echoclaw-relay-agent 0.33.2 → 0.33.4

package/dist/{chunk-BCFYE35W.js → chunk-HDBJBULU.js}

@@ -3094,7 +3094,7 @@ var API_CAPABILITY_MAP = [
   { pattern: /navigator\.geolocation/g, capability: "location", label: "navigator.geolocation" },
   { pattern: /getDisplayMedia\s*\(/g, capability: "media_capture", label: "getDisplayMedia()" },
   { pattern: /requestFullscreen\s*\(/g, capability: "fullscreen", label: "requestFullscreen()" },
-  { pattern: /new\s+Audio\s*\(/g, capability: "audio", label: "new Audio()" },
+  { pattern: /new\s+Audio\b/g, capability: "audio", label: "new Audio()" },
   { pattern: /<audio[\s>]/gi, capability: "audio", label: "<audio>" },
   { pattern: /AudioContext/g, capability: "audio", label: "AudioContext" },
   // Bridge APIs → capability
@@ -3109,9 +3109,9 @@ var PROMPT_TIER_CAPABILITIES = new Set(
   Object.entries(CAPABILITY_TIERS).filter(([, tier]) => tier === "prompt").map(([cap]) => cap)
 );
 var SIDEBAR_PATTERNS = [
-  /(?:class|id)\s*=\s*["'][^"']*\b(?:left-panel|left-sidebar|left-nav|left-sidenav)\b[^"']*["']/gi,
-  /\.(?:left-panel|left-sidebar|left-nav|left-sidenav)\b/gi,
-  /#(?:left-panel|left-sidebar|left-nav|left-sidenav)\b/gi
+  /(?:class|id)\s*=\s*["'][^"']*\b(?:left-panel|left-sidebar|left-nav|left-sidenav|sidebar-left|panel-left|nav-left)\b[^"']*["']/gi,
+  /\.(?:left-panel|left-sidebar|left-nav|left-sidenav|sidebar-left|panel-left|nav-left)\b/gi,
+  /#(?:left-panel|left-sidebar|left-nav|left-sidenav|sidebar-left|panel-left|nav-left)\b/gi
 ];
 function validateClawHtml(html, manifest, options) {
   const phase = options?.phase ?? "hard";
@@ -3133,6 +3133,13 @@ function validateClawHtml(html, manifest, options) {
     if (/d\s*=\s*["'][^"']*$/.test(before)) continue;
     if (/href\s*=\s*["']$/.test(before)) continue;
     if (/id\s*=\s*["']$/.test(before)) continue;
+    if (!isInStyleAttribute(html, hexMatch.index) && !isInScriptBlock(html, hexMatch.index)) {
+      const afterHex = html.slice(hexMatch.index + fullHex.length, hexMatch.index + fullHex.length + 60);
+      if (/^\s*[\{,\s:>+~\[]/.test(afterHex) || /^\s*$/.test(afterHex)) {
+        const beforeCtx = html.slice(Math.max(0, hexMatch.index - 10), hexMatch.index);
+        if (!/[:;]\s*$/.test(beforeCtx)) continue;
+      }
+    }
     const beforeFull = html.slice(Math.max(0, hexMatch.index - 500), hexMatch.index);
     const lastCommentOpen = beforeFull.lastIndexOf("<!--");
     const lastCommentClose = beforeFull.lastIndexOf("-->");
@@ -3241,6 +3248,36 @@ function validateClawHtml(html, manifest, options) {
       line: lineAt(html, linkMatch.index)
     });
   }
+  const fetchUrlPattern = /\bfetch\s*\(\s*["'`]((?:https?:)?\/\/[^\s"'`]+)["'`]/gi;
+  let fetchMatch;
+  while ((fetchMatch = fetchUrlPattern.exec(stripped)) !== null) {
+    const url = fetchMatch[1];
+    if (/^(?:https?:)?\/\/(?:localhost|127\.0\.0\.1)\b/.test(url)) continue;
+    if (isDomainAllowed(url)) continue;
+    externalUrlCount++;
+    errors.push({
+      rule: 3,
+      severity: "critical",
+      message: `External fetch("${snippet(url, 80)}") found in script. Apps must be self-contained or declare network capability with network_allow.`,
+      match: snippet(fetchMatch[0]),
+      line: lineAt(html, fetchMatch.index)
+    });
+  }
+  const xhrOpenPattern = /\.open\s*\(\s*["'][A-Z]+["']\s*,\s*["']((?:https?:)?\/\/[^\s"']+)["']/gi;
+  let xhrMatch;
+  while ((xhrMatch = xhrOpenPattern.exec(stripped)) !== null) {
+    const url = xhrMatch[1];
+    if (/^(?:https?:)?\/\/(?:localhost|127\.0\.0\.1)\b/.test(url)) continue;
+    if (isDomainAllowed(url)) continue;
+    externalUrlCount++;
+    errors.push({
+      rule: 3,
+      severity: "critical",
+      message: `External XMLHttpRequest to "${snippet(url, 80)}" found. Apps must be self-contained or declare network capability with network_allow.`,
+      match: snippet(xhrMatch[0]),
+      line: lineAt(html, xhrMatch.index)
+    });
+  }
   const detectedCaps = /* @__PURE__ */ new Set();
   for (const { pattern, capability, label } of API_CAPABILITY_MAP) {
     pattern.lastIndex = 0;
@@ -3353,6 +3390,13 @@ function validateClawHtml(html, manifest, options) {
     });
   }
   if (declaredCaps.has("network") && manifest.network_allow) {
+    if (manifest.network_allow.length > RESOURCE_LIMITS.NETWORK_ALLOW_MAX_ENTRIES) {
+      errors.push({
+        rule: 5,
+        severity: "critical",
+        message: `network_allow has ${manifest.network_allow.length} entries, max ${RESOURCE_LIMITS.NETWORK_ALLOW_MAX_ENTRIES}.`
+      });
+    }
     for (const url of manifest.network_allow) {
       const isWildcard = /^\*\.[a-zA-Z0-9][\w\-.]+$/.test(url);
       if (!isWildcard && !/^(wss?|https?):\/\/.+/.test(url)) {
@@ -3385,7 +3429,10 @@ function validateClawHtml(html, manifest, options) {
     // Bare location.* patterns — negative lookbehind excludes window. prefix to avoid double-reporting
     { pattern: /(?<!window\.)location\.href\s*=/g, fix: "use in-app routing (history.pushState, show/hide views)", label: "location.href =" },
     { pattern: /(?<!window\.)location\.assign\s*\(/g, fix: "use in-app routing (history.pushState, show/hide views)", label: "location.assign()" },
-    { pattern: /(?<!window\.)location\.replace\s*\(/g, fix: "use in-app routing (history.pushState, show/hide views)", label: "location.replace()" }
+    { pattern: /(?<!window\.)location\.replace\s*\(/g, fix: "use in-app routing (history.pushState, show/hide views)", label: "location.replace()" },
+    // setTimeout/setInterval with string argument — equivalent to eval (blocked by CSP)
+    { pattern: /setTimeout\s*\(\s*["']/g, fix: "pass a function reference to setTimeout, not a string", label: 'setTimeout("string")' },
+    { pattern: /setInterval\s*\(\s*["']/g, fix: "pass a function reference to setInterval, not a string", label: 'setInterval("string")' }
   ];
   for (const { pattern, fix, label } of FORBIDDEN_DIRECT_APIS) {
     pattern.lastIndex = 0;
@@ -3473,6 +3520,110 @@ function validateClawHtml(html, manifest, options) {
       });
     }
   }
+  if (/async\s+function\s+render\s*\(/.test(html)) {
+    const m = html.match(/async\s+function\s+render\s*\(/);
+    const line = m ? html.substring(0, m.index).split("\n").length : void 0;
+    errors.push({
+      rule: 18,
+      severity: "critical",
+      line,
+      message: "render() must be synchronous. The EC Runtime does NOT await it \u2014 async render causes race conditions.",
+      suggestion: "Remove async keyword: `function render() { ... }`. Move async operations outside render.",
+      autoFixable: false
+    });
+  }
+  {
+    const renderMatch = html.match(/function\s+render\s*\([^)]*\)\s*\{/);
+    if (renderMatch && renderMatch.index !== void 0) {
+      let depth = 0;
+      let start = renderMatch.index + renderMatch[0].length - 1;
+      let end = start;
+      for (let i = start; i < html.length; i++) {
+        if (html[i] === "{") depth++;
+        else if (html[i] === "}") {
+          depth--;
+          if (depth === 0) {
+            end = i;
+            break;
+          }
+        }
+      }
+      const body = html.substring(start, end);
+      if (/setInterval\s*\(/.test(body)) {
+        errors.push({
+          rule: 19,
+          severity: "warning",
+          message: "setInterval() inside render() \u2014 intervals accumulate on every re-render. Move outside render or clear previous interval first.",
+          autoFixable: false
+        });
+      }
+      if (/addEventListener\s*\(/.test(body)) {
+        errors.push({
+          rule: 19,
+          severity: "warning",
+          message: "addEventListener() inside render() \u2014 listeners accumulate on every re-render. Move to init() or use named functions.",
+          autoFixable: false
+        });
+      }
+    }
+  }
+  {
+    const lsPattern = /localStorage\.(setItem|getItem|removeItem)\s*\(/g;
+    let lsMatch;
+    while ((lsMatch = lsPattern.exec(html)) !== null) {
+      if (isInScriptBlock(html, lsMatch.index)) {
+        const line = html.substring(0, lsMatch.index).split("\n").length;
+        errors.push({
+          rule: 20,
+          severity: "warning",
+          line,
+          match: lsMatch[0],
+          message: "Direct localStorage is not app-scoped and may collide. Use initState/mutateState or echoclaw.db instead.",
+          autoFixable: false
+        });
+        break;
+      }
+    }
+  }
+  if (/JSON\.parse\(\s*\w+\.body\s*\)/.test(html)) {
+    errors.push({
+      rule: 21,
+      severity: "warning",
+      message: "Bridge fetch response.body is already parsed (object for JSON). Do NOT JSON.parse(res.body) \u2014 use res.body directly.",
+      autoFixable: false
+    });
+  }
+  {
+    const stateOverride = /\b(var|let|const)\s+state\s*=/.exec(html);
+    if (stateOverride && isInScriptBlock(html, stateOverride.index)) {
+      const line = html.substring(0, stateOverride.index).split("\n").length;
+      errors.push({
+        rule: 22,
+        severity: "critical",
+        line,
+        match: stateOverride[0],
+        message: "`state` is a reserved EC Runtime global. Declaring it with var/let/const shadows or conflicts with window.state.",
+        suggestion: "Use a different variable name (e.g., appState, localState).",
+        autoFixable: false
+      });
+    }
+  }
+  {
+    const cssVarPattern = /var\(--(?!ec-)(?:bg-|txt-|agent|border-|radius-|space-)/g;
+    let cssMatch;
+    while ((cssMatch = cssVarPattern.exec(html)) !== null) {
+      if (isInStyleAttribute(html, cssMatch.index) || isInStyleBlock(html, cssMatch.index)) {
+        errors.push({
+          rule: 23,
+          severity: "warning",
+          match: cssMatch[0],
+          message: `CSS variable missing --ec- prefix: ${cssMatch[0]}). Use --ec-bg-page, --ec-txt-primary, --ec-agent, etc.`,
+          autoFixable: false
+        });
+        break;
+      }
+    }
+  }
   const autoFixableCount = errors.filter((e) => e.autoFixable === true).length;
   const filteredErrors = phase === "soft" ? errors.filter((e) => e.autoFixable === true) : errors;
   const hasCritical = filteredErrors.some((e) => e.severity === "critical");
@@ -4221,6 +4372,7 @@ I build and deliver; the client validates and monitors. If violations found, cli
 | \`<!--CLAW_FEEDBACK:{"appId":"APP-<id>","code":"sandbox_violations","message":"..."}-->\` | Fix ONLY the listed violations \u2192 re-write files \u2192 emit CLAW_APP_READY. |
 | \`<!--CLAW_FEEDBACK:{"appId":"APP-<id>","code":"sync_failed","message":"..."}-->\` | Package \`index.html\` + \`claw.json\` + \`session.json\` into a \`.claw\` JSON \u2192 output in \`<details><summary>Click to install</summary>\u2026</details>\`. |
 | \`<!--CLAW_FEEDBACK:{"appId":"APP-<id>","code":"runtime_diagnostic","message":"..."}-->\` | \`message\` has \`csp_violations\`, \`js_errors\`, \`fetch_log\`, \`state_ops\`. Fix root cause \u2192 re-deliver. If platform bug (not my code) \u2192 output \`CLAW_BUG_REPORT\`. |
+| \`<!--CLAW_FEEDBACK:{"appId":"APP-<id>","code":"runtime_validation","message":"..."}-->\` | **Compiler errors** with line numbers + source snippets. App already installed \u2014 fix blockers \u2192 re-deliver as update. |
 | Neither | Normal chat. Never output markers. |
 
