feat(onboarding): add browser Gemma setup assistant

.agents/skills/openclaw-ci-limits/SKILL.md

@@ -13,13 +13,12 @@ registration edge limit.
 
 - The scarce resource is Blacksmith runner registrations, not Blacksmith vCPU
   capacity.
-- GitHub runner registrations for `openclaw` are currently capped at 3,000 per
-  5 minutes per repository, organization, or enterprise. The `openclaw`
-  organization shares one bucket.
+- GitHub runner registrations are capped at 1,500 per 5 minutes per repository,
+  organization, or enterprise. The `openclaw` organization shares one bucket.
 - Core REST quota does not draw down this bucket. Check
   `actions_runner_registration` separately; core quota can be healthy while
   runner registration is throttled.
-- Use 2,000 registrations per 5 minutes as the operating target. Leave the last
+- Use 1,000 registrations per 5 minutes as the operating target. Leave the last
   third for other repos, retries, and burst overlap.
 - Jobs that route, notify, summarize, choose shards, or run short CodeQL quality
   scans should stay on GitHub-hosted runners unless measured evidence says
@@ -88,7 +87,7 @@ admission. The debounce only suppresses pushes that arrive while
 registrations are spent even if a later push cancels the run. If timing is
 uncertain, count every sequential push in the window.
 
-Reject a change unless the org-level worst case stays below 2,000 registrations
+Reject a change unless the org-level worst case stays below 1,000 registrations
 per 5 minutes with headroom for ClawSweeper, ClawHub, Clownfish, OpenClaw RTT,
 and Clawbench.
 
@@ -128,8 +127,8 @@ These are intentionally guarded by `test/scripts/ci-workflow-guards.test.ts`:
 - `runner-admission` on `ubuntu-24.04` with
   `OPENCLAW_MAIN_CI_DEBOUNCE_SECONDS=90`.
 - `preflight` and `security-fast` needing `runner-admission`.
-- CI matrix caps: fast/check lanes at 12, Node test shards at 24, Windows and
-  Android at 2.
+- CI matrix caps: fast/check lanes at 8, compact Node PR plan at current caps,
+  Windows and Android at 2.
 - `build-artifacts` on `blacksmith-16vcpu-ubuntu-2404`.
 - lower-weight Node/check shards on `blacksmith-4vcpu-ubuntu-2404`.
 - heavy retained Linux/Android shards on `blacksmith-8vcpu-ubuntu-2404`.

.agents/skills/release-openclaw-mac/SKILL.md

@@ -5,7 +5,7 @@ description: "Run or recover OpenClaw macOS release signing, notarization, appca
 
 # OpenClaw Mac Release
 
-Use with `$release-openclaw-maintainer`, `$release-openclaw-ci`, `$one-password`, and `$release-private` if it exists when stable macOS assets, release-ops mac preflight, notarization, appcast promotion, or mac release recovery is involved.
+Use with `$release-openclaw-maintainer`, `$release-openclaw-ci`, `$one-password`, and `$release-private` if it exists when stable macOS assets, private mac preflight, notarization, appcast promotion, or mac release recovery is involved.
 
 ## Credentials
 
@@ -23,7 +23,7 @@ Use with `$release-openclaw-maintainer`, `$release-openclaw-ci`, `$one-password`
 
 ## GitHub Secrets
 
-Target release-ops repo environment: `openclaw/releases`, env `mac-release`.
+Target private repo environment: `openclaw/releases-private`, env `mac-release`.
 
 Set only after local notary auth validation:
 
@@ -35,24 +35,12 @@ Do not update these from mixed sources. All three ASC fields must come from the
 
 ## Workflow Shape
 
-- `openclaw/openclaw` is the public product repo. Its GitHub Releases page is
-  where macOS assets are ultimately attached.
-- `openclaw/openclaw` `macos-release.yml` is public handoff validation only.
-  It never signs, notarizes, or uploads macOS assets, regardless of
-  `preflight_only`.
-- `openclaw/releases` is the restricted release-ops repo. Its macOS workflows
-  sign, notarize, validate, and promote assets onto the
-  `openclaw/openclaw` GitHub release.
 - Public release branch may carry mac-only packaging fixes after the stable tag/npm are already live.
-- Use `source_ref=release/YYYY.M.PATCH` for release-ops mac preflight/validation when building that branch variation.
+- Use `source_ref=release/YYYY.M.PATCH` for private mac preflight/validation when building that branch variation.
 - Keep `tag=vYYYY.M.PATCH` pointing at the original stable release commit.
 - Real mac publish must reuse:
-  - a successful release-ops mac preflight run for the same tag/source SHA
-  - a successful release-ops mac validation run for the same tag/source SHA
-- Release-ops preflight and real publish enter the protected `mac-release`
-  environment in the `build_sign_and_package` job. Operators may be able to
-  trigger the workflow while Vincent or another environment reviewer approves
-  the paused deployment before signing/notarization/promotion proceeds.
+  - a successful private mac preflight run for the same tag/source SHA
+  - a successful private mac validation run for the same tag/source SHA
 - If preflight source SHA differs from tag SHA, validation must also use the same `source_ref`; promotion rejects mismatched proof.
 
 ## Notarization
@@ -64,25 +52,10 @@ Do not update these from mixed sources. All three ASC fields must come from the
 
 ## Dispatch
 
-Public handoff validation:
+Private preflight:
 
 ```bash
-gh workflow run macos-release.yml --repo openclaw/openclaw \
-  --ref release/YYYY.M.PATCH \
-  -f tag=vYYYY.M.PATCH \
-  -f preflight_only=true \
-  -f public_release_branch=release/YYYY.M.PATCH
-```
-
-- Use the public release branch as the workflow ref so the Actions list displays
-  `release/YYYY.M.PATCH`, matching prior stable macOS handoff runs.
-- Do not use `--ref main` or `--ref vYYYY.M.PATCH` for this public handoff
-  validation. The workflow checks out the tag from the `tag` input internally.
-
-Release-ops preflight:
-
-```bash
-gh workflow run openclaw-macos-publish.yml --repo openclaw/releases --ref main \
+gh workflow run openclaw-macos-publish.yml --repo openclaw/releases-private --ref main \
   -f tag=vYYYY.M.PATCH \
   -f source_ref=release/YYYY.M.PATCH \
   -f preflight_only=true \
@@ -91,24 +64,18 @@ gh workflow run openclaw-macos-publish.yml --repo openclaw/releases --ref main \
   -f public_release_branch=release/YYYY.M.PATCH
 ```
 
-Wait for the run to reach the `mac-release` environment approval if GitHub
-pauses it, then get approval from Vincent or another configured environment
-reviewer. Record the successful preflight run id.
-
-Release-ops validation for a branch-variation preflight:
+Private validation for a branch-variation preflight:
 
 ```bash
-gh workflow run openclaw-macos-validate.yml --repo openclaw/releases --ref main \
+gh workflow run openclaw-macos-validate.yml --repo openclaw/releases-private --ref main \
   -f tag=vYYYY.M.PATCH \
   -f source_ref=release/YYYY.M.PATCH
 ```
 
-Record the successful validation run id.
-
 Real publish:
 
 ```bash
-gh workflow run openclaw-macos-publish.yml --repo openclaw/releases --ref main \
+gh workflow run openclaw-macos-publish.yml --repo openclaw/releases-private --ref main \
   -f tag=vYYYY.M.PATCH \
   -f preflight_only=false \
   -f smoke_test_only=false \
@@ -118,14 +85,6 @@ gh workflow run openclaw-macos-publish.yml --repo openclaw/releases --ref main \
   -f public_release_branch=release/YYYY.M.PATCH
 ```
 
-Wait for the `mac-release` environment approval again if GitHub pauses the real
-publish run before it promotes assets.
-
-- Release-ops `openclaw/releases` publish/validate workflows run from their own
-  trusted `main` workflow ref. Real publish has a guard that rejects any other
-  workflow ref. That displayed `main` ref is expected; the public OpenClaw
-  source is selected by `tag` and optional `source_ref`.
-
 ## Verify
 
 - `gh release view vYYYY.M.PATCH --repo openclaw/openclaw` shows zip, dmg, dSYM zip, not draft, not prerelease.

.agents/skills/release-openclaw-maintainer/SKILL.md

@@ -203,9 +203,8 @@ Stable publication is not complete until `main` carries the actual shipped relea
   validation-only release machinery. If mac packaging needs release-branch-only
   fixes after the stable npm package or GitHub tag is already published, do not
   create a `vYYYY.M.PATCH-N` correction tag just to change the workflow source.
-  Dispatch the release-ops mac workflows for the original `tag=vYYYY.M.PATCH`
-  with `source_ref=release/YYYY.M.PATCH` and
-  `public_release_branch=release/YYYY.M.PATCH`;
+  Dispatch the private mac workflows for the original `tag=vYYYY.M.PATCH` with
+  `source_ref=release/YYYY.M.PATCH` and `public_release_branch=release/YYYY.M.PATCH`;
   provenance checks must prove the source SHA descends from the tag and
   validation/preflight use the same source. Reserve `vYYYY.M.PATCH-N` correction
   tags for emergency hotfixes that must publish a new npm package/release
@@ -580,8 +579,8 @@ node --import tsx scripts/openclaw-npm-postpublish-verify.ts <published-version>
 - Actual npm install/update phases are capped at 5 minutes. If `npm install -g`, installer package install, or `openclaw update` takes longer than 300s in release e2e, stop treating the run as healthy progress and debug the installer/updater or harness.
 - Serialize host build/package mutations ahead of VM lanes. Finish `pnpm build`, `pnpm ui:build`, `pnpm release:check`, install smoke, and any Docker/package-prep lanes before starting Parallels `npm pack` lanes; otherwise `dist` can disappear during VM pack prep and produce false failures.
 - Include mac release readiness in preflight by running the public validation
-  workflow in `openclaw/openclaw` and the release-ops mac preflight in
-  `openclaw/releases` for every release.
+  workflow in `openclaw/openclaw` and the real mac preflight in
+  `openclaw/releases-private` for every release.
 - Treat the `appcast.xml` update on `main` as part of mac release readiness, not an optional follow-up.
 - The workflows remain tag-based. The agent is responsible for making sure
   preflight runs complete successfully before any publish run starts.
@@ -609,16 +608,16 @@ node --import tsx scripts/openclaw-npm-postpublish-verify.ts <published-version>
 ## Use the right auth flow
 
 - OpenClaw publish uses GitHub trusted publishing.
-- Stable npm promotion from `beta` to `latest` uses the restricted release-ops
-  `openclaw/releases/.github/workflows/openclaw-npm-dist-tags.yml` workflow
-  because `npm dist-tag` management needs `NPM_TOKEN`, while the public npm
-  release workflow stays OIDC-only.
-- Prefer fixing the release-ops workflow token path over any local 1Password
-  fallback. The desired setup is a granular npm token stored as the release-ops
+- Stable npm promotion from `beta` to `latest` uses the private
+  `openclaw/releases-private/.github/workflows/openclaw-npm-dist-tags.yml`
+  workflow because `npm dist-tag` management needs `NPM_TOKEN`, while the
+  public npm release workflow stays OIDC-only.
+- Prefer fixing the private workflow token path over any local 1Password
+  fallback. The desired setup is a granular npm token stored as the private
   repo's `NPM_TOKEN` secret, scoped to the `openclaw` package with read/write
   and 2FA bypass for automation.
-- If the release-ops dist-tag workflow cannot promote because `NPM_TOKEN` is
-  absent or stale, use the local tmux + 1Password fallback:
+- If the private dist-tag workflow cannot promote because `NPM_TOKEN` is absent
+  or stale, use the local tmux + 1Password fallback:
   - Start or reuse a tmux session so interactive `npm login` and OTP prompts
     are observable and recoverable.
   - Hard rule: never run `op` directly in the main agent shell during release
@@ -636,21 +635,21 @@ node --import tsx scripts/openclaw-npm-postpublish-verify.ts <published-version>
   - Verify with a cache-bypassed registry read, for example:
     `npm view openclaw dist-tags --json --prefer-online --cache /tmp/openclaw-npm-cache-verify-$$`
     and `npm view openclaw@latest version dist.tarball --json --prefer-online`.
-- Direct stable publishes can also use that release-ops dist-tag workflow to
-  point `beta` at the already-published `latest` version when the operator wants
-  both tags aligned immediately.
+- Direct stable publishes can also use that private dist-tag workflow to point
+  `beta` at the already-published `latest` version when the operator wants both
+  tags aligned immediately.
 - The publish run must be started manually with `workflow_dispatch`.
-- The npm workflow and the release-ops mac publish workflow accept
+- The npm workflow and the private mac publish workflow accept
   `preflight_only=true` to run validation/build/package steps without uploading
   public release assets.
 - Real npm publish requires a prior successful npm preflight run id and the
   successful Full Release Validation run id for the same tag/SHA so the publish
   job promotes the prepared tarball instead of rebuilding it and attaches the
   correct release evidence.
-- Real release-ops mac publish requires a prior successful release-ops mac
-  preflight run id so the publish job promotes the prepared artifacts instead of
+- Real private mac publish requires a prior successful private mac preflight
+  run id so the publish job promotes the prepared artifacts instead of
   rebuilding or renotarizing them again.
-- The release-ops mac workflow also accepts `smoke_test_only=true` for branch-safe
+- The private mac workflow also accepts `smoke_test_only=true` for branch-safe
   workflow smoke tests that use ad-hoc signing, skip notarization, skip shared
   appcast generation, and do not prove release readiness.
 - `preflight_only=true` on the npm workflow is also the right way to validate an
@@ -671,27 +670,27 @@ node --import tsx scripts/openclaw-npm-postpublish-verify.ts <published-version>
   use only `main` or `release/YYYY.M.PATCH`.
 - `.github/workflows/macos-release.yml` in `openclaw/openclaw` is now a
   public validation-only handoff. It validates the tag/release state and points
-  operators to the release-ops repo. It still rebuilds the JS outputs needed for
+  operators to the private repo. It still rebuilds the JS outputs needed for
   release validation, but it does not sign, notarize, or publish macOS
   artifacts.
-- `openclaw/releases/.github/workflows/openclaw-macos-validate.yml` is the
-  required release-ops mac validation lane for `swift test`; keep it green
+- `openclaw/releases-private/.github/workflows/openclaw-macos-validate.yml`
+  is the required private mac validation lane for `swift test`; keep it green
   before any real stable mac publish run starts.
 - Real mac preflight and real mac publish both use
-  `openclaw/releases/.github/workflows/openclaw-macos-publish.yml`.
-- The release-ops mac validation lane runs on GitHub's standard macOS runner.
-- The release-ops mac preflight path runs on GitHub's xlarge macOS runner and uses
+  `openclaw/releases-private/.github/workflows/openclaw-macos-publish.yml`.
+- The private mac validation lane runs on GitHub's standard macOS runner.
+- The private mac preflight path runs on GitHub's xlarge macOS runner and uses
   a SwiftPM cache because the build/sign/notarize/package path is CPU-heavy.
-- Release-ops mac preflight uploads notarized build artifacts as workflow
-  artifacts instead of uploading public GitHub release assets.
-- Release-ops smoke-test runs upload ad-hoc, non-notarized build artifacts as
+- Private mac preflight uploads notarized build artifacts as workflow artifacts
+  instead of uploading public GitHub release assets.
+- Private smoke-test runs upload ad-hoc, non-notarized build artifacts as
   workflow artifacts and intentionally skip stable `appcast.xml` generation.
 - For stable releases, npm preflight, Full Release Validation, public mac
-  validation, release-ops mac validation, and release-ops mac preflight must all
-  pass before any real publish run starts. For beta releases, npm preflight and
-  Full Release Validation must pass before npm publish unless the operator
-  explicitly waives the full gate; mac beta validation is still only required
-  when requested.
+  validation, private mac validation, and private mac preflight must all pass
+  before any real publish run starts. For beta releases, npm preflight and Full
+  Release Validation must pass before npm publish unless the operator explicitly
+  waives the full gate; mac beta validation is still only required when
+  requested.
 - Real publish runs may be dispatched from `main` or from a
   `release/YYYY.M.PATCH` branch. For release-branch runs, the tag must be contained
   in that release branch, and the real publish must reuse a successful preflight
@@ -700,21 +699,21 @@ node --import tsx scripts/openclaw-npm-postpublish-verify.ts <published-version>
   rather than workflow-level SHA pinning.
 - The `npm-release` environment must be approved by `@openclaw/openclaw-release-managers` before publish continues.
 - Mac publish uses
-  `openclaw/releases/.github/workflows/openclaw-macos-publish.yml` for
-  release-ops mac preflight artifact preparation and real publish artifact
+  `openclaw/releases-private/.github/workflows/openclaw-macos-publish.yml` for
+  private mac preflight artifact preparation and real publish artifact
   promotion.
-- Real release-ops mac publish uploads the packaged `.zip`, `.dmg`, and
+- Real private mac publish uploads the packaged `.zip`, `.dmg`, and
   `.dSYM.zip` assets to the existing GitHub release in `openclaw/openclaw`
   automatically when `OPENCLAW_PUBLIC_REPO_RELEASE_TOKEN` is present in the
-  release-ops repo `mac-release` environment.
+  private repo `mac-release` environment.
 - For stable releases, the agent must also download the signed
-  `macos-appcast-<tag>` artifact from the successful release-ops mac workflow
-  and then update `appcast.xml` on `main`.
+  `macos-appcast-<tag>` artifact from the successful private mac workflow and
+  then update `appcast.xml` on `main`.
 - For beta mac releases, do not update the shared production `appcast.xml`
   unless a separate beta Sparkle feed exists.
-- The release-ops repo targets a dedicated `mac-release` environment. If the
-  GitHub plan does not yet support required reviewers there, do not assume the
-  environment alone is the approval boundary; rely on restricted repo access and
+- The private repo targets a dedicated `mac-release` environment. If the GitHub
+  plan does not yet support required reviewers there, do not assume the
+  environment alone is the approval boundary; rely on private repo access and
   CODEOWNERS until those settings can be enabled.
 - Do not use `NPM_TOKEN` or the plugin OTP flow for the OpenClaw package
   publish path; package publishing uses trusted publishing.
@@ -801,12 +800,12 @@ node --import tsx scripts/openclaw-npm-postpublish-verify.ts <published-version>
 18. For stable releases, start `.github/workflows/macos-release.yml` in
     `openclaw/openclaw` and wait for the public validation-only run to pass.
 19. For stable releases, start
-    `openclaw/releases/.github/workflows/openclaw-macos-validate.yml` with the
-    same tag and wait for the release-ops mac validation lane to pass.
+    `openclaw/releases-private/.github/workflows/openclaw-macos-validate.yml`
+    with the same tag and wait for the private mac validation lane to pass.
 20. For stable releases, start
-    `openclaw/releases/.github/workflows/openclaw-macos-publish.yml` with
-    `preflight_only=true` and wait for it to pass. Save that run id because the
-    real publish requires it to reuse the notarized mac artifacts.
+    `openclaw/releases-private/.github/workflows/openclaw-macos-publish.yml`
+    with `preflight_only=true` and wait for it to pass. Save that run id because
+    the real publish requires it to reuse the notarized mac artifacts.
 21. If any preflight or validation run fails, fix the issue on a new commit,
     delete the tag and any accidental draft/incomplete GitHub release, recreate
     the tag from the fixed commit, and rerun all relevant preflights from
@@ -862,23 +861,22 @@ node --import tsx scripts/openclaw-npm-postpublish-verify.ts <published-version>
     promotion roster when the matching beta already carried the full confidence
     pass: published npm postpublish verify, Docker install/update smoke,
     macOS-only Parallels install/update smoke, and required QA signal.
-    Then start the restricted release-ops
-    `openclaw/releases/.github/workflows/openclaw-npm-dist-tags.yml` workflow
-    to promote that stable version from `beta` to `latest`, then verify
-    `latest` now points at that version.
+    Then start the private
+    `openclaw/releases-private/.github/workflows/openclaw-npm-dist-tags.yml`
+    workflow to promote that stable version from `beta` to `latest`, then
+    verify `latest` now points at that version.
 29. If the stable release was published directly to `latest` and `beta` should
-    follow it, start that same release-ops dist-tag workflow to point `beta` at
-    the stable version, then verify both `latest` and `beta` point at that
-    version.
+    follow it, start that same private dist-tag workflow to point `beta` at the
+    stable version, then verify both `latest` and `beta` point at that version.
 30. For stable releases, start
-    `openclaw/releases/.github/workflows/openclaw-macos-publish.yml` for the
-    real publish with the successful release-ops mac `preflight_run_id` and wait
-    for success.
-31. Verify the successful real release-ops mac run uploaded the `.zip`, `.dmg`,
+    `openclaw/releases-private/.github/workflows/openclaw-macos-publish.yml`
+    for the real publish with the successful private mac `preflight_run_id` and
+    wait for success.
+31. Verify the successful real private mac run uploaded the `.zip`, `.dmg`,
     and `.dSYM.zip` artifacts to the existing GitHub release in
     `openclaw/openclaw`.
 32. For stable releases, download `macos-appcast-<tag>` from the successful
-    release-ops mac run, update `appcast.xml` on `main`, verify the feed, then
+    private mac run, update `appcast.xml` on `main`, verify the feed, then
     complete the **Close stable releases on main** gate.
 33. For beta releases, publish the mac assets only when intentionally requested;
     expect no shared production

