clawvault 3.4.1 → 3.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (36) hide show
  1. package/CHANGELOG.md +543 -0
  2. package/LICENSE +21 -0
  3. package/SKILL.md +369 -0
  4. package/dist/{chunk-X3SPPUFG.js → chunk-JI7VUQV7.js} +118 -132
  5. package/dist/{chunk-PLNK37JD.js → chunk-QUFQBAHP.js} +114 -217
  6. package/dist/cli/index.js +1 -1
  7. package/dist/commands/compat.js +1 -1
  8. package/dist/commands/observe.js +1 -1
  9. package/dist/commands/status.js +4 -4
  10. package/dist/index.js +11 -8
  11. package/dist/openclaw-plugin.js +6 -1
  12. package/docs/clawhub-security-release-playbook.md +75 -0
  13. package/docs/getting-started/installation.md +99 -0
  14. package/docs/openclaw-plugin-usage.md +152 -0
  15. package/openclaw.plugin.json +1 -1
  16. package/package.json +26 -8
  17. package/bin/command-registration.test.js +0 -179
  18. package/bin/command-runtime.test.js +0 -154
  19. package/bin/help-contract.test.js +0 -55
  20. package/bin/register-config-route-commands.test.js +0 -121
  21. package/bin/register-core-commands.test.js +0 -80
  22. package/bin/register-kanban-commands.test.js +0 -83
  23. package/bin/register-project-commands.test.js +0 -206
  24. package/bin/register-query-commands.test.js +0 -80
  25. package/bin/register-resilience-commands.test.js +0 -81
  26. package/bin/register-task-commands.test.js +0 -69
  27. package/bin/register-template-commands.test.js +0 -87
  28. package/bin/test-helpers/cli-command-fixtures.js +0 -120
  29. package/dashboard/lib/graph-diff.test.js +0 -75
  30. package/dashboard/lib/vault-parser.test.js +0 -254
  31. package/hooks/clawvault/HOOK.md +0 -130
  32. package/hooks/clawvault/handler.js +0 -1696
  33. package/hooks/clawvault/handler.test.js +0 -576
  34. package/hooks/clawvault/integrity.js +0 -112
  35. package/hooks/clawvault/integrity.test.js +0 -32
  36. package/hooks/clawvault/openclaw.plugin.json +0 -190
package/CHANGELOG.md ADDED
@@ -0,0 +1,543 @@
1
+ # Changelog
2
+
3
+ ## [3.5.0] — 2026-03-16
4
+
5
+ ### Changed
6
+ - Refactored OpenClaw pre-prompt memory injection to run fully in-process: `vault-context-injector` now uses `ClawVault.find()` directly and removed CLI `context/search` shelling paths.
7
+ - Switched session recap injection to in-process recap assembly and removed pre-prompt dependency on `clawvault session-recap` CLI execution.
8
+ - Reworked plugin session lifecycle startup/reset flows to call recovery and checkpoint library APIs directly (`recover`, `checkpoint`) instead of shelling out.
9
+ - Made observer cron execution fire-and-forget via non-blocking spawn in plugin runtime.
10
+
11
+ ### Removed
12
+ - Removed legacy `hooks/clawvault` hook-pack implementation and related legacy tests/artifacts.
13
+ - Removed deprecated `packages/plugin` script artifacts and `packages/workgraph` dead package contents.
14
+
15
+ ### Improved
16
+ - Updated `compat` diagnostics to validate plugin-first OpenClaw integration (`openclaw.plugin`, extension registration, package-files hygiene, legacy hook artifact detection).
17
+ - Tightened npm publish hygiene by switching to a plugin-first `files` allowlist and adding `.npmignore` exclusions for research/tests/dev-only directories.
18
+
19
+ ---
20
+
21
+ ## [3.4.1] — 2026-03-16
22
+
23
+ ### Fixed
24
+ - fix: OpenClaw plugin tool parameter passing. `memory_search` and `memory_get` tools now correctly receive parameters when called by OpenClaw's tool dispatch system. Root cause: OpenClaw passes `(toolCallId, input)` as two arguments, but the tool execute functions only read the first argument. Added `resolveToolInput()` helper that handles both calling conventions. (PR #178)
25
+ - fix: `memory_get` now accepts both `path` and `relPath` parameters for OpenClaw compatibility.
