taskforce-loop-engineering 0.15.16 → 0.15.17

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## Unreleased
 
+## 0.15.17 - 2026-09-13
+
+- Stop OpenClaw doctor and disposable smoke probes from attaching the synthetic `doctor` account to dry-run notifications.
+- Preserve normal account forwarding for real source-bound notifications while remaining compatible with OpenClaw installations that reject unknown account ids during dry-run validation.
+- Add strict installer regression coverage that rejects any synthetic `--account doctor` delivery.
+
 ## 0.15.16 - 2026-09-13
 
 - Resolve canonical project identifiers from nested checkpoint completion metadata so migrated project tasks continue against the correct authoritative backlog.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "taskforce-loop-engineering",
-  "version": "0.15.16",
+  "version": "0.15.17",
   "private": false,
   "description": "OpenClaw-native loop engineering CLI, templates, and skill for verifiable agent work loops.",
   "type": "module",

package/scripts/openclaw-doctor.mjs

@@ -70,7 +70,7 @@ async function main() {
   if (await present(notifier)) {
     const smoke = await run(process.execPath, [notifier, 'Loop Engineering notification dry-run'], {
       cwd: args.root,
-      env: { ...process.env, LOOP_NOTIFICATION_DRY_RUN: '1', LOOP_NOTIFICATION_SOURCE: JSON.stringify({ channel: 'feishu', target: 'user:loop-doctor-dry-run', account: 'doctor', reply_to: 'doctor-message' }) }
+      env: { ...process.env, LOOP_NOTIFICATION_DRY_RUN: '1', LOOP_NOTIFICATION_SOURCE: JSON.stringify({ channel: 'feishu', target: 'user:loop-doctor-dry-run', reply_to: 'doctor-message' }) }
     });
     checks.push({ id: 'notification_dry_run', ok: smoke.code === 0, detail: (smoke.stdout || smoke.stderr).trim().slice(0, 500) });
   }

package/scripts/openclaw-install-self-test.mjs

@@ -15,6 +15,10 @@ await writeFile(mockOpenClaw, `#!/usr/bin/env node
 import { mkdir, writeFile } from 'node:fs/promises';
 import path from 'node:path';
 const args = process.argv.slice(2);
+if (args.includes('--account') && args[args.indexOf('--account') + 1] === 'doctor') {
+  console.error('Unknown account: doctor');
+  process.exit(1);
+}
 if (args[0] === '--version') console.log('OpenClaw mock 1.0');
 else if (args[0] === 'agents' && args[1] === 'list') console.log(JSON.stringify([{ id: 'builder' }]));
 else {
@@ -132,6 +136,7 @@ const doctorResult = await new Promise((resolve) => {
 if (doctorResult.code !== 0) throw new Error(`doctor failed: ${doctorResult.stderr}`);
 const doctorReport = JSON.parse(doctorResult.stdout);
 if (doctorReport.status !== 'ok' || doctorReport.externalWrite !== false || !doctorReport.checks.some((check) => check.id === 'notification_dry_run' && check.ok) || !doctorReport.checks.some((check) => check.id === 'human_gate_bridge_self_test' && check.ok)) throw new Error('doctor did not complete safe notification and Human Gate self-tests');
+if (JSON.parse(await readFile(deliveryCapture, 'utf8')).includes('doctor')) throw new Error('doctor notification forwarded a synthetic account');
 const smoke = new URL('./openclaw-smoke.mjs', import.meta.url).pathname;
 const smokeSource = await readFile(smoke, 'utf8');
 if (!smokeSource.includes('Do not change user or project files, configuration, credentials, or external state.')
@@ -151,6 +156,7 @@ const smokeResult = await new Promise((resolve) => {
 if (smokeResult.code !== 0) throw new Error(`smoke failed: ${smokeResult.stderr}`);
 const smokeReport = JSON.parse(smokeResult.stdout);
 if (smokeReport.status !== 'ok' || smokeReport.externalWrite !== false || !smokeReport.steps.every((step) => step.ok)) throw new Error('end-to-end smoke did not pass safely');
+if (JSON.parse(await readFile(deliveryCapture, 'utf8')).includes('doctor')) throw new Error('smoke notification forwarded a synthetic account');
 try { await readFile(path.join(root, `configs/loops/queues/${smokeReport.smokeQueue}.json`)); throw new Error('smoke config was not cleaned'); } catch (error) { if (error.code !== 'ENOENT') throw error; }
 try { await readFile(path.join(root, `runtime/loops/${smokeReport.smokeQueue}/state.json`)); throw new Error('smoke runtime was not cleaned'); } catch (error) { if (error.code !== 'ENOENT') throw error; }
 for (const generated of ['scripts/loops/openclaw-loop-dispatch.mjs', 'scripts/loops/openclaw-loop.mjs', 'scripts/loops/openclaw-loop-notify.mjs', 'scripts/loops/openclaw-loop-gate.mjs']) {

package/scripts/openclaw-smoke.mjs

@@ -65,7 +65,7 @@ async function main() {
     await writeFile(smokeConfig, `${JSON.stringify(config, null, 2)}\n`);
     const smokeRuntimeRel = path.relative(args.root, smokeRuntime);
     const message = `走 loop：Perform a read-only integration smoke. Do not change user or project files, configuration, credentials, or external state. Writing the required Loop checkpoint and verification evidence under ${smokeRuntimeRel}/ is allowed and required; do not write anywhere else. Report SMOKE_OK with verification evidence.`;
-    const route = await run(args.loopBin, ['route-message', '--root', args.root, '--queue', smokeQueue, '--message', message, '--route', '--confirm-execute', '--source-channel', 'feishu', '--source-target', 'user:loop-smoke-dry-run', '--source-account', 'doctor', '--source-message-id', `smoke-${runToken}`, '--source-reply-to', `smoke-${runToken}`, '--json'], { cwd: args.root });
+    const route = await run(args.loopBin, ['route-message', '--root', args.root, '--queue', smokeQueue, '--message', message, '--route', '--confirm-execute', '--source-channel', 'feishu', '--source-target', 'user:loop-smoke-dry-run', '--source-message-id', `smoke-${runToken}`, '--source-reply-to', `smoke-${runToken}`, '--json'], { cwd: args.root });
     steps.push({ id: 'route', ok: route.code === 0 });
     if (route.code !== 0) throw new Error(`route failed: ${route.stderr || route.stdout}`);
     const routed = JSON.parse(route.stdout);

package/skills/taskforce-loop-engineering/references/npm-package.md

@@ -1,7 +1,7 @@
 # npm Package
 
 Package name: `taskforce-loop-engineering`
-Version: `0.15.16`
+Version: `0.15.17`
 
 Install from npm: