dashclaw 3.0.0 → 4.0.1

package/README.md

@@ -447,21 +447,6 @@ if (result.recommendation === 'block') {
 }
 ```
 
-### Context Threads
-- `createThread(thread)` -- Create a context thread for tracking multi-step work.
-- `addThreadEntry(threadId, content, entryType)` -- Add an entry to a context thread.
-- `closeThread(threadId, summary)` -- Close a context thread with an optional summary.
-
-```javascript
-// Create a thread, add entries, and close it
-const thread = await claw.createThread({ name: 'Release Planning' });
-
-await claw.addThreadEntry(thread.thread_id, 'Kickoff complete', 'note');
-await claw.addThreadEntry(thread.thread_id, 'Tests green on staging', 'milestone');
-
-await claw.closeThread(thread.thread_id, 'Release shipped successfully');
-```
-
 ### Bulk Sync
 - `syncState(state)` -- Push a full agent state snapshot in a single call.
 
@@ -644,7 +629,7 @@ If your agent supports Model Context Protocol (Claude Code, Claude Desktop, Mana
 
 **Streamable HTTP transport** (same surface, served by your DashClaw instance at `POST /api/mcp`).
 
-**23 tools** in 7 groups:
+**26 tools** in 9 groups:
 
 - **Core governance (8):** `dashclaw_guard`, `dashclaw_record`, `dashclaw_invoke`, `dashclaw_capabilities_list`, `dashclaw_policies_list`, `dashclaw_wait_for_approval`, `dashclaw_session_start`, `dashclaw_session_end`.
 - **Optimal files (2):** `dashclaw_optimal_files_preview`, `dashclaw_optimal_files_manifest` — Code Sessions optimizer output (root CLAUDE.md, path-scoped rules, hooks, skill packs).
@@ -653,6 +638,8 @@ If your agent supports Model Context Protocol (Claude Code, Claude Desktop, Mana
 - **Skill safety (1):** `dashclaw_skill_scan` — static safety scan of untrusted skill files; results cached by content hash.
 - **Open loops (3):** `dashclaw_loop_add`, `dashclaw_loop_list`, `dashclaw_loop_close` — action-scoped commitments (the "I will X later" tracker).
 - **Learning + retrospection (3):** `dashclaw_learning_log`, `dashclaw_learning_query`, `dashclaw_decisions_recent` — log + query non-obvious decisions; recent governed-action ledger.
+- **Agent inbox (2):** `dashclaw_inbox_list`, `dashclaw_messages_mark_read`
+- **Behavior learning (1):** `dashclaw_behavior_suggestions`
 
 **6 resources:** `dashclaw://policies`, `dashclaw://capabilities`, `dashclaw://agent/{agent_id}/history`, `dashclaw://status`, `dashclaw://code-sessions/projects`, `dashclaw://code-sessions/sessions/{session_id}`.
 

package/dashclaw.js

@@ -225,10 +225,18 @@ class DashClaw {
    */
   async *_connectSSE(controller) {
     const res = await fetch(`${this.baseUrl}/api/stream`, {
-      headers: { 'x-api-key': this.apiKey },
+      headers: {
+        'x-api-key': this.apiKey,
+        ...(this.authToken ? { 'Authorization': `Bearer ${this.authToken}` } : {}),
+      },
       signal: controller.signal,
     });
 
+    if (res.status === 403) {
+      let body = {};
+      try { body = await res.json(); } catch { /* ignore */ }
+      throw new GuardBlockedError(body.decision || { reason: 'SSE stream blocked by policy' });
+    }
     if (!res.ok || !res.body) return;
 
     const reader = res.body.getReader();
@@ -316,7 +324,7 @@ class DashClaw {
         if (!controller.signal.aborted) controller.abort();
       }
     } catch (err) {
-      if (err instanceof ApprovalDeniedError || err.message?.includes('Timed out')) throw err;
+      if (err instanceof ApprovalDeniedError || err instanceof GuardBlockedError || err.message?.includes('Timed out')) throw err;
       // SSE failed — fall through to polling
     }
 
@@ -451,7 +459,7 @@ class DashClaw {
     return this._request('/api/learning/lessons', 'GET', null, {
       agent_id: this.agentId,
       ...(actionType && { action_type: actionType }),
-      ...(limit && { limit }),
+      ...(limit != null && { limit }),
     });
   }
 
@@ -540,6 +548,7 @@ class DashClaw {
    * POST /api/scoring/score — score a single action against a profile
    */
   async scoreWithProfile(profileId, action) {
+    if (Array.isArray(action)) throw new TypeError('scoreWithProfile expects a single action object; use batchScoreWithProfile for arrays');