26
+ - fix: Relaxed `memory_get` path validation to allow any `.md` file in the vault, not just `MEMORY.md` or `memory/*`.
27
+
28
+ ### Improved
29
+ - Improved vault context injector with better fallback handling when QMD database is locked.
30
+ - Added `label` field to tool registrations for better OpenClaw UI display.
31
+
32
+ ---
33
+
34
+ ## [3.3.0] — 2026-03-11
35
+
36
+ ### Added
37
+ - feat: In-process hybrid search engine — BM25 + hosted semantic embeddings + cross-encoder reranking. `qmd` is now optional. (PR #152, Issue #146)
38
+ - feat: Python SDK (clawvault-py) — Python package for PyPI with Vault class, BM25 search, checkpoint/wake lifecycle. (PR #149)
39
+ - feat: Inbox + background workers — `clawvault inbox add` and `clawvault maintain` commands with Curator, Janitor, Distiller, Surveyor workers. (PR #151, Issue #127)
40
+
41
+ ### Security
42
+ - security: SECURITY.md, exec hardening, opt-in privilege flags for the OpenClaw plugin. (PR #150, Issue #128)
43
+
44
+ ### Community
45
+ - Community contributors: @smart-tinker, @ukr-coder, @G9Pedro
46
+
47
+ ---
48
+
49
+ ## [3.2.0] — 2026-03-10
50
+
51
+ ### Added
52
+ - Introduced the new `clawvault wg` command group for Workgraph coordination, including thread lifecycle operations, ledger views, dynamic type definition, and terminal board/status dashboards. (PR #141)
53
+ - Added OpenClaw plugin module export wiring (`src/openclaw-plugin.ts`) so plugin entrypoints are resolved directly from built package output. (PR #140)
54
+
55
+ ### Improved
56
+ - Expanded context assembly with stronger structured retrieval signals (daily notes, observations, fact-store context, graph-neighbor expansion, profile ordering, and token-budget fitting) for more reliable prompt injection. (PR #141)
57
+ - Improved observer compressor handling for OpenClaw message/source prefixes and tool-result noise filtering to avoid low-signal memory pollution. (PR #141)
58
+ - Aligned OpenClaw hook/plugin metadata and docs with current runtime behavior and extension loading flow. (PR #140)
59
+ - Enhanced LLM provider resolution/fallback behavior and corresponding tests for provider-specific routing paths. (PR #139)
60
+
61
+ ### Fixed
62
+ - Resolved CI/typecheck friction by removing dead imports and other low-risk unused code paths touched during the release merge cleanup.
63
+
64
+ ---
65
+
66
+ ## [2.6.1] — 2026-02-16
67
+
68
+ ### Fixed
69
+ - Moved Gemini API key from URL query parameter (`?key=`) to `x-goog-api-key` request header in both `llm-provider.ts` and `wake.ts`. Prevents key leakage into HTTP logs, proxy caches, and monitoring middleware. Aligns Gemini auth with Anthropic/OpenAI header-based approach. (PR #40, thanks @gupsammy)
70
+
71
+ ---
72
+
73
+ ## [2.5.4] — 2026-02-15
74
+
75
+ ### Fixed
76
+ - Hardened cross-platform qmd result handling by normalizing URI-derived paths and cache key resolution across Windows and Unix path separators.
77
+ - Fixed WebDAV path safety and root containment checks to avoid false 403s and traversal edge-cases on Windows.
78
+ - Stabilized cross-platform test behavior for WebDAV temp vault setup/cleanup and shell-init path expectations.
79
+ - Corrected npm package `bin` metadata to preserve global CLI install wiring for `clawvault`.
80
+
81
+ ### Improved
82
+ - Strengthened primitives reliability baseline: full test suite now passes on Windows (`449/449`) after path portability fixes.
