echoclaw-relay-agent 0.26.0 → 0.27.0

package/dist/{chunk-KNVTSHSR.js → chunk-6F5HKU53.js}

@@ -2300,6 +2300,8 @@ var OpenClawWsClient = class extends EventEmitter7 {
             }
             this._setupMessageHandling();
             this._startPing();
+            this.request("sessions.subscribe", {}).catch(() => {
+            });
             this.emit("connected");
             resolve();
           } else {
@@ -2430,6 +2432,8 @@ var OpenClawWsClient = class extends EventEmitter7 {
           this.emit("chat.side_result", msg.payload);
         } else if (msg.event === "agent") {
           this.emit("agent", msg.payload);
+        } else if (msg.event === "session.tool") {
+          this.emit("agent", msg.payload);
         }
         return;
       }
@@ -3758,11 +3762,13 @@ var CRITICAL_RULES = [
     title: "Bilingual i18n",
     must: [
       "ALL user-facing text through `t()` function with `en` + `zh-CN` dictionaries",
-      '`manifest.name` and `manifest.description` as `{ "en": "...", "zh-CN": "..." }` objects'
+      '`manifest.name` and `manifest.description` as `{ "en": "...", "zh-CN": "..." }` objects',
+      "Language is switched globally by the EchoClaw system \u2014 do NOT add a language toggle/selector UI in the app"
     ],
     never: [
       "Hardcoded Chinese or English strings in HTML",
-      "Plain string manifest.name or manifest.description"
+      "Plain string manifest.name or manifest.description",
+      "In-app language switcher UI (language is controlled by the host, not the app)"
     ],
     severity: "error"
   },
@@ -3939,1168 +3945,14 @@ Do NOT rely on memory \u2014 verify against this list every time you output an a
 ${rulesBlock}
 ${checklistBlock}
 
-## When to Suggest a ClawApp
-
-Any user request that is "visible, interactive, and shareable" \u2014 dashboards, tools, forms, games, landing pages, portfolios \u2014 SHOULD be a .claw app. See ECHOCLAW_DEV_GUIDE.md \xA72 for the full 20-category list.
-\`\`\`
-`;
-
-// ../claw-engine/src/authoring/openclaw-guides/index.ts
-var OPENCLAW_SPEC = `# ClawApp Visual & Technical Specification
-
-> This file is automatically written by the EchoClaw Relay Agent, based on claw-engine v3.1.0.
-> Last updated: {{TIMESTAMP}}
-> For the complete specification, refer to \`claw-html-design.md\` and \`ARCHITECTURE.md\` in the claw-engine source.
-
----
-
-## 1. Platform Context
-
-- **Target Platform:** Electron desktop (macOS/Windows)
-- **Rendering:** \`<iframe>\` sandbox with dynamic \`sandbox\` + \`allow\` attributes
-- **Theme:** Dark mode only; CSS variables injected by the host shell
-- **Bridge:** \`window.echoclaw\` for host communication
-- **Constraint:** Self-contained HTML (inline CSS+JS, no CDN, \u2264500 KB)
-
----
-
-## 2. Viewport Standard
-
-\`\`\`
-\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510
-\u2502 EchoClaw Window: 1280 \xD7 820 (default)         \u2502
-\u2502 \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\u2502
-\u2502 \u2502 Sidebar  \u2502 TitleBar     52px                \u2502\u2502
-\u2502 \u2502 256px    \u251C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\u2502
-\u2502 \u2502 (shell)  \u2502                                  \u2502\u2502
-\u2502 \u2502          \u2502  .claw iframe: 1024 \xD7 768        \u2502\u2502
-\u2502 \u2502          \u2502  (your design canvas)             \u2502\u2502
-\u2502 \u2502          \u2502                                  \u2502\u2502
-\u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\u2502
-\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518
-\`\`\`
-
-| Parameter | Value | Description |
-|-----------|-------|-------------|
-| **Design target** | **1024 \xD7 768** | XGA, 4:3 aspect ratio |
-| **Minimum safe area** | **544 \xD7 548** | When the window is 800\xD7600 |
-| Window default | 1280 \xD7 820 | 13\u2033 MacBook Air |
-| Window minimum | 800 \xD7 600 | Hard lower limit |
-| Sidebar | 256 px fixed | Occupied by the shell; unavailable to apps |
-| Title bar | 52 px fixed | macOS traffic lights |
-
-**Calculation:** \`iframe width = window width \u2212 256\`, \`iframe height = window height \u2212 52\`
-
-**Reserved area:** The bottom-right 64\xD764 px region is occupied by the host Info button. Apps MUST NOT place interactive elements in this area.
-
-### Font Size Reference (at 1024 px width)
-| Role | Size |
-|------|------|
-| Title | 20\u201324 px |
-| Subtitle | 16\u201318 px |
-| Body text | 13\u201314 px |
-| Caption | 11\u201312 px |
-| Minimum touch target | 32\xD732 px |
-
----
-
-## 3. CSS Variable System (59 Variables)
-
-Injected by the host. Apps MUST use these variables. **Hard-coding color values is strictly forbidden.**
-
-### Core Colors
-\`\`\`
---ec-agent            /* App brand color (from manifest.color) */
---ec-agent-text       /* Auto-contrast text color on the agent background */
---ec-bg-page          /* Deepest background */
---ec-bg-base          /* Base surface */
---ec-bg-raised        /* Raised surface (cards) */
---ec-bg-overlay       /* Floating / overlay surface */
-\`\`\`
-
-### Text Hierarchy
-\`\`\`
---ec-txt-primary      /* High-contrast text */
---ec-txt-secondary    /* Medium-contrast text */
---ec-txt-tertiary     /* Low-contrast (hints, metadata) */
---ec-txt-disabled     /* Disabled text */
-\`\`\`
-
-### Status Colors
-\`\`\`
---ec-status-done      /* Green (success) */
---ec-status-active    /* Blue/cyan (running) */
---ec-status-warning   /* Orange (caution) */
---ec-status-error     /* Red (danger) */
---ec-status-done-bg / error-bg / warning-bg / active-bg  /* 12% opacity tint */
-\`\`\`
-
-### Borders & Dividers
-\`\`\`
---ec-card-bg / --ec-card-border       /* Card */
---ec-border-strong / mid / subtle     /* Three-tier borders */
---ec-divider                          /* Divider line */
-\`\`\`
-
-### Interactive Components
-\`\`\`
---ec-interactive-bg / bdr / fg / hover / active  /* Button states */
---ec-input-bg / bdr                              /* Input fields */
---ec-toggle-off / on / knob                      /* Toggle switch */
-\`\`\`
-
-### Spacing & Animation
-\`\`\`
---ec-space-xs/sm/md/lg/xl/2xl      /* 4/8/16/24/32/48px \u2014 8px grid */
---ec-radius-xs(4)/sm(6)/md(10)/lg(14)/xl(20)  /* Border radius */
---ec-duration-fast/normal/slow     /* 120/200/350ms */
---ec-ease-standard                 /* cubic-bezier(0.4, 0, 0.2, 1) */
---ec-ease-decelerate / accelerate  /* Enter / exit easing */
---ec-shadow-sm / md                /* Shadows */
---ec-font-family                   /* System font stack */
---ec-focus-ring / focus-ring-offset /* Focus ring */
-\`\`\`
-
-### Color Usage Rules
-- \`var(--ec-agent)\` = brand accent color. Use 3\u20135 times: hero, active tab, primary button, key highlight.
-- \`var(--ec-agent-text)\` = text on the agent background; automatically computed for WCAG contrast.
-- Status colors = semantic use only: success=green, running=blue, warning=orange, error=red.
-- Text hierarchy: primary \u2192 secondary \u2192 tertiary.
-
----
-
-## 4. Hard Rules (Violation = Rejection)
-
-| # | Rule | Severity |
-|---|------|----------|
-| 1 | **Use CSS variables only.** Hard-coded hex colors are forbidden. | CRITICAL |
-| 2 | **No left-side navigation.** The shell owns the left sidebar. Apps MUST NOT render any left-side navigation UI. Apps MAY implement top navigation and/or a right-side panel. | CRITICAL |
-| 3 | **Self-contained.** CSS in \`<style>\`, JS in \`<script>\`, icons as inline SVG. Zero external resources. | CRITICAL |
-| 4 | **\`allow-same-origin\` is forbidden.** All host communication MUST go through the \`window.echoclaw\` Bridge. | CRITICAL |
-| 5 | **Declare capabilities.** Usage of audio/camera/mic/clipboard/location/fullscreen MUST be declared in manifest.capabilities. | HIGH |
-| 6 | **Prompt-level permissions require requestPermission.** Call \`echoclaw.requestPermission()\` before use and handle denial. | HIGH |
-| 7 | **Desktop-first layout.** Design target is 1024\xD7768 with multi-column layout. At viewport 544\xD7548, all core functions MUST remain usable without layout overlap, clipped primary actions, or horizontal overflow. | HIGH |
-| 8 | **Dark theme only.** Colors are controlled by CSS variables. \`prefers-color-scheme\` media queries are forbidden. | HIGH |
-| 9 | **Hover + Focus states.** All interactive elements MUST have hover/focus styles and \`cursor: pointer\`. | MEDIUM |
-| 10 | **\u2264500 KB.** | MEDIUM |
-| 11 | **\`javascript:\` URLs are forbidden.** | CRITICAL |
-| 14 | **Tiered credential storage.** Tokens/passwords MUST use \`echoclaw.auth.setSecret()\`. Storing them via \`echoclaw.storage\` is forbidden. | CRITICAL |
-| 15 | **Auth capability declaration.** Any use of \`echoclaw.auth.*\` MUST declare the auth capability and an auth_profile. | HIGH |
-| 16 | **Bottom-right reserved area.** The host places a 36\xD736 px Info button at \`bottom: 20px; right: 20px\` (z-index: 10). Apps MUST NOT place interactive elements (buttons, links, FABs) in this area. Safe practice: leave at least **64\xD764 px** clear in the bottom-right corner. | MEDIUM |
-
-### Soft Rules (Warning, Non-blocking)
-
-| # | Rule | Severity |
-|---|------|----------|
-| 12 | **Bridge-only API.** Direct \`new WebSocket()\`, \`fetch()\` to external URLs, \`localStorage\`, etc. are forbidden. Use Bridge equivalents. | WARNING |
-| 13 | **\`<img>\` elements MUST have an \`alt\` attribute.** | WARNING |
-
----
-
-## 5. Design Principles
-
-### 1. Visual Hierarchy
-- Each screen MUST have **one hero element** (large number, chart, status indicator), 2\u20133\xD7 the size of surrounding elements.
