Skip to content

Commit 42cde56

Browse files
kiranmagic7kiranmagic7
authored
Merge branch 'main' into kiran/daily-community-20260513-node-floor
2 parents f7b1e16 + 7f28c8b commit 42cde56

65 files changed

Lines changed: 5608 additions & 232 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎AGENTS.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -227,6 +227,7 @@ Skills own workflows; root owns hard policy and routing.
227227
- Parallels: `$openclaw-parallels-smoke`; Discord roundtrip: `$parallels-discord-roundtrip`.
228228
- Crabbox/WebVNC human demos: keep remote desktop visible/windowed; no fullscreen remote browser unless video/capture-style output.
229229
- ClawSweeper ops: `$clawsweeper`. Deployed hook sessions may post one concise `#clawsweeper` note only when surprising/actionable/risky; if using message tool, reply exactly `NO_REPLY`.
230+
- Generated-media completions wake the requester agent first. Requester visible-reply config decides final text vs message tool; direct media send is fallback/recovery only.
230231
- Memory wiki prompt digest stays tiny; prefer `wiki_search` / `wiki_get`; verify contact data before use; source-class provenance for generated people facts.
231232
- Rebrand/migration/config warnings: run `openclaw doctor`.
232233
- Never edit `node_modules`.

‎docs/.generated/config-baseline.sha256‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
c80dea63b0a3786c8999d06aae62c110786f440b4d6748f9838577aaa2816971 config-baseline.json
2-
948323a1507817b6580ed976f9f9449239008f40283cc7e6005148ecf0ca4582 config-baseline.core.json
3-
f833ffca6bd88162f062bbea4f0eede783373f46674ebbfc3a390c80353930a2 config-baseline.channel.json
4-
bc38b58b67132401a030b3b3a77efdb6c88f207ea1fab9abcb4599e1f9552dda config-baseline.plugin.json
1+
ac5e91a6adaf02491d2ff6b983f054c813972da3bf79db68cd1d10887a22c594 config-baseline.json
2+
023e3b85ee79e85f90257e65a1376b1212cf534b6a9cff4b4388c9092e846549 config-baseline.core.json
3+
a9102c0611b8170fac37853cc31771810f31757a9e3b2c6796bbd9625f9b9206 config-baseline.channel.json
4+
2f018852d9682871dd22f0920cafc8994a6c0952e8101229210efa6103ae9536 config-baseline.plugin.json

‎docs/.generated/plugin-sdk-api-baseline.sha256‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
1-
59de21361cab0622926ad313caf3f8dc43c28d420a82ba060680ecc30c472453 plugin-sdk-api-baseline.json
2-
05adee9037669db4e834d1a0ca9705d5d94df770083862ab149d2f3e559010d2 plugin-sdk-api-baseline.jsonl
1+
74c6b635c822358e61473a5b1bf7e6786592c459289057db2fddf807ffa022ec plugin-sdk-api-baseline.json
2+
4db87f9b57209632cd3887d791277f6c30c4a894b09785a2b51cb50cb5aedb78 plugin-sdk-api-baseline.jsonl

‎docs/automation/tasks.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,7 @@ Not every agent run creates a task. Heartbeat turns and normal interactive chat
102102
<Accordion title="Notify defaults for cron and media">
103103
Main-session cron tasks use `silent` notify policy by default - they create records for tracking but do not generate notifications. Isolated cron tasks also default to `silent` but are more visible because they run in their own session.
104104

105-
Session-backed `image_generate`, `music_generate`, and `video_generate` runs also use `silent` notify policy. They still create task records, but completion is handed back to the original agent session as an internal wake so the agent can write the follow-up message and attach the finished media itself. Generated-media completion events require message-tool delivery: the agent must send the finished media with the `message` tool, then reply `NO_REPLY`. If the requester session is no longer active or its active wake fails, and the completion agent misses some or all generated media, OpenClaw sends an idempotent direct fallback with only the missing media to the original channel target.
105+
Session-backed `image_generate`, `music_generate`, and `video_generate` runs also use `silent` notify policy. They still create task records, but completion is handed back to the original agent session as an internal wake so the agent can write the follow-up message and attach the finished media itself. The requester agent follows its normal visible-reply contract: automatic final reply when configured, or `message(action="send")` plus `NO_REPLY` when the session requires message-tool replies. If the requester session is no longer active or its active wake fails, and the completion agent misses some or all generated media, OpenClaw sends an idempotent direct fallback with only the missing media to the original channel target.
106106

107107
</Accordion>
108108
<Accordion title="Concurrent media-generation guardrail">

