revoked. Re-authenticate before retrying.
+- `login_rejected`: Kakao explicitly rejected authentication for another server status. Inspect `serverStatus` and the device-slot/account state.
+- `login_failed`: booking, check-in, socket close, timeout, or another transport/protocol interruption. This is not proof that the token is invalid.
+
+Rejected authentication closes the provisional session before it can be adopted. Callers must not continue to `LCHATLIST` or other LOCO operations after either authentication error.
+
 ## See Also
 
 - [Authentication Guide](authentication.md) - Setting up credentials

package/skills/agent-line/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-line
 description: Interact with LINE - send messages, read chats, manage conversations
-version: 2.34.0
+version: 2.36.0
 allowed-tools: Bash(agent-line:*)
 metadata:
   openclaw:

package/skills/agent-slack/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-slack
 description: Interact with Slack workspaces - send messages, read channels, manage reactions
-version: 2.34.0
+version: 2.36.0
 allowed-tools: Bash(agent-slack:*)
 metadata:
   openclaw:

package/skills/agent-slackbot/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-slackbot
 description: Interact with Slack workspaces using bot tokens - send messages, read channels, manage reactions
-version: 2.34.0
+version: 2.36.0
 allowed-tools: Bash(agent-slackbot:*)
 metadata:
   openclaw:

package/skills/agent-teams/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-teams
 description: Interact with Microsoft Teams - send messages, read channels, manage reactions
-version: 2.34.0
+version: 2.36.0
 allowed-tools: Bash(agent-teams:*)
 metadata:
   openclaw:
@@ -205,6 +205,11 @@ Output includes the authenticated user's identity information.
 agent-teams message send <team-id> <channel-id> <content>
 agent-teams message send <team-id> 19:abc123@thread.tacv2 "Hello world"
 
+# Send a rich-text message written in markdown
+agent-teams message send <team-id> <channel-id> "## Deploy done
+- service A
+- service B" --format markdown
+
 # List messages
 agent-teams message list <team-id> <channel-id>
 agent-teams message list <team-id> 19:abc123@thread.tacv2 --limit 50
@@ -249,15 +254,52 @@ agent-teams chat history <chat-id> --limit 100
 
 # Send a message to a chat
 agent-teams chat send <chat-id> "Hello"
+agent-teams chat send <chat-id> "**Important**: see the [board](https://example.com)" --format markdown
 
 # Edit one of your own chat messages
 agent-teams chat edit <chat-id> <message-id> "Updated text"
+agent-teams chat edit <chat-id> <message-id> "Fixed \`bug\`" --format markdown
 ```
 
 Chat IDs look like `19:guid1_guid2@unq.gbl.spaces` (1:1) or `19:guid@thread.tacv2` (group). Get them from `chat list`. The `48:notes` chat (`type: self`) is your personal "to me" notes thread.
 
 `chat edit` only works on your own messages, and only for chats — Teams channel messages are not editable through this API.
 
+### Message Formatting
+
+`message send`, `chat send`, and `chat edit` accept `--format <text|markdown|html>` (default `text`).
+
+In `text` mode the content is HTML-escaped, so `<`, `>`, and `&` are sent literally.
+
+In `markdown` mode the content is converted to HTML before sending. Supported syntax:
+
+| Syntax | Renders as |
+| --- | --- |
+| `# Heading` through `#### Heading` | headings |
+| `##### Heading`, `###### Heading` | **not supported** — indistinguishable from body text |
+| `**bold**`, `_italic_`, `***bold italic***` | emphasis |
+| `` `inline code` `` | inline code |
+| triple-backtick fence | fenced code block, without syntax highlighting |
+| `- item` | bulleted list |
+| `1. item` | numbered list |
+| `> quote` | blockquote |
+| `[label](https://example.com)` | link |
+| `---` | horizontal rule |
+
+Heading levels 5 and 6 are unusable: the Teams client renders `<h5>` and `<h6>` at body size, so they are indistinguishable from surrounding text. Only go as deep as `####`. Fenced code blocks render as monospaced blocks but are never syntax-highlighted — a language tag (` ```ts `) is accepted and then ignored. Both behaviors were verified against a live account.
+
+Links are restricted to `http:`, `https:`, `mailto:`, root-relative (`/`), and anchor (`#`) URLs; anything else renders as plain text.
+
+In `html` mode the content is filtered through a tag whitelist rather than sent verbatim. Use it when you need Teams-specific markup that markdown cannot express — most commonly @mentions:
+
+```bash
+agent-teams message send <team-id> <channel-id> "Hey <at id=\"29:abc\">John</at>, build is ready" --format html
+```
+
+Allowed tags: `at`, `a`, `b`, `i`, `u`, `s`, `strong`, `em`, `code`, `pre`, `br`, `p`, `ul`, `ol`, `li`, `blockquote`, `h1`–`h6`, `hr`. `<at>` only keeps its `id` attribute; `<a>` only keeps `href`, and only when it matches the same URL whitelist as markdown mode; every other tag keeps no attributes at all. Anything not on the list — `<script>`, `<img>`, `on*` event attributes, malformed or unrecognized tags — is escaped or stripped rather than passed through.
+
+The whitelist limits the blast radius, but it does not make the mode safe for arbitrary input: only pass content you construct yourself. Untrusted input belongs in `text` mode.
+
 ### Team Commands
 
