promptfoo 0.121.1 → 0.121.3

package/dist/src/{openclaw-BiSZPL7J.js → openclaw-D1FSCps-.js}

@@ -1,90 +1,111 @@
-import { b as getEnvString, i as logger } from "./logger-DLcq4dWf.js";
-import { P as VERSION, p as REQUEST_TIMEOUT_MS, t as fetchWithProxy } from "./fetch-4M3YRaqL.js";
-import "./esm-CaIwzWR5.js";
-import "./types-CN_TZ2GJ.js";
-import "./cache-D3eqDYGU.js";
+import { C as getEnvString, a as logger } from "./logger-BnkjG2jt.js";
+import { P as VERSION, p as REQUEST_TIMEOUT_MS, t as fetchWithProxy } from "./fetch-BiYv2BZc.js";
+import "./esm-CKWP3u_P.js";
+import "./types-Cd3ygw8W.js";
+import "./cache-HP0NP4k3.js";
 import "./genaiTracer-70Z8BIuV.js";
-import "./pythonUtils-D6fwaDSg.js";
-import "./util-5cB-L7U3.js";
-import { t as OpenAiChatCompletionProvider } from "./chat-BKm79wib.js";
-import "./transform-DGxXocjk.js";
-import { t as OpenAiResponsesProvider } from "./responses-jxdehPkC.js";
-import "./openai-j-sE2O7r.js";
-import "./util-6-GqIvzS.js";
+import "./pythonUtils-Bzwbgpbg.js";
+import "./util-BLvy9qfE.js";
+import { t as OpenAiChatCompletionProvider } from "./chat-B0iaWhoh.js";
+import "./transform-B2-jIv68.js";
+import { t as OpenAiResponsesProvider } from "./responses-CgNyTPsY.js";
+import "./openai-D6wITiVn.js";
+import "./util-BtoGs5Cb.js";
 import fs from "fs";
 import path from "path";
 import os from "os";
 import crypto from "crypto";
 import WebSocket from "ws";
+import JSON5 from "json5";
 //#region src/providers/openclaw/shared.ts
 const DEFAULT_GATEWAY_PORT = 18789;
 const DEFAULT_GATEWAY_HOST = "127.0.0.1";
 /**
-* Strip JSON5 syntax (comments and trailing commas) for JSON.parse compatibility.
-* Uses a state machine to avoid corrupting strings containing // or slash characters.
-*/
-function stripJson5Syntax(raw) {
-	let result = "";
-	let i = 0;
-	let inString = false;
-	let stringQuote = "";
-	let escape = false;
-	while (i < raw.length) {
-		const ch = raw[i];
-		if (inString) {
-			result += ch;
-			if (escape) escape = false;
-			else if (ch === "\\") escape = true;
-			else if (ch === stringQuote) inString = false;
-			i++;
-			continue;
-		}
-		if (ch === "\"" || ch === "'") {
-			inString = true;
-			stringQuote = ch;
-			result += ch;
-			i++;
-		} else if (ch === "/" && raw[i + 1] === "/") while (i < raw.length && raw[i] !== "\n") i++;
-		else if (ch === "/" && raw[i + 1] === "*") {
-			i += 2;
-			while (i < raw.length - 1 && !(raw[i] === "*" && raw[i + 1] === "/")) i++;
-			if (i < raw.length - 1 && raw[i] === "*" && raw[i + 1] === "/") i += 2;
-		} else if (ch === ",") {
-			let j = i + 1;
-			while (j < raw.length && (raw[j] === " " || raw[j] === "	" || raw[j] === "\n" || raw[j] === "\r")) j++;
-			if (j < raw.length && (raw[j] === "}" || raw[j] === "]")) i++;
-			else {
-				result += ch;
-				i++;
-			}
-		} else {
-			result += ch;
-			i++;
-		}
-	}
-	return result;
-}
-/**
 * Cached config to avoid re-reading the file multiple times during provider init.
