fix: media replies and identity handling by joaohlisboa · Pull Request #11 · openclaw/openclaw

joaohlisboa · 2025-12-02T17:50:59Z

Summary

Follow redirects when downloading Twilio media - Media downloads now properly handle 3xx redirects (up to 5 hops), fixing issues with media providers that redirect URLs
Fix media serving and ID consistency - Media files now saved with correct extensions based on MIME type detection via content sniffing
Use export type for type-only re-exports - TypeScript best practice fix
User-agnostic Claude identity - Refactored identity prefix handling with tests
Send Claude identity prefix on first session message - Identity injection now respects sendSystemOnce and systemSent flags

Test plan

Existing tests pass
Media download redirect handling tested
MIME detection and extension handling covered

🤖 Generated with Claude Code

Fixes build error with isolatedModules. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>

- server.ts: Replace sendFile with manual readFile+send to fix NotFoundError when serving media (sendFile failed even after stat) - store.ts: Return id with file extension so it matches actual filename 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>

- Use ~/Clawd instead of hardcoded /Users/steipete/clawd - Add MEDIA: syntax instructions to identity prefix - Update tests to check for 'scratchpad' instead of specific path 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>

node:https request() doesn't follow redirects by default, causing Twilio media URLs (which 302 to CDN) to save placeholder/metadata instead of actual images. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>

The systemSent variable was being set to true before being passed to runCommandReply, causing the identity prefix to never be injected. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>

steipete · 2025-12-02T18:34:33Z

Appreciate you polishing up Twilio! My account was blocked for sending too many messages on testing, so I had to pause this temporarily.

steipete · 2025-12-02T20:21:53Z

src/auto-reply/claude.ts

 export const CLAUDE_BIN = "claude";
 export const CLAUDE_IDENTITY_PREFIX =
-  "You are Clawd (Claude) running on the user's Mac via warelay. Your scratchpad is /Users/steipete/clawd; this is your folder and you can add what you like in markdown files and/or images. You don't need to be concise, but WhatsApp replies must stay under ~1500 characters. Media you can send: images ≤6MB, audio/video ≤16MB, documents ≤100MB. The prompt may include a media path and an optional Transcript: section—use them when present. If a prompt is a heartbeat poll and nothing needs attention, reply with exactly HEARTBEAT_OK and nothing else; for any alert, do not include HEARTBEAT_OK.";
+  "You are Clawd (Claude) running on the user's Mac via warelay. Your scratchpad is ~/Clawd; this is your folder and you can add what you like in markdown files and/or images. You can send media by including MEDIA:/path/to/file.jpg on its own line (no spaces in path). Media limits: images ≤6MB, audio/video ≤16MB, documents ≤100MB. The prompt may include a media path and an optional Transcript: section—use them when present. If a prompt is a heartbeat poll and nothing needs attention, reply with exactly HEARTBEAT_OK and nothing else; for any alert, do not include HEARTBEAT_OK.";


this needs to be lowercased, uppercase folders can be problematic

steipete · 2025-12-02T20:22:16Z

src/auto-reply/reply.ts

    };
    sessionStore[sessionKey] = sessionEntry;
    await saveSessionStore(storePath, sessionStore);
-    systemSent = true;


I believe this was preventing the CLAUDE_IDENTITY_PREFIX from being sent at all. I checked Claude Code logs in ~/.claude/projects and there was just the ultrathink initial message with no prefix. So I started investigating, and found that this line was setting systemSent to true before runCommandReply. So even on the first run, this would skip the prefix.

Without this line, it works perfectly for me (I've checked the logs in multiple sessions to verify). It was already saving systemSent as true in existing session logs, so it loads that correctly when resuming the session upon new messages beyond the first one in the session.

I may have missed something, still learning how the codebase works. Hope this helps clarify.

this breaks heatbeat, will revert

steipete · 2025-12-02T20:23:32Z

(taking this over)

joaohlisboa · 2025-12-02T20:24:48Z

(taking this over)

Sounds good!

steipete · 2025-12-02T20:47:23Z

package-lock.json? did you use npm here? We only use pnpm.

joaohlisboa · 2025-12-02T20:57:09Z

package-lock.json? did you use npm here? We only use pnpm.

My bad, accidentally pushed it with git add -A while using npm on my side.

May I push this deletion and the lowercase clawd/ folder in the prompt?

steipete · 2025-12-02T20:58:25Z

src/media/store.ts

@@ -1,3 +1,5 @@
+// ABOUTME: Media storage utilities - downloads from URLs and saves to disk


never seen aboutme before?

ah that's a new claude thing!

