npm - forge-openclaw-plugin - Versions diffs - 0.2.47 → 0.2.49 - Mend

forge-openclaw-plugin 0.2.47 → 0.2.49

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (32) hide show

package/README.md +6 -5
package/dist/assets/index-2_tuemtU.css +1 -0
package/dist/assets/index-BAmEvOXb.js +91 -0
package/dist/assets/index-BAmEvOXb.js.map +1 -0
package/dist/index.html +2 -2
package/dist/openclaw/api-client.js +15 -1
package/dist/openclaw/session-registry.js +17 -0
package/dist/openclaw/tools.js +1 -1
package/dist/server/server/migrations/052_agent_identity_tightening.sql +307 -0
package/dist/server/server/migrations/053_agent_runtime_session_canonical_labels.sql +9 -0
package/dist/server/server/src/app.js +42 -12
package/dist/server/server/src/health-workout-adapters.js +465 -0
package/dist/server/server/src/health.js +134 -9
package/dist/server/server/src/openapi.js +33 -0
package/dist/server/server/src/repositories/agent-runtime-sessions.js +122 -16
package/dist/server/server/src/repositories/habits.js +62 -25
package/dist/server/server/src/repositories/model-settings.js +5 -0
package/dist/server/server/src/repositories/settings.js +101 -13
package/dist/server/server/src/repositories/users.js +23 -0
package/dist/server/server/src/types.js +22 -6
package/dist/server/server/src/watch-mobile.js +33 -21
package/dist/server/src/lib/date-keys.js +21 -0
package/openclaw.plugin.json +1 -1
package/package.json +5 -2
package/server/migrations/052_agent_identity_tightening.sql +307 -0
package/server/migrations/053_agent_runtime_session_canonical_labels.sql +9 -0
package/skills/forge-openclaw/SKILL.md +3 -1
package/skills/forge-openclaw/entity_conversation_playbooks.md +45 -8
package/skills/forge-openclaw/psyche_entity_playbooks.md +14 -0
package/dist/assets/index-BejDHw1R.js +0 -91
package/dist/assets/index-BejDHw1R.js.map +0 -1
package/dist/assets/index-DtEvFzXp.css +0 -1

package/dist/index.html CHANGED Viewed

@@ -13,14 +13,14 @@
     />
     <link rel="icon" type="image/png" href="/forge/assets/favicon-BCHm9dUV.ico" />
     <link rel="alternate icon" href="/forge/assets/favicon-BCHm9dUV.ico" />
-    <script type="module" crossorigin src="/forge/assets/index-BejDHw1R.js"></script>
+    <script type="module" crossorigin src="/forge/assets/index-BAmEvOXb.js"></script>
     <link rel="modulepreload" crossorigin href="/forge/assets/vendor-D_NZFJze.js">
     <link rel="modulepreload" crossorigin href="/forge/assets/board-CAszQU7Y.js">
     <link rel="modulepreload" crossorigin href="/forge/assets/ui-B5MjRjKe.js">
     <link rel="modulepreload" crossorigin href="/forge/assets/motion-CU5aNClV.js">
     <link rel="modulepreload" crossorigin href="/forge/assets/table-CK0KcPYW.js">
     <link rel="stylesheet" crossorigin href="/forge/assets/vendor-DT3pnAKJ.css">
-    <link rel="stylesheet" crossorigin href="/forge/assets/index-DtEvFzXp.css">
+    <link rel="stylesheet" crossorigin href="/forge/assets/index-2_tuemtU.css">
   </head>
   <body class="bg-canvas text-ink antialiased">
     <div id="root"></div>

package/dist/openclaw/api-client.js CHANGED Viewed

@@ -46,6 +46,20 @@ export function canBootstrapOperatorSession(baseUrl) {
 function isRecord(value) {
     return typeof value === "object" && value !== null;
 }
+function extractUpstreamErrorCode(body) {
+    return isRecord(body) &&
+        isRecord(body.error) &&
+        typeof body.error.code === "string"
+        ? body.error.code
+        : null;
+}
+function buildGuidedUpstreamMessage(result, fallback) {
+    const upstreamCode = extractUpstreamErrorCode(result.body);
+    if (result.status === 401 && upstreamCode === "auth_required") {
+        return `${fallback} In OpenClaw, do not fall back to raw Forge routes. Call forge_get_agent_onboarding, then use the shared plugin tools. For official habit outcomes, use forge_update_entities on entityType "habit" with patch.checkIn instead of a direct check-in route call.`;
+    }
+    return fallback;
+}
 function buildErrorBody(code, message) {
     return {
         ok: false,
@@ -342,7 +356,7 @@ export function expectForgeSuccess(result) {
             typeof result.body.error.message === "string"
             ? result.body.error.message
             : `Forge API returned ${result.status}`;
-        throw new ForgePluginError(result.status, "forge_plugin_upstream_error", message);
+        throw new ForgePluginError(result.status, "forge_plugin_upstream_error", buildGuidedUpstreamMessage(result, message));
     }
     return result.body;
 }

