openclaw-code-agent 3.2.0 → 3.2.1

package/openclaw.plugin.json

@@ -2,7 +2,23 @@
   "id": "openclaw-code-agent",
   "name": "OpenClaw Code Agent",
   "description": "Multi-session coding-agent orchestration from OpenClaw chat",
-  "version": "3.2.0",
+  "version": "3.2.1",
+  "activation": {
+    "onCommands": [
+      "agent",
+      "agent_kill",
+      "agent_output",
+      "agent_respond",
+      "agent_sessions",
+      "agent_stats",
+      "goal",
+      "goal_status",
+      "goal_stop"
+    ]
+  },
+  "setup": {
+    "requiresRuntime": false
+  },
   "configSchema": {
     "type": "object",
     "additionalProperties": false,
@@ -18,7 +34,8 @@
           "codex": {
             "defaultModel": "gpt-5.4",
             "allowedModels": [
-              "gpt-5.4"
+              "gpt-5.4",
+              "gpt-5.4-pro"
             ],
             "reasoningEffort": "medium"
           },
@@ -131,6 +148,7 @@
       },
       "defaultHarness": {
         "type": "string",
+        "enum": ["claude-code", "codex"],
         "default": "claude-code",
         "description": "Default agent harness when agent_launch omits the harness parameter."
       },
@@ -156,14 +174,14 @@
   "uiHints": {
     "fallbackChannel": {
       "label": "Fallback notification channel",
-      "help": "Default channel used when no workspace-specific agentChannels entry matches the session workdir. Prefer a fully routable channel string; bare providers are only weak fallbacks.",
-      "placeholder": "telegram|my-bot|123456789",
-      "sensitive": true
+      "help": "Optional but recommended. Default channel used when no workspace-specific agentChannels entry matches the session workdir. Prefer a fully routable channel string; bare providers are only weak fallbacks.",
+      "placeholder": "telegram|my-bot|123456789"
     },
     "agentChannels": {
       "label": "Workspace notification channels",
       "help": "Map absolute working-directory paths to notification channels so each workspace routes session updates to the right chat.",
-      "sensitive": true
+      "sensitive": true,
+      "advanced": true
     },
     "defaultWorkdir": {
       "label": "Default working directory",
@@ -172,37 +190,38 @@
     },
     "harnesses": {
       "label": "Harness configuration",
-      "help": "Per-harness defaults and model restrictions. Default: {\"codex\":{\"defaultModel\":\"gpt-5.4\",\"allowedModels\":[\"gpt-5.4\"],\"reasoningEffort\":\"medium\"},\"claude-code\":{\"defaultModel\":\"sonnet\",\"allowedModels\":[\"sonnet\",\"opus\"]}}."
-    },
-    "defaultModel": {
-      "label": "Legacy default model",
-      "help": "Deprecated. Mapped to harnesses[defaultHarness].defaultModel during migration.",
-      "placeholder": "sonnet"
-    },
-    "model": {
-      "label": "Legacy Codex model",
-      "help": "Deprecated. Use harnesses.codex.defaultModel instead.",
-      "placeholder": "gpt-5.3-codex"
+      "help": "Per-harness defaults and model restrictions. Default: {\"codex\":{\"defaultModel\":\"gpt-5.4\",\"allowedModels\":[\"gpt-5.4\",\"gpt-5.4-pro\"],\"reasoningEffort\":\"medium\"},\"claude-code\":{\"defaultModel\":\"sonnet\",\"allowedModels\":[\"sonnet\",\"opus\"]}}.",
+      "advanced": true
     },
     "maxSessions": {
       "label": "Maximum concurrent sessions",
-      "help": "Upper limit on concurrently running coding-agent sessions."
+      "help": "Upper limit on concurrently running coding-agent sessions.",
+      "advanced": true
     },
     "idleTimeoutMinutes": {
       "label": "Idle timeout (minutes)",
-      "help": "Minutes a paused multi-turn session can remain idle before the plugin auto-kills it."
+      "help": "Minutes a paused multi-turn session can remain idle before the plugin auto-kills it.",
+      "advanced": true
+    },
+    "defaultHarness": {
+      "label": "Default harness",
+      "help": "Choose the harness you expect to use most often. Pick Codex only when the Codex command and local auth are ready on this machine.",
+      "placeholder": "claude-code"
     },
     "permissionMode": {
       "label": "Default permission mode",
-      "help": "Default plugin orchestration mode used when new coding-agent sessions are launched. Use this for plan/default/bypass behavior; Codex execution stays fixed to 'never'."
+      "help": "Default plugin orchestration mode used when new coding-agent sessions are launched. Use this for plan/default/bypass behavior; Codex execution stays fixed to 'never'.",
+      "advanced": true
     },
     "planApproval": {
       "label": "Plan approval policy",
-      "help": "Choose whether plans are always sent to the user with Approve/Revise/Reject buttons (`ask`, default), delegated to the orchestrator for full-plan review first, or auto-approved."
+      "help": "Choose whether plans are always sent to the user with Approve/Revise/Reject buttons (`ask`, default), delegated to the orchestrator for full-plan review first, or auto-approved.",
+      "advanced": true
     },
     "defaultWorktreeStrategy": {
       "label": "Default worktree strategy",
-      "help": "Applies to all sessions that don't specify worktree_strategy explicitly. 'off' (default) disables worktrees globally. 'ask' creates a worktree and sends inline Merge locally / Create PR buttons on completion. 'delegate' wakes the orchestrator to decide autonomously. 'auto-merge' and 'auto-pr' are fully automated."
+      "help": "Applies to all sessions that don't specify worktree_strategy explicitly. 'off' (default) disables worktrees globally. 'ask' creates a worktree and sends inline Merge locally / Create PR buttons on completion. 'delegate' wakes the orchestrator to decide autonomously. 'auto-merge' and 'auto-pr' are fully automated.",
+      "advanced": true
     }
   },
   "skills": [

