openclaw 2026.4.23-beta.5 → 2026.4.23

package/CHANGELOG.md

@@ -81,6 +81,8 @@ Docs: https://docs.openclaw.ai
 - Codex harness/status: pin embedded harness selection per session, show active non-PI harness ids such as `codex` in `/status`, and keep legacy transcripts on PI until `/new` or `/reset` so config changes cannot hot-switch existing sessions.
 - Gateway/security: fail closed on agent-driven `gateway config.apply`/`config.patch` runtime edits by allowlisting a narrow set of agent-tunable prompt, model, and mention-gating paths (including Telegram topic-level `requireMention`) instead of relying on a hand-maintained denylist of protected subtrees that could miss new sensitive config keys. (#70726) Thanks @drobison00.
 - Webhooks/security: re-resolve `SecretRef`-backed webhook route secrets on each request so `openclaw secrets reload` revokes the previous secret immediately instead of waiting for a gateway restart. (#70727) Thanks @drobison00.
+- Memory/dreaming: decouple the managed dreaming cron from heartbeat by running it as an isolated lightweight agent turn, so dreaming runs even when heartbeat is disabled for the default agent and is no longer skipped by `heartbeat.activeHours`. `openclaw doctor --fix` migrates stale main-session dreaming jobs in persisted cron configs to the new shape. Fixes #69811, #67397, #68972. (#70737) Thanks @jalehman.
+- Agents/CLI: keep `--agent` plus `--session-id` lookup scoped to the requested agent store, so explicit agent resumes cannot select another agent's session. (#70985) Thanks @frankekn.
 
 ## 2026.4.22
 

package/dist/.buildstamp

@@ -1 +1 @@
-{"builtAt":1777024755032,"head":"aee7c4ef8629cc4e1a8413cfce7efe9c4a2fb7ce"}
+{"builtAt":1777047963511,"head":"a9797214338ba31c52c796adbb75afb16e0684a9"}