package/dist/openclaw/session-registry.js CHANGED Viewed

@@ -1,8 +1,22 @@
+import { createHash } from "node:crypto";
 import { isAgentBootstrapEvent } from "openclaw/plugin-sdk/hook-runtime";
 import { callConfiguredForgeApi, expectForgeSuccess, resolveConfiguredForgeActorLabel } from "./api-client.js";
 const SESSION_IDS = new Map();
 const SESSION_PROVIDER = "openclaw";
 const DEFAULT_RUNTIME_AGENT_LABEL = "Forge OpenClaw";
+function shortHash(value) {
+    return createHash("sha1").update(value).digest("hex").slice(0, 12);
+}
+function buildStableMachineKey(config) {
+    const source = JSON.stringify({
+        baseUrl: config.baseUrl,
+        dataRoot: config.dataRoot || ""
+    });
+    return `machine_${shortHash(source)}`;
+}
+function buildStableAgentIdentityKey(config) {
+    return `runtime:${SESSION_PROVIDER}:${buildStableMachineKey(config)}:default`;
+}
 function isRecord(value) {
     return typeof value === "object" && value !== null;
 }
@@ -40,6 +54,9 @@ async function registerSession(config, sessionKey, metadata) {
             provider: SESSION_PROVIDER,
             agentLabel: process.env.FORGE_AGENT_LABEL?.trim() || DEFAULT_RUNTIME_AGENT_LABEL,
             agentType: SESSION_PROVIDER,
+            agentIdentityKey: buildStableAgentIdentityKey(config),
+            machineKey: buildStableMachineKey(config),
+            personaKey: "default",
             actorLabel,
             sessionKey,
             sessionLabel: sessionKey,

package/dist/openclaw/tools.js CHANGED Viewed

@@ -848,7 +848,7 @@ export function registerForgePluginTools(api, config) {
     registerWriteTool(api, config, {
         name: "forge_update_entities",
         label: "Update Forge Entities",
-        description: "Update one or more Forge entities through the ordered batch workflow. Pass `operations` as an array. Each operation must include `entityType`, `id`, and `patch`. This is the preferred update path for calendar_event, work_block_template, task_timebox, preferences basic CRUD entities, and questionnaire_instrument too.",
+        description: "Update one or more Forge entities through the ordered batch workflow. Pass `operations` as an array. Each operation must include `entityType`, `id`, and `patch`. This is the preferred update path for calendar_event, work_block_template, task_timebox, preferences basic CRUD entities, questionnaire_instrument, and official habit outcome logging through `habit.patch.checkIn`.",
         parameters: Type.Object({
             atomic: Type.Optional(Type.Boolean()),
             operations: Type.Array(Type.Object({

package/dist/server/server/migrations/052_agent_identity_tightening.sql ADDED Viewed