.github/workflows/ci.yml

@@ -858,7 +858,7 @@ jobs:
     timeout-minutes: 60
     strategy:
       fail-fast: false
-      max-parallel: 12
+      max-parallel: 8
       matrix: ${{ fromJson(needs.preflight.outputs.checks_fast_core_matrix) }}
     steps:
       - name: Checkout
@@ -977,7 +977,7 @@ jobs:
     timeout-minutes: 60
     strategy:
       fail-fast: false
-      max-parallel: 12
+      max-parallel: 8
       matrix: ${{ fromJson(needs.preflight.outputs.plugin_contracts_matrix) }}
     steps:
       - name: Checkout
@@ -1058,7 +1058,7 @@ jobs:
     timeout-minutes: 60
     strategy:
       fail-fast: false
-      max-parallel: 12
+      max-parallel: 8
       matrix: ${{ fromJson(needs.preflight.outputs.channel_contracts_matrix) }}
     steps:
       - name: Checkout
@@ -1212,8 +1212,8 @@ jobs:
     strategy:
       fail-fast: false
       # The canonical main path waits for the admission debounce above, so
-      # widen this large matrix within the current runner-registration budget.
-      max-parallel: 24
+      # modestly widen this large matrix without recreating registration bursts.
+      max-parallel: 16
       matrix: ${{ fromJson(needs.preflight.outputs.checks_node_core_nondist_matrix) }}
     steps:
       - name: Checkout
@@ -1351,7 +1351,7 @@ jobs:
     timeout-minutes: 20
     strategy:
       fail-fast: false
-      max-parallel: 12
+      max-parallel: 8
       matrix:
         include:
           - check_name: check-guards
@@ -1493,7 +1493,7 @@ jobs:
     timeout-minutes: 20
     strategy:
       fail-fast: false
-      max-parallel: 12
+      max-parallel: 8
       matrix:
         include:
           - check_name: check-additional-boundaries-a

.github/workflows/plugin-init-scaffold-validation.yml

@@ -1,51 +0,0 @@
-name: Plugin Init Scaffold Validation
-
-on:
-  workflow_dispatch:
-  push:
-    branches: [main]
-    paths:
-      - ".github/workflows/plugin-init-scaffold-validation.yml"
-      - "package.json"
-      - "pnpm-lock.yaml"
-      - "scripts/validate-plugin-init-provider-scaffold.ts"
-      - "src/cli/plugins-authoring-command.ts"
-      - "src/cli/plugins-authoring-command.test.ts"
-      - "src/cli/plugins-cli.ts"
-      - "src/plugin-sdk/**"
-  pull_request:
-    types: [opened, reopened, synchronize, ready_for_review]
-    paths:
-      - ".github/workflows/plugin-init-scaffold-validation.yml"
-      - "package.json"
-      - "pnpm-lock.yaml"
-      - "scripts/validate-plugin-init-provider-scaffold.ts"
-      - "src/cli/plugins-authoring-command.ts"
-      - "src/cli/plugins-authoring-command.test.ts"
-      - "src/cli/plugins-cli.ts"
-      - "src/plugin-sdk/**"
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
-jobs:
-  validate-provider-scaffold:
-    name: Validate provider scaffold
-    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
-    runs-on: ${{ github.repository == 'openclaw/openclaw' && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-24.04' }}
-    timeout-minutes: 30
-    steps:
-      - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
-
-      - name: Setup Node environment
-        uses: ./.github/actions/setup-node-env
-        with:
-          install-bun: "false"
-
-      - name: Generate and validate provider scaffold
-        run: pnpm test:plugins:init-provider-scaffold

AGENTS.md

@@ -143,9 +143,6 @@ Skills own workflows; root owns hard policy and routing.
 
 ## GitHub / PRs
 
-- Fresh GitHub items: read `CONTRIBUTING.md`, the issue chooser/form, PR template, and `.github/CODEOWNERS`; blank issues are disabled; preserve templates and evidence requirements.
-- Agent-authored/non-trivial work: create or reuse the issue first; tiny fixes may go direct. PRs use the template, link context, and keep durable problem/impact/evidence sections.
-- Route support to Discord and security through `SECURITY.md`. Use listed maintainer areas/`CODEOWNERS`; never guess mentions.
 - Use `$openclaw-pr-maintainer` immediately for maintainer-side OpenClaw issue/PR review, triage, duplicates, labels, comments, close, land, or evidence. Contributor PR creation/refresh follows the requested contributor workflow; linked refs alone do not require maintainer archive tooling.
 - Issue/PR start: `git status -sb`; if clean, `git pull --ff-only`; if dirty, yell before pull/rebase.
 - PR refs: `gh pr view/diff` or `gh api`, not web search. Prefer `gitcrawl` for maintainer discovery; missing/stale `gitcrawl` falls through to live `gh`, not contributor setup. Verify live with `gh` before mutation.

CHANGELOG.md

@@ -10,92 +10,43 @@ Docs: https://docs.openclaw.ai
 
 ## 2026.6.10
 
-Automatic fast mode starts short conversations quickly, then returns longer or fallback work to normal mode without losing visible state. Provider routing, channel progress, session identity, and trusted tool policies are more reliable, with smaller improvements spanning provider setup, diagnostics, and transcript tooling.
-
 ### Highlights
 
-#### Automatic fast mode
+- **Automatic fast mode for talks:** OpenClaw can enable fast mode for short conversational turns, then return to normal mode for longer runs with bounded fallback and delivery behavior. (#85104) Thanks @alexph-dev and @vincentkoc.
+- **More reliable model routing:** Zai model synthesis, GLM overload failover, and native reasoning-level selection now follow the active model catalog more consistently. (#94461, #93241, #94067, #94136) Thanks @Pandah97, @chrysb, @0xghost42, @zhengli0922, @openperf, @civiltox, and @BorClaw.
+- **Safer session and channel state:** channel switches reset stale origin fields, and cron delivery awareness stays attached to the target session. (#95328, #93580) Thanks @ZengWen-DT, @jalehman, @gorkem2020, and @scotthuang.
+- **Trusted policies survive hook composition:** composed hook registries keep the trusted tool policies required by approval-sensitive flows. (#94545) Thanks @jesse-merhi.
 
-- Adds [`/fast auto`](https://docs.openclaw.ai/tools/thinking) so short conversational calls can start quickly, while longer or fallback work returns to normal mode with the effective state still visible. [PR #85104](https://github.com/openclaw/openclaw/pull/85104), [Issue #85087](https://github.com/openclaw/openclaw/issues/85087). Thanks @alexph-dev and @vincentkoc.
-- Shows the effective automatic fast-mode state in status instead of reducing it to on/off, and avoids carrying a cleared Codex service-tier choice into later runs. [8845f2f](https://github.com/openclaw/openclaw/commit/8845f2fd6143becc37110ab5021dd5e1517f0cdc). Thanks @vincentkoc.
-- Keeps automatic fast-mode timing consistent when a turn switches to a fallback model. [075091d](https://github.com/openclaw/openclaw/commit/075091d0cab94053ff094268efc0acb225d514f4). Thanks @vincentkoc.
-- Keeps the original fast-mode timing and progress behavior when a live model switch retries a turn. [d1e190f](https://github.com/openclaw/openclaw/commit/d1e190fbe822ad6ae4e660ce376b60ec9fdb0fba). Thanks @vincentkoc.
-- Keeps automatic fast-mode progress and reset behavior distinct from explicit fast mode after a run switches modes. [20aec98](https://github.com/openclaw/openclaw/commit/20aec985545db7a24ea066e5bff1c47b789cbded). Thanks @vincentkoc.
-- Shows the effective fast-mode value in connected-agent sessions instead of the configured value, so status reflects what the session is actually using. [9509aa0](https://github.com/openclaw/openclaw/commit/9509aa063c0ef3e32be1516fcb0c23606b6d5c7b). Thanks @vincentkoc.
-- Keeps the effective automatic fast-mode setting visible through fallback transitions in connected-agent sessions. [7f5423c](https://github.com/openclaw/openclaw/commit/7f5423ca97174a3f16c211db54a6c96e5b3a6089). Thanks @vincentkoc.
-- Keeps automatic fast-mode timing and progress consistent when reply and [scheduled-agent runs](https://docs.openclaw.ai/automation/cron-jobs) retry or switch models. [6c29f88](https://github.com/openclaw/openclaw/commit/6c29f88913796bfe05696556cd82246670b126f0). Thanks @vincentkoc.
-- Keeps fast-mode cleanup and status consistent when a run switches between fallback models. [c4694f8](https://github.com/openclaw/openclaw/commit/c4694f84ffd52064f89609098cc4f8570fb72e1b). Thanks @vincentkoc.
-- Shows the automatic fast-mode reset only when fallback work is finished, so status messages match the end of the transition. [f4d93c8](https://github.com/openclaw/openclaw/commit/f4d93c855bff6930f5e5d739b95e0c2612ec4899). Thanks @vincentkoc.
-- Shows reset and delivery progress at the right time when auto-reply or other follow-up runs retry or leave automatic fast mode. [684e440](https://github.com/openclaw/openclaw/commit/684e44013778bd47d159e64b2595e4d09a92ebea). Thanks @vincentkoc.
+### Changes
 
-### Channels and Messaging
+- **Agent and channel runtime:** fast-mode state now survives retries, fallback transitions, progress events, and embedded/CLI/ACP normalization; session and channel routing retain the current target and delivery context. (#85104, #93580, #95328) Thanks @alexph-dev, @vincentkoc, @scotthuang, @ZengWen-DT, @jalehman, and @gorkem2020.
+- **Provider behavior:** model catalogs now supply the correct Zai base URL, overload classification, and native reasoning controls for live-discovered models. (#94461, #93241, #94067, #94136) Thanks @Pandah97, @chrysb, @0xghost42, @zhengli0922, @openperf, @civiltox, and @BorClaw.
 
-#### Channel delivery and progress updates
+### Fixes
 
-- Prevents the next turn after a [scheduled message](https://docs.openclaw.ai/automation/cron-jobs) from losing what was delivered or whether delivery failed, so replies can use that context without exposing cron details in the channel. [PR #93580](https://github.com/openclaw/openclaw/pull/93580). Thanks @jalehman and @scotthuang.
-- Prevents streamed channel progress from dropping a repeated status that represents a separate step, so each meaningful step remains visible in the draft. [2d42e52](https://github.com/openclaw/openclaw/commit/2d42e52ac5513e0bd824b8a0e069db83e04bc056). Thanks @vincentkoc.
-- Prevents keyed streamed progress from staying on an older status, so viewers see the latest state instead of stale text. [8bb6472](https://github.com/openclaw/openclaw/commit/8bb6472c4de2eea06f1ba31d6ed679e2ac4581b0). Thanks @vincentkoc.
+- **Fast-mode and policy correctness:** fallback cutoffs and reset notices are bounded, repeated progress events remain visible, Codex service-tier state is normalized, and trusted policies are not lost when hook registries are composed. (#85104, #94545) Thanks @alexph-dev, @vincentkoc, and @jesse-merhi.
+- **Model and delivery edge cases:** Zai and GLM failover paths use the right runtime metadata, while stale channel-origin state no longer leaks across session changes. (#94461, #93241, #95328) Thanks @Pandah97, @chrysb, @0xghost42, @zhengli0922, @ZengWen-DT, @jalehman, and @gorkem2020.
+- **Provider plugin onboarding:** setup refreshes provider plugin registry metadata after installing setup-selected provider plugins, so auth continuation uses the newly installed provider instead of stale registry state. (#95792) Thanks @snowzlmbot.
 
-### Providers and Models
+### Complete contribution record
 
-#### Provider model catalogs and reasoning controls
+This audited record covers the complete v2026.6.9..HEAD history: 12 merged PRs. The generation manifest also supplies direct commits as editorial input; the grouped notes above prioritize user impact.
 
-- Treats Zhipu/GLM overload responses as overloads, so a configured fallback is selected for the right reason instead of following the wrong failover path. [PR #93241](https://github.com/openclaw/openclaw/pull/93241), [Issue #93211](https://github.com/openclaw/openclaw/issues/93211). Thanks @0xghost42 and @zhengli0922.
-- Prevents Telegram, Slack, and Discord `/think` menus for live Ollama models from hiding supported levels, so users can choose valid reasoning settings without guessing. [PR #94067](https://github.com/openclaw/openclaw/pull/94067), [Issue #93835](https://github.com/openclaw/openclaw/issues/93835). Thanks @civiltox and @openperf.
-- Expands [`zai/glm-5.2` thinking choices](https://docs.openclaw.ai/tools/thinking) beyond binary on/off and sends high or max requests as the intended Z.AI reasoning effort. [PR #94136](https://github.com/openclaw/openclaw/pull/94136). Thanks @borclaw.
-- Prevents bundled [Z.ai GLM-5 models](https://docs.openclaw.ai/providers/zai) from falling through to OpenAI and producing misleading API-key errors, so they use Z.AI by default. [PR #94461](https://github.com/openclaw/openclaw/pull/94461), [Issue #94269](https://github.com/openclaw/openclaw/issues/94269). Thanks @chrysb and @pandah97.
-- Adds GLM-5.2 and Kimi K2.7 Code to the [OpenCode Go catalog](https://docs.openclaw.ai/providers/opencode-go) with current limits, so users can select the models from OpenClaw. [66f84a9](https://github.com/openclaw/openclaw/commit/66f84a9bf1082de26f92b2b3741cc2f34aba34fa). Thanks @samson1357924.
-- Corrects `kimi-k2.7-code` capability listings so OpenCode Go users are not offered unsupported video prompts when the model accepts text and images. [715dc71](https://github.com/openclaw/openclaw/commit/715dc718fc5a2a5d6f7e9ec16e0269382b726e83).
+#### Pull requests
 
-#### Provider plugin onboarding
+- **PR #86627** Keep core doctor health in contribution order. Thanks @giodl73-repo.
+- **PR #93580** fix: preserve cron delivery awareness for target sessions. Thanks @scotthuang and @jalehman.
+- **PR #95030** refactor: add SDK transcript identity target API. Thanks @jalehman.
+- **PR #94838** refactor(copilot): complete harness lifecycle parity. Thanks @vincentkoc.
+- **PR #95328** fix(sessions): reset stale per-channel origin fields on channel switch. Related #95325. Thanks @ZengWen-DT and @jalehman and @gorkem2020.
+- **PR #94461** fix(zai): fall back to manifest baseUrl for synthesized GLM-5 models. Related #94269. Thanks @Pandah97 and @chrysb.
+- **PR #93241** fix(agents): classify Zhipu GLM overload as overloaded for failover. Related #93211. Thanks @0xghost42 and @zhengli0922.
+- **PR #94067** fix(channels): resolve native /think menu levels via runtime catalog for live-discovered models. Related #93835. Thanks @openperf and @civiltox.
+- **PR #94136** fix(zai): expose GLM-5.2 reasoning levels [AI-assisted]. Thanks @BorClaw.
+- **PR #85104** feat: fast talks auto mode. Related #85087. Thanks @alexph-dev.
+- **PR #94545** fix: keep trusted policies with hook registry. Thanks @jesse-merhi.
+- **PR #95792** fix(onboard): refresh provider plugin registry after setup installs. Related #95765. Thanks @snowzlmbot.
 