83
+ - Updated `SKILL.md` with explicit stability snapshot, `auto` context profile guidance, and clearer runtime verification (`openclaw --version`, `clawvault compat`).
84
+
85
+ ---
86
+
87
+ ## [2.5.3] — 2026-02-15
88
+
89
+ ### Fixed
90
+ - Canonicalized OpenClaw onboarding and hook setup docs around the required runtime flow: `openclaw hooks install clawvault` -> `openclaw hooks enable clawvault` -> verification with `hooks list/info/check`.
91
+ - Removed command-surface drift in top-level docs (legacy `serve`/`peers`/`net-search`, old canvas template flags, and stale compatibility script references).
92
+ - Clarified AGENTS.md guidance to append ClawVault workflow instructions instead of replacing existing bootstrap prompts.
93
+
94
+ ### Improved
95
+ - Standardized default OpenClaw fallback agent identity to `main` in active observer and hook runtime paths for safer multi-user installs.
96
+ - Updated hook and skill metadata/docs to align with current package/runtime behavior.
97
+ - Simplified CI and npm script stack to executable, in-repo checks (`typecheck`, `test`, `build`) and removed references to missing compat validator scripts.
98
+
99
+ ### Removed
100
+ - Removed deprecated in-repo `docs/` markdown set in favor of the external live docs source of truth.
101
+
102
+ ---
103
+
104
+ ## [2.5.1] — 2026-02-15
105
+
106
+ ### Security
107
+ - Hardened CLI runtime argument handling for qmd execution by exporting and reusing `sanitizeQmdArg` in `bin/command-runtime.js`.
108
+ - Re-validated `--file` inputs through `validatePathWithinBase` for file-backed write flows (`store` and `remember`) to prevent path traversal.
109
+
110
+ ### Fixed
111
+ - Audited and clarified command descriptions across `bin/register-*.js` modules.
112
+ - Expanded help text default guidance for options where runtime defaults apply.
113
+ - Completed help coverage for `inject` and `project` command families, including subcommand and default behavior notes.
114
+
115
+ ---
116
+
117
+ ## [2.5.0] — 2026-02-15
118
+
119
+ Two headline features that change how agents interact with their vaults.
120
+
121
+ ### 🧠 Dynamic Prompt Injection (`clawvault inject`)
122
+
123
+ Agents can now pull relevant decisions, preferences, and rules directly into their prompt context — automatically. Two-layer matching system:
124
+
125
+ 1. **Deterministic matching** (default) — keyword and scope-based rules fire instantly with zero latency. Define rules that match on entity names, categories, or custom scopes.
126
+ 2. **LLM fuzzy matching** (opt-in via `--enable-llm`) — when deterministic rules miss, an LLM classifies the message intent and finds relevant vault entries. Uses the shared LLM provider (same as observer).
127
+
128
+ ```bash
129
+ clawvault inject "How should we handle the Hale deployment?"
130
+ clawvault inject --enable-llm "What's our pricing strategy?"
131
+ clawvault inject --scope decisions,preferences "brand guidelines"
132
+ ```
133
+
134
+ Options: `--max-results`, `--scope`, `--format (markdown|json)`, `--model`, `--enable-llm`/`--disable-llm`.
135
+
136
+ This is the bridge between passive memory storage and active context engineering — your vault decisions actually show up when they matter.
137
+
138
+ ### 📁 First-Class Project Primitive (`clawvault project`)
139
+
140
+ Projects are now a proper entity type with full lifecycle management:
141
+
142
+ ```bash
143
+ clawvault project add "Site Machine" --owner pedro --client "Hale Pet Door" \
144
+ --team "pedro,clawdious,joao" --status active --deadline 2026-03-01 \
145
+ --repo "https://github.com/Versatly/site-machine" --tags "client,priority"
146
+
147
+ clawvault project list --status active --client "Hale Pet Door"
148
+ clawvault project tasks site-machine
149
+ clawvault project board --group-by client
150
+ ```
151
+
152
+ Subcommands: `add`, `update`, `archive`, `list`, `show`, `tasks`, `board`.