 Normal chat + user describes an app idea \u2192 "Use the Create App button in EchoClaw to get started."
@@ -4248,7 +4400,7 @@ Client responds with \`CLAW_FEEDBACK code="runtime_diagnostic"\`. Wait \u2014 do
 **CLAW_BUG_REPORT** \u2014 Platform bug needing official fix (not app code issues):
 \`<!--CLAW_BUG_REPORT:{"appId":"APP-<id>","issue_type":"client_rendering_bug","severity":"blocker","failure":"what went wrong","suggestion":"proposed fix"}-->\`
 issue_type: client_rendering_bug, capability_not_implemented, api_inconsistency. severity: blocker, degraded, cosmetic.
-Only output CLAW_BUG_REPORT after exhausting my own fixes and confirming the issue is in the platform, not my code. When unsure, keep debugging \u2014 never blame the client prematurely. If confirmed, tell the user they can submit feedback to the EchoClaw team (client shows a confirmation bubble).
+Before requesting new capabilities, **verify existing APIs can't solve it** (bridge fetch, WebSocket, auth, SQLite, shared_libs, NPM deps). Only output CLAW_BUG_REPORT after exhausting existing capabilities AND confirming the issue is in the platform, not my code. When unsure, keep debugging \u2014 never blame the client prematurely.
 