-- Prevents first-run setup from skipping the selected provider's credential prompt after plugin installation, so onboarding continues with that provider instead of falling back to OpenAI. [PR #95792](https://github.com/openclaw/openclaw/pull/95792), [Issue #95765](https://github.com/openclaw/openclaw/issues/95765). Thanks @snowzlmbot.
-
-### Memory, Sessions, and State
-
-#### Session transcript SDK helpers
-
-- Adds a durable [session-transcript SDK contract](https://docs.openclaw.ai/plugins/sdk-runtime) so plugins can read, append, publish, and lock the intended transcript without treating [legacy file paths](https://docs.openclaw.ai/plugins/sdk-subpaths) as identity. [PR #95030](https://github.com/openclaw/openclaw/pull/95030). Thanks @jalehman.
-
-#### Cross-channel session identity
-
-- Prevents a shared direct-message [session](https://docs.openclaw.ai/concepts/session) from carrying the previous [channel's identity](https://docs.openclaw.ai/channels/channel-routing) after a switch, so status, reactions, threads, and message references target the current channel. [PR #95328](https://github.com/openclaw/openclaw/pull/95328), [Issue #95325](https://github.com/openclaw/openclaw/issues/95325). Thanks @gorkem2020, @jalehman, and @zengwen-dt.
-
-### Gateway, Security, and Trust
-
-#### Prompt context boundaries
-
-- Keeps empty prompts separate from hook-added context during compaction or session reuse in [Copilot and Codex sessions](https://docs.openclaw.ai/plugins/copilot), so prompt boundaries remain consistent. [PR #94838](https://github.com/openclaw/openclaw/pull/94838). Thanks @vincentkoc.
-
-#### Trusted tool policy enforcement
-
-- Keeps [approval-sensitive Gateway and plugin tools](https://docs.openclaw.ai/plugins/hooks) protected when connected extensions change, so configured safeguards continue to apply. [PR #94545](https://github.com/openclaw/openclaw/pull/94545). Thanks @jesse-merhi.
-
-#### Trusted package redirects
-
-- Prevents authenticated package-source tokens from being sent to an allowed redirect on another origin, while the valid redirected download still completes. [b0df6dc](https://github.com/openclaw/openclaw/commit/b0df6dc10eb5b9e9fdca93063a16316f8589954e).
-
-### Clients and Interfaces
-
-#### Docker and Podman setup timeouts
-
-- Prevents [Docker](https://docs.openclaw.ai/install/docker) and [Podman](https://docs.openclaw.ai/install/podman) setup from running unbounded on hosts where GNU timeout is installed as `gtimeout`, so image pulls, builds, and detached startup receive the intended guard. [62b2e9e](https://github.com/openclaw/openclaw/commit/62b2e9ef14b4be6fd396621c8e5e248331f08695).
-
-### Plugins and Packaging
-
-#### Codex service-tier clearing
-
-- Prevents cleared [Codex service tiers](https://docs.openclaw.ai/tools/thinking) from being persisted as explicit stale state, so resumed or switched conversations use the normal default instead. [cd32d9f](https://github.com/openclaw/openclaw/commit/cd32d9ff91caf84c0ead38796ef096cdc5bea06e). Thanks @vincentkoc.
-
-#### StepFun provider installation
-
-- Restores [ClawHub discovery](https://docs.openclaw.ai/plugins/reference/stepfun) for the [StepFun provider](https://docs.openclaw.ai/providers/stepfun) plugin, so operators can install it through either ClawHub or npm. [ecb82f1](https://github.com/openclaw/openclaw/commit/ecb82f1be93024be23c1b191ebea92c63230b6c0). Thanks @vincentkoc.
-
-### Docs and Operator Workflows
-
-#### Doctor check ordering
-
-- Keeps core [`openclaw doctor`](https://docs.openclaw.ai/gateway/doctor) diagnostics in their normal order before extension checks, making lint and repair output easier to follow. [PR #86627](https://github.com/openclaw/openclaw/pull/86627). Thanks @giodl73-repo.
 ## 2026.6.9
 
 ### Highlights

CONTRIBUTING.md

@@ -97,23 +97,6 @@ Welcome to the lobster tank! 🦞
 4. **Test/CI-only PRs for known `main` failures** → Don't open a PR. The Maintainer team is already tracking those failures, and PRs that only tweak tests or CI to chase them will be closed unless they are required to validate a new fix.
 5. **Questions** → Discord [#help](https://discord.com/channels/1456350064065904867/1459642797895319552) / [#users-helping-users](https://discord.com/channels/1456350064065904867/1459007081603403828)
 
-## Issue, PR, and Contact Routing
-
-Start from this routing map before creating GitHub items:
-
-| Situation                                                | Use                                                                                                                                                                                  | Required evidence                                                                                                   |
-| -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------- |
-| Product bug, regression, crash, or behavior defect       | [Bug report](https://github.com/openclaw/openclaw/issues/new?template=bug_report.yml)                                                                                                | Repro steps, expected vs actual behavior, version, OS, model/provider route when relevant, logs/screenshots, impact |
-| Documentation bug or missing/contradictory docs          | [Docs bug report](https://github.com/openclaw/openclaw/issues/new?template=docs_bug_report.yml)                                                                                      | Affected docs path or URL, verification steps, expected docs content, actual docs content, impact, evidence         |
-| New feature, architecture change, or product improvement | [Feature request](https://github.com/openclaw/openclaw/issues/new?template=feature_request.yml) or Discord first                                                                     | Problem, proposed solution, alternatives, impact, examples or prior art                                             |
-| Onboarding, setup help, or general support question      | Discord [#help](https://discord.com/channels/1456350064065904867/1459642797895319552) / [#users-helping-users](https://discord.com/channels/1456350064065904867/1459007081603403828) | Do not open a GitHub issue unless there is a concrete product defect or docs gap                                    |
-| Security vulnerability                                   | See [Report a Vulnerability](#report-a-vulnerability) below                                                                                                                          | Do not file public issues for private security reports                                                              |
-| PR for an existing or newly filed issue                  | Use the [PR template](.github/pull_request_template.md)                                                                                                                              | Visible `Closes #<issue>` or `Related: #<issue>`, problem, shipped solution, user impact, validation evidence       |
-
-For agent-authored or otherwise non-trivial work, create or reuse the issue first, then open the PR against it. Bugs and very small fixes may go straight to PR, but still link existing context when it exists and fill out the PR template.
-
-Do not guess who to tag. Let issue forms, labels/automation, `.github/CODEOWNERS`, and the maintainer areas above route the work. Mention a maintainer only when their listed area or owned path is directly relevant and you need a decision; otherwise rely on normal review. For coordinated change sets, ask in **#clawtributors** before opening more than the PR limit.
-
 ## PR Limits
 
 We cap at **20 open PRs per author**. If you exceed this, the `r: too-many-prs` label is added and your PR is auto-closed. This is a hard limit.

README.md

@@ -304,9 +304,6 @@ by Peter Steinberger and the community.
 ## Community
 
 See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines, maintainers, and how to submit PRs.
-Use the [issue chooser](https://github.com/openclaw/openclaw/issues/new/choose) for bugs, docs bugs, and feature requests;
-ask setup/support questions in [Discord](https://discord.gg/clawd); and report vulnerabilities through [SECURITY.md](SECURITY.md).
-PRs should link the relevant issue when possible and follow the [PR template](.github/pull_request_template.md) with problem, impact, and evidence.
 AI/vibe-coded PRs welcome! 🤖
 
 Special thanks to [Mario Zechner](https://mariozechner.at/) for his support and for