@@ -0,0 +1,307 @@
+ALTER TABLE agent_identities ADD COLUMN identity_key TEXT;
+ALTER TABLE agent_identities ADD COLUMN provider TEXT;
+ALTER TABLE agent_identities ADD COLUMN machine_key TEXT;
+ALTER TABLE agent_identities ADD COLUMN persona_key TEXT;
+CREATE TABLE IF NOT EXISTS agent_identity_users (
+  agent_id TEXT NOT NULL REFERENCES agent_identities(id) ON DELETE CASCADE,
+  user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  role TEXT NOT NULL DEFAULT 'linked',
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  PRIMARY KEY (agent_id, user_id)
+);
+CREATE INDEX IF NOT EXISTS idx_agent_identity_users_user
+  ON agent_identity_users(user_id, role);
+INSERT OR IGNORE INTO users (
+  id, kind, handle, display_name, description, accent_color, created_at, updated_at
+) VALUES
+  ('user_agent_openclaw', 'bot', 'openclaw', 'OpenClaw', 'OpenClaw runtime actor linked to Forge agent identity and Kanban ownership.', '#38bdf8', datetime('now'), datetime('now')),
+  ('user_agent_hermes', 'bot', 'hermes', 'Hermes', 'Hermes runtime actor linked to Forge agent identity and Kanban ownership.', '#a78bfa', datetime('now'), datetime('now')),
+  ('user_agent_codex', 'bot', 'codex', 'Codex', 'Codex runtime actor linked to Forge agent identity and Kanban ownership.', '#22c55e', datetime('now'), datetime('now'));
+UPDATE agent_tokens
+SET agent_id = (
+  SELECT id FROM agent_identities
+  WHERE lower(agent_type) = 'openclaw' OR lower(label) IN ('forge openclaw', 'openclaw', 'aurel')
+  ORDER BY CASE WHEN lower(label) = 'forge openclaw' THEN 0 ELSE 1 END, created_at ASC
+  LIMIT 1
+)
+WHERE agent_id IN (
+  SELECT id FROM agent_identities
+  WHERE lower(agent_type) = 'openclaw' OR lower(label) IN ('forge openclaw', 'openclaw', 'aurel')
+)
+AND (SELECT COUNT(*) FROM agent_identities WHERE lower(agent_type) = 'openclaw' OR lower(label) IN ('forge openclaw', 'openclaw', 'aurel')) > 0;
+UPDATE agent_actions
+SET agent_id = (
+  SELECT id FROM agent_identities
+  WHERE lower(agent_type) = 'openclaw' OR lower(label) IN ('forge openclaw', 'openclaw', 'aurel')
+  ORDER BY CASE WHEN lower(label) = 'forge openclaw' THEN 0 ELSE 1 END, created_at ASC
+  LIMIT 1
+)
+WHERE agent_id IN (
+  SELECT id FROM agent_identities
+  WHERE lower(agent_type) = 'openclaw' OR lower(label) IN ('forge openclaw', 'openclaw', 'aurel')
+)
+AND (SELECT COUNT(*) FROM agent_identities WHERE lower(agent_type) = 'openclaw' OR lower(label) IN ('forge openclaw', 'openclaw', 'aurel')) > 0;
+UPDATE approval_requests
+SET requested_by_agent_id = (
+  SELECT id FROM agent_identities
+  WHERE lower(agent_type) = 'openclaw' OR lower(label) IN ('forge openclaw', 'openclaw', 'aurel')
+  ORDER BY CASE WHEN lower(label) = 'forge openclaw' THEN 0 ELSE 1 END, created_at ASC
+  LIMIT 1
+)
+WHERE requested_by_agent_id IN (
+  SELECT id FROM agent_identities
+  WHERE lower(agent_type) = 'openclaw' OR lower(label) IN ('forge openclaw', 'openclaw', 'aurel')
+)
+AND (SELECT COUNT(*) FROM agent_identities WHERE lower(agent_type) = 'openclaw' OR lower(label) IN ('forge openclaw', 'openclaw', 'aurel')) > 0;
+UPDATE insights
+SET origin_agent_id = (
+  SELECT id FROM agent_identities
+  WHERE lower(agent_type) = 'openclaw' OR lower(label) IN ('forge openclaw', 'openclaw', 'aurel')
+  ORDER BY CASE WHEN lower(label) = 'forge openclaw' THEN 0 ELSE 1 END, created_at ASC
+  LIMIT 1
+)
+WHERE origin_agent_id IN (
+  SELECT id FROM agent_identities
+  WHERE lower(agent_type) = 'openclaw' OR lower(label) IN ('forge openclaw', 'openclaw', 'aurel')
+)
+AND (SELECT COUNT(*) FROM agent_identities WHERE lower(agent_type) = 'openclaw' OR lower(label) IN ('forge openclaw', 'openclaw', 'aurel')) > 0;
+UPDATE agent_runtime_sessions
+SET agent_id = (
+  SELECT id FROM agent_identities
+  WHERE lower(agent_type) = 'openclaw' OR lower(label) IN ('forge openclaw', 'openclaw', 'aurel')
+  ORDER BY CASE WHEN lower(label) = 'forge openclaw' THEN 0 ELSE 1 END, created_at ASC
+  LIMIT 1
+)
+WHERE agent_id IN (
+  SELECT id FROM agent_identities
+  WHERE lower(agent_type) = 'openclaw' OR lower(label) IN ('forge openclaw', 'openclaw', 'aurel')
+)
+AND (SELECT COUNT(*) FROM agent_identities WHERE lower(agent_type) = 'openclaw' OR lower(label) IN ('forge openclaw', 'openclaw', 'aurel')) > 0;
+DELETE FROM agent_identities
+WHERE (lower(agent_type) = 'openclaw' OR lower(label) IN ('forge openclaw', 'openclaw', 'aurel'))
+  AND id <> (
+    SELECT id FROM agent_identities
+    WHERE lower(agent_type) = 'openclaw' OR lower(label) IN ('forge openclaw', 'openclaw', 'aurel')
+    ORDER BY CASE WHEN lower(label) = 'forge openclaw' THEN 0 ELSE 1 END, created_at ASC
+    LIMIT 1
+  );
+UPDATE agent_identities
+SET label = 'Forge OpenClaw',
+    agent_type = 'openclaw',
+    provider = 'openclaw',
+    identity_key = 'runtime:openclaw:legacy:default',
+    machine_key = 'legacy',
+    persona_key = 'default',
+    description = 'OpenClaw runtime agent with stable Forge identity and linked Kanban user.',
+    updated_at = datetime('now')
+WHERE lower(agent_type) = 'openclaw' OR lower(label) = 'forge openclaw';
+UPDATE agent_tokens
+SET agent_id = (
+  SELECT id FROM agent_identities
+  WHERE lower(agent_type) = 'hermes' OR lower(label) LIKE 'forge hermes%'
+  ORDER BY CASE WHEN lower(label) = 'forge hermes' THEN 0 ELSE 1 END, created_at ASC
+  LIMIT 1
+)
+WHERE agent_id IN (
+  SELECT id FROM agent_identities
+  WHERE lower(agent_type) = 'hermes' OR lower(label) LIKE 'forge hermes%'
+)
+AND (SELECT COUNT(*) FROM agent_identities WHERE lower(agent_type) = 'hermes' OR lower(label) LIKE 'forge hermes%') > 0;
+UPDATE agent_actions
+SET agent_id = (
+  SELECT id FROM agent_identities
+  WHERE lower(agent_type) = 'hermes' OR lower(label) LIKE 'forge hermes%'
+  ORDER BY CASE WHEN lower(label) = 'forge hermes' THEN 0 ELSE 1 END, created_at ASC
+  LIMIT 1
+)
+WHERE agent_id IN (
+  SELECT id FROM agent_identities
+  WHERE lower(agent_type) = 'hermes' OR lower(label) LIKE 'forge hermes%'
+)
+AND (SELECT COUNT(*) FROM agent_identities WHERE lower(agent_type) = 'hermes' OR lower(label) LIKE 'forge hermes%') > 0;
+UPDATE approval_requests
+SET requested_by_agent_id = (
+  SELECT id FROM agent_identities
+  WHERE lower(agent_type) = 'hermes' OR lower(label) LIKE 'forge hermes%'
+  ORDER BY CASE WHEN lower(label) = 'forge hermes' THEN 0 ELSE 1 END, created_at ASC
+  LIMIT 1
+)
+WHERE requested_by_agent_id IN (
+  SELECT id FROM agent_identities
+  WHERE lower(agent_type) = 'hermes' OR lower(label) LIKE 'forge hermes%'
+)
+AND (SELECT COUNT(*) FROM agent_identities WHERE lower(agent_type) = 'hermes' OR lower(label) LIKE 'forge hermes%') > 0;
+UPDATE insights
+SET origin_agent_id = (
+  SELECT id FROM agent_identities
+  WHERE lower(agent_type) = 'hermes' OR lower(label) LIKE 'forge hermes%'
+  ORDER BY CASE WHEN lower(label) = 'forge hermes' THEN 0 ELSE 1 END, created_at ASC
+  LIMIT 1
+)
+WHERE origin_agent_id IN (
+  SELECT id FROM agent_identities
+  WHERE lower(agent_type) = 'hermes' OR lower(label) LIKE 'forge hermes%'
+)
+AND (SELECT COUNT(*) FROM agent_identities WHERE lower(agent_type) = 'hermes' OR lower(label) LIKE 'forge hermes%') > 0;
+UPDATE agent_runtime_sessions
+SET agent_id = (
+  SELECT id FROM agent_identities
+  WHERE lower(agent_type) = 'hermes' OR lower(label) LIKE 'forge hermes%'
+  ORDER BY CASE WHEN lower(label) = 'forge hermes' THEN 0 ELSE 1 END, created_at ASC
+  LIMIT 1
+)
+WHERE agent_id IN (
+  SELECT id FROM agent_identities
+  WHERE lower(agent_type) = 'hermes' OR lower(label) LIKE 'forge hermes%'
+)
+AND (SELECT COUNT(*) FROM agent_identities WHERE lower(agent_type) = 'hermes' OR lower(label) LIKE 'forge hermes%') > 0;
+DELETE FROM agent_identities
+WHERE (lower(agent_type) = 'hermes' OR lower(label) LIKE 'forge hermes%')
+  AND id <> (
+    SELECT id FROM agent_identities
+    WHERE lower(agent_type) = 'hermes' OR lower(label) LIKE 'forge hermes%'
+    ORDER BY CASE WHEN lower(label) = 'forge hermes' THEN 0 ELSE 1 END, created_at ASC
+    LIMIT 1
+  );
+UPDATE agent_identities
+SET label = 'Forge Hermes',
+    agent_type = 'hermes',
+    provider = 'hermes',
+    identity_key = 'runtime:hermes:legacy:default',
+    machine_key = 'legacy',
+    persona_key = 'default',
+    description = 'Hermes runtime agent with stable Forge identity and linked Kanban user.',
+    updated_at = datetime('now')
+WHERE lower(agent_type) = 'hermes' OR lower(label) = 'forge hermes';
+UPDATE agent_tokens
+SET agent_id = (
+  SELECT id FROM agent_identities
+  WHERE lower(agent_type) = 'codex' OR lower(label) IN ('forge codex', 'codex', 'albert (codex)')
+  ORDER BY CASE WHEN lower(label) = 'forge codex' THEN 0 ELSE 1 END, created_at ASC
+  LIMIT 1
+)
+WHERE agent_id IN (
+  SELECT id FROM agent_identities
+  WHERE lower(agent_type) = 'codex' OR lower(label) IN ('forge codex', 'codex', 'albert (codex)')
+)
+AND (SELECT COUNT(*) FROM agent_identities WHERE lower(agent_type) = 'codex' OR lower(label) IN ('forge codex', 'codex', 'albert (codex)')) > 0;
+UPDATE agent_actions
+SET agent_id = (
+  SELECT id FROM agent_identities
+  WHERE lower(agent_type) = 'codex' OR lower(label) IN ('forge codex', 'codex', 'albert (codex)')
+  ORDER BY CASE WHEN lower(label) = 'forge codex' THEN 0 ELSE 1 END, created_at ASC
+  LIMIT 1
+)
+WHERE agent_id IN (
+  SELECT id FROM agent_identities
+  WHERE lower(agent_type) = 'codex' OR lower(label) IN ('forge codex', 'codex', 'albert (codex)')
+)
+AND (SELECT COUNT(*) FROM agent_identities WHERE lower(agent_type) = 'codex' OR lower(label) IN ('forge codex', 'codex', 'albert (codex)')) > 0;
+UPDATE approval_requests
+SET requested_by_agent_id = (
+  SELECT id FROM agent_identities
+  WHERE lower(agent_type) = 'codex' OR lower(label) IN ('forge codex', 'codex', 'albert (codex)')
+  ORDER BY CASE WHEN lower(label) = 'forge codex' THEN 0 ELSE 1 END, created_at ASC
+  LIMIT 1
+)
+WHERE requested_by_agent_id IN (
+  SELECT id FROM agent_identities
+  WHERE lower(agent_type) = 'codex' OR lower(label) IN ('forge codex', 'codex', 'albert (codex)')
+)
+AND (SELECT COUNT(*) FROM agent_identities WHERE lower(agent_type) = 'codex' OR lower(label) IN ('forge codex', 'codex', 'albert (codex)')) > 0;
+UPDATE insights
+SET origin_agent_id = (
+  SELECT id FROM agent_identities
+  WHERE lower(agent_type) = 'codex' OR lower(label) IN ('forge codex', 'codex', 'albert (codex)')
+  ORDER BY CASE WHEN lower(label) = 'forge codex' THEN 0 ELSE 1 END, created_at ASC
+  LIMIT 1
+)
+WHERE origin_agent_id IN (
+  SELECT id FROM agent_identities
+  WHERE lower(agent_type) = 'codex' OR lower(label) IN ('forge codex', 'codex', 'albert (codex)')
+)
+AND (SELECT COUNT(*) FROM agent_identities WHERE lower(agent_type) = 'codex' OR lower(label) IN ('forge codex', 'codex', 'albert (codex)')) > 0;
+UPDATE agent_runtime_sessions
+SET agent_id = (
+  SELECT id FROM agent_identities
+  WHERE lower(agent_type) = 'codex' OR lower(label) IN ('forge codex', 'codex', 'albert (codex)')
+  ORDER BY CASE WHEN lower(label) = 'forge codex' THEN 0 ELSE 1 END, created_at ASC
+  LIMIT 1
+)
+WHERE agent_id IN (
+  SELECT id FROM agent_identities
+  WHERE lower(agent_type) = 'codex' OR lower(label) IN ('forge codex', 'codex', 'albert (codex)')
+)
+AND (SELECT COUNT(*) FROM agent_identities WHERE lower(agent_type) = 'codex' OR lower(label) IN ('forge codex', 'codex', 'albert (codex)')) > 0;
+DELETE FROM agent_identities
+WHERE (lower(agent_type) = 'codex' OR lower(label) IN ('forge codex', 'codex', 'albert (codex)'))
+  AND id <> (
+    SELECT id FROM agent_identities
+    WHERE lower(agent_type) = 'codex' OR lower(label) IN ('forge codex', 'codex', 'albert (codex)')
+    ORDER BY CASE WHEN lower(label) = 'forge codex' THEN 0 ELSE 1 END, created_at ASC
+    LIMIT 1
+  );
+UPDATE agent_identities
+SET label = 'Forge Codex',
+    agent_type = 'codex',
+    provider = 'codex',
+    identity_key = 'runtime:codex:legacy:default',
+    machine_key = 'legacy',
+    persona_key = 'default',
+    description = 'Codex runtime agent with stable Forge identity and linked Kanban user.',
+    updated_at = datetime('now')
+WHERE lower(agent_type) = 'codex' OR lower(label) = 'forge codex';
+INSERT OR IGNORE INTO agent_identity_users (agent_id, user_id, role, created_at, updated_at)
+SELECT id, 'user_agent_openclaw', 'primary', datetime('now'), datetime('now')
+FROM agent_identities
+WHERE provider = 'openclaw';
+INSERT OR IGNORE INTO agent_identity_users (agent_id, user_id, role, created_at, updated_at)
+SELECT id, 'user_agent_hermes', 'primary', datetime('now'), datetime('now')
+FROM agent_identities
+WHERE provider = 'hermes';
+INSERT OR IGNORE INTO agent_identity_users (agent_id, user_id, role, created_at, updated_at)
+SELECT id, 'user_agent_codex', 'primary', datetime('now'), datetime('now')
+FROM agent_identities
+WHERE provider = 'codex';
+UPDATE agent_runtime_sessions
+SET agent_label = (
+      SELECT label FROM agent_identities WHERE agent_identities.id = agent_runtime_sessions.agent_id
+    ),
+    agent_type = (
+      SELECT agent_type FROM agent_identities WHERE agent_identities.id = agent_runtime_sessions.agent_id
+    ),
+    updated_at = datetime('now')
+WHERE agent_id IN (SELECT id FROM agent_identities WHERE provider IN ('openclaw', 'hermes', 'codex'));
+CREATE UNIQUE INDEX IF NOT EXISTS idx_agent_identities_identity_key
+  ON agent_identities(identity_key)
+  WHERE identity_key IS NOT NULL;