‎docs/gateway/secrets.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -183,6 +183,13 @@ Define providers under `secrets.providers`:
183183
passEnv: ["PATH", "VAULT_ADDR"],
184184
jsonOnly: true,
185185
},
186+
"team-secrets": {
187+
source: "exec",
188+
pluginIntegration: {
189+
pluginId: "acme-secrets",
190+
integrationId: "secret-store",
191+
},
192+
},
186193
},
187194
defaults: {
188195
env: "default",
@@ -219,6 +226,11 @@ Define providers under `secrets.providers`:
219226
- Pair `allowSymlinkCommand` with `trustedDirs` for package-manager paths (for example `["/opt/homebrew"]`).
220227
- Supports timeout, no-output timeout, output byte limits, env allowlist, and trusted dirs.
221228
- Windows fail-closed note: if ACL verification is unavailable for the command path, resolution fails. For trusted paths only, set `allowInsecurePath: true` on that provider to bypass path security checks.
229+
- Plugin-managed exec providers can use `pluginIntegration` instead of
230+
copied `command`/`args`. OpenClaw resolves the current command details
231+
from the installed plugin manifest during startup/reload. If the plugin is
232+
disabled, removed, untrusted, or no longer declares the integration,
233+
active SecretRefs using that provider fail closed.
222234

223235
Request payload (stdin):
224236

‎docs/plugins/manifest.md‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -169,6 +169,7 @@ or npm install metadata. Those belong in your plugin code and `package.json`.
169169
| `modelIdNormalization` | No | `object` | Provider-owned model-id alias/prefix cleanup that must run before provider runtime loads. |
170170
| `providerEndpoints` | No | `object[]` | Manifest-owned endpoint host/baseUrl metadata for provider routes that core must classify before provider runtime loads. |
171171
| `providerRequest` | No | `object` | Cheap provider-family and request-compatibility metadata used by generic request policy before provider runtime loads. |
172+
| `secretProviderIntegrations` | No | `Record<string, object>` | Declarative SecretRef exec provider presets that setup or install surfaces can offer without hardcoding provider-specific integrations in core. |
172173
| `cliBackends` | No | `string[]` | CLI inference backend ids owned by this plugin. Used for startup auto-activation from explicit config refs. |
173174
| `syntheticAuthRefs` | No | `string[]` | Provider or CLI backend refs whose plugin-owned synthetic auth hook should be probed during cold model discovery before runtime loads. |
174175
| `nonSecretAuthMarkers` | No | `string[]` | Bundled-plugin-owned placeholder API key values that represent non-secret local, OAuth, or ambient credential state. |
@@ -1080,6 +1081,72 @@ Provider fields:
10801081
| `compatibilityFamily` | `"moonshot"` | Optional provider-family compatibility bucket for shared request helpers. |
10811082
| `openAICompletions` | `object` | OpenAI-compatible completions request flags, currently `supportsStreamingUsage`. |
10821083

1084+
## secretProviderIntegrations reference
1085+
1086+
Use `secretProviderIntegrations` when a plugin can publish a reusable SecretRef
1087+
exec provider preset. OpenClaw reads this metadata before plugin runtime loads,
1088+
stores plugin ownership in `secrets.providers.<alias>.pluginIntegration`, and
1089+
leaves actual secret resolution to the SecretRef runtime.
1090+
Presets are exposed only for bundled plugins and installed plugins discovered
1091+
from the managed plugin install roots, such as git and ClawHub installs.
1092+
1093+
```json
1094+
{
1095+
"secretProviderIntegrations": {
1096+
"secret-store": {
1097+
"providerAlias": "team-secrets",
1098+
"displayName": "Team secrets",
1099+
"source": "exec",
1100+
"command": "${node}",
1101+
"args": ["./bin/resolve-secrets.mjs"]
1102+
}
1103+
}
1104+
}
1105+
```
1106+
1107+
The map key is the integration id. If `providerAlias` is omitted, OpenClaw uses
1108+
the integration id as the SecretRef provider alias. Provider aliases must match
1109+
the normal SecretRef provider alias pattern, for example `team-secrets` or
1110+
`onepassword-work`.
1111+
1112+
When an operator selects the preset, OpenClaw writes a provider reference like:
1113+
1114+
```json
1115+
{
1116+
"secrets": {
1117+
"providers": {
1118+
"team-secrets": {
1119+
"source": "exec",
1120+
"pluginIntegration": {
1121+
"pluginId": "acme-secrets",
1122+
"integrationId": "secret-store"
1123+
}
1124+
}
1125+
}
1126+
}
1127+
}
1128+
```
1129+
1130+
At startup/reload, OpenClaw resolves that provider by loading current plugin
1131+
manifest metadata, checking that the owning plugin is installed and active, and
1132+
materializing the exec command from the manifest. Disabling or removing the
1133+
plugin revokes the provider for active SecretRefs. Operators who want standalone
1134+
exec configuration can still write manual `command`/`args` providers directly.
1135+
1136+
Only `source: "exec"` presets are currently supported. `command` must be
1137+
`${node}`, and `args[0]` must be a `./` plugin-root-relative resolver script.
1138+
OpenClaw materializes it at startup/reload to the current Node executable and
1139+
the absolute in-plugin script path. Node options such as `--require`, `--import`,
1140+
`--loader`, `--env-file`, `--eval`, and `--print` are not part of the manifest
1141+
preset contract. Operators who need non-Node commands can configure standalone
1142+
manual exec providers directly.
1143+
1144+
OpenClaw derives `trustedDirs` for manifest presets from the plugin root and,
1145+
for `${node}` presets, the current Node executable directory. Manifest-authored
1146+
`trustedDirs` are ignored. Other exec provider options such as `timeoutMs`,
1147+
`maxOutputBytes`, `jsonOnly`, `env`, `passEnv`, and `allowInsecurePath` pass
1148+
through to the normal SecretRef exec provider config.
1149+
10831150
## modelPricing reference
10841151

