openclaw-openagent 1.0.8 → 1.0.9

package/dist/src/proxy/auth-proxy.js

@@ -18,6 +18,7 @@ import nodePath from 'node:path';
 import { logger } from '../util/logger.js';
 import { registry } from '../runtime/registry.js';
 import { isUnconfiguredOasnApiBase } from '../auth/config.js';
+import { resolveOasnRelativeUrl } from '../util/url-resolver.js';
 /** TIM 路径默认上游（兼容旧版） */
 const AUTH_UPSTREAM_TIM = 'https://auth.ai-talk.live';
 const PROXY_TIMEOUT_MS = 15_000;
@@ -56,7 +57,7 @@ function pickUpstream(method, pathname) {
 let _gatewayBaseUrl;
 /** Returns the gateway base URL as seen by the browser (e.g. http://localhost:18794). */
 export function getGatewayBaseUrl() {
-    return _gatewayBaseUrl ?? `http://localhost:18794`;
+    return _gatewayBaseUrl ?? 'http://localhost:18794';
 }
 // ── Handler factory ─────────────────────────────────────────────────────
 export function createAuthProxyHandler() {
@@ -76,19 +77,19 @@ export function createAuthProxyHandler() {
             _gatewayBaseUrl = `${proto}://${host}`;
             logger.info(`[proxy] Gateway base URL detected: ${_gatewayBaseUrl}`);
         }
-        // ── T4: Serve local media files from /tmp/openclaw/openagent-media/ ──
-        // Files downloaded from remote agents via C2C are stored here.
-        // Tool result references them as MEDIA:http://localhost:PORT/plugins/openagent/media/{filename}
-        // to pass through the framework's filterToolResultMediaUrls (http URLs bypass whitelist check).
-        if (url.pathname.startsWith('/media/')) {
-            return serveLocalMedia(url.pathname, res);
-        }
         // req.url may or may not have the /plugins/openagent prefix stripped by Gateway
         // (behavior varies across Gateway versions), so strip it defensively.
         let targetPath = url.pathname;
         if (targetPath.startsWith('/plugins/openagent')) {
             targetPath = targetPath.slice('/plugins/openagent'.length);
         }
+        // ── T4: Serve local media files from /tmp/openclaw/openagent-media/ ──
+        // Files downloaded from remote agents are stored here. The media route must
+        // be detected after prefix normalization because Gateway versions disagree
+        // on whether /plugins/openagent has already been stripped.
+        if (targetPath.startsWith('/media/')) {
+            return serveLocalMedia(targetPath, res);
+        }
         // v3.9+ 双轨抽象：上游按当前 transport 切换（OASN → api.oasn.ai；TIM → auth.ai-talk.live）
         const method = req.method ?? 'GET';
         const rt = registry.getDefault();
@@ -116,7 +117,7 @@ export function createAuthProxyHandler() {
             writeJson(res, 503, { error: 'OASN api_base is not configured' });
             return true;
         }
-        const targetUrl = new URL(targetPath + url.search, upstreamBase).href;
+        const targetUrl = resolveOasnProxyTargetUrl(upstreamBase, targetPath, url.search);
         logger.info(`[proxy] ${method} ${url.pathname} → ${targetUrl}`);
         try {
             // Read request body for non-GET methods
@@ -173,6 +174,9 @@ export function createAuthProxyHandler() {
         return true;
     };
 }
+export function resolveOasnProxyTargetUrl(upstreamBase, targetPath, search = '') {
+    return resolveOasnRelativeUrl(upstreamBase, `${targetPath}${search}`);
+}
 // ── T4: Local media serve ────────────────────────────────────────────────
 const MEDIA_DIR = '/tmp/openclaw/openagent-media';
 /** MIME type lookup for common media extensions. */
@@ -190,6 +194,12 @@ const MIME_MAP = {
     '.webp': 'image/webp',
     '.pdf': 'application/pdf',
     '.txt': 'text/plain',
+    '.md': 'text/markdown; charset=utf-8',
+    '.json': 'application/json; charset=utf-8',
+    '.zip': 'application/zip',
+    '.pptx': 'application/vnd.openxmlformats-officedocument.presentationml.presentation',
+    '.docx': 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+    '.xlsx': 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
 };
 /**
  * Serve a file from the local openagent-media directory.
@@ -230,6 +240,9 @@ function serveLocalMedia(pathname, res) {
         const stat = fs.statSync(filePath);
         res.setHeader('Content-Type', contentType);
         res.setHeader('Content-Length', stat.size);
+        if (shouldDownloadAsAttachment(contentType)) {
+            res.setHeader('Content-Disposition', `attachment; filename*=UTF-8''${encodeURIComponent(fileName)}`);
+        }
         // Allow browser to cache media for 1 hour
         res.setHeader('Cache-Control', 'private, max-age=3600');
         const stream = fs.createReadStream(filePath);
@@ -252,6 +265,12 @@ function serveLocalMedia(pathname, res) {
     }
     return true;
 }
+function shouldDownloadAsAttachment(contentType) {
+    return !contentType.startsWith('image/')
+        && !contentType.startsWith('audio/')
+        && !contentType.startsWith('video/')
+        && !contentType.startsWith('text/plain');
+}
 // ── Helpers ──────────────────────────────────────────────────────────────
 /**
  * Build headers for the upstream request.