package/dist/server/server/migrations/053_agent_runtime_session_canonical_labels.sql ADDED Viewed

@@ -0,0 +1,9 @@
+UPDATE agent_runtime_sessions
+SET agent_label = (
+      SELECT label FROM agent_identities WHERE agent_identities.id = agent_runtime_sessions.agent_id
+    ),
+    agent_type = (
+      SELECT agent_type FROM agent_identities WHERE agent_identities.id = agent_runtime_sessions.agent_id
+    ),
+    updated_at = datetime('now')
+WHERE agent_id IN (SELECT id FROM agent_identities WHERE provider IN ('openclaw', 'hermes', 'codex'));

package/dist/server/server/src/app.js CHANGED Viewed

@@ -830,7 +830,8 @@ const AGENT_ONBOARDING_ENTITY_CATALOG_BASE = [
         ],
         searchHints: [
             "Search by title before creating a duplicate habit.",
-            "Use linkedTo when the habit should already be attached to a goal, project, task, or Psyche entity."
+            "Use linkedTo when the habit should already be attached to a goal, project, task, or Psyche entity.",
+            "To log an official habit outcome from the shared agent tool surface, patch the habit through forge_update_entities with checkIn: { status, dateKey?, note?, description? }."
         ],
         examples: [
             '{"title":"Morning training","frequency":"daily","polarity":"positive","linkedGoalIds":["goal_train_body"],"linkedValueIds":["value_steadiness"],"linkedBehaviorIds":["behavior_regulating_walk"]}'
@@ -2771,6 +2772,10 @@ const AGENT_ONBOARDING_CONVERSATION_RULES = [
     "When useful, help the user name, define, and connect the record in that order: offer a working label, clarify what belongs inside it, then ask about links only after the record itself feels steady.",
     "When the meaning is clearer than the wording, offer a tentative title or formulation yourself and invite correction instead of forcing the user to wordsmith alone.",
     "For direct update or review requests, the next question should usually narrow the saved object, timeframe, or route family instead of reopening the whole meaning-making arc.",
+    "The opening question should help the user understand what they are actually trying to save, decide, review, or change, not make them perform the schema out loud.",
+    "If the user already named the exact correction in usable language, confirm only the missing scope, timing, or route-selecting detail that still matters, then act.",
+    "Once a specialized-surface lane is clear, speak in route-relevant nouns such as timeline, overlay, weekday template, published output, run detail, or node result instead of generic record language.",
+    "If the next answer would not change the route, wording, timing, or write payload in a meaningful way, stop asking and act.",
     "Before saving, briefly summarize the working formulation in the user's own language when that would reduce ambiguity.",
     "Once the record is clear enough to name, stop exploring broadly and ask only for the last structural detail that still matters.",
     "If the record is already clear enough to save, save it instead of performing a ceremonial extra question.",
@@ -3096,6 +3101,7 @@ const AGENT_ONBOARDING_ENTITY_CONVERSATION_PLAYBOOKS = [
             "Ask for the time window, place, or movement item that makes the question concrete.",
             "Ask what they are trying to notice, preserve, or answer through that movement context.",
             "Choose the dedicated day, month, all-time, timeline, places, trip-detail, or selection route once the question shape is clear.",
+            "If the truth of one uncertain span is still unclear, read the timeline or saved-box detail before you mutate it.",
             "Skip the meta lane question when the user already named the exact correction or review target and only one ambiguity remains.",
             "If the request is filling a missing-data gap, use a user-defined movement box rather than a raw stay or trip patch.",
             "If the request is repairing already-saved movement data, use the repair route that matches the saved object instead of treating it like a missing span.",
@@ -3113,6 +3119,7 @@ const AGENT_ONBOARDING_ENTITY_CONVERSATION_PLAYBOOKS = [
             "Ask what part of the current energy picture feels most important or inaccurate.",
             "Ask what should stay true if they are changing profile or template assumptions.",
             "Ask whether the user is describing a stable weekly shape or just how today feels when the lane is still blurred.",
+            "If the user describes a repeatable day-shape such as 'Mondays crash after lunch', treat that as a weekday-template question before you reach for profile or fatigue-signal routes.",
             "If the user already named the life-force lane clearly, skip the meta lane question and ask only for the specific weekday, profile field, or signal that still matters.",
             "If the request is about a durable baseline, use profile or weekday-template mutation rather than a fatigue signal; if it is about right now, prefer the fatigue-signal route.",
             "If the user wants to see what changed after a write, read the overview back instead of leaving the result implicit.",
@@ -3126,11 +3133,12 @@ const AGENT_ONBOARDING_ENTITY_CONVERSATION_PLAYBOOKS = [
         askSequence: [
             "Ask whether the job is flow discovery, one flow edit, execution, run history, published output, node-level inspection, or latest-node-output lookup.",
             "Ask which flow, slug, run, or node the request is about.",
-            "Ask whether they need the flow contract, a run result, a published output, or a node result.",
+            "Ask whether they need the stable flow contract, one run result, one published output, one node result, or the latest node output.",
             "Ask what the user is trying to learn, repair, or publish through that flow.",
             "If the user already named the flow and action clearly, skip the meta lane question and ask only for the missing run, node, or output scope.",
             "If the user wants a stable public input contract or published output, prefer those dedicated reads instead of detouring through run history first.",
             "If the user is still shaping a payload or edit, prefer flow detail or box catalog reads before asking for structured inputs.",
+            "If the user is debugging one failed run, ask whether the useful artifact is the run summary, one node result, the latest node output, or the published output before you start asking for edits.",
             "Prefer flow detail or published-output reads for stable contracts, and use run or node-result routes only when the user is asking about execution history or debugging.",
             "Route to the dedicated workbench route family once the execution lane is clear."
         ]
@@ -3985,8 +3993,8 @@ function buildAgentOnboardingPayload(request) {
         tokenRecovery: {
             rawTokenStoredByForge: false,
             recoveryAction: "rotate_or_issue_new_token",
-            rotationSummary: "Forge reveals raw tokens once. If you lose one, rotate it or issue a new token from Settings and update the plugin config.",
-            settingsSummary: "Token creation, rotation, and revocation all live under Forge Settings so recovery is explicit and operator-controlled."
+            rotationSummary: "Forge reveals raw tokens once. If you lose one, rotate it or issue a new token through /api/v1/settings/tokens, then update the plugin config.",
+            settingsSummary: "Token creation, rotation, and revocation all live on explicit settings routes so recovery stays operator-controlled without requiring a browser click."
         },
         requiredHeaders: {
             authorization: "Authorization: Bearer <forge-api-token>",
@@ -4153,6 +4161,11 @@ function buildAgentOnboardingPayload(request) {
             specializedDomainSurfaces: {
                 movement: {
                     summary: "Dedicated movement workspace API. Use these routes for stays, trips, time-in-place questions, visited places, trip detail, selection aggregates, user-defined overlays, and repair actions on already-recorded movement data.",