153
+
154
+ Projects link to tasks via the `--project` flag on `task add`. `project tasks <slug>` shows all related tasks. `project board` generates an Obsidian-compatible Kanban grouped by status, owner, or client.
155
+
156
+ Frontmatter fields: `owner`, `status`, `team`, `client`, `tags`, `description`, `deadline`, `repo`, `url`.
157
+
158
+ ### Also Added
159
+ - **Pluggable compression backends** — observer now supports Ollama, Minimax, GLM, and any OpenAI-compatible backend via config. No more hard dependency on a single LLM provider.
160
+ - **Centralized transition logging** — task state changes write to a ledger (`transitions.jsonl`) with timestamps, reasons, and actor. Ledger write failures are non-fatal.
161
+
162
+ ### Improved
163
+ - Canvas refactored to single generator, stripped 4 redundant templates (-2,081 lines).
164
+ - Inject: LLM matching disabled by default — deterministic-only unless explicitly opted in.
165
+ - Global inject scope treated as unfiltered for maximum flexibility.
166
+ - Observer: stabilized pluggable backend assertions.
167
+ - Test suite expanded to **429 passing tests across 64 files**.
168
+
169
+ ### Fixed
170
+ - Ledger write failures no longer crash task updates.
171
+ - Task list metadata visibility preserved correctly.
172
+
173
+ ---
174
+
175
+ ## [2.4.0] — 2026-02-14
176
+
177
+ ### Added
178
+ - **Brain Architecture Canvas** — `clawvault canvas --template brain` generates a 4-quadrant system overview:
179
+ - **Hippocampus** (top-left): vault structure with category card grid, content flow pipeline (Session → Observe → Score → Route → Store → Reflect)
180
+ - **Direction** (top-right): vault stats, recent decisions, open loops
181
+ - **Agent Workspace** (bottom-left): 3-column task triage — active, blocked, backlog with owner tags and priority icons
182
+ - **Knowledge Graph** (bottom-right): node/edge stats, most-connected entities, category breakdown with bar charts
183
+ - **Owner-Centric Project Board** — `clawvault canvas --template project-board` redesigned with:
184
+ - Status columns (Open / In Progress / Blocked / Done) with priority icons (🔴🟠🟡)
185
+ - Owner cards distinguishing agents (🤖) from humans (👤) with per-owner task distribution
186
+ - Backlog section grouped by project
187
+ - Blocked-by edges connecting dependent tasks
188
+ - **Canvas Customization Flags**:
189
+ - `--owner <name>` — filter tasks by owner (agent or human)
190
+ - `--width <px>` / `--height <px>` — canvas dimensions
191
+ - `--include-done` — include completed tasks
192
+ - **Setup Command Overhaul** — `clawvault setup` now configurable:
193
+ - `--theme neural|minimal|none` — graph color themes with Obsidian CSS snippets and colorGroups
194
+ - `--graph-colors` / `--no-graph-colors` — opt in/out of graph theming
195
+ - `--bases` / `--no-bases` — opt in/out of Obsidian Bases task views
196
+ - `--canvas [template]` — generate a canvas dashboard during setup
197
+ - `--force` — overwrite existing configuration files
198
+ - `-v, --vault <path>` — target a specific vault
199
+ - **Init Command Flags**:
200
+ - `--no-bases` — skip Obsidian Bases file generation
201
+ - `--no-tasks` — skip tasks/ and backlog/ directories
202
+ - `--no-graph` — skip initial graph build
203
+ - `--categories <list>` — comma-separated custom categories
204
+ - `--canvas <template>` — generate canvas on init
205
+ - `--theme neural|minimal|none` — graph color theme
206
+ - `--minimal` — bare-bones vault (memory categories only)
207
+ - **Neural Graph Theme** — dark background (#0a0a0a), colored nodes by category/tag (cyan people, green projects, orange decisions, yellow lessons, red commitments), green neural-network links, golden glow on focused nodes
208
+ - **Obsidian Bases Views** — auto-generated on `setup` and `init`:
209
+ - `all-tasks.base` — table + card views grouped by status
210