     return this._request('/api/scoring/score', 'POST', { profile_id: profileId, action });
   }
 
@@ -547,6 +556,7 @@ class DashClaw {
    * POST /api/scoring/score — batch score multiple actions against a profile
    */
   async batchScoreWithProfile(profileId, actions) {
+    if (!Array.isArray(actions)) throw new TypeError('batchScoreWithProfile expects an array of actions');
     return this._request('/api/scoring/score', 'POST', { profile_id: profileId, actions });
   }
 
@@ -648,7 +658,7 @@ class DashClaw {
       direction: 'inbox',
       ...(type && { type }),
       ...(unread != null && { unread }),
-      ...(limit && { limit }),
+      ...(limit != null && { limit }),
     });
   }
 
@@ -661,7 +671,7 @@ class DashClaw {
       direction: 'sent',
       ...(type && { type }),
       ...(threadId && { thread_id: threadId }),
-      ...(limit && { limit }),
+      ...(limit != null && { limit }),
     });
   }
 
@@ -675,7 +685,7 @@ class DashClaw {
       ...(type && { type }),
       ...(unread != null && { unread }),
       ...(threadId && { thread_id: threadId }),
-      ...(limit && { limit }),
+      ...(limit != null && { limit }),
     });
   }
 
@@ -753,54 +763,6 @@ class DashClaw {
     });
   }
 
-  // ---------------------------------------------------------------------------
-  // Context Threads
-  // ---------------------------------------------------------------------------
-
-  /**
-   * POST /api/context/threads — Create a reasoning context thread.
-   */
-  async createThread(thread) {
-    return this._request('/api/context/threads', 'POST', {
-      agent_id: this.agentId,
-      ...thread,
-    });
-  }
-
-  /**
-   * POST /api/context/threads/:id/entries — Append a reasoning step.
-   */
-  async addThreadEntry(threadId, content, entryType) {
-    return this._request(`/api/context/threads/${threadId}/entries`, 'POST', {
-      content,
-      entry_type: entryType,
-    });
-  }
-
-  /**
-   * PATCH /api/context/threads/:id — Close a reasoning thread.
-   */
-  async closeThread(threadId, summary) {
-    return this._request(`/api/context/threads/${threadId}`, 'PATCH', {
-      status: 'closed',
-      ...(summary ? { summary } : {}),
-    });
-  }
-
-  // ---------------------------------------------------------------------------
-  // Bulk Sync
-  // ---------------------------------------------------------------------------
-
-  /**
-   * POST /api/sync — Bulk state sync for periodic updates or bootstrap.
-   */
-  async syncState(state) {
-    return this._request('/api/sync', 'POST', {
-      agent_id: this.agentId,
-      ...state,
-    });
-  }
-
   // ---------------------------------------------------------------------------
   // Session Lifecycle
   // ---------------------------------------------------------------------------
@@ -1165,6 +1127,13 @@ class DashClaw {
     return this._request(`/api/capabilities/${capabilityId}`, 'PATCH', patch);
   }
 
+  /**
+   * DELETE /api/capabilities/:id — Delete a capability.
+   */
+  async deleteCapability(capabilityId) {
+    return this._request(`/api/capabilities/${capabilityId}`, 'DELETE');
+  }
+
   /**
    * POST /api/capabilities/:id/invoke — Invoke a governed capability.
    */

package/index.cjs

@@ -1,14 +1,11 @@
 /**
  * DashClaw SDK v2 (Stable Runtime API)
  * CommonJS compatibility bridge.
- * 
+ *
  * ESM: import { DashClaw } from 'dashclaw'
  * CJS: const { DashClaw } = require('dashclaw')
  */
 
-const fs = require('fs');
-const path = require('path');
-
 // Minimal CommonJS shim for the v2 SDK
 // We use a simplified bridge that forwards calls to the async ESM import
 let _module;
@@ -20,6 +17,55 @@ async function loadModule() {
   return _module;
 }
 
+// Lazy error class factory: constructs a placeholder class that delegates
+// instanceof checks to the real ESM class once the module loads, matching
+// the Symbol.hasInstance pattern from legacy/index-v1.cjs so that
+// catch(e) { if (e instanceof ApprovalDeniedError) } works across the
+// ESM/CJS boundary.