package/dist/src/transport/oasn/oasn-http.d.ts

@@ -18,6 +18,8 @@
  *   - 业务幂等持久化（详见 oasn-invocation.ts + state/store.ts）
  *   - file_ref LRU（详见 oasn-files.ts）
  */
+import { type RequestOptions } from 'node:http';
+import { URL } from 'node:url';
 /** OASN HTTP 客户端配置 */
 export interface OasnHttpConfig {
     /** API base URL，如 `https://api.oasn.ai` */
@@ -45,6 +47,16 @@ export interface OasnRequestOptions {
     /** Abort 信号 */
     signal?: AbortSignal;
 }
+/**
+ * OpenClaw gateway may install global-agent for model/provider traffic. OASN
+ * REL endpoints should keep their original TLS hostname; otherwise a local
+ * proxy can turn `https://oasn-test...` into a certificate check against
+ * `localhost`.
+ */
+export declare function ensureOasnHostBypassesGlobalAgentProxy(hostname: string): void;
+export declare function buildNodeRequestOptions(url: URL, method: string, headers: Record<string, string>): RequestOptions & {
+    servername?: string;
+};
 export declare class OasnHttpClient {
     private _config;
     constructor(config: OasnHttpConfig);

package/dist/src/transport/oasn/oasn-http.js

@@ -25,6 +25,47 @@ import { logger } from '../../util/logger.js';
 import { makeTransportError } from '../types.js';
 const DEFAULT_TIMEOUT_MS = 30_000;
 const DEFAULT_MAX_RETRIES = 3;
+/**
+ * OpenClaw gateway may install global-agent for model/provider traffic. OASN
+ * REL endpoints should keep their original TLS hostname; otherwise a local
+ * proxy can turn `https://oasn-test...` into a certificate check against
+ * `localhost`.
+ */
+export function ensureOasnHostBypassesGlobalAgentProxy(hostname) {
+    const normalized = hostname.trim().toLowerCase();
+    if (!normalized || normalized === 'localhost' || normalized === '127.0.0.1' || normalized === '::1')
+        return;
+    const globalAgent = globalThis.GLOBAL_AGENT;
+    if (!globalAgent || typeof globalAgent !== 'object')
+        return;
+    const existing = String(globalAgent.NO_PROXY || '');
+    const entries = existing.split(/[\s,]+/).filter(Boolean);
+    if (entries.some((entry) => entry.toLowerCase() === normalized))
+        return;
+    globalAgent.NO_PROXY = entries.length > 0 ? `${entries.join(',')},${normalized}` : normalized;
+}
+function hasHeader(headers, name) {
+    const lower = name.toLowerCase();
+    return Object.keys(headers).some((key) => key.toLowerCase() === lower);
+}
+export function buildNodeRequestOptions(url, method, headers) {
+    const isHttps = url.protocol === 'https:';
+    const requestHeaders = { ...headers };
+    if (!hasHeader(requestHeaders, 'Host')) {
+        requestHeaders.Host = url.host;
+    }
+    const options = {
+        method,
+        headers: requestHeaders,
+        hostname: url.hostname,
+        port: url.port || (isHttps ? 443 : 80),
+        path: `${url.pathname}${url.search}`,
+    };
+    if (isHttps) {
+        options.servername = url.hostname;
+    }
+    return options;
+}
 // ───────────────────────────────────────────────────────────────
 // 错误转换
 // ───────────────────────────────────────────────────────────────
@@ -241,14 +282,9 @@ export class OasnHttpClient {
     _doRawRequest(url, method, headers, body, timeoutMs, signal) {
         const isHttps = url.protocol === 'https:';
         const requestFn = isHttps ? httpsRequest : httpRequest;
+        ensureOasnHostBypassesGlobalAgentProxy(url.hostname);
         return new Promise((resolve, reject) => {
-            const reqOptions = {
-                method,
-                headers,
-                hostname: url.hostname,
-                port: url.port || (isHttps ? 443 : 80),
-                path: `${url.pathname}${url.search}`,
-            };
+            const reqOptions = buildNodeRequestOptions(url, method, headers);
             let settled = false;
             let timeoutHandle;
             const finish = (fn) => {
@@ -302,14 +338,9 @@ export class OasnHttpClient {
     _doBinaryRequest(url, headers, timeoutMs, signal) {
         const isHttps = url.protocol === 'https:';
         const requestFn = isHttps ? httpsRequest : httpRequest;
+        ensureOasnHostBypassesGlobalAgentProxy(url.hostname);
         return new Promise((resolve, reject) => {
-            const reqOptions = {
-                method: 'GET',
-                headers,
-                hostname: url.hostname,
-                port: url.port || (isHttps ? 443 : 80),
-                path: `${url.pathname}${url.search}`,
-            };
+            const reqOptions = buildNodeRequestOptions(url, 'GET', headers);
             let settled = false;
             let timeoutHandle;
             const finish = (fn) => {

package/dist/src/util/url-resolver.d.ts

@@ -5,6 +5,12 @@
  * Used by remote-agent-tool (WebUI continuation) and download-file-tool (artifact download).
  */
 export declare function resolveOasnAccessUrl(accessApiBase: string | undefined, url: string): string;
+/**
+ * Resolve an OASN API/WebUI-relative path without losing env prefixes such as
+ * `/e/limj1`. `new URL('/api/..', 'https://host/e/limj1')` resets to the
+ * origin root, so use explicit path joining for env-scoped public bases.
+ */
+export declare function resolveOasnRelativeUrl(accessApiBase: string, path: string): string;
 /**
  * Resolve a WebUI continuation URL for user-facing browser clicks.
  *