 */
 let cachedConfig;
+let cachedConfigPath;
+function resolveConfigPath(env) {
+	return env?.OPENCLAW_CONFIG_PATH || getEnvString("OPENCLAW_CONFIG_PATH") || path.join(os.homedir(), ".openclaw", "openclaw.json");
+}
+function normalizeGatewayUrl(url, transport) {
+	const trimmed = url.trim();
+	if (!trimmed) return;
+	if (transport === "http") {
+		if (trimmed.startsWith("wss://")) return `https://${trimmed.slice(6)}`;
+		if (trimmed.startsWith("ws://")) return `http://${trimmed.slice(5)}`;
+		return trimmed;
+	}
+	if (trimmed.startsWith("https://")) return `wss://${trimmed.slice(8)}`;
+	if (trimmed.startsWith("http://")) return `ws://${trimmed.slice(7)}`;
+	return trimmed;
+}
+function resolveGatewayHost(gatewayConfig) {
+	const bind = gatewayConfig?.bind?.trim();
+	const customBindHost = gatewayConfig?.customBindHost?.trim();
+	if (!bind || bind === "auto" || bind === "loopback" || bind === "lan" || bind === "tailnet" || bind === "0.0.0.0" || bind === "::" || bind === "127.0.0.1" || bind === "localhost" || bind === "::1") return DEFAULT_GATEWAY_HOST;
+	if (bind === "custom") {
+		if (!customBindHost || customBindHost === "0.0.0.0" || customBindHost === "::" || customBindHost === "127.0.0.1" || customBindHost === "localhost" || customBindHost === "::1") return DEFAULT_GATEWAY_HOST;
+		return customBindHost;
+	}
+	return bind;
+}
+function buildLocalGatewayUrl(gatewayConfig, transport) {
+	const scheme = transport === "ws" ? gatewayConfig?.tls?.enabled ? "wss" : "ws" : gatewayConfig?.tls?.enabled ? "https" : "http";
+	const port = gatewayConfig?.port ?? 18789;
+	return `${scheme}://${resolveGatewayHost(gatewayConfig)}:${port}`;
+}
+function resolveGatewayUrlFromConfig(openclawConfig, transport) {
+	const gatewayConfig = openclawConfig?.gateway;
+	if (!gatewayConfig) return;
+	if (gatewayConfig.mode === "remote") {
+		const remoteUrl = normalizeGatewayUrl(gatewayConfig.remote?.url ?? "", transport);
+		if (remoteUrl) return remoteUrl;
+	}
+	return buildLocalGatewayUrl(gatewayConfig, transport);
+}
+function toAuthSecret(kind, value) {
+	const trimmed = value?.trim();
+	return trimmed ? {
+		kind,
+		value: trimmed
+	} : void 0;
+}
+function resolveAuthSecretFromConfig(openclawConfig) {
+	const gatewayConfig = openclawConfig?.gateway;
+	const authMode = gatewayConfig?.auth?.mode?.trim();
+	const preferRemoteCredentials = gatewayConfig?.mode === "remote";
+	const localToken = toAuthSecret("token", gatewayConfig?.auth?.token);
+	const localPassword = toAuthSecret("password", gatewayConfig?.auth?.password);
+	const remoteToken = toAuthSecret("token", gatewayConfig?.remote?.token);
+	const remotePassword = toAuthSecret("password", gatewayConfig?.remote?.password);
+	if (preferRemoteCredentials) {
+		if (authMode === "password") return remotePassword || localPassword || remoteToken || localToken;
+		if (authMode === "token") return remoteToken || localToken || remotePassword || localPassword;
+		return remoteToken || remotePassword || localToken || localPassword;
+	}
+	if (authMode === "password") return localPassword || remotePassword || localToken || remoteToken;
+	if (authMode === "token") return localToken || remoteToken || localPassword || remotePassword;
+	return localToken || localPassword || remoteToken || remotePassword;
+}
 /**
-* Read and parse the OpenClaw configuration file.
+* Read and parse the active OpenClaw configuration file.
 * Results are cached based on file modification time.
 * Returns undefined if the file doesn't exist or can't be parsed.
 */
-function readOpenClawConfig() {
-	const configPath = path.join(os.homedir(), ".openclaw", "openclaw.json");
+function readOpenClawConfig(env) {
+	const configPath = resolveConfigPath(env);
 	try {
 		if (!fs.existsSync(configPath)) return;
 		const mtime = fs.statSync(configPath).mtimeMs;
-		if (cachedConfig && cachedConfig.mtime === mtime) return cachedConfig.config;
-		const cleaned = stripJson5Syntax(fs.readFileSync(configPath, "utf-8"));
-		const config = JSON.parse(cleaned);
+		if (cachedConfig && cachedConfigPath === configPath && cachedConfig.mtime === mtime) return cachedConfig.config;
+		const raw = fs.readFileSync(configPath, "utf-8");
+		const config = JSON5.parse(raw);
 		cachedConfig = {
 			config,
 			mtime
 		};
+		cachedConfigPath = configPath;
 		return config;
 	} catch (err) {
 		logger.debug(`Failed to read OpenClaw config at ${configPath}: ${err}`);
@@ -92,28 +113,50 @@ function readOpenClawConfig() {
 	}
 }
 /**
-* Auto-detect the OpenClaw gateway URL from config, env overrides, or environment.