10851152
Use `modelPricing` when a provider needs control-plane pricing behavior before

‎docs/plugins/sdk-subpaths.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -192,6 +192,7 @@ and pairing-path families.
192192
| `plugin-sdk/allow-from` | `formatAllowFromLowercase` |
193193
| `plugin-sdk/channel-secret-runtime` | Narrow secret-contract collection helpers for channel/plugin secret surfaces |
194194
| `plugin-sdk/secret-ref-runtime` | Narrow `coerceSecretRef` and SecretRef typing helpers for secret-contract/config parsing |
195+
| `plugin-sdk/secret-provider-integration` | Type-only SecretRef provider integration manifest and preset contracts for plugins that publish external secret provider presets |
195196
| `plugin-sdk/security-runtime` | Shared trust, DM gating, root-bounded file/path helpers including create-only writes, sync/async atomic file replacement, sibling temp writes, cross-device move fallback, private file-store helpers, symlink-parent guards, external-content, sensitive text redaction, constant-time secret comparison, and secret-collection helpers |
196197
| `plugin-sdk/ssrf-policy` | Host allowlist and private-network SSRF policy helpers |
197198
| `plugin-sdk/ssrf-dispatcher` | Narrow pinned-dispatcher helpers without the broad infra runtime surface |

‎docs/tools/image-generation.md‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -11,11 +11,12 @@ sidebarTitle: "Image generation"
1111
The `image_generate` tool lets the agent create and edit images using your
1212
configured providers. In chat sessions, image generation runs asynchronously:
1313
OpenClaw records a background task, returns the task id immediately, and wakes
14-
the agent when the provider finishes. The completion agent must send generated
15-
images through the `message` tool. If the requester session is inactive or
16-
its active wake fails, and some generated images are still missing from
17-
message-tool delivery, OpenClaw sends an idempotent direct fallback with only
18-
the missing images.
14+
the agent when the provider finishes. The completion agent follows the
15+
session's normal visible-reply mode: automatic final reply delivery when
16+
configured, or `message(action="send")` when the session requires the message
17+
tool. If the requester session is inactive or its active wake fails, and some
18+
generated images are still missing from the completion reply, OpenClaw sends an
19+
idempotent direct fallback with only the missing images.
1920

2021
<Note>
2122
The tool only appears when at least one image-generation provider is

‎docs/tools/media-overview.md‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -98,11 +98,12 @@ For async tools, OpenClaw submits the request to the provider, returns a task
9898
id immediately, and tracks the job in the task ledger. The agent continues
9999
responding to other messages while the job runs. When the provider finishes,
100100
OpenClaw wakes the agent with the generated media paths so it can tell the
101-
user and relay the result through the message tool. If the requester session
102-
is inactive or its active wake fails, and some generated media is still
103-
missing from message-tool delivery, OpenClaw sends an idempotent direct
104-
fallback with only the missing media. Media already delivered through the
105-
message tool is not posted again.
101+
user through the session's normal visible-reply mode: automatic final reply
102+
delivery when configured, or `message(action="send")` when the session requires
103+
the message tool. If the requester session is inactive or its active wake
104+
fails, and some generated media is still missing from the completion reply,
105+
OpenClaw sends an idempotent direct fallback with only the missing media. Media
106+
already delivered by the completion reply is not posted again.
106107

107108
## Speech-to-text and Voice Call
108109

‎docs/tools/music-generation.md‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -15,12 +15,12 @@ fal, Google, MiniMax, and OpenRouter today.
1515
For session-backed agent runs, OpenClaw starts music generation as a
1616
background task, tracks it in the task ledger, then wakes the agent again
1717
when the track is ready so the agent can tell the user and attach the
18-
finished audio. Generated-media completions are delivered by the agent through
19-
the message tool. If the requester session is inactive or its active wake
20-
fails, and some generated audio is still missing from message-tool delivery,
21-
OpenClaw sends an idempotent direct fallback with only the missing audio. The
22-
completion wake explicitly warns the agent that normal final replies are
23-
private for this route.
18+
finished audio. The completion agent follows the session's normal visible-reply
19+
mode: automatic final reply delivery when configured, or `message(action="send")`
20+
when the session requires the message tool. If the requester session is
21+
inactive or its active wake fails, and some generated audio is still missing
22+
from the completion reply, OpenClaw sends an idempotent direct fallback with
23+
only the missing audio.
2424

2525
<Note>
2626
The built-in shared tool only appears when at least one music-generation

0 commit comments

Comments
 (0)