package/dist/src/util/url-resolver.js

@@ -12,12 +12,22 @@ export function resolveOasnAccessUrl(accessApiBase, url) {
     if (!accessApiBase)
         return url;
     try {
-        return new URL(url, accessApiBase).toString();
+        return resolveOasnRelativeUrl(accessApiBase, url);
     }
     catch {
         return url;
     }
 }
+/**
+ * Resolve an OASN API/WebUI-relative path without losing env prefixes such as
+ * `/e/limj1`. `new URL('/api/..', 'https://host/e/limj1')` resets to the
+ * origin root, so use explicit path joining for env-scoped public bases.
+ */
+export function resolveOasnRelativeUrl(accessApiBase, path) {
+    const base = accessApiBase.replace(/\/+$/, '');
+    const suffix = path.startsWith('/') ? path : `/${path}`;
+    return new URL(`${base}${suffix}`).toString();
+}
 /**
  * Resolve a WebUI continuation URL for user-facing browser clicks.
  *
@@ -28,23 +38,29 @@ export function resolveOasnAccessUrl(accessApiBase, url) {
 export function resolveOasnWebuiUrl(accessApiBase, claimUrl, url) {
     if (!url)
         return url;
-    const claimOrigin = originOf(claimUrl);
-    if (!claimOrigin || !isWebuiUrl(url, accessApiBase || claimOrigin)) {
+    const claimPublicBase = publicBaseOfClaimUrl(claimUrl);
+    if (!claimPublicBase || !isWebuiUrl(url, accessApiBase || claimPublicBase)) {
         return resolveOasnAccessUrl(accessApiBase, url);
     }
     try {
-        const absolute = new URL(url, accessApiBase || claimOrigin);
-        return new URL(`${absolute.pathname}${absolute.search}${absolute.hash}`, claimOrigin).toString();
+        const absolute = new URL(resolveOasnAccessUrl(accessApiBase || claimPublicBase, url));
+        const webuiIndex = absolute.pathname.indexOf('/webui/');
+        const path = webuiIndex >= 0 ? absolute.pathname.slice(webuiIndex) : absolute.pathname;
+        return resolveOasnRelativeUrl(claimPublicBase, `${path}${absolute.search}${absolute.hash}`);
     }
     catch {
         return resolveOasnAccessUrl(accessApiBase, url);
     }
 }
-function originOf(value) {
+function publicBaseOfClaimUrl(value) {
     if (!value)
         return undefined;
     try {
-        return new URL(value).origin;
+        const parsed = new URL(value);
+        const claimPathIndex = parsed.pathname.indexOf('/agents/claim');
+        if (claimPathIndex <= 0)
+            return parsed.origin;
+        return `${parsed.origin}${parsed.pathname.slice(0, claimPathIndex)}`;
     }
     catch {
         return undefined;
@@ -52,7 +68,7 @@ function originOf(value) {
 }
 function isWebuiUrl(url, base) {
     try {
-        return new URL(url, base).pathname.startsWith('/webui/');
+        return /(?:^|\/)webui\//.test(new URL(resolveOasnAccessUrl(base, url)).pathname);
     }
     catch {
         return false;

package/openclaw.plugin.json

@@ -37,6 +37,11 @@
                         "description": "OASN API base URL. Required for OASN transport.",
                         "default": "https://oasn.invalid/CONFIGURE_ME"
                     },
+                    "oasn_env_id": {
+                        "type": "string",
+                        "title": "OASN Env ID",
+                        "description": "REL environment id, e.g. limj1. When api_base is not set, the plugin derives https://oasn-test.haimawan.com/e/<env_id>."
+                    },
                     "access_api_base": {
                         "type": "string",
                         "title": "OASN Access API Base URL",
@@ -70,6 +75,11 @@
                                     "description": "OASN API base URL",
                                     "default": "https://oasn.invalid/CONFIGURE_ME"
                                 },
+                                "oasn_env_id": {
+                                    "type": "string",
+                                    "title": "OASN Env ID",
+                                    "description": "REL environment id, e.g. limj1. Used to derive api_base/access_api_base when explicit URLs are omitted."
+                                },
                                 "access_api_base": {
                                     "type": "string",
                                     "title": "Access API Base URL",
@@ -130,6 +140,11 @@
                             "description": "OASN API base URL",
                             "default": "https://oasn.invalid/CONFIGURE_ME"
                         },
+                        "oasn_env_id": {
+                            "type": "string",
+                            "title": "OASN Env ID",
+                            "description": "REL environment id, e.g. limj1. Used to derive api_base/access_api_base when explicit URLs are omitted."
+                        },
                         "access_api_base": {
                             "type": "string",
                             "title": "Access API Base URL",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openclaw-openagent",
-  "version": "1.0.8",
+  "version": "1.0.9",
   "type": "module",
   "description": "OpenAgent channel plugin for OpenClaw",
   "license": "MIT",