 Markers are progress signals, NOT stopping points. After CLAW_STEP, continue immediately. Entire build + deliver in ONE response. I decide design \u2014 no options offered, but confirm plan before building (create only).
 
@@ -5635,7 +5787,9 @@ var WorkspaceFileReader = class {
       await this._atomicWrite(path4.join(dir, WORKSPACE_FILES.STATUS), "writing");
       const files = splitPackageToFiles(pkg, status);
       await this._atomicWrite(path4.join(dir, WORKSPACE_FILES.PACKAGE), files.packageJson);
-      await this._atomicWrite(path4.join(dir, WORKSPACE_FILES.HTML), files.html);
+      if (files.html) {
+        await this._atomicWrite(path4.join(dir, WORKSPACE_FILES.HTML), files.html);
+      }
       if (files.devlogJson) {
         await this._atomicWrite(path4.join(dir, WORKSPACE_FILES.DEVLOG), files.devlogJson);
       }
@@ -9419,9 +9573,8 @@ var SyncCommandHandler = class {
       if (!appId || typeof appId !== "string") continue;
       desktopAppIds.add(appId);
       try {
-        await this._reader.writeAppFiles(appId, pkg, "published");
-      } catch (err) {
-        console.warn(`[sync] full_sync skip appId=${appId}: ${err.message}`);
+        await this._reader.writeAppStatus(appId, "published");
+      } catch {
       }
     }
     const workspaceAppIds = await this._reader.listApps();
@@ -9501,8 +9654,6 @@ var AgentCore = class {
   _workspaceReader;
   _syncCommandHandler = null;
   _agentVersion;
-  /** Called when desktop reports a different version than this agent. */
-  onVersionMismatch = null;
   /** Currently attached transport (Phase 1: single transport). */
   _transport = null;
   /** Workspace directory watcher for detecting new apps from OpenClaw. */
@@ -9835,10 +9986,6 @@ var AgentCore = class {
     if (payloadType === "client_hello") {
       const clientVer = payload.version || "unknown";
       console.log(`  [client_hello] desktop version=${clientVer}`);
-      if (clientVer !== this._agentVersion && clientVer !== "unknown") {
-        console.log(`  [version] agent=${this._agentVersion} desktop=${clientVer} \u2014 versions differ`);
-        this.onVersionMismatch?.(this._agentVersion, clientVer);
-      }
       return;
     }
     if (payloadType === "vm_start") {

package/dist/cli.js

@@ -2,7 +2,7 @@
 import {
   AgentCore,
   RelayAgent
-} from "./chunk-BCFYE35W.js";
+} from "./chunk-HDBJBULU.js";
 import "./chunk-STI2237I.js";
 
 // src/service/platform.ts
@@ -1106,11 +1106,6 @@ async function runDaemon(relay, code, gateway, bridgePort, vmOpts) {
   if (vmConfig) {
     console.log(`  [vm] enabled (backend=${vmConfig.backend ?? "docker"} image=${vmConfig.image ?? "default"})`);
   }
-  agentCore.onVersionMismatch = (_agentVer, clientVer) => {
-    console.log(`  [ota] desktop requests version ${clientVer} \u2014 triggering update`);
-    updater.updateToVersion(clientVer).catch(() => {
-    });
-  };
   updater.on("update_available", (info) => {
     console.log(`  ${GREEN}[ota]${RESET} update available: ${info.current} \u2192 ${info.latest}`);
   });

package/dist/core/AgentCore.d.ts

@@ -21,8 +21,6 @@ export declare class AgentCore {
     private readonly _workspaceReader;
     private _syncCommandHandler;
     private readonly _agentVersion;
-    /** Called when desktop reports a different version than this agent. */
-    onVersionMismatch: ((agentVersion: string, clientVersion: string) => void) | null;
     /** Currently attached transport (Phase 1: single transport). */
     private _transport;
     /** Workspace directory watcher for detecting new apps from OpenClaw. */

package/dist/index.js

@@ -20,7 +20,7 @@ import {
   VmManager,
   buildAppRequestPrompt,
   restartOpenClaw
-} from "./chunk-BCFYE35W.js";
+} from "./chunk-HDBJBULU.js";
 import {
   SessionStore
 } from "./chunk-STI2237I.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "echoclaw-relay-agent",
-  "version": "0.33.2",
+  "version": "0.33.4",
   "description": "EchoClaw Relay Connection — E2E encrypted relay transport, pairing, and session management",
   "type": "module",
   "main": "./dist/index.js",