+* Auto-detect the OpenClaw gateway URL from config, env overrides, or the active config file.
 */
 function resolveGatewayUrl(config, env) {
-	if (config?.gateway_url) return config.gateway_url;
-	const envUrl = env?.OPENCLAW_GATEWAY_URL || getEnvString("OPENCLAW_GATEWAY_URL");
-	if (envUrl) return envUrl;
-	const openclawConfig = readOpenClawConfig();
-	if (openclawConfig?.gateway) {
-		const port = openclawConfig.gateway.port ?? 18789;
-		const bind = openclawConfig.gateway.bind;
-		return `http://${!bind || bind === "loopback" || bind === "0.0.0.0" || bind === "::" ? DEFAULT_GATEWAY_HOST : bind}:${port}`;
-	}
-	return `http://${DEFAULT_GATEWAY_HOST}:${DEFAULT_GATEWAY_PORT}`;
+	return resolveGatewayTransportUrl(config, env, "http");
+}
+function resolveGatewayWsUrl(config, env) {
+	return resolveGatewayTransportUrl(config, env, "ws");
+}
+function resolveGatewayTransportUrl(config, env, transport) {
+	const configUrl = config?.gateway_url?.trim();
+	if (configUrl) return normalizeGatewayUrl(configUrl, transport) || configUrl;
+	const trimmedEnvUrl = (env?.OPENCLAW_GATEWAY_URL || getEnvString("OPENCLAW_GATEWAY_URL") || env?.CLAWDBOT_GATEWAY_URL || getEnvString("CLAWDBOT_GATEWAY_URL"))?.trim();
+	if (trimmedEnvUrl) return normalizeGatewayUrl(trimmedEnvUrl, transport) || trimmedEnvUrl;
+	const resolvedUrl = resolveGatewayUrlFromConfig(readOpenClawConfig(env), transport);
+	if (resolvedUrl) return resolvedUrl;
+	return `${transport === "ws" ? "ws" : "http"}://${DEFAULT_GATEWAY_HOST}:${DEFAULT_GATEWAY_PORT}`;
+}
+function resolveAuthSecret(config, env) {
+	if (config?.auth_token) return {
+		kind: "token",
+		value: config.auth_token
+	};
+	if (config?.auth_password) return {
+		kind: "password",
+		value: config.auth_password
+	};
+	const envToken = env?.OPENCLAW_GATEWAY_TOKEN || getEnvString("OPENCLAW_GATEWAY_TOKEN") || env?.CLAWDBOT_GATEWAY_TOKEN || getEnvString("CLAWDBOT_GATEWAY_TOKEN");
+	if (envToken) return {
+		kind: "token",
+		value: envToken
+	};
+	const envPassword = env?.OPENCLAW_GATEWAY_PASSWORD || getEnvString("OPENCLAW_GATEWAY_PASSWORD") || env?.CLAWDBOT_GATEWAY_PASSWORD || getEnvString("CLAWDBOT_GATEWAY_PASSWORD");
+	if (envPassword) return {
+		kind: "password",
+		value: envPassword
+	};
+	return resolveAuthSecretFromConfig(readOpenClawConfig(env));
 }
 /**
-* Auto-detect the OpenClaw gateway auth token from config, env overrides, or environment.
+* Auto-detect the OpenClaw gateway bearer secret from config, env overrides, or the active
+* config file. OpenClaw accepts either a token or password as the HTTP bearer secret.
 */
 function resolveAuthToken(config, env) {
-	if (config?.auth_token) return config.auth_token;
-	const envToken = env?.OPENCLAW_GATEWAY_TOKEN || getEnvString("OPENCLAW_GATEWAY_TOKEN");
-	if (envToken) return envToken;
-	return readOpenClawConfig()?.gateway?.auth?.token;
+	return resolveAuthSecret(config, env)?.value;
 }
 /**
 * Build common OpenClaw headers for agent-id and session-key.