package/src/app/remote-agent-tool.ts

@@ -26,7 +26,7 @@ import {
   type ToolUpdateCallback,
 } from './types.js';
 import { sendC2CCustomMessage, waitForC2CReply } from '../tim/c2c.js';
-import type { OasnTransport, TaskHandle, TaskRequest } from '../transport/types.js';
+import type { ArtifactRef, OasnTransport, TaskHandle, TaskRequest } from '../transport/types.js';
 import fs from 'node:fs';
 import nodePath from 'node:path';
 import { resolveOasnAccessUrl, resolveOasnWebuiUrl } from '../util/url-resolver.js';
@@ -91,6 +91,118 @@ function artifactContentToText(content: ArrayBuffer): string {
   return Buffer.from(content).toString('utf8').trim();
 }
 
+const OPENAGENT_MEDIA_DIR = '/tmp/openclaw/openagent-media';
+
+const EXT_BY_MIME: Record<string, string> = {
+  'application/json': '.json',
+  'text/markdown': '.md',
+  'text/plain': '.txt',
+  'application/pdf': '.pdf',
+  'image/png': '.png',
+  'image/jpeg': '.jpg',
+  'image/gif': '.gif',
+  'image/webp': '.webp',
+  'application/zip': '.zip',
+  'application/vnd.openxmlformats-officedocument.presentationml.presentation': '.pptx',
+  'application/vnd.openxmlformats-officedocument.wordprocessingml.document': '.docx',
+  'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet': '.xlsx',
+};
+
+function sanitizeMediaFileName(name: string): string {
+  const base = nodePath.basename(name || 'artifact');
+  return base
+    .replace(/[\0\r\n]/g, '')
+    .replace(/[/:\\]/g, '_')
+    .replace(/^\.+$/, 'artifact')
+    .slice(0, 180) || 'artifact';
+}
+
+function inferExtension(buffer: Buffer, mimeType: string): string {
+  const mime = mimeType.split(';')[0]?.trim().toLowerCase() || '';
+  const byMime = EXT_BY_MIME[mime];
+  if (byMime) return byMime;
+
+  if (buffer.subarray(0, 2).toString('latin1') === 'PK') {
+    const zipNames = buffer.toString('latin1');
+    if (zipNames.includes('[Content_Types].xml') && zipNames.includes('ppt/')) return '.pptx';
+    if (zipNames.includes('[Content_Types].xml') && zipNames.includes('word/')) return '.docx';
+    if (zipNames.includes('[Content_Types].xml') && zipNames.includes('xl/')) return '.xlsx';
+    return '.zip';
+  }
+
+  if (buffer.subarray(0, 4).toString('latin1') === '%PDF') return '.pdf';
+  if (buffer.subarray(0, 8).equals(Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]))) return '.png';
+  if (buffer.subarray(0, 3).equals(Buffer.from([0xff, 0xd8, 0xff]))) return '.jpg';
+  return '.bin';
+}
+
+function buildOasnMediaFileName(artifact: ArtifactRef, buffer: Buffer, downloadedName: string, downloadedMime: string): string {
+  const preferredName = downloadedName && downloadedName !== 'artifact'
+    ? downloadedName
+    : artifact.displayName && artifact.displayName !== 'artifact'
+      ? artifact.displayName
+      : artifact.id || 'artifact';
+
+  let safeName = sanitizeMediaFileName(preferredName);
+  if (!nodePath.extname(safeName)) {
+    safeName += inferExtension(buffer, downloadedMime || artifact.mimeType);
+  }
+  return safeName;
+}
+
+async function cacheOasnArtifactsForMedia(
+  oasnTransport: OasnTransport,
+  artifacts: ArtifactRef[],
+): Promise<string[]> {
+  const localPaths: string[] = [];
+
+  for (const artifact of artifacts) {
+    const ref = artifact.contentUrl || artifact.id;
+    if (!ref) continue;
+
+    try {
+      const downloaded = await oasnTransport.downloadArtifact(ref);
+      const buffer = Buffer.from(downloaded.content);
+      const fileName = buildOasnMediaFileName(
+        artifact,
+        buffer,
+        downloaded.displayName,
+        downloaded.mimeType,
+      );
+      const filePath = nodePath.join(OPENAGENT_MEDIA_DIR, fileName);
+      fs.mkdirSync(nodePath.dirname(filePath), { recursive: true });
+      fs.writeFileSync(filePath, buffer);
+      localPaths.push(filePath);
+      logger.info(
+        `[remote-tool] Cached OASN artifact for media: id=${artifact.id} file=${filePath} size=${buffer.byteLength}`,
+      );
+    } catch (err) {
+      logger.warn(
+        `[remote-tool] Failed to cache OASN artifact ${artifact.id || ref}: ${(err as Error).message}`,
+      );
+    }
+  }
+
+  return localPaths;
+}
+
+function mediaDownloadLabel(url: string): string {
+  let fileName = 'artifact';
+  try {
+    fileName = decodeURIComponent(new URL(url).pathname.split('/').pop() || fileName);
+  } catch {
+    fileName = decodeURIComponent(url.split('?')[0]?.split('/').pop() || fileName);
+  }
+  return sanitizeMediaFileName(fileName).replace(/[[\]\r\n]/g, ' ') || 'artifact';
+}
+
+function formatMediaDownloadLines(urls: string[]): string {
+  const lines = urls
+    .filter((url) => typeof url === 'string' && url.trim())
+    .map((url) => `- [${mediaDownloadLabel(url)}](${url})`);
+  return lines.length ? `下载链接:\n${lines.join('\n')}` : '';
+}
+
 function normalizeRemoteToolExecuteArgs(
   signalOrUpdate?: AbortSignal | ToolUpdateCallback,
   onUpdateOrContext?: ToolUpdateCallback | unknown,
@@ -322,7 +434,7 @@ export function createCallRemoteAgentTool(): ToolDescriptor {
 