-- Typographic scale: hero (36\u201348 px/700) \u2192 page title (22 px/700) \u2192 section (17 px/600) \u2192 body (14 px/400) \u2192 caption (13 px/500) \u2192 footnote (11 px/400).
-
-### 2. Aesthetic Defaults
-- **Frosted glass effect:** \`backdrop-filter: blur(20px)\` + semi-transparent background.
-- **Micro-animations:** \`transition: all 0.2s ease\`.
-- **Border radius:** cards 10\u201314 px, buttons/inputs 6\u20138 px, badges 4 px.
-- **Shadows:** cards \`var(--ec-shadow-sm)\`, modals \`var(--ec-shadow-md)\`.
-
-### 3. Spacing (8 px Grid)
-| Element | Value |
-|---------|-------|
-| Page padding | 24\u201332 px |
-| Card padding | 16\u201324 px |
-| Section gap | 16\u201324 px |
-| Item gap | 8\u201312 px |
-| Button padding | 8 px 16 px (small), 12 px 24 px (medium) |
-
-### 4. Z-Index Layers
-| Layer | z-index | Usage |
-|-------|---------|-------|
-| Base content | 0 | Normal flow |
-| Fixed header | 10 | Sticky headers, tab bars |
-| Dropdown | 20 | Select menus, autocomplete |
-| Overlay / backdrop | 40 | Dimmed background |
-| Modal / dialog | 50 | Centered dialogs |
-| Toast / notification | 100 | Top-right toasts |
-
-### 5. Scrollbar Styling (MUST Include)
-\`\`\`css
-::-webkit-scrollbar { width: 6px; height: 6px; }
-::-webkit-scrollbar-track { background: transparent; }
-::-webkit-scrollbar-thumb {
-  background: var(--ec-border-mid);
-  border-radius: 3px;
-}
-::-webkit-scrollbar-thumb:hover { background: var(--ec-border-strong); }
-\`\`\`
-
-### 6. Empty / Loading / Error States (MUST Handle)
-- **Loading:** Skeleton screen or spinner using \`var(--ec-txt-tertiary)\`.
-- **Empty:** Centered icon + message + optional action button.
-- **Error:** \`var(--ec-status-error)\` banner + retry action.
-
----
-
-## 6. Layout Patterns
-
-### Dashboard Layout
-\`\`\`
-\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510
-\u2502 Header: Title + Status + Actions    \u2502
-\u251C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524
-\u2502 KPI 1   \u2502 KPI 2   \u2502 KPI 3  \u2502 KPI 4  \u2502
-\u251C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524
-\u2502 Main Chart        \u2502 Side Panel      \u2502
-\u251C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524
-\u2502 Detail Table / List                 \u2502
-\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518
-\`\`\`
-
-### List-Detail Layout (No Left Sidebar)
-\`\`\`
-\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510
-\u2502 Header: Title + Search + Filters    \u2502
-\u251C\u2500\u2500\u2500\u2500\u2500\u2500\u252C\u2500\u2500\u2500\u2500\u2500\u2500\u252C\u2500\u2500\u2500\u2500\u2500\u2500\u252C\u2500\u2500\u2500\u2500\u2500\u2500\u252C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524
-\u2502 Card \u2502 Card \u2502 Card \u2502 Card \u2502 ...\u2192    \u2502
-\u251C\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524
-\u2502 Detail: Fields        \u2502 Activity    \u2502
-\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518
-\`\`\`
-
-### Form Layout (Centered, max-width 640 px)
-\`\`\`
-\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510
-\u2502         Title + Step Indicator      \u2502
-\u2502    \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510      \u2502
-\u2502    \u2502 Label     [ Input     ] \u2502      \u2502
-\u2502    \u2502 Label     [ Select  \u25BC ] \u2502      \u2502
-\u2502    \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518      \u2502
-\u2502           [ Cancel ] [ Submit ]     \u2502
-\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518
-\`\`\`
-
-### Settings Layout (Top Tabs, No Left Sidebar)
-\`\`\`
-\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510
-\u2502 Settings                            \u2502
-\u2502 [General] [Appearance] [Privacy]    \u2502
-\u251C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524
-\u2502 SECTION HEADER                      \u2502
-\u2502 \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502
-\u2502 \u2502 Label              [Toggle]     \u2502 \u2502
-\u2502 \u2502 Label              [Select \u25BC]   \u2502 \u2502
-\u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2502
-\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518
-\`\`\`
-
----
-
-## 7. Quality Gate (Score \u226514/20 or Redo)
-
-| # | Check | 0 | 1 | 2 |
-|---|-------|---|---|---|
-| 1 | Hero element | None | Has a large element | Stunning hero |
-| 2 | CSS variables | Hard-coded | Mostly variables | 100% variables |
-| 3 | Dark theme | Broken in dark mode | Acceptable | Polished dark theme |
-| 4 | Desktop layout | Narrow single column | Reasonable | Full-width multi-column |
-| 5 | Hover states | None | Partial | Fully interactive |
-| 6 | Transitions | None | Partial | Globally smooth |
-| 7 | Typographic hierarchy | Flat | Some variation | 4+ level scale |
-| 8 | Spacing | Arbitrary | Mostly consistent | 8 px grid |
-| 9 | State visibility | None | Partial | All states clearly shown |
-| 10 | Self-contained | External dependencies | Minimal | Zero external |
-
----
-
-## 8. EC Toolkit (Optional CSS Component Library)
-
-The host injects a pre-built CSS component library alongside the theme variables. You MAY use \`ec-*\` classes to rapidly build polished UI, or ignore them entirely and write your own CSS.
-
-**Core classes:** \`ec-card\`, \`ec-card-glass\`, \`ec-btn ec-btn-primary\`, \`ec-btn ec-btn-secondary\`, \`ec-input\`, \`ec-select\`, \`ec-toggle\`, \`ec-badge ec-badge-done\`, \`ec-tabs\`/\`ec-tab\`, \`ec-table\`, \`ec-modal\`, \`ec-toast\`, \`ec-toolbar\`, \`ec-progress\`, \`ec-ring\`, \`ec-kpi\`, \`ec-list\`/\`ec-list-item\`, \`ec-skeleton\`, \`ec-empty\`, \`ec-error-banner\`, \`ec-dot\`, \`ec-avatar\`, \`ec-dropdown\`
-
-**Animation classes:** \`ec-animate-fade-in\`, \`ec-animate-scale-in\`, \`ec-animate-slide-up\`, \`ec-animate-bounce-in\`, \`ec-animate-spin\`, \`ec-stagger\`
-
-**Layout utilities:** \`ec-flex\`, \`ec-flex-col\`, \`ec-grid ec-grid-4\`, \`ec-gap-md\`, \`ec-flex-1\`, \`ec-truncate\`
-
----
-
-## 9. Icon SVG Rules
-
-- \`icon_svg\`: Inner SVG elements ONLY \u2014 **no \`<svg>\` wrapper, no \`xmlns\`, no \`viewBox\`**
-- The host wraps your content in \`<svg viewBox="0 0 40 40">\`. You provide ONLY the inner elements (path, circle, rect, etc.)
-- Use \`currentColor\` for fill/stroke \u2014 **no hardcoded colors** (no hex, no rgb, no named colors in icon_svg)
-- Maximum 3\u20134 elements; outlines MUST be legible at 20\xD720 px
-- Every app **MUST** generate an \`icon_svg\`
-
-**\u2705 CORRECT:**
-\`\`\`json
-"icon_svg": "<path d=\\"M8 6h24v4H8zm0 10h24v4H8zm0 10h18v4H8z\\" fill=\\"currentColor\\"/>"
-\`\`\`
-
-**\u274C WRONG (all of these errors together):**
-\`\`\`json
-"icon_svg": "<svg xmlns=\\"...\\" viewBox=\\"0 0 64 64\\"><rect fill=\\"#0c4a6e\\"/>...</svg>"
-\`\`\`
-Errors: outer \`<svg>\` tag, \`xmlns\` attribute, custom viewBox, hardcoded hex color.