package/dist/abort-CyX5Ib18.js

@@ -0,0 +1,201 @@
+import { i as formatErrorMessage } from "./errors-CS5wW5eD.js";
+import { c as normalizeOptionalString, s as normalizeOptionalLowercaseString } from "./string-coerce-CjxCKZ6B.js";
+import { r as logVerbose } from "./globals-Bo8QPRgM.js";
+import { x as parseAgentSessionKey } from "./session-key-Cn2QoOyX.js";
+import { p as resolveSessionAgentId } from "./agent-scope-DV_DrBWg.js";
+import { o as updateSessionStore, u as resolveSessionStoreEntry } from "./store-D05p-Y0n.js";
+import "./sessions-BUydSdf4.js";
+import { u as resolveStorePath } from "./paths-CfltKDEL.js";
+import { t as loadSessionStore } from "./store-load-p4WFlm7F.js";
+import { l as resolveInternalSessionKey, u as resolveMainSessionAlias } from "./sessions-helpers-di74wxE7.js";
+import { a as clearSessionQueues } from "./queue-liT_S2gH.js";
+import { h as replyRunRegistry, t as abortEmbeddedPiRun } from "./runs-D1b6O9yq.js";
+import { a as getLatestSubagentRunByChildSessionKey, d as markSubagentRunTerminated, l as listSubagentRunsForController } from "./subagent-registry-zgPENVv0.js";
+import { i as setAbortMemory, n as isAbortRequestText } from "./abort-primitives-DjTToLu8.js";
+import { o as stripMentions, s as stripStructuralPrefixes } from "./mentions-CfR0bgAU.js";
+import { t as resolveCommandAuthorization } from "./command-auth-uwcdpNSx.js";
+import { a as shouldPersistAbortCutoff, i as resolveAbortCutoffFromContext, t as applyAbortCutoffToSessionEntry } from "./abort-cutoff-OSaLkZ2o.js";
+import { n as getAcpSessionManager } from "./manager-BRE42nRU.js";
+const abortDeps = {
+	getAcpSessionManager,
+	abortEmbeddedPiRun,
+	getLatestSubagentRunByChildSessionKey,
+	listSubagentRunsForController,
+	markSubagentRunTerminated
+};
+function formatAbortReplyText(stoppedSubagents) {
+	if (typeof stoppedSubagents !== "number" || stoppedSubagents <= 0) return "⚙️ Agent was aborted.";
+	return `⚙️ Agent was aborted. Stopped ${stoppedSubagents} ${stoppedSubagents === 1 ? "sub-agent" : "sub-agents"}.`;
+}
+function resolveSessionEntryForKey(store, sessionKey) {
+	if (!store || !sessionKey) return {};
+	const resolved = resolveSessionStoreEntry({
+		store,
+		sessionKey
+	});
+	if (resolved.existing) return resolved.legacyKeys.length > 0 ? {
+		entry: resolved.existing,
+		key: resolved.normalizedKey,
+		legacyKeys: resolved.legacyKeys
+	} : {
+		entry: resolved.existing,
+		key: resolved.normalizedKey
+	};
+	return {};
+}
+function normalizeRequesterSessionKey(cfg, key) {
+	const cleaned = normalizeOptionalString(key);
+	if (!cleaned) return;
+	const { mainKey, alias } = resolveMainSessionAlias(cfg);
+	return resolveInternalSessionKey({
+		key: cleaned,
+		alias,
+		mainKey
+	});
+}
+function stopSubagentsForRequester(params) {
+	const requesterKey = normalizeRequesterSessionKey(params.cfg, params.requesterSessionKey);
+	if (!requesterKey) return { stopped: 0 };
+	const dedupedRunsByChildKey = /* @__PURE__ */ new Map();