           const artifacts = result.artifacts ?? [];
           let content = result.content;
-          let mediaUrls = artifacts.map((a) => a.contentUrl).filter(Boolean);
+          let mediaUrls: string[] = [];
 
           if (!content.trim()) {
             for (const textArtifact of artifacts) {
@@ -331,10 +443,6 @@ export function createCallRemoteAgentTool(): ToolDescriptor {
                 const downloaded = await oasnTransport.downloadArtifact(textArtifact.contentUrl || textArtifact.id);
                 if (isTextArtifact(downloaded)) {
                   content = artifactContentToText(downloaded.content);
-                  mediaUrls = artifacts
-                    .filter((a) => a.id !== textArtifact.id)
-                    .map((a) => a.contentUrl)
-                    .filter(Boolean);
                   break;
                 }
               } catch (err) {
@@ -379,6 +487,10 @@ export function createCallRemoteAgentTool(): ToolDescriptor {
               : `Files from remote agent:\n${artifactLines.join('\n')}`;
           }
 
+          if (artifacts.length > 0) {
+            mediaUrls = await cacheOasnArtifactsForMedia(oasnTransport, artifacts);
+          }
+
           // Resolve OASN-relative URLs in content (remote agent may have embedded
           // /webui/continuations/... or /api/artifacts/... in its output text).
           if (content && accessBase) {
@@ -388,7 +500,7 @@ export function createCallRemoteAgentTool(): ToolDescriptor {
             );
           }
 
-          // OASN 的非文本 artifacts 暂继续复用 ArtifactRef.contentUrl 作为 mediaUrls。
+          // OASN artifacts are cached locally before being handed to Gateway media rendering.
           reply = {
             status: 'complete',
             content,
@@ -468,13 +580,16 @@ export function createCallRemoteAgentTool(): ToolDescriptor {
           });
         }
 