-
----
-
-## 10. Internationalization (i18n) \u2014 Mandatory
-
-All .claw apps MUST embed both Chinese and English (zh-CN + en) at generation time.
-
-\`\`\`javascript
-const I18N = {
-  'en': { 'title': 'Dashboard', ... },
-  'zh-CN': { 'title': '\u4EEA\u8868\u76D8', ... }
-};
-let currentLocale = 'en';
-function t(key) { return (I18N[currentLocale] || I18N['en'])[key] || key; }
-\`\`\`
-
-Rules:
-1. All user-visible text MUST go through \`t()\` \u2014 hard-coded Chinese or English strings are forbidden.
-2. Both languages MUST be generated at creation time \u2014 do NOT rely on runtime translation APIs.
-3. Technical terms (API, WebSocket) SHALL remain in English in both locales.
-4. Default locale is \`'en'\`; gracefully fall back when the Bridge is unavailable.
-
----
-
-## 11. Anti-Patterns
-
-| Wrong | Correct |
-|-------|---------|
-| Hard-coded hex colors | \`var(--ec-xxx)\` |
-| Left-side navigation | Top bar or right-side panel |
-| External CDN / fonts | Inline everything |
-| Mobile-first single column | Multi-column desktop layout |
-| No hover states | \`transition\` + \`:hover\` on all interactive elements |
-| Direct fetch/XHR | \`echoclaw.invoke('fetch', ...)\` |
-| Direct WebSocket | \`echoclaw.ws.connect()\` |
-| localStorage | \`echoclaw.storage.*\` or \`echoclaw.db.*\` |
-| \`echoclaw.storage.set('token', ...)\` | \`echoclaw.auth.setSecret('token', ...)\` |
-| Show error on token expiry | \`echoclaw.auth.getValidToken()\` with auto-refresh |
-| Hard-coded token in HTML | Obtain at runtime via auth flow |
-
----
-
-## 12. Output Format
-
-\`\`\`json
-{
-  "manifest": {
-    "id": "kebab-case-id",
-    "name": { "en": "Display Name", "zh-CN": "\u663E\u793A\u540D\u79F0" },
-    "version": "1.0.0",
-    "color": "#hex",
-    "icon_svg": "<path ... />",
-    "description": { "en": "One-line", "zh-CN": "\u4E00\u884C\u63CF\u8FF0" },
-    "capabilities": ["ui", "storage"],
-    "auth_profile": { ... }
-  },
-  "html": "<!DOCTYPE html>...",
-  "prompt": {
-    "seed": {
-      "goal": "Verb-first purpose sentence",
-      "constraints": ["self-contained", "..."],
-      "acceptance_tests": ["User can ...", "User can ..."]
-    },
-    "current": { "goal": "Same as seed for v1" }
-  }
-}
-\`\`\`
-
-### Delivery Format \u2014 File-Based (v3.1.0)
-
-Save your app as workspace files:
-- \`apps/{appId}/claw.json\` \u2014 the ClawAppPackage JSON (manifest + prompt + setup + meta, WITHOUT the html field)
-- \`apps/{appId}/index.html\` \u2014 the complete self-contained HTML
-
-Then notify in your chat response:
-\`\`\`
-<!--CLAW_APP_READY:{"appId":"my-app","op":"create"}-->
-\`\`\`
-
-- The claw.json must conform to the schema above (manifest + prompt required)
-- RelayAgent pulls the files from your workspace and delivers to Desktop
-- You may include explanation text alongside the notification marker
-- During processing, you may emit progress markers: \`<!--CLAW_STATUS:{"action":"creating","progress":50,"message":"..."}-->\`
-
-**The workspace files + CLAW_APP_READY marker is the delivery mechanism.** Always save files first, then notify.
-
-### Pre-Output Self-Check (MANDATORY \u2014 Do NOT Skip)
-
-The engine validator runs automatically. Items marked with R-IDs correspond to MEMORY.md Critical Rules.
-
-1. **(R1) Colors:** Search HTML for \`#\` + hex, \`rgb(\`, \`rgba(\`, \`hsl(\`, named colors. ONLY \`manifest.color\` MAY be hex. ALL others MUST use \`var(--ec-xxx)\`. Custom variables like \`--bg\`, \`--card\`, \`--btn\` are also violations \u2014 replace with platform variables.
-2. **(R6) External URLs:** Zero \`<link href="http...">\`, \`<script src="http...">\`, \`@import url("http...")\`.
-3. **Left sidebar:** No class or id named \`left-panel\`, \`left-sidebar\`, or \`left-nav\`.
-4. **Capabilities:** Every Bridge API and browser API used MUST be declared in manifest.capabilities.
-5. **Permissions:** A \`requestPermission()\` call with denial handling MUST precede every prompt-level API call.
-6. **Bridge-only:** No direct \`new WebSocket()\`, \`fetch()\` to external URLs, or \`localStorage\`.
-7. **(R6) Size:** Total HTML MUST be < 500 KB.
-8. **(R5) Interactivity:** Every \`<button>\` and clickable element MUST have \`:hover\` + \`:focus\` CSS and \`cursor: pointer\`.
-9. **Credentials:** No token or password stored via \`echoclaw.storage\`.
-10. **Auth:** Apps using auth APIs MUST declare the auth capability and an auth_profile.
-11. **(R2) i18n:** ALL user-visible text uses \`t()\` function. No hardcoded Chinese or English strings. Both \`en\` and \`zh-CN\` dictionaries present.
-12. **(R3) icon_svg:** Inner elements only (no \`<svg>\` wrapper), uses \`currentColor\` (no hardcoded colors).
-13. **(R2) manifest.name & description:** Both MUST be \`{ "en": "...", "zh-CN": "..." }\` objects, NOT plain strings.
-14. **(R4) File delivery:** Save app to workspace files (\`apps/{appId}/claw.json\` + \`index.html\`) and include \`<!--CLAW_APP_READY:...-->\` notification in response.
-
----
-
-## 13. Design for Sharing (v1.9.3 \u2014 Mandatory)
-
-Every .claw app MUST be designed for sharing from the moment of creation. The receiving party's AI **SHALL NOT modify the HTML structure** \u2014 it SHALL only populate configuration values.
-
-### Core Principles
-
-1. **HTML is a finished artifact.** Once created, the HTML/CSS/JS is an immutable design artifact. It MUST NOT be redone by another AI after sharing.
-2. **Environment-dependent values = config_fields.** API endpoints, usernames, preferences, etc. MUST be written as \`{{KEY}}\` placeholders.
-3. **Sensitive values go through the Bridge.** API keys, tokens, and passwords MUST be declared via \`config_fields\` (\`sensitive: true\`) and MUST NOT be injected into HTML via \`{{KEY}}\`. At runtime, retrieve them through \`echoclaw.invoke('getSecret', { key })\`.
-4. **install_contract protects integrity.** Declare \`mode: 'ready'\` + \`immutable_segments\` so the system can verify the HTML has not been tampered with after installation.
-
-### Scenarios config_fields MUST Cover
-
-| Scenario | config_field example | sensitive? |
-|----------|---------------------|-----------|
-| External API endpoint | \`api_url\` (type: url) | No |
-| API Key / Token | \`api_key\` (type: password) | Yes |
-| User display name | \`display_name\` (type: text) | No |
-| Timezone / language preference | \`timezone\` (type: select) | No |
-| Local service endpoint | \`ollama_url\` (type: url, auto_resolve: from_env) | No |
-| Gateway Agent ID | \`agent_id\` (type: text, auto_resolve: from_gateway) | No |
-
-### auto_resolve Strategy
-
-Minimize manual user input. Declare \`auto_resolve\` for any value that can be obtained automatically:
-
-\`\`\`json
-{
-  "key": "agent_id",
-  "auto_resolve": {
-    "strategy": "from_gateway",
-    "source": "agentId",
-    "fallback": "ask_user"
-  }
-}
-\`\`\`
-
-Strategies: \`from_gateway\` (Gateway connection info), \`from_openclaw_config\` (local configuration), \`from_env\` (environment variables), \`from_context\` (conversation context), \`detect_installed\` (detect installed Skills).
-
-### Installation Paths (Determined Automatically by the Engine)
-
-The engine provides a \`resolveInstallAction(pkg)\` function. Clients **MUST** call it before installation:
-
-| Return value | Meaning | AI involvement? |
-|--------------|---------|-----------------|
-| \`install_direct\` | HTML is complete, no configuration needed | No |
-| \`install_with_config\` | HTML is complete, config fields need filling | Only resolving config values |
-| \`complete_template\` | Template mode, ai_tasks need completion | Yes \u2014 work within designated slots |
-| \`generate_fresh\` | No HTML, generate from DNA | Yes \u2014 full generation |
-
-### Self-Check Checklist (Appended to the Checklist Above)
-
-- [ ] **All environment-dependent values** are declared as config_fields. No hard-coded URLs/IDs/usernames in HTML.
-- [ ] **Sensitive fields** are marked \`sensitive: true\` and are NOT injected into HTML via \`{{KEY}}\`.
-- [ ] **install_contract** is declared (mode: 'ready' or 'template').
-- [ ] **share_profile** is populated (value_prop + ai_handoff_notes).
-- [ ] **Out-of-the-box apps** have an empty config_fields array (no configuration needed = install_direct path).