+ - `blocked.base` — blocked tasks with days-blocked formula
211
+ - `by-project.base` — tasks grouped by project
212
+ - `by-owner.base` — tasks grouped by owner (agent or human)
213
+ - `backlog.base` — backlog items by source and project
214
+
215
+ ### Fixed
216
+ - Date handling for bare dates in frontmatter (e.g., `2026-02-14` without time) — `blocked`, `backlog list`, and canvas templates no longer crash on Date objects from gray-matter
217
+ - Canvas template descriptions no longer reference competitor products
218
+
219
+ ### Changed
220
+ - Default setup theme is now `neural` (was unconfigured)
221
+ - Brain canvas template generates 37-50 nodes with architecture-style grouped layout (was radial)
222
+ - Project board uses text cards with owner/priority metadata (was bare file nodes)
223
+
224
+ ---
225
+
226
+ ## [2.3.1] — 2026-02-14
227
+
228
+ ### Added
229
+ - **WebDAV server** — `clawvault serve` now handles WebDAV protocol on `/webdav/` path prefix for Obsidian mobile sync via Remotely Save over Tailscale
230
+
231
+ ### Improved
232
+ - Tailscale server module refactored for WebDAV route integration
233
+ - 51 new WebDAV tests (553 total passing)
234
+
235
+ ---
236
+
237
+ ## [2.3.0] — 2026-02-14
238
+
239
+ ### Added
240
+ - **Task Tracking Primitives** — Full task management with `clawvault task` command:
241
+ - `task add` — Create tasks with owner, project, priority, due date
242
+ - `task list` — List tasks with filters (status, owner, project, priority)
243
+ - `task update` — Update task status, owner, priority, blocked_by
244
+ - `task done` — Mark tasks complete with completion timestamp
245
+ - `task show` — Display task details
246
+ - **Backlog Management** — Quick capture with `clawvault backlog` command:
247
+ - `backlog add` — Add ideas to backlog with source and project
248
+ - `backlog list` — List backlog items with project filter
249
+ - `backlog promote` — Promote backlog item to active task
250
+ - **Blocked View** — `clawvault blocked` shows all blocked tasks with blockers and duration
251
+ - **Canvas Dashboard** — `clawvault canvas` generates Obsidian JSON Canvas file:
252
+ - Active tasks grouped by status with priority colors
253
+ - Blocked tasks with blocker info (red)
254
+ - Backlog queue grouped by project
255
+ - Knowledge graph stats and top entities
256
+ - Recent decisions and vault statistics
257
+ - Data flow diagram (Session → Observe → Score → Route → Reflect → Promote)
258
+ - File nodes for tasks (clickable in Obsidian)
259
+ - Valid JSON Canvas spec (jsoncanvas.org)
260
+ - **New Categories** — `tasks` and `backlog` added to DEFAULT_CATEGORIES
261
+
262
+ ### Changed
263
+ - Task files stored as markdown in `tasks/` with frontmatter (status, owner, project, priority, blocked_by, due, created, updated, completed, tags)
264
+ - Backlog files stored in `backlog/` with frontmatter (source, project, created, tags)
265
+ - Wiki-links auto-generated for task owners and projects (`[[owner]]`, `[[project]]`)
266
+ - Clean terminal table output for task and backlog lists
267
+
268
+ ## [2.0.0] — 2026-02-13
269
+
270
+ ### Added
271
+ - **Memory Graph Index** — typed knowledge graph (`.clawvault/graph-index.json`) with wiki-link, tag, and frontmatter edges. Schema versioned with incremental rebuild.
272
+ - **Graph-Aware Context** — `clawvault context` now blends semantic search with graph-neighbor traversal, with explain signals in JSON output.
273
+ - **Context Profiles** — `clawvault context --profile <name>` with `default`, `planning`, `incident`, `handoff` presets for task-appropriate context injection.
274
+ - **`clawvault compat`** — OpenClaw compatibility diagnostics. Checks hook wiring, event routing, SKILL.md, and handler safety. `--strict` mode for CI.
275
+ - **`clawvault graph`** — Graph summary and refresh diagnostics.
276
+ - **Doctor upgrade** — now includes OpenClaw compatibility check summary.