@@ -173,7 +216,8 @@ const OPENCLAW_PROTOCOL_VERSION = 3;
 var OpenClawAgentProvider = class {
 	agentId;
 	gatewayUrl;
-	authToken;
+	authKind;
+	authSecret;
 	openclawConfig;
 	timeoutMs;
 	activeConnections = /* @__PURE__ */ new Set();
@@ -181,8 +225,10 @@ var OpenClawAgentProvider = class {
 		this.agentId = agentId;
 		this.openclawConfig = providerOptions.config || {};
 		const env = providerOptions.env;
-		this.gatewayUrl = resolveGatewayUrl(this.openclawConfig, env);
-		this.authToken = resolveAuthToken(this.openclawConfig, env);
+		this.gatewayUrl = resolveGatewayWsUrl(this.openclawConfig, env);
+		const authSecret = resolveAuthSecret(this.openclawConfig, env);
+		this.authKind = authSecret?.kind;
+		this.authSecret = authSecret?.value;
 		this.timeoutMs = this.openclawConfig.timeoutMs ?? REQUEST_TIMEOUT_MS;
 	}
 	id() {
@@ -199,9 +245,9 @@ var OpenClawAgentProvider = class {
 		this.activeConnections.clear();
 	}
 	async callApi(prompt) {
-		const wsUrl = this.gatewayUrl.replace(/^http(s?):\/\//, "ws$1://");
+		const sessionKey = this.openclawConfig.session_key || `promptfoo-${crypto.randomUUID()}`;
 		return new Promise((resolve) => {
-			const ws = new WebSocket(wsUrl);
+			const ws = new WebSocket(this.gatewayUrl);
 			this.activeConnections.add(ws);
 			const agentRequestId = crypto.randomUUID();
 			const waitRequestId = crypto.randomUUID();
@@ -210,27 +256,23 @@ var OpenClawAgentProvider = class {
 			let runId;
 			let connected = false;
 			let resolved = false;
-			const timeout = setTimeout(() => {
-				if (!resolved) {
-					resolved = true;
-					ws.close();
-					resolve({ error: `OpenClaw agent request timed out after ${this.timeoutMs}ms` });
-				}
-			}, this.timeoutMs);
-			const finish = (result) => {
+			const finish = (result, closeSocket = true) => {
 				if (resolved) return;
 				resolved = true;
 				clearTimeout(timeout);
 				this.activeConnections.delete(ws);
-				ws.close();
+				if (closeSocket) ws.close();
 				resolve(result);
 			};
+			const timeout = setTimeout(() => {
+				finish({ error: `OpenClaw agent request timed out after ${this.timeoutMs}ms` });
+			}, this.timeoutMs);
 			ws.on("error", (err) => {
 				finish({ error: `OpenClaw WebSocket error: ${err.message}` });
 			});
 			ws.on("close", () => {
 				this.activeConnections.delete(ws);
-				if (!resolved) finish({ error: "OpenClaw WebSocket connection closed unexpectedly" });
+				if (!resolved) finish({ error: "OpenClaw WebSocket connection closed unexpectedly" }, false);
 			});
 			ws.on("message", (data) => {
 				let frame;
@@ -265,7 +307,7 @@ var OpenClawAgentProvider = class {
 							caps: [],
 							commands: [],
 							permissions: {},
-							...this.authToken && { auth: { token: this.authToken } }
+							...this.authSecret && this.authKind && { auth: this.authKind === "password" ? { password: this.authSecret } : { token: this.authSecret } }
 						}
 					}));
 					return;
@@ -284,8 +326,9 @@ var OpenClawAgentProvider = class {
 							message: prompt,
 							agentId: this.agentId,
 							idempotencyKey,
-							...this.openclawConfig.session_key && { sessionKey: this.openclawConfig.session_key },
-							...this.openclawConfig.thinking_level && { thinking: this.openclawConfig.thinking_level }
+							sessionKey,
+							...this.openclawConfig.thinking_level && { thinking: this.openclawConfig.thinking_level },
+							...this.openclawConfig.extra_system_prompt && { extraSystemPrompt: this.openclawConfig.extra_system_prompt }
 						}
 					}));
 					return;
@@ -295,8 +338,17 @@ var OpenClawAgentProvider = class {
 						finish({ error: `OpenClaw agent error: ${frame.error?.message || "unknown error"}` });
 						return;
 					}
-					runId = frame.payload?.runId;
-					if (runId) ws.send(JSON.stringify({
+					const payload = frame.payload;
+					runId = typeof payload?.runId === "string" && payload.runId.trim() ? payload.runId : void 0;
+					if (!runId) {
+						logger.warn("[OpenClaw Agent] Missing runId in accepted response", {
+							agentId: this.agentId,
+							payload
+						});
+						finish({ error: "OpenClaw agent error: gateway accepted request without a runId" });
+						return;
+					}
+					ws.send(JSON.stringify({
 						type: "req",
 						id: waitRequestId,
 						method: "agent.wait",
@@ -328,10 +380,11 @@ var OpenClawAgentProvider = class {
 * OpenClaw chat provider extends OpenAI chat completion provider.