+                    routeSelectionQuestions: [
+                        "Is the user asking for a day, month, all-time, timeline, place, trip detail, or selected-span answer?",
+                        "Is this a missing-gap overlay, a saved-overlay repair, or an edit to one already-recorded stay, trip, or trip point?",
+                        "If the target is already known, what one time, place, or saved-object detail is still missing before acting?"
+                    ],
                     readRoutes: {
                         day: "/api/v1/movement/day",
                         month: "/api/v1/movement/month",
@@ -4190,6 +4203,11 @@ function buildAgentOnboardingPayload(request) {
                 },
                 lifeForce: {
                     summary: "Dedicated life-force API. Use it to read the current energy budget, drains, recommendations, and warnings, then patch only the parts that are meant to be user-controlled.",
+                    routeSelectionQuestions: [
+                        "Is the user trying to understand the overview, change durable profile assumptions, change a weekday curve, or log a right-now fatigue signal?",
+                        "Are they describing a repeatable weekly shape or a one-off current state?",
+                        "If the lane is already clear, what one weekday, profile field, or signal detail is still missing?"
+                    ],
                     readRoutes: {
                         overview: "/api/v1/life-force"
                     },
@@ -4202,12 +4220,18 @@ function buildAgentOnboardingPayload(request) {
                         "Life Force is a focused domain surface, not a batch CRUD entity type.",
                         "Use GET /api/v1/life-force for the current overview payload with stats, drains, recommendations, and current-curve state.",
                         "Patch the profile only for durable personal settings, update weekday templates only for the curve itself, and post fatigue signals for real-time tired or recovered observations.",
+                        "If the user says something like 'I always dip on Tuesdays after lunch', treat that as a weekday-template change rather than a one-off fatigue signal.",
                         "If the user is asking what changed after a profile, template, or fatigue write, read the overview back so the effect stays visible.",
                         "If the user already knows they want a profile change, weekday-template edit, or right-now fatigue signal, skip the broad lane question and ask only for the missing weekday, profile field, or signal detail."
                     ]
                 },
                 workbench: {
                     summary: "Dedicated graph-flow API. Use it for flow catalog reads, flow CRUD, execution, run history, published outputs, node results, and latest successful node outputs.",
+                    routeSelectionQuestions: [
+                        "Is the job flow discovery, flow editing, execution, published output, run detail, node result, latest node output, or flow chat follow-up?",
+                        "Does the user need a stable public contract or one execution artifact?",
+                        "If the flow is already known, what one run, node, or output scope detail is still missing before acting?"
+                    ],
                     readRoutes: {
                         listFlows: "/api/v1/workbench/flows",
                         flowById: "/api/v1/workbench/flows/:id",
@@ -4233,6 +4257,7 @@ function buildAgentOnboardingPayload(request) {
                         "Use the flow routes when the agent needs stable public input contracts, published outputs, node-level results, or reusable execution history.",
                         "If the user is still figuring out inputs or editable structure, read flow detail or box catalog before asking them to author a payload from memory.",
                         "Prefer the dedicated output and node-result routes over reverse-engineering raw traces.",
+                        "If the user only wants a published output, latest node output, or run detail, do not reopen a flow-edit intake before reading that artifact.",
                         "If the user already named the flow and wants one output or one run, skip the broad lane question and ask only for the missing run, node, or output scope."
                     ]
                 }
@@ -4281,19 +4306,24 @@ function buildAgentOnboardingPayload(request) {
                 installSteps: [
                     "Install the Forge plugin from the repo or published package.",
                     "Restart the OpenClaw gateway so the tool surface and UI proxy routes refresh.",
-                    "Open Forge Settings -> Agents to issue or rotate a managed token when remote scoped auth is needed."
+                    "For localhost or Tailscale, finish onboarding through operator-session bootstrap and CLI verification without opening the Forge UI.",
+                    "If remote scoped auth is needed, issue or rotate a managed token through /api/v1/settings/tokens and update the plugin config without a Settings click."
                 ],
                 verifyCommands: [
                     `curl -s ${origin}/api/v1/health`,
                     "openclaw plugins install ./projects/forge/openclaw-plugin",
                     "openclaw plugins info forge-openclaw-plugin",
-                    "openclaw gateway restart"
+                    "openclaw gateway restart",
+                    "openclaw forge onboarding",
+                    "openclaw forge health"
                 ],
                 configNotes: [
                     "Localhost and Tailscale targets can usually use the operator-session path without a long-lived token.",
+                    "The operator-session route is /api/v1/auth/operator-session, so trusted local OpenClaw onboarding does not need a browser confirmation step.",
                     "If your current OpenClaw build blocks the repo-local install because of the package scanner, keep the repo folder on plugins.load.paths and verify that plugins info still points at the local Forge source path before continuing.",
                     "Use a distinct actor label such as Albert (claw) so OpenClaw-originated work stays obvious in Forge provenance.",
-                    "Create each agent as a Forge bot user, then use userId or userIds in tool inputs whenever the agent should focus on one human, one bot, or a specific collaboration slice."
+                    "Create each agent as a Forge bot user, then use userId or userIds in tool inputs whenever the agent should focus on one human, one bot, or a specific collaboration slice.",
+                    "If you genuinely need a durable managed token, create it through /api/v1/settings/tokens instead of sending the operator into the Settings UI."
                 ]
             },
             hermes: {
@@ -4301,7 +4331,7 @@ function buildAgentOnboardingPayload(request) {
                 installSteps: [
                     "Install forge-hermes-plugin into the Python environment Hermes actually runs.",
                     "Let Hermes load the Forge plugin and bundled skill pack on startup.",
-                    "Use Forge Settings -> Agents if Hermes needs a managed token for remote or durable access."
+                    "If Hermes needs remote or durable scoped auth, issue a managed token through /api/v1/settings/tokens and update the Hermes config without a Settings click."
                 ],
                 verifyCommands: [
                     "python -m pip show forge-hermes-plugin",
@@ -4435,8 +4465,8 @@ function buildAgentOnboardingPayload(request) {
             saveSuggestionPlacement: "end_of_message",
             saveSuggestionTone: "gentle_optional",
             maxQuestionsPerTurn: 1,