277
+ - **Dashboard upgrades** — vault parser emits typed nodes, typed edges, and type statistics.
278
+ - **Hook handler** — flexible event routing via `eventMatches()` and `normalizeEventToken()`, `--profile auto` for context queries.
279
+
280
+ ### Changed
281
+ - **CLI modularized** — monolithic `clawvault.js` split into 7 command groups (`register-core`, `register-query`, `register-vault-operations`, `register-maintenance`, `register-resilience`, `register-session-lifecycle`, `register-template`).
282
+ - **367+ tests** across core, commands, graph, dashboard, hooks, and CLI registration.
283
+
284
+ ## [1.11.2] - 2026-02-12
285
+
286
+ ### Fixed
287
+ - **Entity-slug routing** — People/project observations now route to entity subfolders (`people/pedro/2026-02-12.md` instead of `people/2026-02-12.md`)
288
+ - **Root-level file prevention** — Observations never create files at vault root; always route to category folders
289
+ - **Entity name extraction** — Case-sensitive proper noun matching prevents capturing common words as entity names
290
+ - **Dedup improvements** — Router uses normalized content + Jaccard similarity to prevent duplicate entries
291
+
292
+ ### Changed
293
+ - Router `appendToCategory` now resolves entity-aware file paths for people and projects categories
294
+ - Updated router tests to validate entity-slug subfolder structure
295
+
296
+ ---
297
+
298
+ ## [1.11.1] - 2026-02-11
299
+
300
+ ### Fixed
301
+ - **Compressor priority enforcement** — Post-processes LLM output to upgrade misclassified priorities (decisions→🔴, preferences→🟡)
302
+ - **Temporal decay in reflector** — 🟢 observations older than 7 days auto-pruned; 🔴 always kept
303
+ - **Exec summary in wake** — Wake command now shows richer context with observation summaries
304
+ - **Dedup normalization** — Strips timestamps, wiki-links, and whitespace before comparing for duplicates
305
+
306
+ ---
307
+
308
+ ## [1.11.0] - 2026-02-11
309
+
310
+ ### Removed
311
+ - **Cloud sync** — Removed entire `src/cloud/` module (client, config, queue, service, types)
312
+ - **`clawvault cloud` command** — Removed cloud sync CLI command
313
+ - All cloud-related dependencies and imports stripped
314
+
315
+ ### Philosophy
316
+ - ClawVault is now fully local-first. Zero network calls except optional LLM API for observe compression.
317
+ - Local folder sync (`vault.sync()`) remains for Obsidian cross-platform workflows.
318
+
319
+ ---
320
+
321
+ ## [1.10.2] - 2026-02-10
322
+
323
+ ### Added
324
+ - Auto wiki-links in routed observations for Obsidian graph view
325
+
326
+ ---
327
+
328
+ ## [1.10.1] - 2026-02-10
329
+
330
+ ### Fixed
331
+ - Search docs: clarified memory_search vs clawvault search scope
332
+
333
+ ---
334
+
335
+ ## [1.10.0] - 2026-02-10
336
+
337
+ ### Changed
338
+ - Clean repo: removed internal docs, SEO bloat, dist from git
339
+
340
+ ---
341
+
342
+ ## [1.9.6] - 2026-02-10
343
+
344
+ ### Fixed
345
+ - Stress test fixes: priority calibration, budget enforcement, scoring, watch reliability, wake verbosity
346
+
347
+ ---
348
+
349
+ ## [1.9.5] - 2026-02-10
350
+
351
+ ### Fixed
352
+ - Stronger decision detection in compressor
353
+
354
+ ---
355
+
356
+ ## [1.9.4] - 2026-02-10
357
+
358
+ ### Fixed
359
+ - Enforce priority rules on LLM output, fix people routing patterns
360
+
361
+ ---
362
+
363
+ ## [1.9.3] - 2026-02-10
364
+
365
+ ### Fixed
366
+ - Watch, dedup, budget, classification, people routing fixes
367
+
368
+ ---
369
+
370
+ ## [1.9.2] - 2026-02-10
371
+
372
+ ### Added
373
+ - Gemini support for observer compressor (in addition to Anthropic + OpenAI)
374
+
375
+ ---
376
+
377
+ ## [1.9.1] - 2026-02-10
378
+
379
+ ### Added
380
+ - Auto-observe on sleep/wake
381
+ - Context-aware token budgets for observation injection
382
+
383
+ ---
384
+
385
+ ## [1.9.0] - 2026-02-10
386
+
387
+ ### Added
388
+ - **Observational memory system** — Compresses session transcripts into durable observations
389
+ - Observer, Compressor, Reflector, Router, SessionWatcher, SessionParser modules
390
+ - Priority system (🔴 critical, 🟡 notable, 🟢 info) with automatic classification
391
+ - Vault routing: observations auto-categorize to decisions/, people/, lessons/, etc.