 *
 * OpenClaw exposes an OpenAI-compatible HTTP API at /v1/chat/completions.
-* This provider auto-detects gateway URL and auth token from:
-*   1. Explicit config (gateway_url, auth_token)
-*   2. Environment variables (OPENCLAW_GATEWAY_URL, OPENCLAW_GATEWAY_TOKEN)
-*   3. ~/.openclaw/openclaw.json
+* This provider auto-detects gateway URL and bearer auth from:
+*   1. Explicit config (gateway_url, auth_token, auth_password)
+*   2. Environment variables (OPENCLAW_GATEWAY_URL, OPENCLAW_GATEWAY_TOKEN, OPENCLAW_GATEWAY_PASSWORD)
+*   3. The active OpenClaw config file (OPENCLAW_CONFIG_PATH or ~/.openclaw/openclaw.json),
+*      including gateway.remote.url and gateway.tls.enabled
 *
 * Usage:
 *   openclaw              - default agent (main)
@@ -408,14 +461,19 @@ var OpenClawResponsesProvider = class extends OpenAiResponsesProvider {
 * OpenClaw Tool Invoke Provider
 *
 * Simple HTTP provider for direct tool invocation via POST /tools/invoke.
-* The tool name is extracted from the provider path: openclaw:tools:bash → tool="bash"
+* The tool name is extracted from the provider path:
+* openclaw:tools:sessions_list → tool="sessions_list"
 *
 * The prompt is parsed as JSON for tool arguments. If it's not valid JSON,
 * it's passed as a single `input` argument.
 *
 * Usage:
-*   openclaw:tools:bash        - invoke the bash tool
-*   openclaw:tools:agents_list - invoke the agents_list tool
+*   openclaw:tools:sessions_list - invoke the sessions_list tool
+*   openclaw:tools:session_status - invoke the session_status tool
+*
+* Optional config:
+*   action  - tool sub-action, forwarded as body.action
+*   dry_run - dry-run hint, forwarded as body.dryRun
 */
 var OpenClawToolInvokeProvider = class {
 	toolName;
@@ -448,11 +506,16 @@ var OpenClawToolInvokeProvider = class {
 			args = { input: prompt };
 		}
 		const url = `${this.gatewayUrl}/tools/invoke`;
-		const headers = { "Content-Type": "application/json" };
+		const headers = {
+			"Content-Type": "application/json",
+			...this.openclawConfig.headers || {}
+		};
 		if (this.authToken) headers["Authorization"] = `Bearer ${this.authToken}`;
 		const body = {
 			tool: this.toolName,
+			...this.openclawConfig.action && { action: this.openclawConfig.action },
 			args,
+			...typeof this.openclawConfig.dry_run === "boolean" && { dryRun: this.openclawConfig.dry_run },
 			...this.openclawConfig.session_key && { sessionKey: this.openclawConfig.session_key }
 		};
 		logger.debug(`[OpenClaw Tool] POST ${url}`, {
@@ -493,7 +556,7 @@ var OpenClawToolInvokeProvider = class {
 *   openclaw:responses:X    → OpenClawResponsesProvider('X')
 *   openclaw:agent          → OpenClawAgentProvider('main')
 *   openclaw:agent:X        → OpenClawAgentProvider('X')
-*   openclaw:tools:bash     → OpenClawToolInvokeProvider('bash')
+*   openclaw:tools:sessions_list → OpenClawToolInvokeProvider('sessions_list')
 */
 function createOpenClawProvider(providerPath, providerOptions = {}, env) {
 	const splits = providerPath.split(":");
@@ -514,4 +577,4 @@ function createOpenClawProvider(providerPath, providerOptions = {}, env) {
 //#endregion
 export { createOpenClawProvider };
 
-//# sourceMappingURL=openclaw-BiSZPL7J.js.map
+//# sourceMappingURL=openclaw-D1FSCps-.js.map