+	for (const run of abortDeps.listSubagentRunsForController(requesterKey)) {
+		const childKey = normalizeOptionalString(run.childSessionKey);
+		if (!childKey) continue;
+		const latest = abortDeps.getLatestSubagentRunByChildSessionKey(childKey);
+		if (!latest) {
+			const existing = dedupedRunsByChildKey.get(childKey);
+			if (!existing || run.createdAt >= existing.createdAt) dedupedRunsByChildKey.set(childKey, run);
+			continue;
+		}
+		const latestControllerSessionKey = normalizeOptionalString(latest?.controllerSessionKey) ?? normalizeOptionalString(latest?.requesterSessionKey);
+		if (latest.runId !== run.runId || latestControllerSessionKey !== requesterKey) continue;
+		const existing = dedupedRunsByChildKey.get(childKey);
+		if (!existing || run.createdAt >= existing.createdAt) dedupedRunsByChildKey.set(childKey, run);
+	}
+	const runs = Array.from(dedupedRunsByChildKey.values());
+	if (runs.length === 0) return { stopped: 0 };
+	const storeCache = /* @__PURE__ */ new Map();
+	const seenChildKeys = /* @__PURE__ */ new Set();
+	let stopped = 0;
+	for (const run of runs) {
+		const childKey = normalizeOptionalString(run.childSessionKey);
+		if (!childKey || seenChildKeys.has(childKey)) continue;
+		seenChildKeys.add(childKey);
+		if (!run.endedAt) {
+			const cleared = clearSessionQueues([childKey]);
+			const parsed = parseAgentSessionKey(childKey);
+			const storePath = resolveStorePath(params.cfg.session?.store, { agentId: parsed?.agentId });
+			let store = storeCache.get(storePath);
+			if (!store) {
+				store = loadSessionStore(storePath);
+				storeCache.set(storePath, store);
+			}
+			const entry = store[childKey];
+			const sessionId = replyRunRegistry.resolveSessionId(childKey) ?? entry?.sessionId;
+			const aborted = (childKey ? replyRunRegistry.abort(childKey) : false) || (sessionId ? abortDeps.abortEmbeddedPiRun(sessionId) : false);
+			if (abortDeps.markSubagentRunTerminated({
+				runId: run.runId,
+				childSessionKey: childKey,
+				reason: "killed"
+			}) > 0 || aborted || cleared.followupCleared > 0 || cleared.laneCleared > 0) stopped += 1;
+		}
+		const cascadeResult = stopSubagentsForRequester({
+			cfg: params.cfg,
+			requesterSessionKey: childKey
+		});
+		stopped += cascadeResult.stopped;
+	}
+	if (stopped > 0) logVerbose(`abort: stopped ${stopped} subagent run(s) for ${requesterKey}`);
+	return { stopped };
+}
+async function tryFastAbortFromMessage(params) {
+	const { ctx, cfg } = params;
+	const targetKey = normalizeOptionalString(ctx.CommandTargetSessionKey) ?? normalizeOptionalString(ctx.SessionKey);
+	const raw = stripStructuralPrefixes(ctx.CommandBody ?? ctx.RawBody ?? ctx.Body ?? "");
+	if (!isAbortRequestText(normalizeOptionalLowercaseString(ctx.ChatType) === "group" ? stripMentions(raw, ctx, cfg, resolveSessionAgentId({
+		sessionKey: targetKey ?? ctx.SessionKey ?? "",
+		config: cfg
+	})) : raw)) return {
+		handled: false,
+		aborted: false
+	};
+	const commandAuthorized = ctx.CommandAuthorized;
+	const auth = resolveCommandAuthorization({
+		ctx,
+		cfg,
+		commandAuthorized
+	});
+	if (!auth.isAuthorizedSender) return {
+		handled: false,
+		aborted: false
+	};
+	const agentId = resolveSessionAgentId({
+		sessionKey: targetKey ?? ctx.SessionKey ?? "",
+		config: cfg
+	});
+	const abortKey = targetKey ?? auth.from ?? auth.to;
+	const requesterSessionKey = targetKey ?? ctx.SessionKey ?? abortKey;
+	if (targetKey) {
+		const storePath = resolveStorePath(cfg.session?.store, { agentId });
+		const store = loadSessionStore(storePath);
+		const { entry, key, legacyKeys } = resolveSessionEntryForKey(store, targetKey);
+		const resolvedTargetKey = key ?? targetKey;
+		const acpManager = abortDeps.getAcpSessionManager();
+		if (acpManager.resolveSession({
+			cfg,
+			sessionKey: resolvedTargetKey
+		}).kind !== "none") try {
+			await acpManager.cancelSession({
+				cfg,
+				sessionKey: resolvedTargetKey,
+				reason: "fast-abort"
+			});
+		} catch (error) {
+			logVerbose(`abort: ACP cancel failed for ${resolvedTargetKey}: ${formatErrorMessage(error)}`);
+		}
+		const sessionId = replyRunRegistry.resolveSessionId(resolvedTargetKey) ?? entry?.sessionId;
+		const aborted = replyRunRegistry.abort(resolvedTargetKey) || (sessionId ? abortDeps.abortEmbeddedPiRun(sessionId) : false);
+		const cleared = clearSessionQueues([resolvedTargetKey, sessionId]);
+		if (cleared.followupCleared > 0 || cleared.laneCleared > 0) logVerbose(`abort: cleared followups=${cleared.followupCleared} lane=${cleared.laneCleared} keys=${cleared.keys.join(",")}`);
+		const abortCutoff = shouldPersistAbortCutoff({
+			commandSessionKey: ctx.SessionKey,
+			targetSessionKey: resolvedTargetKey
+		}) ? resolveAbortCutoffFromContext(ctx) : void 0;
+		if (entry && key) {
+			entry.abortedLastRun = true;
+			applyAbortCutoffToSessionEntry(entry, abortCutoff);
+			entry.updatedAt = Date.now();
+			store[key] = entry;
+			for (const legacyKey of legacyKeys ?? []) if (legacyKey !== key) delete store[legacyKey];
+			await updateSessionStore(storePath, (nextStore) => {
+				const nextEntry = nextStore[key] ?? entry;
+				if (!nextEntry) return;
+				nextEntry.abortedLastRun = true;
+				applyAbortCutoffToSessionEntry(nextEntry, abortCutoff);
+				nextEntry.updatedAt = Date.now();
+				nextStore[key] = nextEntry;
+				for (const legacyKey of legacyKeys ?? []) if (legacyKey !== key) delete nextStore[legacyKey];
+			});
+		} else if (abortKey) setAbortMemory(abortKey, true);
+		const { stopped } = stopSubagentsForRequester({
+			cfg,
+			requesterSessionKey
+		});
+		return {
+			handled: true,
+			aborted,
+			stoppedSubagents: stopped
+		};
+	}
+	if (abortKey) setAbortMemory(abortKey, true);
+	const { stopped } = stopSubagentsForRequester({
+		cfg,
+		requesterSessionKey
+	});
+	return {
+		handled: true,
+		aborted: false,
+		stoppedSubagents: stopped
+	};
+}
+//#endregion
+export { tryFastAbortFromMessage as i, resolveSessionEntryForKey as n, stopSubagentsForRequester as r, formatAbortReplyText as t };