appcast.xml

@@ -2,53 +2,6 @@
 <rss xmlns:sparkle="http://www.andymatuschak.org/xml-namespaces/sparkle" version="2.0">
     <channel>
         <title>OpenClaw</title>
-        <item>
-            <title>2026.6.10</title>
-            <pubDate>Fri, 26 Jun 2026 23:37:36 +0000</pubDate>
-            <link>https://raw.githubusercontent.com/openclaw/openclaw/main/appcast.xml</link>
-            <sparkle:version>2606001090</sparkle:version>
-            <sparkle:shortVersionString>2026.6.10</sparkle:shortVersionString>
-            <sparkle:minimumSystemVersion>15.0</sparkle:minimumSystemVersion>
-            <description><![CDATA[<h2>OpenClaw 2026.6.10</h2>
-<h3>Highlights</h3>
-<ul>
-<li><strong>Automatic fast mode for talks:</strong> OpenClaw can enable fast mode for short conversational turns, then return to normal mode for longer runs with bounded fallback and delivery behavior. (#85104) Thanks @alexph-dev and @vincentkoc.</li>
-<li><strong>More reliable model routing:</strong> Zai model synthesis, GLM overload failover, and native reasoning-level selection now follow the active model catalog more consistently. (#94461, #93241, #94067, #94136) Thanks @Pandah97, @chrysb, @0xghost42, @zhengli0922, @openperf, @civiltox, and @BorClaw.</li>
-<li><strong>Safer session and channel state:</strong> channel switches reset stale origin fields, and cron delivery awareness stays attached to the target session. (#95328, #93580) Thanks @ZengWen-DT, @jalehman, @gorkem2020, and @scotthuang.</li>
-<li><strong>Trusted policies survive hook composition:</strong> composed hook registries keep the trusted tool policies required by approval-sensitive flows. (#94545) Thanks @jesse-merhi.</li>
-</ul>
-<h3>Changes</h3>
-<ul>
-<li><strong>Agent and channel runtime:</strong> fast-mode state now survives retries, fallback transitions, progress events, and embedded/CLI/ACP normalization; session and channel routing retain the current target and delivery context. (#85104, #93580, #95328) Thanks @alexph-dev, @vincentkoc, @scotthuang, @ZengWen-DT, @jalehman, and @gorkem2020.</li>
-<li><strong>Provider behavior:</strong> model catalogs now supply the correct Zai base URL, overload classification, and native reasoning controls for live-discovered models. (#94461, #93241, #94067, #94136) Thanks @Pandah97, @chrysb, @0xghost42, @zhengli0922, @openperf, @civiltox, and @BorClaw.</li>
-</ul>
-<h3>Fixes</h3>
-<ul>
-<li><strong>Fast-mode and policy correctness:</strong> fallback cutoffs and reset notices are bounded, repeated progress events remain visible, Codex service-tier state is normalized, and trusted policies are not lost when hook registries are composed. (#85104, #94545) Thanks @alexph-dev, @vincentkoc, and @jesse-merhi.</li>
-<li><strong>Model and delivery edge cases:</strong> Zai and GLM failover paths use the right runtime metadata, while stale channel-origin state no longer leaks across session changes. (#94461, #93241, #95328) Thanks @Pandah97, @chrysb, @0xghost42, @zhengli0922, @ZengWen-DT, @jalehman, and @gorkem2020.</li>
-<li><strong>Provider plugin onboarding:</strong> setup refreshes provider plugin registry metadata after installing setup-selected provider plugins, so auth continuation uses the newly installed provider instead of stale registry state. (#95792) Thanks @snowzlmbot.</li>
-</ul>
-<h3>Complete contribution record</h3>
-This audited record covers the complete v2026.6.9..HEAD history: 12 merged PRs. The generation manifest also supplies direct commits as editorial input; the grouped notes above prioritize user impact.
-<h4>Pull requests</h4>
-<ul>
-<li><strong>PR #86627</strong> Keep core doctor health in contribution order. Thanks @giodl73-repo.</li>
-<li><strong>PR #93580</strong> fix: preserve cron delivery awareness for target sessions. Thanks @scotthuang and @jalehman.</li>
-<li><strong>PR #95030</strong> refactor: add SDK transcript identity target API. Thanks @jalehman.</li>
-<li><strong>PR #94838</strong> refactor(copilot): complete harness lifecycle parity. Thanks @vincentkoc.</li>
-<li><strong>PR #95328</strong> fix(sessions): reset stale per-channel origin fields on channel switch. Related #95325. Thanks @ZengWen-DT and @jalehman and @gorkem2020.</li>
-<li><strong>PR #94461</strong> fix(zai): fall back to manifest baseUrl for synthesized GLM-5 models. Related #94269. Thanks @Pandah97 and @chrysb.</li>
-<li><strong>PR #93241</strong> fix(agents): classify Zhipu GLM overload as overloaded for failover. Related #93211. Thanks @0xghost42 and @zhengli0922.</li>
-<li><strong>PR #94067</strong> fix(channels): resolve native /think menu levels via runtime catalog for live-discovered models. Related #93835. Thanks @openperf and @civiltox.</li>
-<li><strong>PR #94136</strong> fix(zai): expose GLM-5.2 reasoning levels [AI-assisted]. Thanks @BorClaw.</li>
-<li><strong>PR #85104</strong> feat: fast talks auto mode. Related #85087. Thanks @alexph-dev.</li>
-<li><strong>PR #94545</strong> fix: keep trusted policies with hook registry. Thanks @jesse-merhi.</li>
-<li><strong>PR #95792</strong> fix(onboard): refresh provider plugin registry after setup installs. Related #95765. Thanks @snowzlmbot.</li>
-</ul>
-<p><a href="https://github.com/openclaw/openclaw/blob/main/CHANGELOG.md">View full changelog</a></p>
-]]></description>
-            <enclosure url="https://github.com/openclaw/openclaw/releases/download/v2026.6.10/OpenClaw-2026.6.10.zip" length="56115790" type="application/octet-stream" sparkle:edSignature="MEeGG8+WePhUg9uDShznmdhhAgy/WWe7bAwr4XRTauNdrM441iziQYIlwhfNrtHDHX+uE1/tkRtIMcELfuekAg=="/>
-        </item>
         <item>
             <title>2026.6.8</title>
             <pubDate>Tue, 16 Jun 2026 17:17:20 +0000</pubDate>
@@ -171,5 +124,132 @@ This audited record covers the complete v2026.6.9..HEAD history: 12 merged PRs.
 ]]></description>
             <enclosure url="https://github.com/openclaw/openclaw/releases/download/v2026.6.5/OpenClaw-2026.6.5.zip" length="55725877" type="application/octet-stream" sparkle:edSignature="EKr7gCfpEVStis9HSADJk1CWYbmH2MHMqSgNfZvLbBFCBWmk3pjBJS6K2qkxkq5lIbTj4H+Lo7Iri6ip/xTGDA=="/>
         </item>
+        <item>
+            <title>2026.6.1</title>
+            <pubDate>Wed, 03 Jun 2026 21:26:22 +0000</pubDate>
+            <link>https://raw.githubusercontent.com/openclaw/openclaw/main/appcast.xml</link>
+            <sparkle:version>2026060190</sparkle:version>
+            <sparkle:shortVersionString>2026.6.1</sparkle:shortVersionString>
+            <sparkle:minimumSystemVersion>15.0</sparkle:minimumSystemVersion>
+            <description><![CDATA[<h2>OpenClaw 2026.6.1</h2>
+<h3>Highlights</h3>
+<ul>
+<li>Agents and CLI-backed runtimes recover more cleanly from interrupted tool calls, stale session bindings, compaction handoffs, and media delivery retries. (#88129, #88136, #88141, #88162, #88182)</li>
+<li>Channels and mobile delivery are steadier across Telegram, WhatsApp, iMessage, Slack, Discord, Microsoft Teams, Google Chat, Google Meet, and iOS realtime Talk. (#88096, #88105, #88183, #88231)</li>
+<li>Provider and plugin requests now bound more timers, retries, OAuth/device-code lifetimes, media downloads, local service probes, and generated-content polling paths before they can hang a run.</li>
+<li>Skills, session metadata, gateway runtime state, plugin metadata, memory watchers, and store writes do less repeated work on hot paths while keeping config, dispatch, and Linux file-watch behavior stable. (#89185, #89188, #85351) Thanks @RomneyDa and @NianJiuZst.</li>
+<li>Skills and plugin loading now handle stale disabled snapshots and loader failures more clearly, so channel turns avoid disabled SecretRefs and operators get better recovery guidance. (#79072, #79173) Thanks @zeus1959.</li>
+<li>Workboard, SecretRef plugin manifests, hosted iOS push relay, and external Copilot/Tokenjuice packaging add broader orchestration, integration, and plugin delivery surfaces. (#82326, #87469, #87796, #88107, #88117)</li>
+<li>Skill Workshop now has a fuller Control UI flow with proposal lists, today actions, revision handoff, searchable file previews, review states, locale coverage, and reusable session routing.</li>
+<li>Chat and Control UI startup paths keep sends alive through history loading, stream deltas incrementally, skip markdown work while streaming, keep drafts local while typing, clear the composer after sends, trace first-output latency, prioritize first connect, and expose calmer composer controls. (#88772, #88825, #88998, #89030, #89106) Thanks @vincentkoc and @sallyom.</li>
+<li>Provider coverage and model metadata now include MiniMax M3, account OAuth endpoints, Google/Vertex catalog fixes, OpenRouter SQLite model caching, Copilot Claude 1M capabilities, Foundry reasoning alignment, and OpenAI response replay guards. (#88480, #88512, #88851, #88860)</li>
+<li>iMessage monitor state, inbound queues, and plugin install ledgers moved toward SQLite-backed state so restarts and local monitors recover with less duplicate filesystem scanning. (#88794, #88797)</li>
+<li>Release, CI, Docker, E2E, plugin install, and diagnostics lanes now cap more logs, response bodies, readiness probes, artifact checks, status polling, child workflow waits, docker package cleanup, quiet test stalls, and rollback snapshots so failures report bounded proof instead of stalling. (#88966) Thanks @RomneyDa.</li>
+</ul>
+<h3>Changes</h3>
+<ul>
+<li>Docs: add a dedicated Skill Workshop guide covering governed skill creation, reviewable proposals, CLI, Gateway, agent tool behavior, approval policy, support files, and recovery, and refresh the ClawHub showcase cards. (#88734) Thanks @shakkernerd and @vyctorbrzezowski.</li>
+<li>Skills: let the <code>skill_workshop</code> agent tool apply, reject, and quarantine explicit proposals through the guarded review flow. Thanks @shakkernerd.</li>
+<li>Skills: let proposals carry approved support files under standard skill folders, with scanner, hash, and rollback safeguards. Thanks @shakkernerd.</li>
+<li>Skills: let pending proposals be revised in place with versioned, dated proposal frontmatter before approval. Thanks @shakkernerd.</li>
+<li>Skills: add Skill Workshop with pending proposals, CLI/Gateway review actions, rollback metadata, and the <code>skill_workshop</code> agent tool. Thanks @shakkernerd.</li>
+<li>Skill Workshop: add the Control UI navigation, styled dashboard, proposal today view, revision dialog, file preview modal, searchable preview files, reusable session handoff, and localized strings.</li>
+<li>Plugins: externalize Tokenjuice as the official <code>@openclaw/tokenjuice</code> plugin with npm and ClawHub publish metadata.</li>
+<li>Plugins: externalize the GitHub Copilot agent runtime as the official <code>@openclaw/copilot</code> plugin with npm and ClawHub publish metadata.</li>
+<li>iOS: add hosted push relay defaults, realtime Talk playback, and a guarded WebSocket ping path for more reliable mobile sessions. (#88096, #88105, #88231)</li>
+<li>iOS: support native iPad display layouts.</li>
+<li>Workboard: add orchestration primitives and agent coordination tools for multi-agent planning and run tracking. (#87469)</li>
+<li>Workboard: wire task-backed board runs and show task comments in the edit modal.</li>
+<li>Code mode: add internal namespaces for scoped agent/global sessions and exact namespace tool dispatch. (#88043)</li>
+<li>Code mode: add MCP API files and docs for code-mode integrations.</li>
+<li>Control UI: add a Dreaming-tab agent selector and propagate the selected agent through Dreaming status, diary, and diary actions. (#78748) Thanks @stevenepalmer.</li>
+<li>Control UI: add calmer chat composer controls, local draft typing state, and first-output latency instrumentation for active chat entry. (#88772, #88998) Thanks @vincentkoc.</li>
+<li>Plugins: add a SecretRef provider integration manifest contract and extract shared LLM core packages for provider/plugin reuse. (#82326, #88117)</li>
+<li>Plugins: persist the plugin install index in SQLite so installed package lookup survives reloads with less filesystem scanning. (#88794)</li>
+<li>Providers: add MiniMax M3 model support. (#88860)</li>
+<li>Doctor: add disk space health checks and stabilize post-upgrade JSON probes.</li>
+<li>Channels: store inbound queues in SQLite and migrate iMessage monitor state to SQLite-backed tracking. (#88797)</li>
+<li>Skills: add the core skills index and centralize skills runtime loading, status, filtering, and prompt formatting.</li>
+</ul>
+<h3>Fixes</h3>
+<ul>
+<li>Release/CI/E2E: fail early when Crabbox sparse-sync full checkouts do not have enough local disk, with guidance for moving the sync root.</li>
+<li>Build: render independent CLI startup metadata help snapshots concurrently to cut cold build-all metadata time.</li>
+<li>Plugins: stop timed-out package-boundary prep steps by process group so descendant TypeScript/helper processes do not survive local check cleanup.</li>
+<li>Control UI: serve static assets asynchronously after safe-open checks so large UI files do not block Gateway request handling.</li>
+<li>Scripts/UI: forward direct wrapper SIGHUP shutdown to child processes so terminal hangups do not leave wrapped dev commands running.</li>
+<li>Gateway: return the post-expiration pending-work revision from node drains so reconnecting nodes do not observe stale queue revisions after expired items are pruned.</li>
+<li>Release/CI/E2E: keep temporary full-sync checkouts alive while slow Crabbox leases boot, so sparse worktree runs do not lose their sync source before file-list generation.</li>
+<li>Release/CI/E2E: normalize inherited Linux <code>C.UTF-8</code> locale settings before raw AWS macOS Crabbox bootstrap commands, avoiding macOS locale warnings during package-manager hydration.</li>
+<li>Release/CI/E2E: keep gateway watch regression checks from copying large static plugin assets inside the measured idle window.</li>
+<li>Update: keep core updates nonblocking when a missing external plugin repair download stalls, while still blocking installed active plugin payload smoke failures.</li>
+<li>Agents/providers: keep streaming tool-call argument parsing record-shaped when providers emit valid non-object JSON such as <code>null</code> or arrays.</li>
+<li>Release/CI/E2E: reset incremental log readers when watched log files rotate without shrinking, so same-size replacements do not hide new readiness or RPC lines.</li>
+<li>Talk: preserve explicit <code>null</code> payloads on controller-created turn and output-audio lifecycle events.</li>
+<li>Agents/TUI: keep local custom provider runs from loading plugin runtime and auth alias metadata when plugins are disabled.</li>
+<li>Agents/TUI: restore in-flight TUI run switch-back behavior, keep no-policy native hook fallback available, guard vanished workspaces, and keep lightweight isolated subagents lightweight.</li>
+<li>Agents/media: keep async image, music, and video generation starts from ending the Codex turn, so mixed requests can continue with summaries or other work while media renders in the background.</li>
+<li>Agents/Codex: keep public OpenAI API-key profiles from being treated as native Codex app-server auth while preserving persisted Codex OAuth sessions.</li>
+<li>Agents/Codex: stream Codex app-server final-answer partials to live reply previews, preserve ACP metadata in SQLite, prefer real tool results over synthetic repair output, prevent aborted app-server turn handles from lingering, migrate legacy OpenAI Codex <code>lastGood</code> auth state, and preserve workspace/session metadata through ACP runtime refactors. (#88405, #88724, #88730) Thanks @vincentkoc.</li>
+<li>Control UI: keep collapsed tool cards labeled with the tool name and action instead of generic output text. Thanks @shakkernerd.</li>
+<li>Agents/Codex: surface Skill Workshop guidance in Codex app-server prompts when <code>skill_workshop</code> is available. Thanks @shakkernerd.</li>
+<li>Skill Workshop: restore and localize the Control UI board/today view switcher so review workflows keep their intended layout toggle across locales. Thanks @shakkernerd.</li>
+<li>Agents/auth: write auth profiles atomically, dispatch auth failures by type, add force re-login recovery, preserve workspaces during state-only uninstall, and compact before oversized turns so recovery paths avoid partial state. (#89181) Thanks @RomneyDa.</li>
+<li>Skills: skip disabled skill env overrides from stale persisted snapshots so disabled skill <code>apiKey</code> SecretRefs cannot abort embedded or channel turns. (#79072, #79173) Thanks @zeus1959.</li>
+<li>Skill Workshop: render the Control UI tab from filtered navigation state and keep filtered fallback routing stable.</li>
+<li>CLI: avoid live catalog validation during <code>openclaw agents add</code>, so adding a secondary agent no longer depends on provider catalog availability. (#76284, #88314) Thanks @zhangguiping-xydt.</li>
+<li>CLI: keep <code>plugins list --json</code> on the snapshot-only path so plugin sweeps avoid loading the full runtime status graph.</li>
+<li>CLI/desktop: bridge WSL clipboard operations through the shell, recognize manual-update launchd jobs, and keep machine-readable startup output parseable during progress setup. (#88764, #88689) Thanks @alexzhu0.</li>
+<li>Plugins: make PixVerse external-plugin ClawHub metadata explicit and keep it out of bundled dist builds.</li>
+<li>Plugins: clarify plugin loader failure guidance so missing or incompatible plugin packages point operators at the right repair path.</li>
+<li>Plugins: preserve npm plugin roots after blocked installs, skip plugin-local <code>openclaw</code> peer symlinks during rollback snapshots, relink those peers after restore, isolate cached tool runtime siblings, and isolate web-provider factory failures so one bad plugin does not poison sibling runtime paths. (#77237, #88807)</li>
+<li>Cron: keep SQLite cron migrations compatible with legacy run-log tables, archived job stores, diagnostic cron names, and legacy one-shot delete-after-run behavior. (#88285)</li>
+<li>Cron: keep update delivery validation scoped, harden restart state, and retire MCP runtimes on isolated cron cleanup.</li>
+<li>Memory: serialize QMD update/embed writes per store, reduce Linux watcher fan-out, retry transient FileProvider-backed reads, preserve phase signals on read errors, harden envelope metadata sanitization, reattach Linux native watchers when directories are recreated, and rewrite generated transcript paths on rollover so memory/search state survives concurrent gateway and CLI activity. (#66339, #85931, #89185, #89188, #85351) Thanks @openperf, @amittell, @RomneyDa, and @NianJiuZst.</li>
+<li>Memory: keep vector-disabled FTS indexes from resolving embedding providers during sync and search.</li>
+<li>Providers: bound generated media downloads from OpenAI, Runway, xAI, MiniMax, BytePlus, DashScope-compatible, FAL, OpenRouter, Google, Vydra, and Comfy providers.</li>
+<li>Providers: resolve Google defaults to <code>google-generative-ai</code>, register Vertex static catalog rows, align Foundry reasoning metadata, skip DeepSeek V4 thinking params on Foundry fallback, use MiniMax account OAuth endpoints, preserve Copilot Claude 1M capabilities, suppress disabled Ollama reasoning output, forward Gemini stop sequences, strip Kimi-incompatible Anthropic cache markers, keep OpenAI stop-finished tool calls, and avoid replay ids when the Responses store is disabled. (#88480, #88512, #76612) Thanks @coder999999999, @BryanTegomoh, and @vliuyt.</li>
+<li>Providers: cap GitHub Copilot OAuth request timeouts before creating abort signals.</li>
+<li>Cron: retry recurring jobs after transient model rate limits before waiting for the next scheduled slot.</li>
+<li>Agents/Codex: keep live session locks during cleanup, recover interrupted CLI tool transcripts, preserve Codex auth and compaction session identity, clear orphan tool state, cap app-server idle timers, and keep media completion delivery retryable. (#88129, #88136, #88141, #88162, #88182)</li>
+<li>Chat/UI: show Gateway chat failures as visible assistant messages in the Control UI instead of only setting an invisible error state.</li>
+<li>Channels: cap Telegram, Discord, WhatsApp, Signal, Feishu, Google Chat, Microsoft Teams, QQBot, Nostr, Zalo, Zalouser, and Nextcloud-style request/retry timers; preserve SMS approval reply routes; and retry WhatsApp QR login 408 timeouts. (#88183)</li>
+<li>Security/config parsing: reject unsafe OAuth/token lifetimes, retry-after delays, inbound timestamps, response body sizes, command timeout config, sandbox observer token TTLs, and gateway WebSocket calls after close.</li>
+<li>Providers/media: cap local service, model, usage, queue, generated media, TTS, music, workflow polling, and provider OAuth request timers across hosted and local providers.</li>
+<li>Release/CI/E2E: bound release candidate reads, beta smoke REST calls, plugin npm verification commands, changelog restore, cross-OS process groups, kitchen-sink and bundled plugin readiness probes, secret-provider probes, Telegram credential timeouts, Control UI i18n and CLI startup metadata generation, Vitest routing, dependency guard admin approvals, child workflow failure detection, quiet Node test shard stalls, docker package cleanup, and mainline test flakes. (#88127, #88137, #88155, #88160, #88966) Thanks @RomneyDa.</li>
+<li>Release/CI/E2E: keep Kitchen Sink live plugin MCP probes resolving source-checkout workspace packages and align the live gauntlet with current Kitchen Sink diagnostics.</li>
+<li>Release/CI/E2E: run the secret-provider integration proof through the repo pnpm runner so native macOS and Windows validation use the hydrated package-manager shim.</li>
+<li>Release/CI/E2E: run the Telegram desktop proof gateway through the repo pnpm runner so native macOS proof uses the hydrated package-manager shim.</li>
+<li>Docs/CI: run Mintlify anchor checks through the repo pnpm runner so docs link validation works when pnpm is only available through the hydrated package-manager shim.</li>
+<li>Agents: keep configured fallback model metadata typed so provider params, context-token caps, and media input limits do not break changed-gate typechecks.</li>
+<li>Agents: accept hidden <code>sessions_send</code> body aliases before validation while keeping the model-facing <code>message</code> schema canonical. (#88229) Thanks @zhangguiping-xydt.</li>
+<li>Chat/UI: preserve startup chat sends during history loading, unblock the initial Control UI chat send, stream chat deltas incrementally, skip markdown parsing while streaming, keep drafts local while typing, guard composer rerenders, honor Chromium executable overrides, and detect system Chromium for E2E. (#88998) Thanks @vincentkoc.</li>
+<li>Channels: stop schema-padded poll modifiers from turning normal <code>send</code> actions into invalid poll sends. (#89601) Thanks @codezz.</li>
+<li>Channels: preserve long Feishu streaming replies, send visible fallbacks when accepted Feishu turns produce no final reply, tolerate iMessage self-chat timestamp skew, preserve colon-prefixed slash commands in mention parsing, decode Nostr <code>npub</code> allowlists correctly, and suppress raw provider errors during channel delivery. (#87896)</li>
+<li>Config/status/doctor: skip unresolved shell references in state-dir dotenv files, resolve gateway auth secrets during deep status audits, respect explicit PI runtime policy, report runtime tool-schema errors, and keep post-upgrade JSON stable. (#88288)</li>
+<li>Gateway/session state: list commands from the Gateway plugin registry, harden MCP loopback tool schemas, hide phantom agent-store rows from <code>sessions.list</code>, make task persistence failures explicit, and carry session UUIDs on interactive dispatch events.</li>
+<li>Gateway/plugins: narrow plugin lookup memoization to the stable plugin/runtime inputs, avoiding repeated lookup work without mixing disabled or filtered plugin state.</li>
+<li>OpenAI/TTS: handle speed directives for OpenAI TTS voices. (#74089)</li>
+<li>CI/Crabbox: keep default runner capacity on the Azure credit-backed on-demand D4 lane with the Azure SSH port and a Git-independent full check job, so broad validation avoids low-priority spot quota stalls, hydrate port mismatches, non-Git hydrated workspaces, and stale AWS region hints.</li>
+<li>CI/Crabbox: route Crabbox wrapper and Testbox workflow edits to their regression tests so changed-test gates do not silently run zero specs.</li>
+<li>CI/workflows: route workflow sanity helper edits to their guard tests and cover composite-action input interpolation checks.</li>
+<li>CI/tooling: route CI scope, dependency, changelog, and docs helper edits to their owner tests instead of silently skipping changed-test coverage.</li>
+<li>CI/tooling: route package, release, and install helper edits to their owner tests so changed-test gates cover publish and installer script changes.</li>
+<li>CI/tooling: route shared script library edits through their owner tests so lock, process, safety, and scan helpers do not skip changed-test coverage.</li>
+<li>CI/tooling: skip expensive import-graph scans once a changed diff already requires broad fallback, keeping local changed-test planning fast while still collecting explicit owner tests.</li>
+<li>CI/tooling: route script edits through conventional owner tests when matching <code>test/scripts</code> or <code>src/scripts</code> coverage already exists.</li>
+<li>CI/tooling: honor option terminators in the memory FD repro script so follow-on arguments are not reparsed.</li>
+<li>Release/CI/E2E: assert plugin lifecycle runtime inspect output instead of only capturing it.</li>
+<li>Release/CI/E2E: make gateway-network prove the advertised health RPC and retry early WebSocket closes without burning full open timeouts.</li>
+<li>Release/CI/E2E: honor option terminators across release, Parallels smoke, plugin gauntlet, and extension-memory scripts.</li>
+<li>Release/CI/E2E: fail plugin gateway gauntlet QA chunks when the requested suite summary is missing or invalid.</li>
+<li>Performance: prebuild QA runtime probes with generated plugin assets but without CLI startup metadata.</li>
+<li>Performance: skip declaration bundling for runtime-only CLI startup and gateway watch build profiles.</li>
+<li>Performance: reuse prepared provider handles, strict tool schemas, gateway runtime metadata, session maintenance config, plugin metadata, bundled skill allowlists, package-local plugin artifacts, single-entry store writes, and validated/serialized session prompt blobs.</li>
+</ul>
+<p><a href="https://github.com/openclaw/openclaw/blob/main/CHANGELOG.md">View full changelog</a></p>
+]]></description>
+            <enclosure url="https://github.com/openclaw/openclaw/releases/download/v2026.6.1/OpenClaw-2026.6.1.zip" length="55062100" type="application/octet-stream" sparkle:edSignature="PVp8E2HBCvikB/0LCr36lFEyHPAzoFA2ScT6LW27FlzvP+m4r1AEuVN2UrtgWlpkGSsn4Eav0kPJe32u4ObNBw=="/>
+        </item>
     </channel>
 </rss>

apps/android/VERSIONING.md

@@ -56,38 +56,6 @@ Recommended workflow:
 
 The third-party flavor is archived as a signed APK for non-Play distribution. It is not uploaded by the Play release lane.
 
-## Release SHA tracking
-
-Successful Play build uploads create a non-tag Git ref that records the source
-commit for the uploaded store build:
-
-```text
-refs/openclaw/mobile-releases/android/<versionName>-<versionCode>
-```
-
-Example:
-
-```text
-refs/openclaw/mobile-releases/android/2026.6.10-2026061008
-```
-
-These refs are intentionally outside `refs/tags/*` and `refs/heads/*`. They do
-not appear on GitHub release or tag pages, and they do not participate in the
-core OpenClaw release machinery.
-
-`pnpm android:release:upload` checks the ref before uploading the Play build and
-records it only after `upload_to_play_store` succeeds. Existing refs are
-immutable: the same ref at the same SHA is accepted, while the same ref at a
-different SHA fails. `GOOGLE_PLAY_VALIDATE_ONLY=1` still checks the ref but does
-not record it because no Play build is published.
-
-Useful direct commands:
-
-```bash
-pnpm mobile:release:preflight -- --platform android --version 2026.6.10 --version-code 2026061008
-pnpm mobile:release:resolve -- --platform android --version 2026.6.10 --version-code 2026061008
-```
-
 ## Signing model
 
 `apps/android/Config/ReleaseSigning.json` pins the Android signing assets in the shared private `apps-signing` repo. The Android pipeline uses the same `MATCH_PASSWORD` release-owner secret as iOS, but the Android files are managed by `scripts/android-release-signing.mjs` instead of Fastlane `match`.

apps/android/fastlane/Fastfile

@@ -198,58 +198,6 @@ def capture_android_screenshots!
   sh(shell_join(["bash", File.join(repo_root, "scripts", "android-screenshots.sh")]))
 end
 
-def mobile_release_ref_script
-  File.join(repo_root, "scripts", "mobile-release-ref.ts")
-end
-
-def release_git_sha
-  stdout, stderr, status = Open3.capture3("git", "rev-parse", "HEAD", chdir: repo_root)
-  UI.user_error!("Unable to resolve release Git SHA: #{stderr.strip}") unless status.success?
-  stdout.strip
-end
-
-def mobile_release_ref_command(command, platform:, version:, build: nil, version_code: nil, sha: nil)
-  args = [
-    "node",
-    "--import",
-    "tsx",
-    mobile_release_ref_script,
-    command,
-    "--platform",
-    platform,
-    "--version",
-    version,
-    "--root",
-    repo_root,
-  ]
-  args.push("--build", build.to_s) if build
-  args.push("--version-code", version_code.to_s) if version_code
-  args.push("--sha", sha.to_s) if sha
-  sh(shell_join(args))
-end
-
-def ensure_mobile_release_ref_available!(platform:, version:, build: nil, version_code: nil, sha: nil)
-  mobile_release_ref_command(
-    "preflight",
-    platform: platform,
-    version: version,
-    build: build,
-    version_code: version_code,
-    sha: sha
-  )
-end
-
-def record_mobile_release_ref!(platform:, version:, build: nil, version_code: nil, sha: nil)
-  mobile_release_ref_command(
-    "record",
-    platform: platform,
-    version: version,
-    build: build,
-    version_code: version_code,
-    sha: sha
-  )
-end
-
 def read_android_release_signing_properties!(path)
   UI.user_error!("Missing materialized Android release signing properties at #{path}.") unless File.exist?(path)
 
@@ -334,13 +282,6 @@ def upload_play_store_metadata!(version_metadata)
 end
 
 def upload_play_store_build!(version_metadata, upload_metadata: false, upload_images: false, upload_screenshots: false)
-  release_sha = release_git_sha
-  ensure_mobile_release_ref_available!(
-    platform: "android",
-    version: version_metadata.fetch(:version),
-    version_code: version_metadata.fetch(:version_code),
-    sha: release_sha
-  )
   ENV["SUPPLY_UPLOAD_SCREENSHOTS"] = "1" if upload_screenshots
   validate_android_screenshots!
   sync_android_changelog!(version_metadata.fetch(:version_code))
@@ -361,15 +302,6 @@ def upload_play_store_build!(version_metadata, upload_metadata: false, upload_im
     skip_upload_screenshots: !upload_screenshots,
     validate_only: play_validate_only?
   )
-
-  unless play_validate_only?
-    record_mobile_release_ref!(
-      platform: "android",
-      version: version_metadata.fetch(:version),
-      version_code: version_metadata.fetch(:version_code),
-      sha: release_sha
-    )
-  end
 end
 
 load_env_file(File.join(ANDROID_FASTLANE_ROOT, ".env"))

apps/ios/VERSIONING.md

@@ -129,37 +129,6 @@ pnpm ios:version:pin -- --version 2026.4.10
 
 This keeps the TestFlight version stable while review is in flight.
 