-
----
-
-### Mandatory Pre-Generation Checklist (v1.9.3)
-
-Verify each item before every HTML output. Failure of ANY item = automatic rejection by the engine:
-
-- [ ] **Zero hard-coded color literals in app HTML/CSS/JS.** This includes hex (#xxx), rgb(), rgba(), hsl(), hsla(), and named colors. Only CSS variables \`var(--ec-xxx)\` are allowed. \`manifest.color\` MAY be hex.
-- [ ] **Agent theme color** uses \`var(--ec-agent)\` / \`var(--ec-agent-text)\`. Hard-coding any color is forbidden.
-- [ ] **All network requests** use \`echoclaw.invoke('fetch', ...)\`. Direct fetch/XHR/axios/WebSocket/EventSource to external URLs is forbidden.
-- [ ] **Tokens/passwords** use \`echoclaw.auth.setSecret()\`. Storing credentials via localStorage/sessionStorage/indexedDB/echoclaw.storage is forbidden.
-- [ ] **All visible text** uses the \`t()\` i18n function. This includes aria-label, title, placeholder, empty-state, and error-state copy.
-- [ ] **No left-side navigation.** The shell owns the left sidebar. Apps MUST use only a top bar or right-side panel.
-- [ ] **All capabilities are declared and minimized.** Declare only capabilities that are actually used.
-- [ ] **No dangerous code** \u2014 no eval(), new Function(), unsanitized innerHTML, or remote script injection.
-
----
-
-## 14. App Delivery Format (v3.1.0)
-
-When creating or updating an app, save the files to your workspace and notify via chat.
-
-### Workspace File Layout
-
-Save your app as two separate files in \`apps/{appId}/\`:
-- \`claw.json\` \u2014 ClawAppPackage JSON (manifest + prompt + setup + meta, WITHOUT the html field)
-- \`index.html\` \u2014 complete self-contained HTML (the content that was previously in the \`html\` field)
-
-### Notification Marker
-
-After saving files, include this notification in your chat response:
-\`\`\`
-<!--CLAW_APP_READY:{"appId":"my-app","op":"create"}-->
-\`\`\`
-RelayAgent pulls the files from your workspace and delivers to Desktop.
-
-### Schema
-
-\`claw.json\` must contain a valid JSON object (ClawAppPackage minus html):
-
-\`\`\`json
-{
-  "manifest": {
-    "id": "kebab-case-id",
-    "name": { "en": "Display Name", "zh-CN": "\u663E\u793A\u540D\u79F0" },
-    "version": "1.0.0",
-    "color": "#3b82f6",
-    "icon_svg": "<path d=\\"M12 2...\\"/>",
-    "description": { "en": "One-line description", "zh-CN": "\u4E00\u884C\u63CF\u8FF0" },
-    "capabilities": ["ui", "storage"]
-  },
-  "prompt": {
-    "seed": {
-      "goal": "Verb-first purpose sentence",
-      "constraints": ["self-contained", "dark-theme-first"],
-      "acceptance_tests": ["User can ...", "..."]
-    },
-    "current": { "goal": "Same as seed for v1" }
-  },
-  "setup": {
-    "app_mode": "ready",
-    "services": [],
-    "config_fields": [],
-    "share_profile": {
-      "value_prop": { "en": "...", "zh-CN": "..." },
-      "ai_handoff_notes": "..."
-    },
-    "install_contract": {
-      "mode": "ready",
-      "immutable_segments": []
-    }
-  },
-  "meta": {
-    "claw_spec_version": "2.0.0",
-    "built_at": "2026-03-20T10:00:00Z"
-  }
-}
-\`\`\`
-
-\`index.html\` is a complete self-contained HTML document (the content that was previously JSON-escaped in the \`html\` field).
-
-### Required Fields
-
-| Field | Required | Notes |
-|-------|----------|-------|
-| \`manifest.id\` | Yes | kebab-case, unique identifier |
-| \`manifest.name\` | Yes | \`{ "en": "...", "zh-CN": "..." }\` |
-| \`manifest.version\` | Yes | semver, default \`"1.0.0"\` for new apps |
-| \`manifest.color\` | Yes | hex color like \`"#3b82f6"\` |
-| \`manifest.icon_svg\` | Yes | inline SVG path string |
-| \`manifest.description\` | Yes | \`{ "en": "...", "zh-CN": "..." }\` |
-| \`manifest.capabilities\` | Yes | array of needed capabilities |
-| \`html\` | Yes (create/update) | Full self-contained HTML, \u2264500KB |
-| \`prompt.seed.goal\` | Yes | Verb-first purpose sentence |
-| \`setup\` | Recommended | Required for shareable apps |
-| \`meta\` | Recommended | Include claw_spec_version and built_at |
-
-### Output Rules
-
-- Output complete files \u2014 not patches or diffs
-- No placeholder values (\`TODO\`, \`FIXME\`, \`...\`)
-- \`html\` must be a complete self-contained HTML document string
-- All CSS and JS must be inline (no external links)
-- You may include explanation text outside the marker \u2014 Connection only extracts the marker content
-
-### Validation Chain
-
-The engine validates your output in this order:
-1. **validateClawHtml** \u2014 checks 16 hard rules (hardcoded colors, external resources, layout, etc.)
-2. **validateInstallResult** \u2014 verifies immutable segment integrity (adapt tasks only)
-3. **validateSlotMarkers** \u2014 checks slot marker integrity (template tasks only)
-4. **diagnoseAppCompliance** \u2014 computes overall compliance scoring
-5. **autoFixClawHtml** \u2014 identifies auto-fixable items as suggestions (not auto-applied)
-
-### Pass Condition
-
-All critical errors must be zero for the output to pass. Warnings are reported but do not block delivery.
-`;
-var OPENCLAW_DEV_GUIDE = `# EchoClaw Application Development Guide
-
-> This file is automatically written by the EchoClaw Relay Agent, based on claw-engine v3.1.0.
-> Last updated: {{TIMESTAMP}}
-
-## 1. What Is EchoClaw
-
-EchoClaw is an open-source, AI-native application platform. You can create .claw applications for users \u2014 self-contained HTML pages that run inside a secure sandbox.
-
-**Benefits for you (the AI):**
-- You are no longer limited to plain-text responses; you can create fully visual, interactive applications
-- Applications have a complete lifecycle: create, install, update, share, rollback
-- The DevLog system enables any AI to understand the full context and history of an application
-
-**Benefits for the user:**
-- AI-generated tools become persistent, installable desktop applications
-- Multiple AIs can collaboratively maintain the same application
-- All applications have quality assurance (structural validation + secure sandbox)
-
----
-
-## 2. Recommended Scenarios (20 Categories)
-
-When a user's request matches any of the following scenarios, you MUST proactively suggest creating a .claw application:
-
-**Data & Visualization**
-01. Dashboards & KPI reports (sales, product metrics, team statistics)
-02. Real-time monitoring panels (API health, cloud costs, smart home status)
-03. Data exploration & visualization (CSV/database analysis, interactive charts)
-
-**Management & Productivity**
-04. Project/task management boards (Kanban, to-do lists, OKR tracking)
-05. Roadmaps & timelines (product planning, Gantt charts, study plans)
-06. Calendars & scheduling (weekly calendars, travel itineraries, shift rosters, class schedules)
-07. Pipeline tracking (CRM, recruiting, job search, fundraising progress)
-08. Ticket & queue management (customer support, bug tracking, incident triage)
-
-**Web Pages & Presentations**
-09. Marketing landing pages & event pages (product launches, conferences, promotions)
-10. Personal homepages & portfolios (online resumes, design galleries, single-page blogs)
-11. Presentations & reports (client proposals, weekly reports, investor updates)
-
-**Tools & Calculators**
-12. Productivity tools (calculators, converters, countdowns, password generators)
-13. Finance & budget tracking (personal budgets, subscription management, savings goals)
-14. Decision comparison tools (product selection, school selection, housing, vendor comparison)
-15. Business simulators (mortgage calculators, pricing models, nutrition calculators, shift optimization)
-
-**Forms & Data Collection**
-16. Forms & approval workflows (client onboarding, audit checklists, daily reports)
-17. Inventory & collection management (equipment, books, ingredients, lab supplies)
-
-**Learning & Entertainment**
-18. Learning & exam prep apps (course tracking, flashcards, spaced repetition)
-19. Interactive mini-games (lotteries, text adventures, quizzes, casual games)
-20. Media galleries & mood boards (inspiration boards, content calendars, recipes, maps)
-
-**Heuristic Rules** \u2014 You SHOULD suggest a .claw application when the request exhibits any of the following characteristics:
-- Persistent state (not a one-off answer)
-- Repeated use (the user will return to use it)
-- Visual structure (charts, cards, maps, timelines, calendars)
-- Interactive operations (filtering, editing, toggling, forms, drill-down)
-- Ongoing updates (real-time data or periodic data entry)
-- Sharing & presentation (intended to be shown to others)
-- **Fallback rule: any request that is "visible and operable" SHALL default to a ClawApp recommendation**
-
----
-
-## 3. Technical Specification Summary
-
-### Package Structure
-| Field | Description |
-|-------|-------------|
-| manifest | Identity: id, name, version, icon_svg, capabilities, auth_profile |
-| html | PC rendering: complete HTML/CSS/JS (sandboxed iframe, MUST NOT exceed 500KB) |