I actually added this as an instruction in my global CLAUDE.md after seeing someone online using it (- Start all code files with "ABOUTME:" 2-line summary). It seems to help agents better understand and navigate larger codebases. I kind of like it too, so as a habit I leave them there. But I understand you might find it cluttering! I'll keep them to myself on future PRs 👍🏻

steipete · 2025-12-02T21:07:02Z

merged via local branch - thnks!!

…nnet and Opus - Introduced Pattern openclaw#11 to document a critical incident where Sonnet's systems fix plan missed the PRIMARY APEX file, leading to potential enforcement issues with new Core Laws. - Updated the historical patterns summary to include this new pattern and its implications for verification protocols. - Adjusted related documentation to reflect the latest APEX version 6.3.3 compliance.

Claude/sync ios webapp parity qy h8h

…iner, Postgres traces, cost budgets, phase restructuring Factsheet changes (12 architecture critiques): - Add users table with auth provider (openclaw#1) - Change all TEXT PKs to native UUID type (openclaw#2) - Remove orphaned session_id from Task/TaskCommand/TaskResult (openclaw#3) - Replace per-task containers with single shared Docker container (openclaw#4) - Phase injection queue: in-memory Phase 1, Redis Phase 2+ (openclaw#5) - Decouple Board Sync DB writes from WebSocket broadcasting (openclaw#6) - Move trace storage from JSONL+index to Postgres-only (openclaw#7) - Add chat_messages escalation to agent context (openclaw#8) - Normalize discussion_messages into separate table (openclaw#9) - Add PolicyEngine facade with single evaluate() entry point (openclaw#10) - Add per-plugin Zod validation schemas for SourceConfig (openclaw#11) - Add CostPolicy with token/cost budgets and cost_usage table (openclaw#12) Blueprint changes (4 implementation improvements): - Split Phase 1 into 4 sub-phases (1a-1d) - Reorder: API skeleton before agent loop - Defer frontend to Phase 5 - Add packages/shared for types and schemas DB schema: 17 tables → 20 tables (added users, traces, discussion_messages, cost_usage) https://claude.ai/code/session_01V2xvGqZqX6JKPGQeXyNMQW

…oad scanning Phase 1 complete implementation of the Skill Guard system: Core changes (4 files, ~110 lines): - src/config/types.skills.ts: Add SkillGuardConfig, SkillStoreConfig types - src/config/zod-schema.ts: Add guard validation schema (strict mode) - src/agents/skills/load-guard.ts: New guard registration point - src/agents/skills/workspace.ts: Insert guard evaluation in loadSkillEntries() Extension (extensions/skill-guard/, 7 files, ~650 lines): - cloud-client.ts: Multi-store manifest fetch with ETag/304 + fallback - hash-cache.ts: In-memory + disk manifest cache - verify-engine.ts: Full-directory SHA256 verification + sideload scanning - audit-logger.ts: JSONL audit trail - index.ts: Plugin entry wiring everything together - types.ts: Cloud API response type definitions Tests (51 tests, all passing): - load-guard.test.ts: Guard registration/unregistration (4 tests) - zod-schema.guard.test.ts: Config validation (9 tests) - verify-engine.test.ts: All acceptance criteria (12 tests) - hash-cache.test.ts: Cache persistence (5 tests) - audit-logger.test.ts: JSONL logging (3 tests) - cloud-client.test.ts: HTTP client behavior (6 tests) - smoke.test.ts: E2E with Python mock store server (12 tests) Smoke infrastructure: - test/smoke/skill-guard-server.py: Zero-dep Python mock store API All 11 acceptance criteria verified: openclaw#1 guard.enabled=false → all load openclaw#2 store skill hash match → pass openclaw#3 tampered file → blocked openclaw#4 injected file → blocked openclaw#5 blocklisted → blocked openclaw#6 sideload clean → pass openclaw#7 sideload critical + block-critical → blocked openclaw#8 sideload critical + warn → warning only openclaw#9 cloud down + cache → uses cache openclaw#10 cloud down + no cache → degrade allow openclaw#11 100 skills < 500ms → performance OK Existing security tests (69) verified: zero regression. Co-authored-by: Cursor <[email protected]>

…move deprecated skills - Fix env var names throughout: COBROKER_BASE_URL, COBROKER_AGENT_SECRET, COBROKER_AGENT_USER_ID (replacing old COBROKER_API_URL/API_KEY/USER_ID) - Add Gotcha openclaw#11: skill snapshot caching in sessions.json prevents new skills from loading without session reset - Add Gotcha openclaw#12: COBROKER_AGENT_SECRET (Fly) must match AGENT_AUTH_SECRET (Vercel) for agent auth bypass in middleware - Remove deprecated skills from appendix (site-selection, property-search, alerts) — only client-memory and import-properties are active - Update import-properties SKILL.md: remove requires.env, use correct env var names in curl template Co-Authored-By: Claude Opus 4.6 <[email protected]>