-## Release SHA tracking
-
-Successful App Store Connect uploads create a non-tag Git ref that records the
-source commit for the uploaded store build:
-
-```text
-refs/openclaw/mobile-releases/ios/<CFBundleShortVersionString>-<CFBundleVersion>
-```
-
-Example:
-
-```text
-refs/openclaw/mobile-releases/ios/2026.6.10-8
-```
-
-These refs are intentionally outside `refs/tags/*` and `refs/heads/*`. They do
-not appear on GitHub release or tag pages, and they do not participate in the
-core OpenClaw release machinery.
-
-`pnpm ios:release:upload` checks the ref before archive/upload work and records
-it only after `upload_to_testflight` succeeds. Existing refs are immutable: the
-same ref at the same SHA is accepted, while the same ref at a different SHA
-fails.
-
-Useful direct commands:
-
-```bash
-pnpm mobile:release:preflight -- --platform ios --version 2026.6.10 --build 8
-pnpm mobile:release:resolve -- --platform ios --version 2026.6.10 --build 8
-```
-
 ## New release promotion workflow
 
 When you want the next production iOS release to align with the current gateway release:

apps/ios/fastlane/Fastfile

@@ -1128,58 +1128,6 @@ def prepare_app_store_release!(version:, build_number:)
   release_xcconfig
 end
 
-def mobile_release_ref_script
-  File.join(repo_root, "scripts", "mobile-release-ref.ts")
-end
-
-def release_git_sha
-  stdout, stderr, status = Open3.capture3("git", "rev-parse", "HEAD", chdir: repo_root)
-  UI.user_error!("Unable to resolve release Git SHA: #{stderr.strip}") unless status.success?
-  stdout.strip
-end
-
-def mobile_release_ref_command(command, platform:, version:, build: nil, version_code: nil, sha: nil)
-  args = [
-    "node",
-    "--import",
-    "tsx",
-    mobile_release_ref_script,
-    command,
-    "--platform",
-    platform,
-    "--version",
-    version,
-    "--root",
-    repo_root,
-  ]
-  args.push("--build", build.to_s) if build
-  args.push("--version-code", version_code.to_s) if version_code
-  args.push("--sha", sha.to_s) if sha
-  sh(shell_join(args))
-end
-
-def ensure_mobile_release_ref_available!(platform:, version:, build: nil, version_code: nil, sha: nil)
-  mobile_release_ref_command(
-    "preflight",
-    platform: platform,
-    version: version,
-    build: build,
-    version_code: version_code,
-    sha: sha
-  )
-end
-
-def record_mobile_release_ref!(platform:, version:, build: nil, version_code: nil, sha: nil)
-  mobile_release_ref_command(
-    "record",
-    platform: platform,
-    version: version,
-    build: build,
-    version_code: version_code,
-    sha: sha
-  )
-end
-
 def validate_app_store_ipa!(ipa_path)
   script_path = File.join(repo_root, "scripts", "ios-validate-app-store-ipa.sh")
   sh(shell_join(["bash", script_path, "--ipa", ipa_path]))
@@ -1361,22 +1309,15 @@ platform :ios do
       UI.user_error!("Use `pnpm ios:release:upload`; direct Fastlane TestFlight upload is disabled.")
     end
 
-    release_sha = release_git_sha
     release_signing_check!
     preserve_local_signing do
       screenshots
     end
-    context = prepare_app_store_context(require_api_key: true)
-    ensure_mobile_release_ref_available!(
-      platform: "ios",
-      version: context[:short_version],
-      build: context[:build_number],
-      sha: release_sha
-    )
     ENV["DELIVER_SCREENSHOTS"] = "1"
     ENV["DELIVER_RELEASE_NOTES"] = "1"
     metadata
 
+    context = prepare_app_store_context(require_api_key: true)
     build = build_app_store_release(context)
 
     upload_to_testflight(
@@ -1385,12 +1326,6 @@ platform :ios do
       skip_waiting_for_build_processing: true,
       uses_non_exempt_encryption: false
     )
-    record_mobile_release_ref!(
-      platform: "ios",
-      version: build[:short_version],
-      build: build[:build_number],
-      sha: release_sha
-    )
 
     UI.success("Uploaded iOS App Store build: version=#{build[:version]} short=#{build[:short_version]} build=#{build[:build_number]}")
     UI.important("App Review submission remains manual in App Store Connect.")

apps/shared/OpenClawKit/Sources/OpenClawProtocol/GatewayModels.swift

@@ -7187,20 +7187,17 @@ public struct ChatHistoryParams: Codable, Sendable {
     public let sessionkey: String
     public let agentid: String?
     public let limit: Int?
-    public let offset: Int?
     public let maxchars: Int?
 
     public init(
         sessionkey: String,
         agentid: String? = nil,
         limit: Int?,
-        offset: Int? = nil,
         maxchars: Int?)
     {
         self.sessionkey = sessionkey
         self.agentid = agentid
         self.limit = limit
-        self.offset = offset
         self.maxchars = maxchars
     }
 
@@ -7208,7 +7205,6 @@ public struct ChatHistoryParams: Codable, Sendable {
         case sessionkey = "sessionKey"
         case agentid = "agentId"
         case limit
-        case offset
         case maxchars = "maxChars"
     }
 }

docs/.generated/plugin-sdk-api-baseline.sha256

@@ -1,2 +1,2 @@
-760812c17f7e48d7ceafeebbbe348dad13916ccb9ecaf41b3abc9a09b1e690c1  plugin-sdk-api-baseline.json
-4d9b76016b2f845e101949a3d2ac92437f49783906d1c263d65f3534bb333de5  plugin-sdk-api-baseline.jsonl
+e9fb501204b6c4c0e08c09174311f85ae8a129bf35e18edea0fa217ee4203ad8  plugin-sdk-api-baseline.json
+50db19cf60c5465b22d342ccdabe465ae08d0c475e6403b86360f775bfc3513a  plugin-sdk-api-baseline.jsonl

docs/.i18n/README.md

@@ -11,7 +11,7 @@ Generated locale trees and live translation memory now live in the publish repo:
 
 - English docs are authored in `openclaw/openclaw`.
 - The source docs tree lives under `docs/`.
-- The source repo no longer keeps committed generated locale trees such as `docs/zh-CN/**`, `docs/zh-TW/**`, `docs/ja-JP/**`, `docs/es/**`, `docs/pt-BR/**`, `docs/ko/**`, `docs/de/**`, `docs/fr/**`, `docs/hi/**`, `docs/ar/**`, `docs/it/**`, `docs/vi/**`, `docs/nl/**`, `docs/fa/**`, `docs/ru/**`, `docs/tr/**`, `docs/uk/**`, `docs/id/**`, `docs/pl/**`, or `docs/th/**`.
+- The source repo no longer keeps committed generated locale trees such as `docs/zh-CN/**`, `docs/zh-TW/**`, `docs/ja-JP/**`, `docs/es/**`, `docs/pt-BR/**`, `docs/ko/**`, `docs/de/**`, `docs/fr/**`, `docs/ar/**`, `docs/it/**`, `docs/vi/**`, `docs/nl/**`, `docs/fa/**`, `docs/tr/**`, `docs/uk/**`, `docs/id/**`, `docs/pl/**`, or `docs/th/**`.
 
 ## End-to-end flow
 
@@ -32,10 +32,10 @@ Generated locale trees and live translation memory now live in the publish repo:
 
 ## Locale visibility
 
-- Control UI supports `en`, `zh-CN`, `zh-TW`, `pt-BR`, `de`, `es`, `ja-JP`, `ko`, `fr`, `hi`, `ar`, `it`, `vi`, `nl`, `fa`, `ru`, `tr`, `uk`, `id`, `pl`, and `th`.
+- Control UI supports `en`, `zh-CN`, `zh-TW`, `pt-BR`, `de`, `es`, `ja-JP`, `ko`, `fr`, `ar`, `it`, `tr`, `uk`, `id`, `pl`, `th`, `vi`, `nl`, and `fa`.
 - Docs translation workflows generate the same non-English locale set in `openclaw/docs`.
-- The Mintlify docs language picker can expose only the locales accepted by Mintlify `navigation.languages`; Russian (`ru`) and Hindi (`hi`) are now included in the publish configuration.
-- Do not treat locale visibility in generated `docs/docs.json` as proof that translation artifacts exist. Verify each generated locale folder and its translation memory in `openclaw/docs`.
+- The Mintlify docs language picker can expose only the locales accepted by Mintlify `navigation.languages`; today that includes Vietnamese (`vi`) and Dutch (`nl`), but not Thai (`th`) or Persian (`fa`).
+- Do not treat missing `th` or `fa` entries in generated `docs/docs.json` as a pipeline failure. Verify their generated folders in `openclaw/docs` instead.
 
 ## Files in this folder
 

docs/.i18n/glossary.hi.json

@@ -1,82 +0,0 @@
-[
-  {
-    "source": "ACP",
-    "target": "ACP"
-  },
-  {
-    "source": "Active Memory",
-    "target": "Active Memory"
-  },
-  {
-    "source": "ClawHub",
-    "target": "ClawHub"
-  },
-  {
-    "source": "CLI",
-    "target": "CLI"
-  },
-  {
-    "source": "Compaction",
-    "target": "Compaction"
-  },
-  {
-    "source": "Cron",
-    "target": "Cron"
-  },
-  {
-    "source": "Dreaming",
-    "target": "Dreaming"
-  },
-  {
-    "source": "Gateway",
-    "target": "Gateway"
-  },
-  {
-    "source": "Heartbeat",
-    "target": "Heartbeat"
-  },
-  {
-    "source": "LINE",
-    "target": "LINE"
-  },
-  {
-    "source": "Mintlify",
-    "target": "Mintlify"
-  },
-  {
-    "source": "Node",
-    "target": "Node"
-  },
-  {
-    "source": "OpenClaw",
-    "target": "OpenClaw"
-  },
-  {
-    "source": "Pi",
-    "target": "Pi"
-  },
-  {
-    "source": "Plugin",
-    "target": "Plugin"
-  },
-  {
-    "source": "Skills",
-    "target": "Skills"
-  },
-  {
-    "source": "Tailscale",
-    "target": "Tailscale"
-  },
-  {
-    "source": "TaskFlow",
-    "target": "TaskFlow"
-  },
-  {
-    "source": "TUI",
-    "target": "TUI"
-  },
-  {
-    "source": "Webhook",
-    "target": "Webhook"
-  }
-]

docs/.i18n/glossary.ru.json

@@ -1,82 +0,0 @@
-[
-  {
-    "source": "ACP",
-    "target": "ACP"
-  },
-  {
-    "source": "Active Memory",
-    "target": "Active Memory"
-  },
-  {
-    "source": "ClawHub",
-    "target": "ClawHub"
-  },
-  {
-    "source": "CLI",
-    "target": "CLI"
-  },
-  {
-    "source": "Compaction",
-    "target": "Compaction"
-  },
-  {
-    "source": "Cron",
-    "target": "Cron"
-  },
-  {
-    "source": "Dreaming",
-    "target": "Dreaming"
-  },
-  {
-    "source": "Gateway",
-    "target": "Gateway"
-  },
-  {
-    "source": "Heartbeat",
-    "target": "Heartbeat"
-  },
-  {
-    "source": "LINE",
-    "target": "LINE"
-  },
-  {
-    "source": "Mintlify",
-    "target": "Mintlify"
-  },
-  {
-    "source": "Node",
-    "target": "Node"
-  },
-  {
-    "source": "OpenClaw",
-    "target": "OpenClaw"
-  },
-  {
-    "source": "Pi",
-    "target": "Pi"
-  },
-  {
-    "source": "Plugin",
-    "target": "Plugin"
-  },
-  {
-    "source": "Skills",
-    "target": "Skills"
-  },
-  {
-    "source": "Tailscale",
-    "target": "Tailscale"
-  },
-  {
-    "source": "TaskFlow",
-    "target": "TaskFlow"
-  },
-  {
-    "source": "TUI",
-    "target": "TUI"
-  },
-  {
-    "source": "Webhook",
-    "target": "Webhook"
-  }
-]

docs/ci.md

@@ -90,9 +90,9 @@ Scope logic lives in `scripts/ci-changed-scope.mjs` and is covered by unit tests
 
 The slowest Node test families are split or balanced so each job stays small without over-reserving runners: plugin contracts and channel contracts each run as two weighted Blacksmith-backed shards with the standard GitHub runner fallback, core unit fast/support lanes run separately, core runtime infra is split between state, process/config, shared, and three cron domain shards, auto-reply runs as balanced workers (with the reply subtree split into agent-runner, dispatch, and commands/state-routing shards), and agentic gateway/server configs are split across chat/auth/model/http-plugin/runtime/startup lanes instead of waiting on built artifacts. Normal CI then packs only isolated infra include-pattern shards into deterministic bundles of at most 64 test files, reducing the Node matrix without merging non-isolated command/cron, stateful agents-core, or gateway/server suites; heavy fixed suites stay on 8 vCPU while the bundled and lower-weight lanes use 4 vCPU. Pull requests on the canonical repository use an additional compact admission plan: the same per-config groups run in isolated subprocesses inside the current 34-job Linux Node plan, so a single PR does not register the full 70-plus-job Node matrix. `main` pushes, manual dispatches, and release gates retain the full matrix. Broad browser, QA, media, and miscellaneous plugin tests use their dedicated Vitest configs instead of the shared plugin catch-all. Include-pattern shards record timing entries using the CI shard name, so `.artifacts/vitest-shard-timings.json` can distinguish a whole config from a filtered shard. `check-additional-*` keeps package-boundary compile/canary work together and separates runtime topology architecture from gateway watch coverage; the boundary guard list is striped into one prompt-heavy shard and one combined shard for the remaining guard stripes, each running selected independent guards concurrently and printing per-check timings. The expensive Codex happy-path prompt snapshot drift check runs as its own additional job for manual CI and for prompt-affecting changes only, so normal unrelated Node changes do not wait behind cold prompt snapshot generation and the boundary shards stay balanced while prompt drift is still pinned to the PR that caused it; the same flag skips prompt snapshot Vitest generation inside the built-artifact core support-boundary shard. Gateway watch, channel tests, and the core support-boundary shard run concurrently inside `build-artifacts` after `dist/` and `dist-runtime/` are already built.
 
-Once admitted, canonical Linux CI permits up to 24 concurrent Node test jobs and
-12 for the smaller fast/check lanes; Windows and Android stay at two because
-those runner pools are narrower.
+Once admitted, canonical Linux CI permits up to 12 concurrent Node jobs and 8 for
+the smaller fast/check lanes; Windows and Android stay at two because those
+runner pools are narrower.
 
 The compact PR plan emits 18 Node jobs for the current suite: whole-config
 groups are batched in isolated subprocesses with a 120-minute batch timeout,
@@ -145,17 +145,17 @@ gh workflow run full-release-validation.yml --ref main -f ref=<branch-or-sha>
 
 ## Runner registration budget
 
-OpenClaw's current GitHub runner-registration bucket allows 3,000 self-hosted
-runner registrations per 5 minutes. The limit is shared by all Blacksmith runner
-registrations in the `openclaw` organization, so adding another Blacksmith
-installation does not add a new bucket.
+GitHub caps self-hosted runner registrations at 1,500 runners per 5 minutes per
+repository, organization, or enterprise. The limit is shared by all Blacksmith
+runner registrations in the `openclaw` organization, so adding another
+Blacksmith installation does not add a new bucket.
 
 Treat Blacksmith labels as the scarce resource for burst control. Jobs that
 only route, notify, summarize, select shards, or run short CodeQL scans should
 stay on GitHub-hosted runners unless they have measured Blacksmith-specific
 needs. Any new Blacksmith matrix, larger `max-parallel`, or high-frequency
 workflow must show its worst-case registration count and keep the org-level
-target below 2,000 registrations per 5 minutes, leaving headroom for concurrent
+target below 1,000 registrations per 5 minutes, leaving headroom for concurrent
 repositories and retried jobs.
 
 Canonical-repo CI keeps Blacksmith as the default runner path for normal push and pull-request runs. `workflow_dispatch` and non-canonical repository runs use GitHub-hosted runners, but normal canonical runs do not currently probe Blacksmith queue health or automatically fall back to GitHub-hosted labels when Blacksmith is unavailable.

docs/cli/crestodian.md

@@ -141,6 +141,11 @@ Discovery is not audited. Only applied operations and writes are logged.
 `openclaw onboard --modern` starts Crestodian as the modern onboarding preview.
 Plain `openclaw onboard` still runs classic onboarding.
 