-        // Path 1: MEDIA: lines in text for Gateway MEDIA: parser + LLM echo
+        // Path 1: explicit markdown links + MEDIA: lines for Gateway parser.
+        // The markdown block makes the link visible even when the host does not
+        // render MEDIA: attachments in assistant/tool-result bubbles.
+        const downloadLines = formatMediaDownloadLines(httpMediaUrls);
         const mediaLines = httpMediaUrls
           .map((url: string) => `MEDIA:${url}`)
           .join('\n');
-        const textWithMedia = reply.content
-          ? `${reply.content}\n${mediaLines}`
-          : mediaLines;
+        const textWithMedia = [reply.content.trim(), downloadLines, mediaLines]
+          .filter(Boolean)
+          .join('\n\n');
 
         return {
           content: [{ type: 'text' as const, text: textWithMedia }],

package/src/auth/config.ts

@@ -10,6 +10,8 @@
  */
 
 const DEFAULT_API_BASE = 'https://api.openagent.club';
+const DEFAULT_OASN_PUBLIC_ROOT = 'https://oasn-test.haimawan.com';
+const OASN_ENV_ID_RE = /^[A-Za-z0-9_-]+$/;
 /**
  * OASN 默认 API base。
  *
@@ -22,6 +24,55 @@ export function isUnconfiguredOasnApiBase(value: string | undefined): boolean {
   return !value || value === DEFAULT_OASN_API_BASE;
 }
 