package/dist/abort.runtime-BfxSO7Lu.js

@@ -0,0 +1,2 @@
+import { i as tryFastAbortFromMessage, t as formatAbortReplyText } from "./abort-CyX5Ib18.js";
+export { formatAbortReplyText, tryFastAbortFromMessage };

package/dist/abort.runtime.js

@@ -1 +1 @@
-export * from "./abort.runtime-BIL5GBVQ.js";
+export * from "./abort.runtime-BfxSO7Lu.js";

package/dist/accounts-BefVN8Cp.js

@@ -0,0 +1,2 @@
+import { i as resolveZaloAccount } from "./accounts-CzZ0OjG3.js";
+export { resolveZaloAccount };

package/dist/accounts-CZvkhMlw.js

@@ -0,0 +1,107 @@
+import { n as normalizeAccountId$1, r as normalizeOptionalAccountId, t as DEFAULT_ACCOUNT_ID } from "./account-id-BM1T6029.js";
+import { t as resolveAccountEntry } from "./account-lookup-CeMMaXmv.js";
+import { o as tryReadSecretFileSync } from "./secret-file-D8oF5NCW.js";
+import "./core-Ct-DQVbS.js";
+import "./account-resolution-DH1x1uBM.js";
+//#region extensions/line/src/accounts.ts
+function readFileIfExists(filePath) {
+	return tryReadSecretFileSync(filePath, "LINE credential file", { rejectSymlink: true });
+}
+function resolveToken(params) {
+	const { accountId, baseConfig, accountConfig } = params;
+	if (accountConfig?.channelAccessToken?.trim()) return {
+		token: accountConfig.channelAccessToken.trim(),
+		tokenSource: "config"
+	};
+	const accountFileToken = readFileIfExists(accountConfig?.tokenFile);
+	if (accountFileToken) return {
+		token: accountFileToken,
+		tokenSource: "file"
+	};
+	if (accountId === "default") {
+		if (baseConfig?.channelAccessToken?.trim()) return {
+			token: baseConfig.channelAccessToken.trim(),
+			tokenSource: "config"
+		};
+		const baseFileToken = readFileIfExists(baseConfig?.tokenFile);
+		if (baseFileToken) return {
+			token: baseFileToken,
+			tokenSource: "file"
+		};
+		const envToken = process.env.LINE_CHANNEL_ACCESS_TOKEN?.trim();
+		if (envToken) return {
+			token: envToken,
+			tokenSource: "env"
+		};
+	}
+	return {
+		token: "",
+		tokenSource: "none"
+	};
+}
+function resolveSecret(params) {
+	const { accountId, baseConfig, accountConfig } = params;
+	if (accountConfig?.channelSecret?.trim()) return accountConfig.channelSecret.trim();
+	const accountFileSecret = readFileIfExists(accountConfig?.secretFile);
+	if (accountFileSecret) return accountFileSecret;
+	if (accountId === "default") {
+		if (baseConfig?.channelSecret?.trim()) return baseConfig.channelSecret.trim();
+		const baseFileSecret = readFileIfExists(baseConfig?.secretFile);
+		if (baseFileSecret) return baseFileSecret;
+		const envSecret = process.env.LINE_CHANNEL_SECRET?.trim();
+		if (envSecret) return envSecret;
+	}
+	return "";
+}
+function resolveLineAccount(params) {
+	const cfg = params.cfg;
+	const accountId = normalizeAccountId$1(params.accountId ?? resolveDefaultLineAccountId(cfg));
+	const lineConfig = cfg.channels?.line;
+	const accounts = lineConfig?.accounts;
+	const accountConfig = accountId !== "default" ? resolveAccountEntry(accounts, accountId) : void 0;
+	const { token, tokenSource } = resolveToken({
+		accountId,
+		baseConfig: lineConfig,
+		accountConfig
+	});
+	const secret = resolveSecret({
+		accountId,
+		baseConfig: lineConfig,
+		accountConfig
+	});
+	const { accounts: _ignoredAccounts, defaultAccount: _ignoredDefaultAccount, ...lineBase } = lineConfig ?? {};
+	const mergedConfig = {
+		...lineBase,
+		...accountConfig
+	};
+	const enabled = accountConfig?.enabled ?? (accountId === "default" ? lineConfig?.enabled ?? true : false);
+	return {
+		accountId,
+		name: accountConfig?.name ?? (accountId === "default" ? lineConfig?.name : void 0),
+		enabled,
+		channelAccessToken: token,
+		channelSecret: secret,
+		tokenSource,
+		config: mergedConfig
+	};
+}
+function listLineAccountIds(cfg) {
+	const lineConfig = cfg.channels?.line;
+	const accounts = lineConfig?.accounts;
+	const ids = /* @__PURE__ */ new Set();
+	if (lineConfig?.channelAccessToken?.trim() || lineConfig?.tokenFile || process.env.LINE_CHANNEL_ACCESS_TOKEN?.trim()) ids.add(DEFAULT_ACCOUNT_ID);
+	if (accounts) for (const id of Object.keys(accounts)) ids.add(id);
+	return Array.from(ids);
+}
+function resolveDefaultLineAccountId(cfg) {
+	const preferred = normalizeOptionalAccountId((cfg.channels?.line)?.defaultAccount);
+	if (preferred && listLineAccountIds(cfg).some((accountId) => normalizeAccountId$1(accountId) === preferred)) return preferred;
+	const ids = listLineAccountIds(cfg);
+	if (ids.includes("default")) return DEFAULT_ACCOUNT_ID;
+	return ids[0] ?? "default";
+}
+function normalizeAccountId(accountId) {
+	return normalizeAccountId$1(accountId);
+}
+//#endregion
+export { resolveLineAccount as i, normalizeAccountId as n, resolveDefaultLineAccountId as r, listLineAccountIds as t };