+Interactive local classic onboarding now opens a separate loopback browser
+setup surface by default. Use `openclaw onboard --no-browser` to keep the
+terminal wizard. Crestodian remains the configless repair and maintenance
+surface.
+
 ## Setup bootstrap
 
 `setup` is the chat-first onboarding bootstrap. It writes only through typed

docs/cli/onboard.md

@@ -33,6 +33,7 @@ Full guided onboarding for local or remote Gateway setup. Use this when you want
 
 ```bash
 openclaw onboard
+openclaw onboard --no-browser
 openclaw onboard --modern
 openclaw onboard --flow quickstart
 openclaw onboard --flow manual
@@ -42,6 +43,15 @@ openclaw onboard --skip-bootstrap
 openclaw onboard --mode remote --remote-url wss://gateway-host:18789
 ```
 
+Interactive local onboarding opens the browser setup surface by default. The
+browser runs the small Gemma 4 E2B assistant locally through WebGPU while the
+OpenClaw setup wizard remains the authority for configuration, credentials,
+plugin installs, and Gateway lifecycle. Use `--no-browser` to force the
+terminal wizard. Explicit provider, flow, channel, daemon, reset, import, and
+other advanced flags automatically stay on the terminal path so their exact
+semantics are preserved. Non-interactive and remote onboarding remain
+terminal/client flows.
+
 `--flow import` uses plugin-owned migration providers such as Hermes. It only runs against a fresh OpenClaw setup; if existing config, credentials, sessions, or workspace memory/identity files are present, reset or choose a fresh setup before importing.
 
 `--modern` starts the Crestodian conversational onboarding preview. Without

docs/cli/plugins.md

@@ -54,9 +54,8 @@ openclaw plugins update <id-or-npm-spec>
 openclaw plugins update --all
 openclaw plugins marketplace list <marketplace>
 openclaw plugins marketplace list <marketplace> --json
-openclaw plugins init my-tool --name "My Tool"
-openclaw plugins init my-provider --name "My Provider" --type provider
-openclaw plugins init my-provider --name "My Provider" --type provider --directory ./my-provider
+openclaw plugins init <id>
+openclaw plugins init <id> --directory ./my-plugin --name "My Plugin"
 openclaw plugins build --entry ./dist/index.js
 openclaw plugins build --entry ./dist/index.js --check
 openclaw plugins validate --entry ./dist/index.js
@@ -87,15 +86,12 @@ npm run plugin:build
 npm run plugin:validate
 ```
 
-`plugins init` creates a minimal TypeScript tool plugin by default. The first
-argument is the plugin id; pass `--name` for the display name. OpenClaw uses the
-id for the default output directory and package naming. Tool scaffolds use
-`defineToolPlugin`.
-`plugins build` imports the built entry, reads its static tool metadata, writes
-`openclaw.plugin.json`, and keeps `package.json` `openclaw.extensions` aligned.
-`plugins validate` checks that the generated manifest, package metadata, and
-current entry export still agree. See [Tool Plugins](/plugins/tool-plugins) for
-the full tool-authoring workflow.
+`plugins init` creates a minimal TypeScript tool plugin that uses
+`defineToolPlugin`. `plugins build` imports that entry, reads its static tool
+metadata, writes `openclaw.plugin.json`, and keeps `package.json`
+`openclaw.extensions` aligned. `plugins validate` checks that the generated
+manifest, package metadata, and current entry export still agree. See
+[Tool Plugins](/plugins/tool-plugins) for the full authoring workflow.
 
 The scaffold writes TypeScript source but generates metadata from the built
 `./dist/index.js` entry so the workflow also works with the published CLI. Use
@@ -103,29 +99,6 @@ The scaffold writes TypeScript source but generates metadata from the built
 `plugins build --check` in CI to fail when generated metadata is stale without
 rewriting files.
 
-### Provider Scaffold
-
-```bash
-openclaw plugins init acme-models --name "Acme Models" --type provider
-cd acme-models
-npm install
-npm run build
-npm test
-npm run validate
-```
-
-Provider scaffolds create a generic text/model provider plugin with OpenAI-compatible
-API-key plumbing, a built-in `npm run validate` script for `clawhub package
-validate`, ClawHub package metadata, and a manually dispatched GitHub workflow
-for future trusted publishing through GitHub Actions OIDC. Provider scaffolds do
-not generate skills and do not use `openclaw plugins build` or
-`openclaw plugins validate`; those commands are for the tool scaffold's
-generated metadata path.
-
-Before publishing, replace the placeholder API base URL, model catalog, docs
-route, credential text, and README copy with real provider details. Use the
-generated README for first-time ClawHub publishing and trusted publisher setup.
-
 ### Install
 
 ```bash

docs/concepts/delegate-architecture.md

@@ -297,8 +297,7 @@ tool-call XML payloads (including `<tool_call>...</tool_call>`,
 downgraded tool-call scaffolding / leaked ASCII/full-width model control
 tokens / malformed MiniMax tool-call XML from assistant recall, and can
 replace oversized rows with `[sessions_history omitted: message too large]`
-instead of returning a raw transcript dump. Use `nextOffset` when present to
-page backward through older transcript windows.
+instead of returning a raw transcript dump.
 
 ## Scaling pattern
 

docs/concepts/session-tool.md

@@ -58,11 +58,6 @@ results may be scope-limited.
 
 `sessions_history` fetches the conversation transcript for a specific session.
 By default, tool results are excluded -- pass `includeTools: true` to see them.
-Use `limit` for the newest bounded tail. Pass `offset: 0` when you need
-pagination metadata, then pass returned `nextOffset` values to page backward
-through older OpenClaw transcript windows without reading raw transcript files.
-Explicit offset pages do not merge external CLI fallback imports; use the
-default newest-tail view when you need that merged display history.
 The returned view is intentionally bounded and safety-filtered:
 
 - assistant text is normalized before recall:
@@ -83,7 +78,7 @@ The returned view is intentionally bounded and safety-filtered:
 - very large histories can drop older rows or replace an oversized row with
   `[sessions_history omitted: message too large]`
 - the tool reports summary flags such as `truncated`, `droppedMessages`,
-  `contentTruncated`, `contentRedacted`, `bytes`, and pagination metadata
+  `contentTruncated`, `contentRedacted`, and `bytes`
 
 Both tools accept either a **session key** (like `"main"`) or a **session ID**
 from a previous list call.

docs/gateway/configuration-reference.md

@@ -316,11 +316,6 @@ conversation bindings, or any non-Codex harness.
   plugin/app support for the Codex harness. Default: `false`.
 - `plugins.entries.codex.config.codexPlugins.allow_destructive_actions`:
   default destructive-action policy for migrated plugin app elicitations.
-  Use `true` to accept safe Codex approval schemas without prompting, `false`
-  to decline them, `"auto"` to route Codex-required approvals through OpenClaw
-  plugin approvals, or `"always"` to ask for every plugin write/destructive
-  action without durable approval. The `"always"` mode clears durable Codex
-  per-tool approval overrides for the affected app before starting the thread.
   Default: `true`.
 - `plugins.entries.codex.config.codexPlugins.plugins.<key>.enabled`: enables a
   migrated plugin entry when global `codexPlugins.enabled` is also true.
@@ -331,8 +326,7 @@ conversation bindings, or any non-Codex harness.
   Codex plugin identity from migration, for example `"google-calendar"`.
 - `plugins.entries.codex.config.codexPlugins.plugins.<key>.allow_destructive_actions`:
   per-plugin destructive-action override. When omitted, the global
-  `allow_destructive_actions` value is used. The per-plugin value accepts the
-  same `true`, `false`, `"auto"`, or `"always"` policies.
+  `allow_destructive_actions` value is used.
 
 `codexPlugins.enabled` is the global enablement directive. Explicit plugin
 entries written by migration are the durable install and repair eligibility set.

docs/plugins/codex-native-plugins.md

@@ -200,11 +200,11 @@ enabled.
 
 OpenClaw sets app-level `destructive_enabled` from the effective global or
 per-plugin `allow_destructive_actions` policy and lets Codex enforce
-destructive tool metadata from its native app tool annotations. `true`,
-`"auto"`, and `"always"` set `destructive_enabled: true`; `false` sets it
-false. The `_default` app config is disabled with `open_world_enabled: false`.
-Enabled plugin apps are emitted with `open_world_enabled: true`; OpenClaw does
-not expose a separate plugin open-world policy knob and does not maintain
+destructive tool metadata from its native app tool annotations. `true` and
+`"auto"` both set `destructive_enabled: true`; `false` sets it false. The
+`_default` app config is disabled with `open_world_enabled: false`. Enabled
+plugin apps are emitted with `open_world_enabled: true`; OpenClaw does not
+expose a separate plugin open-world policy knob and does not maintain
 per-plugin destructive tool-name deny lists.
 
 Tool approval mode is automatic by default for plugin apps so non-destructive
@@ -225,10 +225,6 @@ plugins, while unsafe schemas and ambiguous ownership still fail closed:
 - When policy is `"auto"`, OpenClaw exposes destructive plugin actions to
   Codex but turns ownership-proven MCP approval elicitations into OpenClaw
   plugin approvals before returning the Codex approval response.
-- When policy is `"always"`, OpenClaw uses the same Codex write/destructive
-  gating as `"auto"`, clears durable Codex per-tool approval overrides for the
-  app before the thread starts, and only offers one-shot approval or denial so
-  durable approvals cannot suppress later write-action prompts.
 - Missing plugin identity, ambiguous ownership, a missing turn id, a wrong turn
   id, or an unsafe elicitation schema declines instead of prompting.
 
@@ -276,9 +272,8 @@ Codex thread bindings keep the app config they started with until OpenClaw
 establishes a new harness session or replaces a stale binding.
 
 **Destructive action is declined:** check the global and per-plugin
-`allow_destructive_actions` values. Even when policy is true, `"auto"`, or
-`"always"`, unsafe elicitation schemas and ambiguous plugin identity still fail
-closed.
+`allow_destructive_actions` values. Even when policy is true or `"auto"`,
+unsafe elicitation schemas and ambiguous plugin identity still fail closed.
 
 ## Related
 

docs/plugins/voice-call.md

@@ -211,18 +211,6 @@ each carrier call should start with fresh context, for example reception,
 booking, IVR, or Google Meet bridge flows where the same phone number may
 represent different meetings.
 
-Voice Call stores generated session keys under the configured agent namespace
-(`agent:<agentId>:voice:*`) so call memory survives Gateway session-key
-canonicalization after restarts. Raw explicit integration keys use the same
-agent namespace. A canonical `agent:<configuredAgentId>:*` key keeps that owner,
-and its main aliases honor core `session.mainKey` and global scope. Foreign or
-malformed `agent:*` input is scoped as an opaque key under the configured agent;
-`global` and `unknown` remain global sentinels. Gateway startup promotes older
-raw keys in default or `{agentId}`-templated stores where the path proves one
-owner. In fixed custom stores, ambiguous legacy rows remain untouched because
-they do not contain enough information to choose an owner; new calls use
-canonical agent-scoped history.
-
 ## Realtime voice conversations
 
 `realtime` selects a full-duplex realtime voice provider for live call

docs/providers/xai.md

@@ -29,11 +29,10 @@ Use the path that matches your OpenClaw install state:
     openclaw onboard --install-daemon
     ```
 
-    On a VPS or over SSH, select xAI OAuth directly; OpenClaw uses device-code
-    verification and does not require a localhost callback:
+    On a VPS or over SSH, use device-code during onboarding:
 
     ```bash
-    openclaw onboard --install-daemon --auth-choice xai-oauth
+    openclaw onboard --install-daemon --auth-choice xai-device-code
     ```
 
     OAuth does not require an xAI API key. OpenClaw does not require the Grok
@@ -49,6 +48,13 @@ Use the path that matches your OpenClaw install state:
     openclaw models auth login --provider xai --method oauth
     ```
 
+    Use the device-code flow instead when the Gateway runs over SSH, Docker, or
+    a VPS and a localhost browser callback is awkward:
+
+    ```bash
+    openclaw models auth login --provider xai --device-code
+    ```
+
     To make Grok the default model after signing in, apply it separately:
 
     ```bash
@@ -80,7 +86,8 @@ Use the path that matches your OpenClaw install state:
 
 <Note>
 OpenClaw uses the xAI Responses API as the bundled xAI transport. The same
-credential from `openclaw models auth login --provider xai --method oauth` or
+credential from `openclaw models auth login --provider xai --method oauth`,
+`openclaw models auth login --provider xai --device-code`, or
 `openclaw models auth login --provider xai --method api-key` can also power first-class
 `web_search`, `x_search`, remote `code_execution`, and xAI image/video generation.
 Speech and transcription currently require `XAI_API_KEY` or provider config.
@@ -95,9 +102,8 @@ and, by default, `x_search` through an operator xAI Responses proxy.
 
 ## OAuth troubleshooting
 
-- For SSH, Docker, VPS, or other remote setups, use
-  `openclaw models auth login --provider xai --method oauth`; xAI OAuth uses
-  device-code verification instead of a localhost callback.
+- If browser OAuth cannot reach `127.0.0.1:56121`, use
+  `openclaw models auth login --provider xai --device-code`.
 - If sign-in succeeds but Grok is not the default model, run
   `openclaw models set xai/grok-4.3`.
 - To inspect saved xAI auth profiles, run:
@@ -111,9 +117,9 @@ and, by default, `x_search` through an operator xAI Responses proxy.
   eligible, try the API-key path or check the subscription on xAI's side.
 
 <Tip>
-Use `xai-oauth` when signing in from SSH, Docker, or a VPS. OpenClaw prints an
-xAI URL and short code; finish sign-in in any local browser while the remote
-process polls xAI for the completed token exchange.
+Use `xai-device-code` when signing in from SSH, Docker, or a VPS. OpenClaw
+prints an xAI URL and short code; finish sign-in in any local browser while the
+remote process polls xAI for the completed token exchange.
 </Tip>
 
 ## Built-in catalog
@@ -492,10 +498,12 @@ Legacy aliases still normalize to the canonical bundled ids:
 
   <Accordion title="Known limits">
     - xAI auth can use an API key, environment variable, plugin config fallback,
-      or OAuth with an eligible xAI account. OAuth uses device-code verification
-      without a localhost callback. xAI decides which accounts can receive OAuth
-      API tokens, and the consent page may show Grok Build even though OpenClaw
-      does not require the Grok Build app.
+      browser OAuth, or device-code OAuth with an eligible xAI account. Browser
+      OAuth uses a local callback on `127.0.0.1:56121`; for remote hosts, use
+      `xai-device-code` unless you want to forward that port before opening the
+      sign-in URL. xAI decides which accounts can receive OAuth API tokens, and
+      the consent page may show Grok Build even though OpenClaw does not require
+      the Grok Build app.
     - OpenClaw does not currently expose the xAI multi-agent model family. xAI
       serves these models through the Responses API, but they do not accept the
       client-side or custom tools used by OpenClaw's shared agent loop. See the

docs/start/onboarding-overview.md

@@ -15,7 +15,7 @@ optional chat channels — they just differ in how you interact with the setup.
 |                | CLI onboarding                         | macOS app onboarding      |
 | -------------- | -------------------------------------- | ------------------------- |
 | **Platforms**  | macOS, Linux, Windows (native or WSL2) | macOS only                |
-| **Interface**  | Terminal wizard                        | Guided UI in the app      |
+| **Interface**  | Browser setup or terminal fallback     | Guided UI in the app      |
 | **Best for**   | Servers, headless, full control        | Desktop Mac, visual setup |
 | **Automation** | `--non-interactive` for scripts        | Manual only               |
 | **Command**    | `openclaw onboard`                     | Launch the app            |
@@ -43,6 +43,10 @@ Run in any terminal:
 openclaw onboard
 ```
 
+Interactive local onboarding opens the loopback browser setup by default. Use
+`openclaw onboard --no-browser` for the terminal wizard, or use
+`--non-interactive` for scripts and headless hosts.
+
 Add `--install-daemon` to also install the background service in one step.
 
 Full reference: [Onboarding (CLI)](/start/wizard)

docs/start/wizard.md

@@ -17,6 +17,12 @@ and workspace defaults in one guided flow.
 openclaw onboard
 ```
 
+Interactive local onboarding opens a loopback browser setup page by default.
+The page uses the local Gemma 4 E2B browser model when WebGPU is available and
+falls back to the structured wizard controls when it is not. Use
+`openclaw onboard --no-browser` to stay in the terminal. Non-interactive and
+remote onboarding keep their existing behavior.
+
 ## Locale
 
 The CLI wizard localizes fixed onboarding copy. It resolves locale from

docs/tools/code-execution.md

@@ -38,13 +38,13 @@ Do **not** use it when you need local files, your shell, your repo, or paired de
 <Steps>
   <Step title="Provide xAI credentials">
     Sign in with Grok OAuth using an eligible SuperGrok or X Premium subscription,
-    or store an API key. xAI OAuth uses device-code verification, so it works
-    from remote hosts without a localhost callback. OAuth works for
-    `code_execution` and `x_search`; `XAI_API_KEY` or plugin web-search config
-    can also power Grok `web_search`.
+    use the remote-friendly device-code flow, or store an API key. OAuth works
+    for `code_execution` and `x_search`; `XAI_API_KEY` or plugin web-search
+    config can also power Grok `web_search`.
 
     ```bash
     openclaw models auth login --provider xai --method oauth
+    openclaw models auth login --provider xai --device-code
     ```
 
     During a fresh install, the same auth choices are available inside
@@ -52,7 +52,7 @@ Do **not** use it when you need local files, your shell, your repo, or paired de
 
     ```bash
     openclaw onboard --install-daemon
-    openclaw onboard --install-daemon --auth-choice xai-oauth
+    openclaw onboard --install-daemon --auth-choice xai-device-code
     ```
 
     Or use an API key:

docs/tools/subagents.md

@@ -523,7 +523,6 @@ should be rewritten in normal assistant voice.
 - Credential/token-like text is redacted.
 - Long blocks can be truncated.
 - Very large histories can drop older rows or replace an oversized row with `[sessions_history omitted: message too large]`.
-- Use `nextOffset` when present to page backward through older transcript windows.
 - Raw on-disk transcript inspection is the fallback when you need the full byte-for-byte transcript.
 