+function normalizeOasnApiBase(value: unknown): string {
+  const normalized = String(value || '')
+    .trim()
+    .replace(/\/+$/, '')
+    .replace(/\/api$/, '');
+  return normalized === DEFAULT_OASN_API_BASE ? '' : normalized;
+}
+
+function normalizeOasnEnvId(value: unknown): string {
+  const envId = String(value || '').trim();
+  if (!envId) return '';
+  return OASN_ENV_ID_RE.test(envId) ? envId : '';
+}
+
+function oasnPublicBaseFromEnvId(envId: string): string {
+  const normalized = normalizeOasnEnvId(envId);
+  if (!normalized) return '';
+  const root = normalizeOasnApiBase(process.env.OASN_PUBLIC_ROOT || process.env.OPENAGENT_OASN_PUBLIC_ROOT || DEFAULT_OASN_PUBLIC_ROOT);
+  return `${root}/e/${normalized}`;
+}
+
+function resolveOasnBase({
+  accountBase,
+  channelBase,
+  envBase,
+  accountEnvId,
+  channelEnvId,
+  envEnvId,
+  fallbackBase,
+}: {
+  accountBase?: unknown;
+  channelBase?: unknown;
+  envBase?: unknown;
+  accountEnvId?: unknown;
+  channelEnvId?: unknown;
+  envEnvId?: unknown;
+  fallbackBase: string;
+}): string {
+  const configuredBase = normalizeOasnApiBase(accountBase) || normalizeOasnApiBase(channelBase);
+  if (configuredBase) return configuredBase;
+  const configuredEnvId = normalizeOasnEnvId(accountEnvId) || normalizeOasnEnvId(channelEnvId);
+  if (configuredEnvId) return oasnPublicBaseFromEnvId(configuredEnvId);
+  const ambientBase = normalizeOasnApiBase(envBase);
+  if (ambientBase) return ambientBase;
+  const ambientEnvId = normalizeOasnEnvId(envEnvId);
+  if (ambientEnvId) return oasnPublicBaseFromEnvId(ambientEnvId);
+  return fallbackBase;
+}
+
 /**
  * Transport 类型 —— v3.9+ 双轨抽象。
  *
@@ -132,19 +183,37 @@ export function resolveOpenagentAccount(
   const envApiBase = transport === 'oasn'
     ? (process.env.OASN_API_BASE || process.env.OPENAGENT_OASN_API_BASE || '')
     : '';
-  const apiBase = (targetAcc['api_base'] || targetAcc['apiBase']
-    || clCfg['api_base']
-    || clCfg['apiBase']
-    || envApiBase
-    || fallbackApiBase) as string;
+  const apiBase = transport === 'oasn'
+    ? resolveOasnBase({
+        accountBase: targetAcc['api_base'] || targetAcc['apiBase'],
+        channelBase: clCfg['api_base'] || clCfg['apiBase'],
+        envBase: envApiBase,
+        accountEnvId: targetAcc['oasn_env_id'] || targetAcc['oasnEnvId'] || targetAcc['env_id'] || targetAcc['envId'],
+        channelEnvId: clCfg['oasn_env_id'] || clCfg['oasnEnvId'] || clCfg['env_id'] || clCfg['envId'],