-| code | RTOS rendering: Protocol JSON UI tree (32 primitives) |
-| dna | AI memory: seed + current + history |
-| setup | Installation configuration: app_mode, config_fields, ai_tasks, share_profile, install_contract |
-| meta | Metadata: spec_version, generated_at, package_hash |
-
-### Capability System (21 Capabilities)
-- **Auto-granted (10):** ui, timer, storage, notification, network, audio, fullscreen, app_comm, database, secure_credential
-- **Requires user confirmation (10):** clipboard, microphone, camera, location, media_capture, filesystem, local_network, lan_network, background_task, auth
-- **Bridge-exclusive (1):** device_control
-
-### Local Network Access Capabilities (Added in v1.9.1)
-- \`local_network\`: localhost only (127.0.0.1, ::1) \u2014 local services (Ollama, dev servers)
-- \`lan_network\`: private LAN (10.x, 172.16-31.x, 192.168.x, .local) \u2014 NAS, home automation, LAN services
-- Both MUST declare specific target addresses in \`manifest.network_allow\`
-- Link-local addresses (169.254.x) and cloud metadata endpoints are ALWAYS blocked
-
-### Authentication Capability (Added in v1.9.0)
-- \`auth\` is a prompt-level capability; it MUST be confirmed by the user before the \`echoclaw.auth.*\` API can be used
-- **Three-tier storage model:**
-  - Tier 1 (Plaintext session): \`echoclaw.auth.setSession()\` \u2014 non-sensitive fields such as userId, displayName
-  - Tier 2 (Keychain read-only): \`echoclaw.invoke('getSecret')\` \u2014 API keys entered at install time
-  - Tier 3 (Keychain read-write): \`echoclaw.auth.setSecret()\` \u2014 runtime credentials such as OAuth tokens
-- **manifest.auth_profile:** declares the authentication model (strategy, token_tier, providers, session_fields, unauthenticated_behavior)
-- **Token naming convention:** \`{providerId}.{tokenType}\`, e.g., \`google.access_token\`
-- **config_fields vs auth_profile:** config_fields = what values to collect at install time (UI layer); auth_profile = how the application manages authentication (security/lifecycle layer)
-
-### Resource Limits
-| Resource | Limit |
-|----------|-------|
-| HTML size | 500KB hard limit / 400KB warning threshold |
-| Bridge calls | 60/sec + 120 burst/1sec |
-| SQLite | 10MB \u2192 50MB \u2192 200MB (tiered) |
-| KV storage | 5MB / 1000 keys |
-| WebSocket | 1MB/message, 3 connections default |
+## i18n Note
 
-### Design Rules (14 Hard Rules + 2 Soft Rules)
-1. Design for a 1024\xD7768 iframe; minimum compatible size is 544\xD7548
-2. Use ONLY CSS variables \`var(--ec-xxx)\` for theming
-3. Self-contained HTML (inline CSS+JS, no CDN references)
-4. Dark theme first (all colors MUST be controlled via CSS variables)
-5. MUST NOT use a left sidebar (reserved by the shell)
-6. manifest MUST declare all capabilities
-7. All interactive elements MUST have hover + focus states
-8. Communicate with the host via the \`window.echoclaw\` Bridge
-9. SVG icons (inline only; MUST NOT use emoji or icon fonts)
-10. State MUST be visible at a glance
-11. Bilingual (en + zh-CN); use the \`t()\` function for all user-facing strings
-12. Every application MUST generate an \`icon_svg\`
-13. MUST request permission before using any prompt-level capability
-14. Credential storage MUST be tiered \u2014 tokens/secrets/passwords MUST use \`echoclaw.auth.setSecret()\`; using \`echoclaw.storage\` for credentials is PROHIBITED
-15. Any application that uses \`echoclaw.auth.*\` MUST declare the \`auth\` capability and provide an \`auth_profile\`
-16. The bottom-right 64\xD764px area is reserved \u2014 the host Info button occupies this zone; you MUST NOT place any interactive elements there
-
-### Bridge API
-\`\`\`javascript
-// Core
-echoclaw.getContext()              // Theme, device, capabilities
-echoclaw.invoke(action, payload)   // Invoke host services
-echoclaw.subscribe(event, cb)      // Listen for events
-echoclaw.storage.get/set/remove    // KV storage
-echoclaw.emit(action, payload)     // Emit actions
-echoclaw.log(level, ...args)       // Logging
-
-// Database
-echoclaw.db.exec(sql, params)      // SQLite execute
-echoclaw.db.query(sql, params)     // SQLite query
-
-// File System
-echoclaw.fs.appRead/appWrite/appList/appRemove  // Sandboxed files
-echoclaw.fs.pick(options)          // External file picker (requires filesystem capability)
-echoclaw.fs.save(options)          // External file save
-
-// WebSocket
-echoclaw.ws.connect/send/close     // WebSocket proxy
-
-// Authentication (requires auth capability)
-echoclaw.auth.setSecret(key, value)    // Keychain write
-echoclaw.auth.getSecret(key)           // Keychain read
-echoclaw.auth.deleteSecret(key)        // Keychain delete
-echoclaw.auth.setSession(fields)       // Plaintext session write
-echoclaw.auth.getSession()             // Plaintext session read
-echoclaw.auth.clearSession()           // Clear session
-echoclaw.auth.isAuthenticated({...})   // Check authentication status
-echoclaw.auth.getValidToken(key)       // Get valid token (auto-refresh)
-echoclaw.auth.logout()                 // Logout (preserves install-time Tier 2 secrets)
-
-// Authentication Events
-echoclaw.subscribe('auth:sessionExpired', ({ reason, key, providerId }) => {...})
-echoclaw.subscribe('auth:tokenRefreshed', ({ key, providerId, expiresAt }) => {...})
-\`\`\`
-
-### DevLog Discipline
-- On creation: initialize \`original_intent\` (AI-abstracted summary; MUST NOT store the user's raw words)
-- After every iteration: update immediately (MUST NOT batch updates)
-- All text MUST be AI-abstracted and sanitized; MUST NOT contain PII, secrets, or raw conversation content
-
----
-
-## 4. Design for Sharing (v1.9.3)
-
-**Every application MUST be prepared for sharing at creation time.** The app you build will be installed by other users in the future; their AI MUST NOT need to rewrite your HTML.
-
-Key rules:
-1. **Environment-specific values \u2192 config_fields + \`{{KEY}}\` placeholders.** API addresses, usernames, and preferences MUST go through configuration.
-2. **Sensitive values \u2192 \`sensitive: true\`.** API keys/tokens MUST NOT be injected into HTML; they MUST be retrieved at runtime via the Bridge.
-3. **Declare an install_contract.** This protects HTML integrity and prevents the receiving AI from tampering with the markup.
-4. **Populate share_profile.** This tells the receiving AI what the application does and what caveats to be aware of.
-5. **Applications that do not depend on external services \u2192 config_fields MUST be an empty array.** These applications are "ready to use out of the box" and require no AI involvement at install time.
-
-See \`CLAWAPP_SPEC.md\` Chapter 13 for full details.
-
----
-
-## 5. Quality Standards
-
-When generating a .claw application, you MUST target Grade B+ (>=70 points):
-- All colors MUST use CSS variables
-- MUST be bilingual (en + zh-CN)
-- MUST include hover/focus interaction states on all interactive elements
-- MUST NOT leave any TODO/FIXME/placeholder in the output
-- Design target is 1024\xD7768; minimum safe area is 544\xD7548
-- Credentials MUST use tiered storage (Rule 14)
-- Applications with authentication requirements MUST include an auth_profile (Rule 15)
-
----
-
-## 6. Known Platform Limitations (Updated with CLAW_DOC_VERSION)
-
-The following are **temporary Bridge feature gaps** \u2014 the desktop platform (Electron) natively supports these capabilities, but the Bridge API layer has not yet implemented them. All items are scheduled for implementation. When encountered, inform the user and provide the listed workaround. Do NOT submit feedback for these items.
-
-| Limitation | Current Status | Workaround |
-|------------|----------------|------------|
-| WebSocket proxy | Stub \u2014 \`ws.connect()\` throws error | Use fetch polling via \`echoclaw.invoke('fetch', ...)\` instead |
-| SQLite database | KV-emulated \u2014 no SQL query capability | Use \`echoclaw.storage\` KV store |
-| File system picker | Stub \u2014 \`fs.pick()\` / \`fs.save()\` unavailable | Use \`echoclaw.fs.appRead\` / \`appWrite\` sandbox files |
-| Secret encryption | Plaintext localStorage | Functional but security pending upgrade |
-| Light theme | Hard-coded dark mode | Design for dark theme only |
-| Permission prompts | All permissions auto-approved | Functional but missing user confirmation step |
-| Inter-app broadcast | Stub \u2014 \`broadcast()\` logs only | N/A \u2014 apps run independently |
-| Keyboard shortcuts | Stub \u2014 \`registerShortcut()\` logs only | Use button interactions instead |
-| 14 deprecated node types | stat / tabs / table / slider etc. unavailable | Use composition recipes to build equivalent UI |
-
----
+Language switching is handled globally by the EchoClaw host system. Your app MUST support bilingual text via \`t()\` function + dictionaries, but MUST NOT render a language toggle/selector UI. The host tells the iframe which language to use.