-            psycheExplorationRule: "When a Psyche entity needs understanding first, begin with one exploratory question before any working formulation, replacement belief, suggested title, or save pitch. Keep the opening reflection to one or two short sentences, stay in plain prose instead of bullets or numbered lists, keep that first reply short, do not mention Forge search or save structure yet, avoid colons or list-shaped phrasing, prefer what/when/how over why until the experience is grounded, wait for the user's answer before offering a fuller formulation, ask permission before moving from charged exploration into naming or challenge when needed, do not widen into adjacent entities until the current one has a working sentence the user recognizes, and once the lived experience is coherent stop deepening and help the user name it cleanly. When the user is updating a Psyche record because of one fresh episode, anchor in that episode before renaming the durable formulation. If the user accepts the wording, move toward the save instead of reopening deeper exploration.",
-            specializedSurfaceRule: "For Movement, Life Force, and Workbench, clarify the lane first, then name the dedicated route family in plain language and do not guess at a generic CRUD path. When the user already named a precise correction or review target, confirm only the route-selecting detail that is still missing. After a concrete specialized-surface correction, read the relevant specialized view back when the user is trying to understand the result rather than just store it. The canonical runtime routes stay under /api/v1/*, and the OpenClaw HTTP mirror exposes the same families under /forge/v1/movement, /forge/v1/life-force, and /forge/v1/workbench.",
+            psycheExplorationRule: "When a Psyche entity needs understanding first, begin with one exploratory question before any working formulation, replacement belief, suggested title, or save pitch. Keep the opening reflection to one or two short sentences, stay in plain prose instead of bullets or numbered lists, keep that first reply short, do not mention Forge search or save structure yet, avoid colons or list-shaped phrasing, prefer what/when/how over why until the experience is grounded, wait for the user's answer before offering a fuller formulation, ask permission before moving from charged exploration into naming or challenge when needed, make the next question help the user feel more able to name the experience rather than more examined, do not widen into adjacent entities until the current one has a working sentence the user recognizes, and once the lived experience is coherent stop deepening and help the user name it cleanly. When the user is updating a Psyche record because of one fresh episode, anchor in that episode before renaming the durable formulation. If the user accepts the wording, move toward the save instead of reopening deeper exploration.",
+            specializedSurfaceRule: "For Movement, Life Force, and Workbench, clarify the lane first, then name the dedicated route family in plain language and do not guess at a generic CRUD path. Use specializedDomainSurfaces.routeSelectionQuestions when they are present so the next follow-up stays route-selective instead of generic. Once the lane is clear, talk in route-relevant nouns such as timeline, overlay, weekday template, published output, run detail, or node result rather than generic record language. If the truth of the current state is still uncertain, read the relevant specialized view before you mutate it. When the user already named a precise correction or review target, confirm only the route-selecting detail that is still missing. After a concrete specialized-surface correction, read the relevant specialized view back when the user is trying to understand the result rather than just store it. The canonical runtime routes stay under /api/v1/*, and the OpenClaw HTTP mirror exposes the same families under /forge/v1/movement, /forge/v1/life-force, and /forge/v1/workbench.",
             reviewShortcutRule: "When the user is reviewing or correcting an existing record, narrow the saved object, timeframe, or route family first. Do not reopen the whole intake unless the user is actually redefining the record.",
             readModelWriteRule: "Self-observation is note-backed and should be written through observed notes with frontmatter.observedAt. Sleep and workout sessions stay on batch CRUD by default; use the reflective review helpers only when enriching one already-known record after review.",
             psycheOpeningQuestionRule: "Prefer a concrete opening question tied to the entity: ask when the value mattered, what happened the last time the pattern appeared, what cue or body signal came first before the behavior, what the belief starts saying about self or outcome, what feels most at risk inside the mode, what the part is trying to get the user to do or stop doing, or where the shift began in the incident. Reflect briefly before the question, choose one follow-up lane at a time, say what is becoming clearer before the next deeper question, and if several Psyche entities are visible hold the adjacent ones lightly until the main container is clear.",
@@ -4460,9 +4490,9 @@ function buildAgentOnboardingPayload(request) {
             batchingRule: "forge_create_entities, forge_update_entities, forge_delete_entities, and forge_restore_entities all accept operations as arrays. Batch CRUD is the default for simple entities, so batch multiple related mutations together instead of reaching for a long list of entity-specific routes.",
             searchRule: "forge_search_entities accepts searches as an array. Search before create or update when duplicate risk exists.",
             createRule: "Each create operation must include entityType and full data. entityType alone is not enough. This includes calendar_event, work_block_template, task_timebox, sleep_session, workout_session, preference CRUD entities, and questionnaire_instrument alongside the usual planning and Psyche entities.",
-            updateRule: "Each update operation must include entityType, id, and patch. For projects, lifecycle changes are status patches: active to restart, paused to suspend, completed to finish. Keep task and project scheduling rules on those same patch payloads. Calendar-event updates still run downstream provider projection sync, and manual health-session field edits belong on the batch route by default rather than on the reflective review helpers.",
+            updateRule: "Each update operation must include entityType, id, and patch. For projects, lifecycle changes are status patches: active to restart, paused to suspend, completed to finish. Keep task and project scheduling rules on those same patch payloads. Official habit outcomes can also be logged through forge_update_entities by patching the habit with checkIn: { status, dateKey?, note?, description? } instead of route-hunting. Calendar-event updates still run downstream provider projection sync, and manual health-session field edits belong on the batch route by default rather than on the reflective review helpers.",
             createExample: '{"operations":[{"entityType":"goal","data":{"title":"Create meaningfully"},"clientRef":"goal-create-1"},{"entityType":"goal","data":{"title":"Build a beautiful family"},"clientRef":"goal-create-2"}]}',
-            updateExample: '{"operations":[{"entityType":"project","id":"project_123","patch":{"status":"paused","schedulingRules":{"blockWorkBlockKinds":["main_activity"],"allowWorkBlockKinds":["secondary_activity"]}},"clientRef":"project-suspend-1"},{"entityType":"task","id":"task_456","patch":{"plannedDurationSeconds":5400,"schedulingRules":{"allowEventKeywords":["creative"],"blockEventKeywords":["clinic"]}},"clientRef":"task-scheduling-1"}]}'
+            updateExample: '{"operations":[{"entityType":"project","id":"project_123","patch":{"status":"paused","schedulingRules":{"blockWorkBlockKinds":["main_activity"],"allowWorkBlockKinds":["secondary_activity"]}},"clientRef":"project-suspend-1"},{"entityType":"habit","id":"habit_456","patch":{"checkIn":{"status":"missed","note":"Resisted the urge after dinner.","description":"85 sec reset"}},"clientRef":"habit-check-in-1"}]}'
         }
     };
 }