+function makeLazyErrorClass(name) {
+  const Placeholder = class extends Error {
+    constructor(...args) {
+      super(...args);
+      this.name = name;
+    }
+  };
+  Object.defineProperty(Placeholder, 'name', { value: name });
+  loadModule().then(m => {
+    if (m[name]) {
+      Object.defineProperty(Placeholder, Symbol.hasInstance, {
+        value: (instance) => instance && (instance.name === name || instance instanceof m[name])
+      });
+    }
+  });
+  return Placeholder;
+}
+
+// Recursive deferred proxy. Each property access records the access path and
+// returns another callable proxy; invoking the leaf awaits the async ESM import,
+// walks the path on the resolved instance, and calls the real method. This makes
+// both flat methods (client.guard(...)) and nested namespaces
+// (client.execution.capabilities.list(...)) work across the CJS bridge, where the
+// ESM instance only exists after an async import.
+function makeDeferred(target, path) {
+  return new Proxy(function () {}, {
+    get(_t, prop) {
+      if (prop === 'then' || typeof prop === 'symbol') return undefined;
+      return makeDeferred(target, path.concat(String(prop)));
+    },
+    apply(_t, _thisArg, args) {
+      return target._ready.then(() => {
+        let parent = target._instance;
+        for (let i = 0; i < path.length - 1; i++) parent = parent[path[i]];
+        const leaf = parent && parent[path[path.length - 1]];
+        if (typeof leaf !== 'function') {
+          throw new Error(`Method ${path.join('.')} does not exist on DashClaw v2`);
+        }
+        return leaf.apply(parent, args);
+      });
+    },
+  });
+}
+
 module.exports = {
   // Sync wrapper that returns a proxy for the DashClaw class
   DashClaw: class DashClawProxy {
@@ -32,15 +78,10 @@ module.exports = {
       return new Proxy(this, {
         get(target, prop) {
           if (prop in target) return target[prop];
-          if (prop === 'then') return undefined;
-
-          return async (...args) => {
-            await target._ready;
-            if (!target._instance[prop]) {
-              throw new Error(`Method ${String(prop)} does not exist on DashClaw v2`);
-            }
-            return target._instance[prop](...args);
-          };
+          if (prop === 'then' || typeof prop === 'symbol') return undefined;
+          // Defer to the async ESM instance; supports flat methods and
+          // nested namespaces (e.g. client.execution.capabilities.list(...)).
+          return makeDeferred(target, [String(prop)]);
         }
       });
     }
@@ -51,20 +92,8 @@ module.exports = {
     }
   },
 
-  // Errors from v2
-  ApprovalDeniedError: class ApprovalDeniedError extends Error {
-    constructor(message, decision) {
-      super(message);
-      this.name = 'ApprovalDeniedError';
-      this.decision = decision;
-    }
-  },
-
-  GuardBlockedError: class GuardBlockedError extends Error {
-    constructor(decision) {
-      super(decision.reason || 'Action blocked by policy');
-      this.name = 'GuardBlockedError';
-      this.decision = decision;
-    }
-  }
+  // Errors from v2 — lazy re-exports that resolve instanceof across the
+  // ESM/CJS boundary once the module has loaded.
+  ApprovalDeniedError: makeLazyErrorClass('ApprovalDeniedError'),
+  GuardBlockedError: makeLazyErrorClass('GuardBlockedError'),
 };

package/legacy/dashclaw-v1.js

@@ -1419,6 +1419,7 @@ class DashClaw {
 
   /**
    * Capture a key point from the current session.
+   * @deprecated The /api/context/points endpoint was retired in platform v4. This method always 404s.
    * @param {Object} point
    * @param {string} point.content - The key point content
    * @param {string} [point.category] - One of: decision, task, insight, question, general
@@ -1427,6 +1428,7 @@ class DashClaw {
    * @returns {Promise<{point: Object, point_id: string}>}
    */
   async captureKeyPoint(point) {
+    console.warn('[DashClaw] captureKeyPoint targets a retired endpoint (/api/context/points) and will 404. Upgrade to platform v4+.');
     return this._request('/api/context/points', 'POST', {
       agent_id: this.agentId,
       ...point
@@ -1435,6 +1437,7 @@ class DashClaw {
 
   /**
    * Get key points with optional filters.
+   * @deprecated The /api/context/points endpoint was retired in platform v4. This method always 404s.
    * @param {Object} [filters]
    * @param {string} [filters.category] - Filter by category
    * @param {string} [filters.session_date] - Filter by date
@@ -1442,6 +1445,7 @@ class DashClaw {
    * @returns {Promise<{points: Object[], total: number}>}
    */
   async getKeyPoints(filters = {}) {
+    console.warn('[DashClaw] getKeyPoints targets a retired endpoint (/api/context/points) and will 404. Upgrade to platform v4+.');
     const params = new URLSearchParams({ agent_id: this.agentId });
     if (filters.category) params.set('category', filters.category);
     if (filters.session_date) params.set('session_date', filters.session_date);
@@ -1451,12 +1455,14 @@ class DashClaw {
 
   /**
    * Create a context thread for tracking a topic across entries.