 
-## 7. When To Submit Feedback
-
-You SHOULD ask the user for consent and submit feedback ONLY in these scenarios:
-
-1. **New issue not in the known limitations list** \u2014 you encountered a platform limitation not listed above
-2. **Documentation vs reality mismatch** \u2014 the spec says a feature is supported, but the actual call errors or behaves unexpectedly
-3. **Overly strict validation** \u2014 an existing validation rule blocks a reasonable user requirement
-4. **Spec blind spot** \u2014 the user's request exposes a scenario the current spec does not cover
-5. **Client rendering anomaly** \u2014 after receiving render diagnostics, you confirmed the issue is on the client/platform side, not in your generated code
-
-**Critical:** If the client relays render diagnostics (JS errors, Bridge call failures, layout anomalies), you MUST first attempt to fix your own code. Only submit feedback if you confirm the issue is a platform problem (e.g., Bridge method itself errors, CSS variables not injected). Do NOT blame the platform for your own generation quality issues.
-
----
-
-## 8. User Communication Guidelines
-
-When hitting a platform limitation, follow this flow: **Empathize \u2192 Workaround \u2192 Then ask about feedback.**
-
-**Correct examples:**
-> "This feature is still being developed. Let me use [specific workaround] to implement it \u2014 the result will be very similar. If you think this capability is important, I can report it to the dev team to prioritize. Would you like that?"
-
-> "I noticed this isn't working as smoothly as it should \u2014 let me try a different approach."
-
-**After submission:**
-> "Reported to the dev team. They'll evaluate and schedule it."
-
-**Prohibited language:**
-- MUST NOT say "This is a platform limitation", "The platform can't do this", "EchoClaw doesn't support this"
-- MUST NOT ask about feedback without providing a workaround first
-- MUST NOT proactively mention feedback when the user has not encountered a problem
-- MUST NOT expose technical details: error codes, stack traces, diagnostic JSON, Bridge method names
-- MUST NOT tell the user "JS error detected", "Bridge call failed", "layout anomaly found"
-
-**When self-correcting after receiving render diagnostics:**
-- CORRECT: "I noticed something looks off \u2014 let me adjust that"
-- CORRECT: "This feature is still being refined, let me use a different approach"
-- WRONG: "I received a runtime diagnostic showing ReferenceError on line 42"
-
----
-
-## 9. Feedback Frequency Control
-
-- **Same issue** (identical \`issue_type\` + \`spec_reference\`): submit only once per conversation session
-- **User consent prompt**: ask "would you like me to report this?" at most ONCE per session; for subsequent limitations, just explain and provide the workaround without asking again
-- **Maximum 3 feedback submissions per session**
-
----
-
-## 10. CLAW_FEEDBACK Marker Format
-
-After receiving user consent, embed the following marker in your response. The client will parse it and auto-attach runtime data before submitting to the feedback server.
-
-\`\`\`
-<!--CLAW_FEEDBACK:{"schema_version":1,"issue_type":"capability_not_implemented|spec_gap|toolkit_gap|validation_too_strict|client_rendering_bug|api_inconsistency","severity":"blocker|degraded|cosmetic","spec_reference":"e.g. CLAWAPP_SPEC.md#bridge-api / echoclaw.ws.connect","user_request":"One-line summary of user's original request","attempted":"What implementation approach you tried","failure":"Specific failure reason","suggestion":"Your recommendation for how the platform should improve","code_snippet":"Key code you wanted to write but couldn't (max 5 lines)","workaround":"The workaround you provided to user","workaround_accepted":true,"confidence":0.9,"conversation_summary":"Summary of last 3-5 conversation turns (sanitized, no PII)"}-->
-\`\`\`
-
-**Field descriptions:**
-- \`issue_type\`: one of \`capability_not_implemented\`, \`spec_gap\`, \`toolkit_gap\`, \`validation_too_strict\`, \`client_rendering_bug\`, \`api_inconsistency\`
-- \`severity\`: \`blocker\` = user request completely impossible; \`degraded\` = achievable but noticeably compromised; \`cosmetic\` = minor impact
-- \`confidence\`: your confidence (0\u20131) that this is a platform issue, not your own generation problem
-- \`conversation_summary\`: MUST be sanitized \u2014 do NOT include user personal info, API keys, or any sensitive content
-
-**Marker rules:**
-- MUST be on its own line, not embedded within other text
-- JSON MUST be valid single-line JSON with no line breaks
-- Maximum one CLAW_FEEDBACK marker per message
-- The marker will be stripped from chat display by the client \u2014 the user will not see it
-
----
-
-## 11. Handling Render Diagnostics
-
-The client may relay render diagnostics for the current app via an internal channel (NOT chat messages), in this format:
-
-\`\`\`json
-{
-  "type": "runtime_diagnostic",
-  "appId": "xxx",
-  "diagnostics": [
-    { "kind": "js_error", "message": "ReferenceError: xxx is not defined", "line": 42 },
-    { "kind": "bridge_error", "method": "db.query", "error": "not implemented" },
-    { "kind": "layout_warning", "message": "Root container has zero dimensions" }
-  ]
-}
-\`\`\`
-
-Upon receiving diagnostics:
-1. **First check if it is your own code issue** (typo, syntax error, calling a nonexistent method)
-2. If it is your issue \u2192 fix the code. Do NOT submit feedback.
-3. If confirmed as a platform issue (Bridge method itself errors, CSS variables not injected, etc.) \u2192 follow the feedback flow described in Sections 7\u201310
-
-**Critical requirement: NEVER expose technical details to the user in conversation.**
-- MUST NOT tell the user "JS error detected", "Bridge call failed", "layout anomaly"
-- MUST NOT show error codes, stack traces, or diagnostic JSON
-- CORRECT: use natural language such as "I noticed something looks off with the display \u2014 let me fix that"
-- CORRECT: for platform issues, say "This feature is still being refined, let me use a different approach"
-
----
-
-## 12. Iterating Existing Apps
-
-When a user asks to modify an installed app (e.g., "change the color of my dashboard", "add a filter to my tracker"):
-
-1. **Identify the target app** from the \`ClientInventorySnapshot\` sent on connection. Match by app name, ID, or user description.
-2. **Read the app's DevLog** before making any changes. The DevLog contains: original intent, current state, feature list, design decisions, iteration history, and trade-offs. This is your full context \u2014 you MUST understand it before touching the code.
-3. **Use the Edit Protocol** to submit changes. Do NOT regenerate the entire HTML. Submit structured \`ClawEditPatch\` operations (insert, replace, delete) targeting specific code regions. The client applies patches and verifies integrity.
-4. **Update the DevLog immediately** after every successful change:
-   - Add an entry to \`iterations[]\` with: type, description, what changed, what was preserved
-   - Update \`current_state\` to reflect the new behavior
-   - Add to \`features[]\` or \`decisions[]\` if the change introduces new functionality or design choices
-5. **Increment the app version** (patch bump for small changes, minor bump for new features).
-6. **Do NOT reset or discard** the user's existing data, config, or customizations unless explicitly requested.
-
----
-
-## 13. Multi-AI Collaboration
-
-Multiple AI instances (different OpenClaw sessions, or different AI models) may work on the same app over time. The DevLog is the shared context that makes this possible.
-
-**When taking over an app you did not create:**
-1. **Read the full DevLog first.** Pay special attention to \`original_intent\`, \`current_state\`, \`decisions[]\`, and \`trade_offs[]\`. These tell you WHY the app is built the way it is.
-2. **Respect existing design decisions.** Do NOT refactor or "improve" code unless the user explicitly asks. The previous AI made deliberate choices \u2014 the DevLog explains them.
-3. **Update the DevLog after every change.** Your iteration entry MUST include what you changed and why. The next AI (or your future self) depends on this record.
-
-**Concurrency protection:**
-- The client enforces \`AppWriteLock\`. If another agent is currently modifying the app, your edit will be rejected. Wait and retry.
-- On reconnection, the client sends \`AgentHandoverContext\` with: which apps you installed, which you last modified, and when you disconnected. Use this to resume context.
-
-**DevLog discipline reminder:**
-- All text MUST be AI-abstracted and sanitized \u2014 no PII, no secrets, no raw user conversation
-- Initialize \`original_intent\` on creation (summarize, do not quote the user)
-- Update after EVERY iteration \u2014 do NOT batch updates
-
----
-
-## 14. File-Driven App Delivery & Communication Protocol (v3.1.0)
-
-You work directly with files in your workspace. The EchoClaw client and RelayAgent sync files between your workspace and the user's Desktop. **The client and RelayAgent have no AI capability** \u2014 all feedback from them is rule-based and standardized.
-
-### Workspace Structure
-
-Your app files live at \`apps/{appId}/\`:
-- \`claw.json\` \u2014 manifest + prompt + setup + meta (NO html field)
-- \`index.html\` \u2014 complete self-contained HTML
-- \`session.json\` \u2014 conversation record (requirement evolution, decisions \u2014 YOU maintain this)
-- \`devlog.json\` \u2014 optional development log
-- \`.status\` \u2014 "draft" (creating) or "published" (installed)
-
-### Communication Protocol \u2014 Three Markers
-
-| Marker | Direction | Purpose |
-|--------|-----------|---------|
-| \`CLAW_TASK_ACK\` | You \u2192 Client | Confirm you received a task. Client updates UI: "AI working..." |
-| \`CLAW_APP_READY\` | You \u2192 Client | Signal files are ready. Client tells RelayAgent to pull. |
-| \`CLAW_FEEDBACK\` | Client \u2192 You | Rule-based error report. Something went wrong, fix it. |
-
-#### CLAW_TASK_ACK \u2014 Confirm Receipt
-When you receive a task, include this marker in your response:
-\`\`\`
-<!--CLAW_TASK_ACK:{"appId":"my-app","op":"create","status":"received"}-->
-\`\`\`
-The client needs this to show "AI is working" in the UI. Do NOT skip this.