+        envEnvId: process.env.OASN_ENV_ID || process.env.OPENAGENT_OASN_ENV_ID,
+        fallbackBase: fallbackApiBase,
+      })
+    : (targetAcc['api_base'] || targetAcc['apiBase']
+        || clCfg['api_base']
+        || clCfg['apiBase']
+        || fallbackApiBase) as string;
   const envAccessApiBase = transport === 'oasn'
     ? (process.env.OASN_ACCESS_API_BASE || process.env.OPENAGENT_OASN_ACCESS_API_BASE || '')
     : '';
-  const accessApiBase = (targetAcc['access_api_base'] || targetAcc['accessApiBase']
-    || clCfg['access_api_base']
-    || clCfg['accessApiBase']
-    || envAccessApiBase
-    || apiBase) as string;
+  const accessApiBase = transport === 'oasn'
+    ? resolveOasnBase({
+        accountBase: targetAcc['access_api_base'] || targetAcc['accessApiBase'],
+        channelBase: clCfg['access_api_base'] || clCfg['accessApiBase'],
+        envBase: envAccessApiBase,
+        accountEnvId: targetAcc['oasn_env_id'] || targetAcc['oasnEnvId'] || targetAcc['env_id'] || targetAcc['envId'],
+        channelEnvId: clCfg['oasn_env_id'] || clCfg['oasnEnvId'] || clCfg['env_id'] || clCfg['envId'],
+        envEnvId: process.env.OASN_ENV_ID || process.env.OPENAGENT_OASN_ENV_ID,
+        fallbackBase: apiBase,
+      })
+    : (targetAcc['access_api_base'] || targetAcc['accessApiBase']
+        || clCfg['access_api_base']
+        || clCfg['accessApiBase']
+        || apiBase) as string;
   const claimUrl = (targetAcc['claim_url'] || targetAcc['claimUrl'] || clCfg['claim_url'] || clCfg['claimUrl'] || '') as string;
   const rawStatus = (targetAcc['status'] || targetAcc['claim_status'] || targetAcc['claimStatus'] || clCfg['status'] || '') as string;
   const normalizedStatus = normalizeClaimStatus(rawStatus, agentId, apiKey);

package/src/channel.ts

@@ -13,6 +13,7 @@ import { registry } from './runtime/registry.js';
 import { AccountRuntime } from './runtime/account.js';
 
 import { logger } from './util/logger.js';
+import { resolveOasnRelativeUrl } from './util/url-resolver.js';
 import * as timMessages from './tim/messages.js';
 
 const API_BASE = 'https://api.clawlink.club';
@@ -544,7 +545,7 @@ async function claimOasnAgent(
   agentId: string,
   ownerEmail: string,
 ): Promise<Record<string, unknown>> {
-  const res = await fetch(new URL('/api/agents/claim', apiBase), {
+  const res = await fetch(resolveOasnRelativeUrl(apiBase, '/api/agents/claim'), {
     method: 'POST',
     headers: {
       'Content-Type': 'application/json',