 ```bash
@@ -385,7 +427,7 @@ agent-teams channel list --pretty
 | Channel identifiers | UUID format (19:xxx@thread.tacv2) | Snowflake IDs  | Channel name or ID |
 | Token storage       | Cookies SQLite                    | LevelDB        | LevelDB            |
 | Token expiry        | **60-90 minutes**                 | Rarely expires | Rarely expires     |
-| Mentions            | `<at id="user-id">Name</at>`      | `<@user_id>`   | `<@USER_ID>`       |
+| Mentions            | `<at id="user-id">Name</at>` (needs `--format html`) | `<@user_id>`   | `<@USER_ID>`       |
 
 **Important**: Teams uses UUID-style channel IDs (like `19:abc123@thread.tacv2`). You cannot use channel names directly - use `channel list` to find IDs first.
 

package/skills/agent-teams/references/common-patterns.md

@@ -279,12 +279,12 @@ if [ -z "$USER_ID" ] || [ "$USER_ID" = "null" ]; then
 fi
 
 # Send message with mention (Teams format)
-agent-teams message send "$TEAM_ID" "$CHANNEL_ID" "Hey <at id=\"$USER_ID\">$USER_NAME</at>, the build is ready for review!"
+agent-teams message send "$TEAM_ID" "$CHANNEL_ID" "Hey <at id=\"$USER_ID\">$USER_NAME</at>, the build is ready for review!" --format html
 ```
 
 **When to use**: Notifications, task assignments, code review requests.
 
-**Note**: Teams mentions use format `<at id="USER_ID">Display Name</at>`.
+**Note**: Teams mentions use format `<at id="USER_ID">Display Name</at>` and require `--format html` — in the default `text` mode the tags are escaped and render literally.
 
 ## Pattern 8: Reaction-Based Workflow
 

package/skills/agent-telegram/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-telegram
 description: Interact with Telegram through TDLib - authenticate, inspect chats, and send messages
-version: 2.34.0
+version: 2.36.0
 allowed-tools: Bash(agent-telegram:*)
 ---
 

package/skills/agent-telegrambot/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-telegrambot
 description: Interact with Telegram using bot tokens - send messages, read chats, manage reactions
-version: 2.34.0
+version: 2.36.0
 allowed-tools: Bash(agent-telegrambot:*)
 metadata:
   openclaw:

package/skills/agent-webex/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-webex
 description: Interact with Cisco Webex - send messages, read spaces, manage memberships
-version: 2.34.0
+version: 2.36.0
 allowed-tools: Bash(agent-webex:*)
 metadata:
   openclaw:

package/skills/agent-webexbot/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-webexbot
 description: Interact with Cisco Webex using bot tokens - send messages, reply in threads, upload and download files, look up people, read spaces, manage memberships, stream real-time events
-version: 2.34.0
+version: 2.36.0
 allowed-tools: Bash(agent-webexbot:*)
 metadata:
   openclaw:

package/skills/agent-wechatbot/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-wechatbot
 description: Interact with WeChat Official Account using API credentials - send messages, manage templates, list followers
-version: 2.34.0
+version: 2.36.0
 allowed-tools: Bash(agent-wechatbot:*)
 metadata:
   openclaw:

package/skills/agent-whatsapp/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-whatsapp
 description: Interact with WhatsApp - send messages, read chats, manage conversations
-version: 2.34.0
+version: 2.36.0
 allowed-tools: Bash(agent-whatsapp:*)
 metadata:
   openclaw:

package/skills/agent-whatsappbot/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-whatsappbot
 description: Interact with WhatsApp using Cloud API credentials - send messages, manage templates
-version: 2.34.0
+version: 2.36.0
 allowed-tools: Bash(agent-whatsappbot:*)
 metadata:
   openclaw:

package/src/platforms/kakaotalk/auth/kakao-login.ts

@@ -7,8 +7,8 @@ import type { KakaoDeviceType, KakaoLoginResult } from '../types'
 const ANDROID_APP_VERSION = '25.9.2'
 const ANDROID_OS_VERSION = '13'
 const ANDROID_API_LEVEL = '33'
-const ANDROID_AGENT = `android/${ANDROID_APP_VERSION}/ko`
-const ANDROID_USER_AGENT = `KT/${ANDROID_APP_VERSION} An/${ANDROID_OS_VERSION} ko`
+export const ANDROID_AGENT = `android/${ANDROID_APP_VERSION}/ko`
+export const ANDROID_USER_AGENT = `KT/${ANDROID_APP_VERSION} An/${ANDROID_OS_VERSION} ko`
 const ANDROID_LOGIN_URL = 'https://katalk.kakao.com/android/account/login.json'
 const ANDROID_PASSCODE_URL = 'https://katalk.kakao.com/android/account/passcodeLogin/generate'
 const ANDROID_REGISTER_URL = 'https://katalk.kakao.com/android/account/passcodeLogin/registerDevice'