-**Note:** For simple tasks, you may include both CLAW_TASK_ACK and CLAW_APP_READY in the same response. For longer tasks (Studio, multi-step), ACK first, then READY when files are saved.
-
-#### CLAW_APP_READY \u2014 Signal Completion
-After saving files, include in your response:
-\`\`\`
-<!--CLAW_APP_READY:{"appId":"my-app","op":"create","contentHash":"optional"}-->
-\`\`\`
-- \`op\`: "create", "adapt", "update", "comply", or "publish"
-- \`contentHash\`: optional hash of index.html for integrity verification
-
-#### CLAW_FEEDBACK \u2014 Client Error Reports
-If something goes wrong, the client sends a \`<!--CLAW_FEEDBACK:...-->\` marker. Error codes:
-
-| Code | Meaning | What to do |
-|------|---------|------------|
-| \`file_not_found\` | You notified but files don't exist at the path | Check path, re-save files, re-notify |
-| \`json_parse_error\` | claw.json has invalid JSON syntax | Fix JSON, re-save |
-| \`html_empty\` | index.html is empty (0 bytes) | Write complete HTML, re-save |
-| \`schema_invalid\` | claw.json missing required fields | Add missing manifest/prompt fields |
-| \`task_timeout\` | No ACK or READY within timeout | Send CLAW_TASK_ACK if still working |
-| \`task_ack_missing\` | You're working but didn't send ACK | Send CLAW_TASK_ACK immediately |
-| \`hash_mismatch\` | contentHash doesn't match actual file | Verify file, re-notify |
-| \`validation_failed\` | Engine validation failed | Fix issues per feedback (comply flow) |
-
-**Always respond to CLAW_FEEDBACK by fixing the issue and re-notifying.** The client cannot interpret your text \u2014 it only understands markers.
-
-### How It Works
-
-1. **Client sends task** \u2014 first message has full context + framework; follow-ups are lightweight.
-2. **You confirm** \u2014 reply with \`CLAW_TASK_ACK\` immediately.
-3. **You create/modify files** \u2014 work directly in \`apps/{appId}/\`.
-4. **You notify** \u2014 include \`CLAW_APP_READY\` in your chat response.
-5. **RelayAgent syncs** \u2014 pulls files and delivers to Desktop.
-6. **Desktop validates** \u2014 runs 16-rule validator.
-7. **If error** \u2014 client sends \`CLAW_FEEDBACK\`. Fix and re-notify.
-
-### Session Record \u2014 session.json
-
-You maintain \`apps/{appId}/session.json\` \u2014 a summarized record of conversation context:
-- User requirements and how they evolved
-- Key design decisions and why
-- NO raw user conversation, NO PII \u2014 always AI-summarized
-
-This provides continuity when:
-- Resuming after a long break
-- Switching between channels (user talks to you in multiple threads)
-- Building the DNA (prompt.seed) \u2014 session history is your reference
-
-### Message Format \u2014 Two Tiers
-
-**First message / resume after break** \u2014 full context:
-- Identity: "I'm the EchoClaw client..."
-- Task scope: what to do and what NOT to touch
-- Framework: code structure template (create) or file index (update/adapt)
-- Protocol: TASK_ACK + APP_READY markers
-- Doc reference: where to find specs
-
-**Follow-up messages** \u2014 lightweight wrapper:
-\`\`\`
-<App Update:weather-app>
-User's message here
-</App Update:weather-app>
-
-Workspace: apps/weather-app/ | Rules: R1-R8 reminder
-Done \u2192 <!--CLAW_APP_READY:{"appId":"weather-app","op":"update"}-->
-\`\`\`
-The routing tag tells you which app this message is about (you may be working on multiple apps across channels).
-
-### Operation Types
-
-| Operation | What you receive | Scope | What to do |
-|-----------|-----------------|-------|------------|
-| **create** | User request + code framework | Full build | Build all files, notify CLAW_APP_READY |
-| **adapt** | Files in workspace + install contract | Config only | Fill config values ONLY, do NOT modify UI/HTML structure |
-| **update** | Files in workspace + user request | User's changes only | Modify only what was requested, preserve everything else |
-| **comply** | CLAW_FEEDBACK with issues | Fix only | Fix ONLY listed issues, do NOT touch "correct" parts |
-| **publish** | Client signals "user confirmed publish" | Finalize | Set .status to "published", bump version if needed, notify CLAW_APP_READY |
-
-### Forbidden Actions (all operations)
-
-- Do NOT use placeholder values like \`TODO\`, \`FIXME\`, or \`...\`
-- Do NOT add external CDN links or remote resource URLs
-- Do NOT include \`allow-same-origin\` in any sandbox attribute
-- Do NOT skip CLAW_TASK_ACK \u2014 the client needs it for UI status
-- Do NOT skip CLAW_APP_READY \u2014 the client cannot receive your work without it
-
-### Create: Step-by-Step Guide
-
-1. Send CLAW_TASK_ACK
-2. Build the manifest \u2014 id, name, version, color, icon_svg, description, capabilities
-3. Build the HTML \u2014 \`<!DOCTYPE html>\`, dark theme, 1024\xD7768, CSS variables
-4. Add styles section by section \u2014 var(--ec-*) only, :hover + :focus on interactive
-5. Add JavaScript \u2014 state object, event listeners, i18n (t() + en/zh-CN)
-6. Handle edge cases \u2014 empty states, errors, loading
-7. Self-check against CLAWAPP_SPEC.md (no hardcoded colors, no external resources, size \u2264500KB)
-8. Initialize session.json with original intent
-9. Save claw.json + index.html + session.json, notify CLAW_APP_READY
-
-### Update: Step-by-Step Guide
-
-1. Send CLAW_TASK_ACK
-2. Read existing files at \`apps/{appId}/\` + session.json for context
-3. Identify what to change based on user request
-4. Modify only the requested parts \u2014 preserve functionality, config, i18n
-5. Bump version (patch for fixes, minor for features)
-6. Update session.json with this change
-7. Self-check, save, notify CLAW_APP_READY
-
-### Adapt: Step-by-Step Guide
-
-1. Send CLAW_TASK_ACK
-2. Read existing files at \`apps/{appId}/\` \u2014 understand the app
-3. Review install contract and config_fields
-4. Fill config values, localize where needed
-5. Do NOT modify HTML structure, UI, or UE \u2014 only config/setup
-6. Save, notify CLAW_APP_READY
-
-### Comply: Step-by-Step Guide
-
-1. Send CLAW_TASK_ACK
-2. Read CLAW_FEEDBACK \u2014 note error code and details
-3. Fix ALL listed issues in workspace files
-4. Do NOT modify anything not mentioned in feedback
-5. Save, notify CLAW_APP_READY with op="comply"
-
-### Publish: Step-by-Step Guide
-
-Triggered when the user confirms a draft is ready to install.
-1. Send CLAW_TASK_ACK
-2. Ensure all files are complete and self-checked
-3. Set \`.status\` to "published"
-4. Bump version if this is an update to an existing published app
-5. Finalize session.json with a publish entry
-6. Save, notify CLAW_APP_READY with op="publish"
-
----
-
-## 15. Studio Mode \u2014 Interactive App Creation/Editing (v3.1.0)
-
-Studio mode enables real-time interactive development. The user chats with you while previewing changes live via RelayAgent file sync.
-
-### How Studio Mode Differs from Normal Chat
-
-| Aspect | Normal Chat | Studio Mode |
-|--------|------------|-------------|
-| Interaction | One-shot: create/modify and notify | Conversational: multi-turn with user |
-| Preview | No preview \u2014 user sees app after install | Live: RelayAgent polls files, pushes to Desktop |
-| Delivery | Save files + CLAW_APP_READY | Save after each change; "Publish" for final |
-| Draft | Created apps start as drafts | Same \u2014 draft until user publishes |
-| Session | session.json updated per task | session.json updated continuously |
-
-### Key Rule: Save Complete HTML After Every Change
-
-**Every time you modify the HTML, save the complete updated file to \`apps/{appId}/index.html\`.**
-RelayAgent detects the file change and pushes the updated HTML to Desktop for live preview.
-
-### Message Format in Studio
-
-**First message**: Full context with code framework, rules, and Studio mode instructions.
-**Follow-up messages**: Lightweight routing tags:
-\`\`\`
-<Studio Create:my-app>
-User's request
-</Studio Create:my-app>
+## When to Suggest a ClawApp
 
-Workspace: apps/my-app/ | Save files after changes (RelayAgent polls for preview).
+Any user request that is "visible, interactive, and shareable" \u2014 dashboards, tools, forms, games, landing pages, portfolios \u2014 SHOULD be a .claw app. See ECHOCLAW_DEV_GUIDE.md \xA72 for the full 20-category list.