package/package.json

@@ -1,10 +1,13 @@
 {
   "name": "openclaw-code-agent",
-  "version": "3.2.0",
+  "version": "3.2.1",
   "type": "module",
+  "packageManager": "pnpm@10.30.0",
   "main": "dist/index.js",
   "scripts": {
+    "audit:prod": "pnpm audit --prod",
     "build": "esbuild index.ts --bundle --platform=node --target=node22 --format=esm --outfile=dist/index.js --minify --external:openclaw --external:openclaw/plugin-sdk --external:openclaw/plugin-sdk/* --external:@anthropic-ai/claude-agent-sdk",
+    "check-plugin-security": "node scripts/check-plugin-security.mjs",
     "test": "node scripts/run-tests.mjs",
     "test:serial": "node scripts/run-tests.mjs",
     "test:file": "node scripts/run-tests.mjs",
@@ -22,12 +25,12 @@
       "./dist/index.js"
     ],
     "compat": {
-      "pluginApi": ">=2026.4.9",
-      "minGatewayVersion": "2026.4.9"
+      "pluginApi": ">=2026.4.14",
+      "minGatewayVersion": "2026.4.14"
     },
     "build": {
-      "openclawVersion": "2026.4.9",
-      "pluginSdkVersion": "2026.4.9"
+      "openclawVersion": "2026.4.21",
+      "pluginSdkVersion": "2026.4.21"
     }
   },
   "files": [
@@ -46,7 +49,7 @@
     "@types/node": "^25.5.2",
     "esbuild": "^0.28.0",
     "nanoid": "^5.1.7",
-    "openclaw": "2026.4.10",
+    "openclaw": "2026.4.21",
     "tsx": "^4.21.0",
     "typescript": "^6.0.2"
   },
@@ -81,10 +84,10 @@
   },
   "description": "An OpenClaw plugin that orchestrates coding agent sessions as managed background processes. Launch, monitor, and control coding agents (Claude Code, Codex, and more) directly from your AI gateway.",
   "peerDependencies": {
-    "openclaw": ">=2026.4.9"
+    "openclaw": ">=2026.4.14"
   },
   "overrides": {
-    "basic-ftp": "5.2.2"
+    "basic-ftp": "5.3.0"
   },
   "pnpm": {
     "onlyBuiltDependencies": [
@@ -96,7 +99,10 @@
       "@img/sharp-linux-arm64"
     ],
     "overrides": {
-      "basic-ftp": "5.2.2",
+      "basic-ftp": "5.3.0",
+      "axios@<1.15.0": ">=1.15.0",
+      "follow-redirects@<1.16.0": "1.16.0",
+      "protobufjs@>=7 <7.5.5": "7.5.5",
       "brace-expansion@>=4.0.0 <5.0.5": ">=5.0.5",
       "path-to-regexp@>=8.0.0 <8.4.0": ">=8.4.0"
     }

package/skills/code-agent-orchestration/SKILL.md

@@ -97,6 +97,7 @@ Completion ownership:
 - Skip the summary only in narrow cases:
   - no user-facing follow-up will be sent at all because the orchestrator is silently continuing an internal multi-phase pipeline
   - the completion produced no meaningful outcome to report, or the reliable result data is still too incomplete to support even a short factual summary
+  - the session is a silent cron/system pipeline that already returned `NO_REPLY` or otherwise explicitly opted out of a user-facing follow-up summary
 
 ## Respond Rules