392
+ - File watcher mode for real-time session observation
393
+ - One-shot compression via `--compress` flag
394
+
395
+ ---
396
+
397
+ ## [1.8.2] - 2026-02-09
398
+
399
+ ### Fixed
400
+ - **Path validation** - OPENCLAW_HOME and OPENCLAW_STATE_DIR now properly validated (trimmed, require absolute paths)
401
+ - **Error handling** - `listAgents()` now wrapped in try/catch to handle malformed filesystem state gracefully
402
+
403
+ ---
404
+
405
+ ## [1.8.1] - 2026-02-09
406
+
407
+ ### Added
408
+ - **OPENCLAW_HOME support** - Session utilities now respect the `OPENCLAW_HOME` environment variable for custom OpenClaw installations
409
+ - **OPENCLAW_STATE_DIR support** - Also supports `OPENCLAW_STATE_DIR` for overriding state/agent paths
410
+
411
+ ### Compatibility
412
+ - Verified compatibility with OpenClaw v2026.2.9
413
+ - Hook handler confirmed working after OpenClaw's tsdown migration fix (#9295)
414
+ - Session transcript reading benefits from OpenClaw's parentId chain fix (#12283)
415
+
416
+ ---
417
+
418
+ ## [1.5.1] - 2026-02-06
419
+
420
+ ### Security
421
+ - **Fixed shell injection vulnerability** in hooks/clawvault/handler.js
422
+ - Changed from `execSync` (with shell) to `execFileSync` (no shell)
423
+ - All arguments passed as array, never interpolated into shell string
424
+ - Vault path validation: must be absolute, exist, and contain .clawvault.json
425
+
426
+ - **Fixed prompt injection vulnerability**
427
+ - Checkpoint recovery data now sanitized before injection
428
+ - Control characters stripped, markdown escaped, length limited
429
+ - Session keys and command sources sanitized with strict allowlist
430
+
431
+ - **Removed direct GitHub dependency** for qmd
432
+ - qmd moved to optional peer dependency
433
+ - Users install separately: `npm install -g github:tobi/qmd`
434
+ - ClawVault gracefully handles missing qmd
435
+
436
+ ### Changed
437
+ - Hook now validates vault paths before use
438
+ - Error messages in hooks are now generic (no sensitive data leaked)
439
+
440
+ ---
441
+
442
+ ## [1.5.0] - 2026-02-06
443
+
444
+ ### Added
445
+ - **`clawvault repair-session`** - Repair corrupted OpenClaw session transcripts
446
+ - Detects orphaned `tool_result` blocks that reference non-existent `tool_use` IDs
447
+ - Identifies aborted tool calls with partial JSON
448
+ - Automatically relinks parent chain after removals
449
+ - Creates backup before repair (configurable with `--no-backup`)
450
+ - Dry-run mode with `--dry-run` to preview repairs
451
+ - List sessions with `--list` flag
452
+ - JSON output with `--json` for scripting
453
+
454
+ **Problem solved:** When the Anthropic API rejects with "unexpected tool_use_id found in tool_result blocks", this command fixes the transcript so the session can continue without losing context.