 ## Tool policy

extensions/acpx/src/runtime.test.ts

@@ -192,109 +192,6 @@ describe("AcpxRuntime fresh reset wrapper", () => {
     );
   });
 
-  it("adds the OpenClaw session key to the managed OpenClaw tools MCP bridge", () => {
-    const baseStore: TestSessionStore = {
-      load: vi.fn(async () => undefined),
-      save: vi.fn(async () => {}),
-    };
-    const { runtime } = makeRuntime(baseStore, {
-      openclawToolsMcpBridgeEnabled: true,
-      mcpServers: [
-        {
-          name: "openclaw-tools",
-          command: "node",
-          args: ["dist/mcp/openclaw-tools-serve.js"],
-          env: [],
-        },
-      ],
-    });
-
-    const readScopedMcpEnv = (sessionKey: string) => {
-      const delegate = (
-        runtime as unknown as {
-          resolveOpenClawToolsDelegateForSession(sessionKey: string): unknown;
-        }
-      ).resolveOpenClawToolsDelegateForSession(sessionKey) as {
-        options: {
-          mcpServers?: Array<{
-            env?: Array<{ name: string; value: string }>;
-            name: string;
-          }>;
-        };
-      };
-      return delegate.options.mcpServers?.find((server) => server.name === "openclaw-tools")?.env;
-    };
-
-    expect(readScopedMcpEnv("agent:worker:main")).toContainEqual({
-      name: "OPENCLAW_TOOLS_MCP_AGENT_SESSION_KEY",
-      value: "agent:worker:main",
-    });
-    expect(readScopedMcpEnv("agent:research:main")).toContainEqual({
-      name: "OPENCLAW_TOOLS_MCP_AGENT_SESSION_KEY",
-      value: "agent:research:main",
-    });
-  });
-
-  it("keeps managed OpenClaw tools MCP delegates reachable for fresh sessions", async () => {
-    const baseStore: TestSessionStore = {
-      load: vi.fn(async () => undefined),
-      save: vi.fn(async () => {}),
-    };
-    const { runtime } = makeRuntime(baseStore, {
-      openclawToolsMcpBridgeEnabled: true,
-      mcpServers: [
-        {
-          name: "openclaw-tools",
-          command: "node",
-          args: ["dist/mcp/openclaw-tools-serve.js"],
-          env: [],
-        },
-      ],
-    });
-    const exposedRuntime = runtime as unknown as {
-      openclawToolsSessionDelegates: Map<string, unknown>;
-      resolveOpenClawToolsDelegateForSession(sessionKey: string): unknown;
-    };
-
-    const firstDelegate =
-      exposedRuntime.resolveOpenClawToolsDelegateForSession("agent:worker:main");
-    expect(exposedRuntime.openclawToolsSessionDelegates.has("agent:worker:main")).toBe(true);
-
-    await runtime.prepareFreshSession({ sessionKey: "agent:worker:main" });
-
-    expect(exposedRuntime.openclawToolsSessionDelegates.has("agent:worker:main")).toBe(true);
-    expect(exposedRuntime.resolveOpenClawToolsDelegateForSession("agent:worker:main")).toBe(
-      firstDelegate,
-    );
-  });
-
-  it("uses the no-MCP delegate for startup probes when the OpenClaw tools bridge is enabled", async () => {
-    const baseStore: TestSessionStore = {
-      load: vi.fn(async () => undefined),
-      save: vi.fn(async () => {}),
-    };
-    const { runtime, delegate, bridgeSafeDelegate } = makeRuntime(baseStore, {
-      openclawToolsMcpBridgeEnabled: true,
-      mcpServers: [
-        {
-          name: "openclaw-tools",
-          command: "node",
-          args: ["dist/mcp/openclaw-tools-serve.js"],
-          env: [],
-        },
-      ],
-    });
-    const defaultProbe = vi.spyOn(delegate, "probeAvailability").mockResolvedValue(undefined);
-    const safeProbe = vi
-      .spyOn(bridgeSafeDelegate, "probeAvailability")
-      .mockResolvedValue(undefined);
-
-    await runtime.probeAvailability();
-
-    expect(safeProbe).toHaveBeenCalledTimes(1);
-    expect(defaultProbe).not.toHaveBeenCalled();
-  });
-
   it("normalizes OpenClaw Codex model ids for ACP startup", async () => {
     const baseStore: TestSessionStore = {
       load: vi.fn(async () => undefined),
@@ -1266,46 +1163,6 @@ describe("AcpxRuntime fresh reset wrapper", () => {
     expect(baseStore["load"]).toHaveBeenCalledOnce();
   });
 
-  it("releases managed OpenClaw tools MCP delegates after close", async () => {
-    const baseStore: TestSessionStore = {
-      load: vi.fn(async () => undefined),
-      save: vi.fn(async () => {}),
-    };
-
-    const { runtime } = makeRuntime(baseStore, {
-      openclawToolsMcpBridgeEnabled: true,
-      mcpServers: [
-        {
-          name: "openclaw-tools",
-          command: "node",
-          args: ["dist/mcp/openclaw-tools-serve.js"],
-          env: [],
-        },
-      ],
-    });
-    const exposedRuntime = runtime as unknown as {
-      openclawToolsSessionDelegates: Map<string, { close: AcpRuntime["close"] }>;
-      resolveOpenClawToolsDelegateForSession(sessionKey: string): {
-        close: AcpRuntime["close"];
-      };
-    };
-    const scopedDelegate =
-      exposedRuntime.resolveOpenClawToolsDelegateForSession("agent:codex:main");
-    const close = vi.spyOn(scopedDelegate, "close").mockResolvedValue(undefined);
-
-    await runtime.close({
-      handle: {
-        sessionKey: "agent:codex:main",
-        backend: "acpx",
-        runtimeSessionName: "agent:codex:main",
-      },
-      reason: "closed",
-    });
-
-    expect(close).toHaveBeenCalledOnce();
-    expect(exposedRuntime.openclawToolsSessionDelegates.has("agent:codex:main")).toBe(false);
-  });
-
   it("cleans up OpenClaw-owned ACPX process trees after close", async () => {
     const baseStore: TestSessionStore = {
       load: vi.fn(async () => ({

extensions/acpx/src/runtime.ts

@@ -50,7 +50,6 @@ type OpenClawAcpxRuntimeOptions = AcpRuntimeOptions & {
   openclawWrapperRoot?: string;
   openclawGatewayInstanceId?: string;
   openclawProcessLeaseStore?: AcpxProcessLeaseStore;
-  openclawToolsMcpBridgeEnabled?: boolean;
 };
 type AcpxRuntimeTestOptions = Record<string, unknown> & {
   openclawProcessCleanup?: AcpxProcessCleanupDeps;
@@ -58,10 +57,6 @@ type AcpxRuntimeTestOptions = Record<string, unknown> & {
 type OpenClawRuntimeTurnInput = Parameters<NonNullable<AcpRuntime["startTurn"]>>[0];
 type OpenClawRuntimeEnsureInput = Parameters<AcpRuntime["ensureSession"]>[0];
 type AcpxDelegateEnsureInput = Parameters<BaseAcpxRuntime["ensureSession"]>[0];
-type AcpxMcpServer = NonNullable<AcpRuntimeOptions["mcpServers"]>[number];
-
-const ACPX_OPENCLAW_TOOLS_MCP_SERVER_NAME = "openclaw-tools";
-const OPENCLAW_TOOLS_MCP_AGENT_SESSION_KEY_ENV = "OPENCLAW_TOOLS_MCP_AGENT_SESSION_KEY";
 
 type ResetAwareSessionStore = AcpSessionStore & {
   markFresh: (sessionKey: string) => void;
@@ -687,33 +682,6 @@ function shouldUseDistinctBridgeDelegate(options: AcpRuntimeOptions): boolean {
   return Array.isArray(mcpServers) && mcpServers.length > 0;
 }
 
-function withOpenClawToolsMcpSessionEnv(params: {
-  enabled: boolean | undefined;
-  mcpServers: AcpRuntimeOptions["mcpServers"];
-  sessionKey: string;
-}): AcpRuntimeOptions["mcpServers"] {
-  const sessionKey = params.sessionKey.trim();
-  if (!params.enabled || !sessionKey || !params.mcpServers?.length) {
-    return params.mcpServers;
-  }
-  let changed = false;
-  const nextServers = params.mcpServers.map((server): AcpxMcpServer => {
-    if (server.name !== ACPX_OPENCLAW_TOOLS_MCP_SERVER_NAME || !("command" in server)) {
-      return server;
-    }
-    changed = true;
-    const env = [
-      ...server.env.filter((entry) => entry.name !== OPENCLAW_TOOLS_MCP_AGENT_SESSION_KEY_ENV),
-      {
-        name: OPENCLAW_TOOLS_MCP_AGENT_SESSION_KEY_ENV,
-        value: sessionKey,
-      },
-    ];
-    return { ...server, env };
-  });
-  return changed ? nextServers : params.mcpServers;
-}
-
 /** OpenClaw-managed ACP runtime implementation backed by the upstream acpx runtime. */
 export class AcpxRuntime implements AcpRuntime {
   private readonly sessionStore: ResetAwareSessionStore;
@@ -725,10 +693,6 @@ export class AcpxRuntime implements AcpRuntime {
   private readonly delegate: BaseAcpxRuntime;
   private readonly bridgeSafeDelegate: BaseAcpxRuntime;
   private readonly probeDelegate: BaseAcpxRuntime;
-  private readonly delegateOptions: AcpRuntimeOptions;
-  private readonly delegateTestOptions: BaseAcpxRuntimeTestOptions;
-  private readonly openclawToolsMcpBridgeEnabled: boolean;
-  private readonly openclawToolsSessionDelegates = new Map<string, BaseAcpxRuntime>();
   private readonly processCleanupDeps: AcpxProcessCleanupDeps | undefined;
   private readonly wrapperRoot: string | undefined;
   private readonly gatewayInstanceId: string | undefined;
@@ -742,7 +706,6 @@ export class AcpxRuntime implements AcpRuntime {
     this.wrapperRoot = options.openclawWrapperRoot;
     this.gatewayInstanceId = options.openclawGatewayInstanceId;
     this.processLeaseStore = options.openclawProcessLeaseStore;
-    this.openclawToolsMcpBridgeEnabled = options.openclawToolsMcpBridgeEnabled === true;
     this.cwd = options.cwd;
     this.sessionStore = createResetAwareSessionStore(options.sessionStore, {
       gatewayInstanceId: this.gatewayInstanceId,
@@ -760,21 +723,20 @@ export class AcpxRuntime implements AcpRuntime {
       sessionStore: this.sessionStore,
       agentRegistry: this.scopedAgentRegistry,
     };
-    this.delegateOptions = sharedOptions;
-    this.delegateTestOptions = delegateTestOptions as BaseAcpxRuntimeTestOptions;
-    this.delegate = new BaseAcpxRuntime(sharedOptions, this.delegateTestOptions);
+    this.delegate = new BaseAcpxRuntime(
+      sharedOptions,
+      delegateTestOptions as BaseAcpxRuntimeTestOptions,
+    );
     this.bridgeSafeDelegate = shouldUseDistinctBridgeDelegate(options)
       ? new BaseAcpxRuntime(
           {
             ...sharedOptions,
             mcpServers: [],
           },
-          this.delegateTestOptions,
+          delegateTestOptions as BaseAcpxRuntimeTestOptions,
         )
       : this.delegate;
-    this.probeDelegate = this.openclawToolsMcpBridgeEnabled
-      ? this.bridgeSafeDelegate
-      : this.resolveDelegateForAgent(resolveProbeAgentName(options));
+    this.probeDelegate = this.resolveDelegateForAgent(resolveProbeAgentName(options));
   }
 
   private resolveDelegateForAgent(agentName: string | undefined): BaseAcpxRuntime {
@@ -789,57 +751,6 @@ export class AcpxRuntime implements AcpRuntime {
     return shouldUseBridgeSafeDelegateForCommand(command) ? this.bridgeSafeDelegate : this.delegate;
   }
 
-  private resolveDelegateForSession(params: {
-    command: string | undefined;
-    sessionKey: string;
-  }): BaseAcpxRuntime {
-    if (shouldUseBridgeSafeDelegateForCommand(params.command)) {
-      return this.bridgeSafeDelegate;
-    }
-    return this.resolveOpenClawToolsDelegateForSession(params.sessionKey);
-  }
-
-  private resolveOpenClawToolsDelegateForSession(sessionKey: string): BaseAcpxRuntime {
-    if (!this.openclawToolsMcpBridgeEnabled) {
-      return this.delegate;
-    }
-    const normalizedSessionKey = sessionKey.trim();
-    if (!normalizedSessionKey) {
-      return this.delegate;
-    }
-    const cached = this.openclawToolsSessionDelegates.get(normalizedSessionKey);
-    if (cached) {
-      return cached;
-    }
-    // Upstream acpx captures mcpServers at runtime construction. The managed
-    // OpenClaw tools bridge needs per-session identity, so cache one delegate
-    // per session with the scoped MCP env already embedded.
-    const delegate = new BaseAcpxRuntime(
-      {
-        ...this.delegateOptions,
-        mcpServers: withOpenClawToolsMcpSessionEnv({
-          enabled: this.openclawToolsMcpBridgeEnabled,
-          mcpServers: this.delegateOptions.mcpServers,
-          sessionKey: normalizedSessionKey,
-        }),
-      },
-      this.delegateTestOptions,
-    );
-    this.openclawToolsSessionDelegates.set(normalizedSessionKey, delegate);
-    return delegate;
-  }
-
-  private releaseOpenClawToolsDelegateForSession(sessionKey: string): void {
-    if (!this.openclawToolsMcpBridgeEnabled) {
-      return;
-    }
-    const normalizedSessionKey = sessionKey.trim();
-    if (!normalizedSessionKey) {
-      return;
-    }
-    this.openclawToolsSessionDelegates.delete(normalizedSessionKey);
-  }
-
   private async resolveDelegateForHandle(handle: AcpRuntimeHandle): Promise<BaseAcpxRuntime> {
     const record = await this.sessionStore.load(handle.acpxRecordId ?? handle.sessionKey);
     return this.resolveDelegateForLoadedRecord(handle, record);
@@ -851,17 +762,9 @@ export class AcpxRuntime implements AcpRuntime {
   ): BaseAcpxRuntime {
     const recordCommand = readAgentCommandFromRecord(record);
     if (recordCommand) {
-      return this.resolveDelegateForSession({
-        command: recordCommand,
-        sessionKey: handle.sessionKey,
-      });
+      return this.resolveDelegateForCommand(recordCommand);
     }
-    const agentName = readAgentFromHandle(handle);
-    const command = resolveAgentCommandForName({
-      agentName,
-      agentRegistry: this.agentRegistry,
-    });
-    return this.resolveDelegateForSession({ command, sessionKey: handle.sessionKey });
+    return this.resolveDelegateForAgent(readAgentFromHandle(handle));
   }
 
   private async resolveCommandForHandle(handle: AcpRuntimeHandle): Promise<string | undefined> {
@@ -1077,7 +980,7 @@ export class AcpxRuntime implements AcpRuntime {
       agentName: input.agent,
       agentRegistry: this.agentRegistry,
     });
-    const delegate = this.resolveDelegateForSession({ command, sessionKey: input.sessionKey });
+    const delegate = this.resolveDelegateForCommand(command);
     const claudeModelOverride = isClaudeAcpCommand(command)
       ? normalizeClaudeAcpModelOverride(input.model)
       : undefined;
@@ -1361,9 +1264,6 @@ export class AcpxRuntime implements AcpRuntime {
   }
 
   async prepareFreshSession(input: { sessionKey: string }): Promise<void> {
-    // Fresh reset has no ACP handle to close the delegate's upstream client.
-    // Keep the scoped delegate reachable so the next ensure can replace it;
-    // close() owns cache release when the session lifecycle ends.
     this.sessionStore.markFresh(input.sessionKey);
   }
 
@@ -1372,9 +1272,8 @@ export class AcpxRuntime implements AcpRuntime {
       input.handle.acpxRecordId ?? input.handle.sessionKey,
     );
     let closeSucceeded;
-    const delegate = this.resolveDelegateForLoadedRecord(input.handle, record);
     try {
-      await delegate.close({
+      await this.resolveDelegateForLoadedRecord(input.handle, record).close({
         handle: input.handle,
         reason: input.reason,
         discardPersistentState: input.discardPersistentState,
@@ -1383,9 +1282,6 @@ export class AcpxRuntime implements AcpRuntime {
     } finally {
       await this.cleanupProcessTreeForRecord(input.handle, record);
     }
-    if (closeSucceeded) {
-      this.releaseOpenClawToolsDelegateForSession(input.handle.sessionKey);
-    }
     if (closeSucceeded && input.discardPersistentState) {
       this.sessionStore.markFresh(input.handle.sessionKey);
     }

extensions/acpx/src/service.ts

@@ -111,7 +111,6 @@ function createLazyDefaultRuntime(params: AcpxRuntimeFactoryParams): AcpxRuntime
         }),
         probeAgent: params.pluginConfig.probeAgent,
         mcpServers: toAcpMcpServers(params.pluginConfig.mcpServers),
-        openclawToolsMcpBridgeEnabled: params.pluginConfig.openClawToolsMcpBridge,
         permissionMode: params.pluginConfig.permissionMode,
         nonInteractivePermissions: params.pluginConfig.nonInteractivePermissions,
         timeoutMs: resolveAcpxTimerTimeoutMs(params.pluginConfig.timeoutSeconds),

extensions/clickclack/src/http-client.test.ts

@@ -1,81 +1,6 @@
-import { createServer, type Server } from "node:http";
 import { describe, expect, it, vi } from "vitest";
 import { createClickClackClient } from "./http-client.js";
 