) - Add optional AUTH_TOKEN bearer auth for agent/chat routes (openclaw#2) - DRY CI with composite action, replace npx bun with setup-bun (openclaw#3, openclaw#4) - Fix smoke test URL to use CF_WORKER_SUBDOMAIN secret (openclaw#5) - Deduplicate types: import canonical model types in landscape-loader (openclaw#6, openclaw#7) - Fix C4 direction logic to respect actual integration direction (openclaw#8) - Add edges connecting current→target nodes in comparison diagram (openclaw#9) - Add agents CDN version sync comment in index.html (openclaw#11) - Add missing landscape directory guard in bundle script (openclaw#12) - Update wrangler compatibility_date to 2026-02-13 (openclaw#13) - Rename prebuild to predev/predeploy in package.json (openclaw#14) - Remove sk- prefix from .dev.vars.example placeholder (openclaw#15) Co-Authored-By: Claude Opus 4.6 <[email protected]>

…dflare Worker (#1) * ArchiClaw Phase 1: foundation scaffold, data model, skills, and harness Add the ArchiClaw enterprise architecture management foundation: - Zod schemas for all EA data types (application passports, capabilities, data entities, change requests, domains, integrations, ADRs, IDs) - ID generation system with domain-prefixed sequential IDs (FIN-APP-001) - Landscape directory structure with config, templates, registries - Landscape validation (schema compliance, ID uniqueness, cross-refs) - Mermaid render wrapper using beautiful-mermaid with Archimate theming - 3 initial skills: interview, passport-manage, landscape-query - Evaluation harness framework with per-skill scoring and examples - 5 seeded applications (SAP ERP, SAP BPC, TM1, Workday HR, Salesforce CRM) with passports, context diagrams, data matrices - 5 data entities, 10 capabilities, 5 integrations across 5 domains - 58 tests passing across 8 test files Co-Authored-By: Claude Opus 4.6 <[email protected]> * ArchiClaw: address PR #1 review feedback - Add TODO comment on nextId() race condition (file locking needed) - Add negative landscape validation tests (duplicate IDs, folder mismatch, broken cross-refs, sequence counter exceeded) - Clarify eval harness test names to "eval fixtures" with comments - Wrap readIdSequences/writeIdSequences in try-catch with descriptive messages - Validate IdSequencesSchema keys against EntityTypeSchema via refine() - Fix CLI entrypoint detection in runner.ts using path.resolve() - Fill empty domain lead fields with placeholder names - Add expandTemplate() utility with tests - Add render CLI (src/archiclaw/render/cli.ts) and update skill SKILL.md files with rendering documentation sections Co-Authored-By: Claude Opus 4.6 <[email protected]> * ArchiClaw: add entire.io session tracking, entire skill, and enhance skill-creator * ArchiClaw: address PR #1 review feedback (phantom refs, validation cross-refs, mermaid nits) * ArchiClaw: deploy as Cloudflare Worker (Agents SDK) * ArchiClaw: add Teams outgoing webhook integration (query-only MVP) Pattern-matching dispatcher routes @mentions to landscape accessors for sub-second responses without LLM. HMAC-SHA256 validation via CF Workers Web Crypto API. Adaptive Card v1.5 responses for rich Teams rendering. Co-Authored-By: Claude Opus 4.6 <[email protected]> * ArchiClaw: address review feedback for Cloudflare Worker deploy (469580b) - Add optional AUTH_TOKEN bearer auth for agent/chat routes (openclaw#2) - DRY CI with composite action, replace npx bun with setup-bun (openclaw#3, openclaw#4) - Fix smoke test URL to use CF_WORKER_SUBDOMAIN secret (openclaw#5) - Deduplicate types: import canonical model types in landscape-loader (openclaw#6, openclaw#7) - Fix C4 direction logic to respect actual integration direction (openclaw#8) - Add edges connecting current→target nodes in comparison diagram (openclaw#9) - Add agents CDN version sync comment in index.html (openclaw#11) - Add missing landscape directory guard in bundle script (openclaw#12) - Update wrangler compatibility_date to 2026-02-13 (openclaw#13) - Rename prebuild to predev/predeploy in package.json (openclaw#14) - Remove sk- prefix from .dev.vars.example placeholder (openclaw#15) Co-Authored-By: Claude Opus 4.6 <[email protected]> --------- Co-authored-by: KristjanAkk <[email protected]> Co-authored-by: Claude Opus 4.6 <[email protected]>