455
+
456
+ ```bash
457
+ # Analyze without changing
458
+ clawvault repair-session --dry-run
459
+
460
+ # Repair current main session
461
+ clawvault repair-session
462
+
463
+ # Repair specific session
464
+ clawvault repair-session --session <id> --agent <agent-id>
465
+ ```
466
+
467
+ - **Session utilities** (`src/lib/session-utils.ts`)
468
+ - `listAgents()` - Find all agents in ~/.openclaw/agents/
469
+ - `findMainSession()` - Get current session for an agent
470
+ - `findSessionById()` - Look up specific session
471
+ - `getSessionFilePath()`, `backupSession()` - File helpers
472
+
473
+ ### Tests
474
+ - Added 13 tests for session repair functionality
475
+ - Transcript parsing
476
+ - Tool use extraction from assistant messages
477
+ - Corruption detection (aborted + orphaned)
478
+ - Parent chain relinking
479
+ - Dry-run mode
480
+ - Backup creation
481
+
482
+ ---
483
+
484
+ ## [1.4.2] - 2026-02-06
485
+
486
+ ### Added
487
+ - **OpenClaw Hook Integration** - Automatic context death resilience
488
+ - `gateway:startup` event: Detects if previous session died, injects alert into first agent turn
489
+ - `command:new` event: Auto-checkpoints before session reset
490
+ - Install: `openclaw hooks install clawvault && openclaw hooks enable clawvault`
491
+ - Hook ships with npm package via `openclaw.hooks` field in package.json
492
+
493
+ - **`clawvault wake`** - All-in-one session start command
494
+ - Combines: `recover --clear` + `recap` + summary
495
+ - Shows context death status, recent handoffs, what you were working on
496
+ - Perfect for session startup ritual
497
+
498
+ - **`clawvault sleep <summary>`** - All-in-one session end command
499
+ - Creates handoff with: --next, --blocked, --decisions, --questions, --feeling
500
+ - Clears death flag
501
+ - Optional git commit prompt (--no-git to skip)
502
+ - Captures rich context before ending session
503
+
504
+ ### Fixed
505
+ - Fixed readline import in sleep command (was using `readline/promises` which bundlers couldn't resolve)
506
+
507
+ ### Changed
508
+ - Documentation updated for hook-first approach
509
+ - AGENTS.md simplified - hook handles basics, manual commands for rich context
510
+ - SKILL.md updated with OpenClaw Integration section
511
+
512
+ ---
513
+
514
+ ## [1.4.1] - 2026-02-05
515
+
516
+ ### Added
517
+ - `clawvault doctor` - Vault health diagnostics
518
+ - `clawvault shell-init` - Shell integration setup
519
+
520
+ ---
521
+
522
+ ## [1.4.0] - 2026-02-04
523
+
524
+ ### Added
525
+ - **qmd integration** - Semantic search via local embeddings
526
+ - `clawvault setup` - Auto-discovers OpenClaw memory folder
527
+ - `clawvault status` - Vault health, checkpoint age, qmd index
528
+ - `clawvault template` - List/create/add with 7 built-in templates
529
+ - `clawvault link --backlinks` - See what links to a file
530
+ - `clawvault link --orphans` - Find broken wiki-links
531
+
532
+ ### Changed
533
+ - qmd is now required for semantic search functionality
534
+
535
+ ---
536
+
537
+ ## [1.3.x] - Earlier
538
+
539
+ - Initial release with core functionality
540
+ - Checkpoint/recover for context death resilience
541
+ - Handoff/recap for session continuity
542
+ - Wiki-linking and entity management
543
+ - Structured memory categories
package/LICENSE ADDED
@@ -0,0 +1,21 @@
1
+ MIT License
2
+
3
+ Copyright (c) 2026 Versatly
4
+
5
+ Permission is hereby granted, free of charge, to any person obtaining a copy
6
+ of this software and associated documentation files (the "Software"), to deal
7
+ in the Software without restriction, including without limitation the rights
8
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
+ copies of the Software, and to permit persons to whom the Software is
10
+ furnished to do so, subject to the following conditions:
11
+
12
+ The above copyright notice and this permission notice shall be included in all
13
+ copies or substantial portions of the Software.
14
+
15
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
+ SOFTWARE.