+   * @deprecated The /api/context/threads endpoint was retired in platform v4. This method always 404s.
    * @param {Object} thread
    * @param {string} thread.name - Thread name (unique per agent per org)
    * @param {string} [thread.summary] - Initial summary
    * @returns {Promise<{thread: Object, thread_id: string}>}
    */
   async createThread(thread) {
+    console.warn('[DashClaw] createThread targets a retired endpoint (/api/context/threads) and will 404. Upgrade to platform v4+.');
     return this._request('/api/context/threads', 'POST', {
       agent_id: this.agentId,
       ...thread
@@ -1465,12 +1471,14 @@ class DashClaw {
 
   /**
    * Add an entry to an existing thread.
+   * @deprecated The /api/context/threads endpoint was retired in platform v4. This method always 404s.
    * @param {string} threadId - The thread ID
    * @param {string} content - Entry content
    * @param {string} [entryType] - Entry type (default: 'note')
    * @returns {Promise<{entry: Object, entry_id: string}>}
    */
   async addThreadEntry(threadId, content, entryType) {
+    console.warn('[DashClaw] addThreadEntry targets a retired endpoint (/api/context/threads) and will 404. Upgrade to platform v4+.');
     return this._request(`/api/context/threads/${threadId}/entries`, 'POST', {
       content,
       entry_type: entryType || 'note'
@@ -1479,11 +1487,13 @@ class DashClaw {
 
   /**
    * Close a thread with an optional summary.
+   * @deprecated The /api/context/threads endpoint was retired in platform v4. This method always 404s.
    * @param {string} threadId - The thread ID
    * @param {string} [summary] - Final summary
    * @returns {Promise<{thread: Object}>}
    */
   async closeThread(threadId, summary) {
+    console.warn('[DashClaw] closeThread targets a retired endpoint (/api/context/threads) and will 404. Upgrade to platform v4+.');
     const body = { status: 'closed' };
     if (summary) body.summary = summary;
     return this._request(`/api/context/threads/${threadId}`, 'PATCH', body);
@@ -1491,12 +1501,14 @@ class DashClaw {
 
   /**
    * Get threads with optional filters.
+   * @deprecated The /api/context/threads endpoint was retired in platform v4. This method always 404s.
    * @param {Object} [filters]
    * @param {string} [filters.status] - Filter by status (active, closed)
    * @param {number} [filters.limit] - Max results
    * @returns {Promise<{threads: Object[], total: number}>}
    */
   async getThreads(filters = {}) {
+    console.warn('[DashClaw] getThreads targets a retired endpoint (/api/context/threads) and will 404. Upgrade to platform v4+.');
     const params = new URLSearchParams({ agent_id: this.agentId });
     if (filters.status) params.set('status', filters.status);
     if (filters.limit) params.set('limit', String(filters.limit));
@@ -1505,9 +1517,11 @@ class DashClaw {
 
   /**
    * Get a combined context summary: today's key points + active threads.
+   * @deprecated The /api/context endpoints were retired in platform v4. This method always 404s.
    * @returns {Promise<{points: Object[], threads: Object[]}>}
    */
   async getContextSummary() {
+    console.warn('[DashClaw] getContextSummary targets retired endpoints (/api/context/*) and will 404. Upgrade to platform v4+.');
     const today = new Date().toISOString().split('T')[0];
     const [pointsResult, threadsResult] = await Promise.all([
       this.getKeyPoints({ session_date: today }),
@@ -1793,11 +1807,6 @@ class DashClaw {
     return this._request(`/api/messages?${params}`, 'GET');
   }
 
-  /**
-   * Mark messages as read.
-   * @param {string[]} messageIds - Array of message IDs to mark read
-   * @returns {Promise<{updated: number}>}
-   */
   /**
    * Get sent messages from this agent.
    * @param {Object} [params]
@@ -2818,10 +2827,12 @@ class DashClaw {
   }
 
   async scoreWithProfile(profileId, action) {
+    if (Array.isArray(action)) throw new TypeError('use batchScoreWithProfile for arrays');
     return this._request('POST', '/api/scoring/score', { profile_id: profileId, action });
   }
 
   async batchScoreWithProfile(profileId, actions) {
+    if (!Array.isArray(actions)) throw new TypeError('batchScoreWithProfile expects an array');
     return this._request('POST', '/api/scoring/score', { profile_id: profileId, actions });
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dashclaw",
-  "version": "3.0.0",
+  "version": "4.0.1",
   "description": "Minimal governance runtime for AI agents. Intercept, govern, and verify agent actions.",
   "type": "module",
   "publishConfig": {