…ment - New design doc covering Task-Assign-Wait-Verify lifecycle for subagent work - Addresses gap between task system and subagent spawn/announce systems - Includes TaskDelegationManager, task_verify tool, and result snapshot design - Updated architecture index and dependency graph with openclaw#11

Improvements completed: - #1 A2A conversation index (O(1) lookup, 24 tests) - #2 A2A durable jobs (JobManager + Reaper + Orchestrator, 43 tests) - openclaw#3 task-tool.ts modularization (5 modules, 2296→45 LOC facade, 147 tests) - openclaw#4 continuation state machine Phase 1 (pure decision functions, 56 tests) - openclaw#5 gateway composition (6 init modules, 737→565 LOC, 80→48 imports) - openclaw#7 A2A per-agent concurrency gate (semaphore + config, 25 tests) - openclaw#8 structured handoff payload (types + parser, 42 tests) - openclaw#9 coordination invariants test suite (TC-01~07, 22 tests) - openclaw#11 subagent-task lifecycle (delegation manager + verify tool, 135 tests) - openclaw#12 task enforcement bypass fix (session-scoped + stale cleanup, 20 tests) N/A: openclaw#6 (DI already via GatewayRequestContext), openclaw#10 (partially resolved by #2) Deferred: openclaw#4 Phase 2-5 (high risk, Phase 1 delivers core value) Total: 514 new tests, 0 regressions, 11 implementation docs

…law#11) from feature/subagent-relay into main Reviewed-on: https://gitea.hosting-cloud.net/dreamit/zulip-claw/pulls/11

joaohlisboa and others added 5 commits December 2, 2025 13:20

fix: use export type for type-only re-exports

22132cc

Fixes build error with isolatedModules. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>

joaohlisboa and others added 7 commits December 2, 2025 16:59

Merge branch 'main' into fix/media-replies

04ea9e5

chore: bundle pending local edits

2d063ad

style: fix biome formatting

a314f60

Merge remote-tracking branch 'origin/main' into fix/media-replies

42a235c

style: fix biome lint errors

f5442d2

Merge branch 'main' into fix/media-replies

0e19278

style: fix biome formatting

d7420ac

steipete reviewed Dec 2, 2025

View reviewed changes

steipete closed this Dec 2, 2025

joaohlisboa deleted the fix/media-replies branch December 2, 2025 21:24

thatwebagency mentioned this pull request Jan 29, 2026

[Bug]: Render.com Blueprint fails to deploy #3754

Closed

dgarson referenced this pull request in dgarson/clawdbot Feb 2, 2026

Merge pull request #11 from dgarson/claude/sync-ios-webapp-parity-qyH8h

21e6406

Claude/sync ios webapp parity qy h8h

marcusdevcode mentioned this pull request Feb 2, 2026

[Bug]: Deploy issue #7416

Open

saulmc mentioned this pull request Feb 13, 2026

Merge staging into main #15302

Closed

ruiwarn mentioned this pull request Feb 15, 2026

Cron scheduler regression after v2026.2.6 — jobs fire multiple times, wrong order, duplicates #16735

Closed

davidahmann mentioned this pull request Feb 15, 2026

[Gait Alignment] Add tamper-evident audit log chaining for security-critical events #17168

Closed

Copilot AI mentioned this pull request Feb 20, 2026

fix: replace unavailable Blacksmith runner labels with standard GitHub-hosted runners SeanHogg/coderClaw#10

Merged

18 tasks

		@@ -1,3 +1,5 @@
		// ABOUTME: Media storage utilities - downloads from URLs and saves to disk

Uh oh!

Conversation

joaohlisboa commented Dec 2, 2025

Summary

Test plan

Uh oh!

steipete commented Dec 2, 2025

Uh oh!

steipete Dec 2, 2025

Choose a reason for hiding this comment

Uh oh!

steipete Dec 2, 2025

Choose a reason for hiding this comment

Uh oh!

joaohlisboa Dec 2, 2025

Choose a reason for hiding this comment

Uh oh!

steipete Dec 2, 2025

Choose a reason for hiding this comment

Uh oh!

steipete commented Dec 2, 2025

Uh oh!

joaohlisboa commented Dec 2, 2025

Uh oh!

steipete commented Dec 2, 2025

Uh oh!

joaohlisboa commented Dec 2, 2025

Uh oh!

steipete Dec 2, 2025

Choose a reason for hiding this comment

Uh oh!

steipete Dec 2, 2025

Choose a reason for hiding this comment

Uh oh!

joaohlisboa Dec 2, 2025

Choose a reason for hiding this comment

Uh oh!

steipete commented Dec 2, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Comments