 \`\`\`
-
-### Resuming a Saved Draft
-
-When a user returns to continue a saved draft, the client sends full context again with:
-- Draft state (taskId, version, last edited time)
-- Reference to session.json for previous context
-- "Check session.json for previous conversation and requirements"
-
-You should read session.json first, then wait for the user's next instruction.
-
-### Delivery \u2014 File-Based (v3.1.0)
-
-#### Normal Chat
-- Save files to \`apps/{appId}/\` and include \`<!--CLAW_APP_READY:...-->\` in your response
-- RelayAgent pulls the files and delivers to Desktop
-
-#### Studio Mode
-- Save updated files after each change (RelayAgent pushes to Desktop for preview)
-- When user clicks "Publish", Desktop runs full validation and installs
-
-**\u26A0\uFE0F CRITICAL: Always save your app files to the workspace. Always include CLAW_APP_READY when the app is ready.**
-**If you respond with app content only in chat without saving to workspace files, the client cannot receive it.**
-
-Both paths use the same CLAWAPP_SPEC rules and quality standards (CSS variables, bilingual i18n, icon_svg format, self-check, etc.).
 `;
 
 // ../claw-engine/src/studio/prompt.ts
@@ -5172,7 +4024,7 @@ var CLAWAPP_FRAMEWORK = `### claw.json
   <!-- App UI structure -->
 </body>
 <script>
-  // i18n: const dict = { en: {...}, 'zh-CN': {...} }; function t(key) {...}
+  // i18n: const dict = { en: {...}, 'zh-CN': {...} }; function t(key) {...}  // NO language toggle UI \u2014 host switches globally
   // State: app state object + init
   // Events: addEventListener for all interactive elements
   // Bridge: window.echoclaw calls (if capabilities declared)
@@ -5194,17 +4046,15 @@ function completionProtocol(appId, op) {
     `- Session: Update \`apps/${appId}/session.json\` with this task's context`
   ].join("\n");
 }
-function specSystemContent() {
+function specReference() {
   return [
-    "# ClawApp Specification (CLAWAPP_SPEC.md)",
+    "# EchoClaw Development Reference",
     "",
-    OPENCLAW_SPEC,
+    "Before generating ANY app code, you MUST open and read these workspace files:",
+    "- `CLAWAPP_SPEC.md` \u2014 Visual & technical specification (CSS variables, hard rules, viewport, Bridge API)",
+    "- `ECHOCLAW_DEV_GUIDE.md` \u2014 Development guide (20 scenarios, package structure, capabilities, design rules)",
     "",
-    "---",
-    "",
-    "# Development Guide (ECHOCLAW_DEV_GUIDE.md)",
-    "",
-    OPENCLAW_DEV_GUIDE
+    "These files are in your workspace root. Do NOT guess \u2014 read them first."
   ].join("\n");
 }
 function rulesBlock2() {
@@ -5216,7 +4066,7 @@ function rulesReminder() {
 function getCreateSessionStart(userRequest, appId) {
   const id = appId ?? "{appId}";
   return {
-    systemContent: specSystemContent(),
+    systemContent: specReference(),
     userContent: [
       `[EchoClaw Client \u2192 Create Task]`,
       "",
@@ -5249,7 +4099,7 @@ function getAdaptTask(appId, appName, installContract) {
     "```"
   ].join("\n") : "";
   return {
-    systemContent: specSystemContent(),
+    systemContent: specReference(),
     userContent: [
       `[EchoClaw Client \u2192 Adapt Task]`,
       "",
@@ -5301,7 +4151,7 @@ function getComplyTask(appId, anchors, criticalIssues) {
 function getStudioCreateTask(draft, userRequest) {
   const studioPrompt = buildStudioSystemPrompt(draft);
   return {
-    systemContent: specSystemContent(),
+    systemContent: specReference(),
     userContent: [
       studioPrompt,
       "",
@@ -5332,7 +4182,7 @@ function getStudioCreateTask(draft, userRequest) {
 }
 function getStudioResumeTask(draft) {
   return {
-    systemContent: specSystemContent(),
+    systemContent: specReference(),
     userContent: [
       `[EchoClaw Client \u2192 Studio Resume]`,
       "",
@@ -5365,7 +4215,7 @@ function getFollowUp(appId, op, userInput) {
       userInput,
       `</${opLabel}:${appId}>`,
       "",
-      `Workspace: \`apps/${appId}/\` | Rules: ${rulesReminder()}`,
+      `Workspace: \`apps/${appId}/\` | Rules: ${rulesReminder()} | Ref: CLAWAPP_SPEC.md + ECHOCLAW_DEV_GUIDE.md in workspace`,
       op !== "create" ? `Done \u2192 \`<!--CLAW_APP_READY:{"appId":"${appId}","op":"${op}"}-->\`` : "Save files after changes (RelayAgent polls for preview)."
     ].join("\n"),
     docReference: "CLAWAPP_SPEC.md",
@@ -7958,6 +6808,7 @@ var StudioHandler = class {
 
 // src/install/InstallHandler.ts
 import crypto5 from "node:crypto";
+import fs5 from "node:fs";
 
 // src/install/MarkerParser.ts
 var MARKER_OPEN = "<!--";
@@ -8164,7 +7015,8 @@ var InstallHandler = class {
       lastStatusAt: 0,
       streamMarkers: [],
       hasConfirmedPlan: !!(action === "install" && payload.confirmedPlan),
-      retryRound: 1
+      retryRound: 1,
+      appId: payload.appId
     };
     this._activeInstalls.set(requestId, install);
     let prompt;
@@ -8526,6 +7378,10 @@ var InstallHandler = class {
           aiText: cleanText
         });
       }
+    } else if (install.appId && (install.action === "adapt" || install.action === "install" || install.action === "generate_fresh")) {
+      this._sendStatus(requestId, "ai_processing", "Waiting for app files...").catch(() => {
+      });
+      this._startWorkspaceWatch(requestId, install);
     } else {
       this._completeInstall(requestId, {
         status: "failed",
@@ -8535,6 +7391,90 @@ var InstallHandler = class {
       });
     }
   }
+  /**
+   * v3.1: Watch workspace directory for file changes (subagent deferred delivery).
+   * When OpenClaw's subagent writes files to workspace, pick them up and complete install.
+   */
+  _startWorkspaceWatch(requestId, install) {
+    const appId = install.appId;
+    const wsRoot = this._workspaceReader.appDir(appId);
+    if (install.timeoutTimer) clearTimeout(install.timeoutTimer);
+    install.timeoutTimer = setTimeout(() => {
+      this._stopWorkspaceWatch(install);
+      this._completeInstall(requestId, {
+        status: "failed",
+        error: "Timeout waiting for app files from subagent",
+        code: INSTALL_ERROR_CODES.TIMEOUT
+      });
+    }, 18e4);
+    try {
+      fs5.mkdirSync(wsRoot, { recursive: true });
+      install.watcher = fs5.watch(wsRoot, (_eventType, filename) => {
+        if (filename !== "index.html" && filename !== "claw.json") return;
+        if (install.watcherDebounce) clearTimeout(install.watcherDebounce);
+        install.watcherDebounce = setTimeout(() => {
+          this._onWorkspaceFileChanged(requestId, install);
+        }, 1500);
+      });
+      install.watcher.unref?.();
+    } catch {
+      const pollInterval = setInterval(() => {
+        this._onWorkspaceFileChanged(requestId, install);
+      }, 3e3);
+      install.watcherDebounce = pollInterval;
+    }
+  }
+  /**
+   * v3.1: Called when workspace files change — try to assemble and deliver.
+   */
+  async _onWorkspaceFileChanged(requestId, install) {
+    if (!this._activeInstalls.has(requestId)) return;
+    const appId = install.appId;
+    try {
+      const result = await this._workspaceReader.assemblePackage(appId);
+      if ("error" in result) return;
+      this._stopWorkspaceWatch(install);
+      const { html: pkgHtml, ...packageMeta } = result;
+      const pipelineResult = runFilePipeline({
+        html: pkgHtml ?? "",
+        packageMeta,
+        context: {
+          operation: "adapt",
+          appId,
+          maxHtmlSize: 512e3
+        },
+        round: install.retryRound
+      });
+      if (pipelineResult.action === "deliver" || pipelineResult.action === "fallback") {
+        this._completeInstall(requestId, {
+          status: "success",
+          app: {
+            manifest: result.manifest,
+            html: result.html ?? ""
+          }
+        });
+      } else {
+        this._completeInstall(requestId, {
+          status: "success",
+          app: {
+            manifest: result.manifest,
+            html: result.html ?? ""
+          }
+        });
+      }
+    } catch {
+    }
+  }
+  _stopWorkspaceWatch(install) {
+    if (install.watcher) {
+      install.watcher.close();
+      install.watcher = null;
+    }
+    if (install.watcherDebounce) {
+      clearTimeout(install.watcherDebounce);
+      install.watcherDebounce = null;
+    }
+  }
   // ── Private: Install Lifecycle ─────────────────────────────────
   /**
    * Complete an install request with a result.
@@ -8597,6 +7537,7 @@ var InstallHandler = class {
     if (install.timeoutTimer) {
       clearTimeout(install.timeoutTimer);
     }
+    this._stopWorkspaceWatch(install);
     if (install.runId) {
       this._chatHandler.unregisterExternalRun(install.runId);
       this._runToRequest.delete(install.runId);