package/dist/accounts-CzZ0OjG3.js

@@ -0,0 +1,104 @@
+import { c as normalizeOptionalString } from "./string-coerce-CjxCKZ6B.js";
+import { c as normalizeResolvedSecretInputString, l as normalizeSecretInputString } from "./types.secrets-BZ6RGKR0.js";
+import { n as normalizeAccountId, t as DEFAULT_ACCOUNT_ID } from "./account-id-BM1T6029.js";
+import { t as resolveAccountEntry } from "./account-lookup-CeMMaXmv.js";
+import "./text-runtime-BoTf6fkP.js";
+import { s as resolveMergedAccountConfig, t as createAccountListHelpers } from "./account-helpers-YjrnBOFI.js";
+import { o as tryReadSecretFileSync } from "./secret-file-D8oF5NCW.js";
+import "./core-Ct-DQVbS.js";
+import "./routing-dukHeVr4.js";
+import "./secret-input-C8TbEBr-.js";
+//#region extensions/zalo/src/token.ts
+function readTokenFromFile(tokenFile) {
+	return tryReadSecretFileSync(tokenFile, "Zalo token file", { rejectSymlink: true }) ?? "";
+}
+function resolveZaloToken(config, accountId, options) {
+	const resolvedAccountId = normalizeAccountId(accountId ?? config?.defaultAccount);
+	const isDefaultAccount = resolvedAccountId === DEFAULT_ACCOUNT_ID;
+	const baseConfig = config;
+	const accountConfig = resolveAccountEntry(baseConfig?.accounts, normalizeAccountId(resolvedAccountId));
+	const accountHasBotToken = Boolean(accountConfig && Object.prototype.hasOwnProperty.call(accountConfig, "botToken"));
+	if (accountConfig && accountHasBotToken) {
+		const token = options?.allowUnresolvedSecretRef ? normalizeSecretInputString(accountConfig.botToken) : normalizeResolvedSecretInputString({
+			value: accountConfig.botToken,
+			path: `channels.zalo.accounts.${resolvedAccountId}.botToken`
+		});
+		if (token) return {
+			token,
+			source: "config"
+		};
+		const fileToken = readTokenFromFile(accountConfig.tokenFile);
+		if (fileToken) return {
+			token: fileToken,
+			source: "configFile"
+		};
+	}
+	if (!accountHasBotToken) {
+		const fileToken = readTokenFromFile(accountConfig?.tokenFile);
+		if (fileToken) return {
+			token: fileToken,
+			source: "configFile"
+		};
+	}
+	if (!accountHasBotToken) {
+		const token = options?.allowUnresolvedSecretRef ? normalizeSecretInputString(baseConfig?.botToken) : normalizeResolvedSecretInputString({
+			value: baseConfig?.botToken,
+			path: "channels.zalo.botToken"
+		});
+		if (token) return {
+			token,
+			source: "config"
+		};
+		const fileToken = readTokenFromFile(baseConfig?.tokenFile);
+		if (fileToken) return {
+			token: fileToken,
+			source: "configFile"
+		};
+	}
+	if (isDefaultAccount) {
+		const envToken = process.env.ZALO_BOT_TOKEN?.trim();
+		if (envToken) return {
+			token: envToken,
+			source: "env"
+		};
+	}
+	return {
+		token: "",
+		source: "none"
+	};
+}
+//#endregion
+//#region extensions/zalo/src/accounts.ts
+const { listAccountIds: listZaloAccountIds, resolveDefaultAccountId: resolveDefaultZaloAccountId } = createAccountListHelpers("zalo");
+function mergeZaloAccountConfig(cfg, accountId) {
+	return resolveMergedAccountConfig({
+		channelConfig: cfg.channels?.zalo,
+		accounts: (cfg.channels?.zalo)?.accounts,
+		accountId,
+		omitKeys: ["defaultAccount"]
+	});
+}
+function resolveZaloAccount(params) {
+	const accountId = normalizeAccountId(params.accountId ?? (params.cfg.channels?.zalo)?.defaultAccount);
+	const baseEnabled = (params.cfg.channels?.zalo)?.enabled !== false;
+	const merged = mergeZaloAccountConfig(params.cfg, accountId);
+	const accountEnabled = merged.enabled !== false;
+	const enabled = baseEnabled && accountEnabled;
+	const tokenResolution = resolveZaloToken(params.cfg.channels?.zalo, accountId, { allowUnresolvedSecretRef: params.allowUnresolvedSecretRef });
+	return {
+		accountId,
+		name: normalizeOptionalString(merged.name),
+		enabled,
+		token: tokenResolution.token,
+		tokenSource: tokenResolution.source,
+		config: merged
+	};
+}
+function listEnabledZaloAccounts(cfg) {
+	return listZaloAccountIds(cfg).map((accountId) => resolveZaloAccount({
+		cfg,
+		accountId
+	})).filter((account) => account.enabled);
+}
+//#endregion
+export { resolveZaloToken as a, resolveZaloAccount as i, listZaloAccountIds as n, resolveDefaultZaloAccountId as r, listEnabledZaloAccounts as t };