-const LOOPBACK_RESPONSE_BYTES = 18 * 1024 * 1024;
-
-async function listenLoopbackServer(server: Server): Promise<number> {
-  return await new Promise((resolve, reject) => {
-    server.once("error", reject);
-    server.listen(0, "127.0.0.1", () => {
-      server.off("error", reject);
-      const address = server.address();
-      if (!address || typeof address === "string") {
-        reject(new Error("expected loopback TCP address"));
-        return;
-      }
-      resolve(address.port);
-    });
-  });
-}
-
-function createOversizedJsonServer(): { server: Server; closed: Promise<number> } {
-  let resolveClosed: (sentBytes: number) => void = () => {};
-  const closed = new Promise<number>((resolve) => {
-    resolveClosed = resolve;
-  });
-  const server = createServer((req, res) => {
-    let sentBytes = 0;
-    let stopped = false;
-    let prefixSent = false;
-    const prefixChunk = Buffer.from('{"user":{"id":"');
-    const bodyChunk = Buffer.alloc(64 * 1024, 0x61);
-    const suffixChunk = Buffer.from('"}}');
-    const writeBuffer = (buffer: Buffer) => {
-      sentBytes += buffer.length;
-      if (!res.write(buffer)) {
-        res.once("drain", writeChunks);
-        return false;
-      }
-      return true;
-    };
-    const writeChunks = () => {
-      if (!prefixSent) {
-        prefixSent = true;
-        if (!writeBuffer(prefixChunk)) {
-          return;
-        }
-      }
-      while (true) {
-        if (stopped) {
-          return;
-        }
-        if (sentBytes + bodyChunk.length + suffixChunk.length >= LOOPBACK_RESPONSE_BYTES) {
-          break;
-        }
-        if (!writeBuffer(bodyChunk)) {
-          return;
-        }
-      }
-      if (!stopped) {
-        sentBytes += suffixChunk.length;
-        res.end(suffixChunk);
-      }
-    };
-    res.writeHead(200, { connection: "close", "content-type": "application/json" });
-    res.on("close", () => {
-      stopped = true;
-      resolveClosed(sentBytes);
-    });
-    req.on("aborted", () => {
-      stopped = true;
-      res.destroy();
-    });
-    writeChunks();
-  });
-  return { server, closed };
-}
-
 function streamedErrorResponse(body: string, limit: number) {
   const encoded = new TextEncoder().encode(body);
   let readCount = 0;
@@ -114,25 +39,6 @@ function streamedErrorResponse(body: string, limit: number) {
 }
 
 describe("ClickClack HTTP client", () => {
-  it("bounds oversized success JSON responses and closes the stream early", async () => {
-    const { server, closed } = createOversizedJsonServer();
-    const port = await listenLoopbackServer(server);
-    const client = createClickClackClient({
-      baseUrl: `http://127.0.0.1:${port}`,
-      token: "test-token",
-    });
-
-    try {
-      await expect(client.me()).rejects.toThrow(
-        "ClickClack response: JSON response exceeds 16777216 bytes",
-      );
-      const sentBytes = await closed;
-      expect(sentBytes).toBeLessThan(LOOPBACK_RESPONSE_BYTES);
-    } finally {
-      server.close();
-    }
-  });
-
   it("bounds error response bodies without using raw response.text()", async () => {
     const streamed = streamedErrorResponse("x".repeat(9000), 8 * 1024);
     const fetchMock = vi.fn(async () => streamed.response);

extensions/clickclack/src/http-client.ts

@@ -2,10 +2,7 @@
  * Thin ClickClack REST/websocket client used by gateway, resolver, and outbound
  * delivery code.
  */
-import {
-  readProviderJsonResponse,
-  readResponseTextLimited,
-} from "openclaw/plugin-sdk/provider-http";
+import { readResponseTextLimited } from "openclaw/plugin-sdk/provider-http";
 import { WebSocket } from "ws";
 import type {
   ClickClackChannel,
@@ -47,7 +44,7 @@ export function createClickClackClient(options: ClientOptions) {
       const detail = await readResponseTextLimited(response, CLICKCLACK_ERROR_BODY_LIMIT_BYTES);
       throw new Error(`ClickClack ${response.status}: ${detail}`);
     }
-    return await readProviderJsonResponse<T>(response, "ClickClack response");
+    return (await response.json()) as T;
   }
 
   return {

extensions/codex/doctor-contract-api.test.ts

@@ -36,14 +36,6 @@ describe("codex doctor contract", () => {
         },
       }),
     ).toBe(false);
-    expect(
-      legacyConfigRules[1]?.match({
-        allow_destructive_actions: "always",
-        plugins: {
-          "google-calendar": { allow_destructive_actions: "always" },
-        },
-      }),
-    ).toBe(false);
   });
 
   it("removes the retired dynamic tools profile without dropping other Codex config", () => {

extensions/codex/openclaw.plugin.json

@@ -101,7 +101,7 @@
             "default": false
           },
           "allow_destructive_actions": {
-            "oneOf": [{ "type": "boolean" }, { "const": "auto" }, { "const": "always" }],
+            "oneOf": [{ "type": "boolean" }, { "const": "auto" }],
             "default": true
           },
           "plugins": {
@@ -121,7 +121,7 @@
                   "type": "string"
                 },
                 "allow_destructive_actions": {
-                  "oneOf": [{ "type": "boolean" }, { "const": "auto" }, { "const": "always" }]
+                  "oneOf": [{ "type": "boolean" }, { "const": "auto" }]
                 }
               }
             }
@@ -343,7 +343,7 @@
     },
     "codexPlugins.allow_destructive_actions": {
       "label": "Allow Destructive Plugin Actions",
-      "help": "Default policy for plugin app write or destructive action elicitations. Use true to accept safe schemas without prompting, false to decline, auto to ask through plugin approvals when Codex requires approval, or always to ask for every write/destructive action without durable approval.",
+      "help": "Default policy for plugin app write or destructive action elicitations. Use true to accept safe schemas without prompting, false to decline, or auto to ask through plugin approvals.",
       "advanced": true
     },
     "codexPlugins.plugins": {

extensions/codex/src/app-server/attempt-notification-state.ts

@@ -21,7 +21,6 @@ import {
   readCodexNotificationItem,
   readNotificationItemId,
   shouldDisarmAssistantCompletionIdleWatch,
-  updateActiveCompletionBlockerItemIds,
   updateActiveTurnItemIds,
 } from "./attempt-notifications.js";
 import { CODEX_POST_REASONING_REPLY_IDLE_TIMEOUT_MS } from "./attempt-timeouts.js";
@@ -93,7 +92,6 @@ export function applyCodexTurnNotificationState(params: {
   currentPromptTexts: string[];
   turnWatches: CodexAttemptTurnWatchController;
   activeTurnItemIds: Set<string>;
-  activeCompletionBlockerItemIds: Set<string>;
   activeAppServerTurnRequests: number;
   pendingOpenClawDynamicToolCompletionIds: Set<string>;
   turnCrossedToolHandoff: boolean;
@@ -123,7 +121,6 @@ export function applyCodexTurnNotificationState(params: {
     });
     params.onReportExecutionNotification(notification);
     updateActiveTurnItemIds(notification, params.activeTurnItemIds);
-    updateActiveCompletionBlockerItemIds(notification, params.activeCompletionBlockerItemIds);
     if (notification.method === "item/completed" && params.activeTurnItemIds.size === 0) {
       params.onScheduleTerminalDynamicToolReleaseCheck();
     }

extensions/codex/src/app-server/attempt-notifications.ts

@@ -63,45 +63,6 @@ export function updateActiveTurnItemIds(
   activeItemIds.delete(itemId);
 }
 
-export function updateActiveCompletionBlockerItemIds(
-  notification: CodexServerNotification,
-  activeItemIds: Set<string>,
-): void {
-  if (notification.method !== "item/started" && notification.method !== "item/completed") {
-    return;
-  }
-  const itemId = readNotificationItemId(notification);
-  if (!itemId) {
-    return;
-  }
-  if (notification.method === "item/completed") {
-    activeItemIds.delete(itemId);
-    return;
-  }
-  const item = readCodexNotificationItem(notification.params);
-  if (item && isCompletionBlockingItem(item)) {
-    activeItemIds.add(itemId);
-  }
-}
-
-function isCompletionBlockingItem(item: CodexThreadItem): boolean {
-  // Codex emits paired item/started and item/completed notifications for these
-  // execution items. Completion must not time out while any pair is still open.
-  switch (item.type) {
-    case "collabAgentToolCall":
-    case "commandExecution":
-    case "dynamicToolCall":
-    case "fileChange":
-    case "imageGeneration":
-    case "imageView":
-    case "mcpToolCall":
-    case "webSearch":
-      return true;
-    default:
-      return false;
-  }
-}
-
 function isCompletedAssistantNotification(notification: CodexServerNotification): boolean {
   if (!isJsonObject(notification.params)) {
     return false;

extensions/codex/src/app-server/attempt-startup.ts

@@ -346,7 +346,6 @@ export async function startCodexAttemptThread(params: {
                               timeoutMs: params.appServer.requestTimeoutMs,
                               signal,
                             }),
-                          configCwd: startupExecutionCwd,
                           appCache: defaultCodexAppInventoryCache,
                           appCacheKey: pluginAppCacheKey,
                         }),

extensions/codex/src/app-server/attempt-turn-watches.test.ts

@@ -1,7 +1,6 @@
 // Codex tests cover attempt turn watches plugin behavior.
 import { MAX_TIMER_TIMEOUT_MS } from "openclaw/plugin-sdk/number-runtime";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { updateActiveCompletionBlockerItemIds } from "./attempt-notifications.js";
 import { createCodexAttemptTurnWatchController } from "./attempt-turn-watches.js";
 
 describe("Codex app-server attempt turn watches", () => {
@@ -24,7 +23,6 @@ describe("Codex app-server attempt turn watches", () => {
     let terminalQueued = false;
     let activeRequests = 0;
     let activeItems = 0;
-    let activeCompletionBlockers = 0;
     const interrupts: Array<Record<string, unknown>> = [];
     const timeouts: Array<Record<string, unknown>> = [];
     const events: Array<{ name: string; fields: Record<string, unknown> }> = [];
@@ -38,7 +36,6 @@ describe("Codex app-server attempt turn watches", () => {
       isTerminalTurnNotificationQueued: () => terminalQueued,
       getActiveAppServerTurnRequests: () => activeRequests,
       getActiveTurnItemCount: () => activeItems,
-      getActiveCompletionBlockerItemCount: () => activeCompletionBlockers,
       turnCompletionIdleTimeoutMs: 10,
       turnAssistantCompletionIdleTimeoutMs: 10,
       turnAttemptIdleTimeoutMs: 10,
@@ -72,9 +69,6 @@ describe("Codex app-server attempt turn watches", () => {
       set activeItems(value: number) {
         activeItems = value;
       },
-      set activeCompletionBlockers(value: number) {
-        activeCompletionBlockers = value;
-      },
       interrupts,
       timeouts,
       events,
@@ -161,32 +155,6 @@ describe("Codex app-server attempt turn watches", () => {
     expect(harness.abortController.signal.aborted).toBe(false);
   });
 
-  it("waits for active completion blocker items before firing completion idle timeout", () => {
-    const harness = createController();
-    harness.activeCompletionBlockers = 1;
-
-    harness.controller.touchActivity("request:mcpServer/elicitation/request:response", {
-      arm: true,
-    });
-    vi.advanceTimersByTime(10);
-
-    expect(harness.timeouts).toEqual([]);
-    expect(harness.abortController.signal.aborted).toBe(false);
-
-    harness.activeCompletionBlockers = 0;
-    harness.controller.touchActivity("notification:item/completed");
-    vi.advanceTimersByTime(10);
-
-    expect(harness.timeouts).toMatchObject([
-      {
-        kind: "completion",
-        idleMs: 10,
-        timeoutMs: 10,
-        lastActivityReason: "notification:item/completed",
-      },
-    ]);
-  });
-
   it("releases a completed assistant item after the assistant idle guard expires", () => {
     const harness = createController();
 
@@ -246,41 +214,3 @@ describe("Codex app-server attempt turn watches", () => {
     expect(harness.abortController.signal.reason).toBe("turn_progress_idle_timeout");
   });
 });
-
-describe("Codex completion blocker item tracking", () => {
-  it.each([
-    "collabAgentToolCall",
-    "commandExecution",
-    "dynamicToolCall",
-    "fileChange",
-    "imageGeneration",
-    "imageView",
-    "mcpToolCall",
-    "webSearch",
-  ])("tracks the %s lifecycle", (type) => {
-    const activeItemIds = new Set<string>();
-    updateActiveCompletionBlockerItemIds(
-      { method: "item/started", params: { item: { id: "item-1", type } } },
-      activeItemIds,
-    );
-    expect(activeItemIds).toEqual(new Set(["item-1"]));
-
-    updateActiveCompletionBlockerItemIds(
-      { method: "item/completed", params: { item: { id: "item-1", type } } },
-      activeItemIds,
-    );
-    expect(activeItemIds).toEqual(new Set());
-  });
-
-  it.each(["agentMessage", "contextCompaction", "plan", "reasoning", "subAgentActivity"])(
-    "does not track the %s lifecycle",
-    (type) => {
-      const activeItemIds = new Set<string>();
-      updateActiveCompletionBlockerItemIds(
-        { method: "item/started", params: { item: { id: "item-1", type } } },
-        activeItemIds,
-      );
-      expect(activeItemIds).toEqual(new Set());
-    },
-  );
-});

extensions/codex/src/app-server/attempt-turn-watches.ts

@@ -36,7 +36,6 @@ export function createCodexAttemptTurnWatchController(params: {
   isTerminalTurnNotificationQueued: () => boolean;
   getActiveAppServerTurnRequests: () => number;
   getActiveTurnItemCount: () => number;
-  getActiveCompletionBlockerItemCount: () => number;
   turnCompletionIdleTimeoutMs: number;
   turnAssistantCompletionIdleTimeoutMs: number;
   turnAttemptIdleTimeoutMs: number;
@@ -122,8 +121,7 @@ export function createCodexAttemptTurnWatchController(params: {
       params.isCompleted() ||
       params.signal.aborted ||
       !completionIdleWatchArmed ||
-      params.getActiveAppServerTurnRequests() > 0 ||
-      params.getActiveCompletionBlockerItemCount() > 0
+      params.getActiveAppServerTurnRequests() > 0
     ) {
       return;
     }
@@ -185,8 +183,7 @@ export function createCodexAttemptTurnWatchController(params: {
       params.isTerminalTurnNotificationQueued() ||
       params.signal.aborted ||
       !completionIdleWatchArmed ||
-      params.getActiveAppServerTurnRequests() > 0 ||
-      params.getActiveCompletionBlockerItemCount() > 0
+      params.getActiveAppServerTurnRequests() > 0
     ) {
       return false;
     }
@@ -305,8 +302,7 @@ export function createCodexAttemptTurnWatchController(params: {
       params.isTerminalTurnNotificationQueued() ||
       params.signal.aborted ||
       !completionIdleWatchArmed ||
-      params.getActiveAppServerTurnRequests() > 0 ||
-      params.getActiveCompletionBlockerItemCount() > 0
+      params.getActiveAppServerTurnRequests() > 0
     ) {
       return;
     }

extensions/codex/src/app-server/config.test.ts

@@ -1192,52 +1192,6 @@ allowed_sandbox_modes = ["read-only", "workspace-write"]
     });
   });
 
-  it("parses always native Codex plugin destructive policy", () => {
-    const config = readCodexPluginConfig({
-      codexPlugins: {
-        enabled: true,
-        allow_destructive_actions: "always",
-        plugins: {
-          "google-calendar": {
-            marketplaceName: "openai-curated",
-            pluginName: "google-calendar",
-          },
-          slack: {
-            marketplaceName: "openai-curated",
-            pluginName: "slack",
-            allow_destructive_actions: "auto",
-          },
-        },
-      },
-    });
-
-    expect(config.codexPlugins?.allow_destructive_actions).toBe("always");
-    expect(resolveCodexPluginsPolicy(config)).toEqual({
-      configured: true,
-      enabled: true,
-      allowDestructiveActions: true,
-      destructiveApprovalMode: "always",
-      pluginPolicies: [
-        {
-          configKey: "google-calendar",
-          marketplaceName: "openai-curated",
-          pluginName: "google-calendar",
-          enabled: true,
-          allowDestructiveActions: true,
-          destructiveApprovalMode: "always",
-        },
-        {
-          configKey: "slack",
-          marketplaceName: "openai-curated",
-          pluginName: "slack",
-          enabled: true,
-          allowDestructiveActions: true,
-          destructiveApprovalMode: "auto",
-        },
-      ],
-    });
-  });
-
   it("rejects unsupported native Codex plugin destructive policy strings", () => {
     const config = readCodexPluginConfig({
       codexPlugins: {

extensions/codex/src/app-server/config.ts

@@ -74,8 +74,8 @@ export type CodexAppServerSandboxMode = "read-only" | "workspace-write" | "dange
 type CodexAppServerApprovalsReviewer = "user" | "auto_review" | "guardian_subagent";
 type CodexAppServerCommandSource = "managed" | "resolved-managed" | "config" | "env";
 export type CodexDynamicToolsLoading = "searchable" | "direct";
-export type CodexPluginDestructivePolicy = boolean | "auto" | "always";
-export type CodexPluginDestructiveApprovalMode = "allow" | "deny" | "auto" | "always";
+export type CodexPluginDestructivePolicy = boolean | "auto";
+export type CodexPluginDestructiveApprovalMode = "allow" | "deny" | "auto";
 
 export const CODEX_PLUGINS_MARKETPLACE_NAME = "openai-curated";
 
@@ -311,11 +311,7 @@ const codexAppServerApprovalPolicySchema = z.enum([
 const codexAppServerSandboxSchema = z.enum(["read-only", "workspace-write", "danger-full-access"]);
 const codexAppServerApprovalsReviewerSchema = z.enum(["user", "auto_review", "guardian_subagent"]);
 const codexDynamicToolsLoadingSchema = z.enum(["searchable", "direct"]);
-const codexPluginDestructivePolicySchema = z.union([
-  z.boolean(),
-  z.literal("auto"),
-  z.literal("always"),
-]);
+const codexPluginDestructivePolicySchema = z.union([z.boolean(), z.literal("auto")]);
 const codexAppServerServiceTierSchema = z
   .preprocess(
     (value) => (value === null ? null : normalizeCodexServiceTier(value)),
@@ -499,8 +495,8 @@ function resolveCodexPluginDestructivePolicy(policy: CodexPluginDestructivePolic
   allowDestructiveActions: boolean;
   destructiveApprovalMode: CodexPluginDestructiveApprovalMode;
 } {
-  if (policy === "auto" || policy === "always") {
-    return { allowDestructiveActions: true, destructiveApprovalMode: policy };
+  if (policy === "auto") {
+    return { allowDestructiveActions: true, destructiveApprovalMode: "auto" };
   }
   return {
     allowDestructiveActions: policy,

extensions/codex/src/app-server/dynamic-tools.test.ts

@@ -1102,585 +1102,6 @@ describe("createCodexDynamicToolBridge", () => {
     ]);
   });
 
-  it("marks delivered message-tool-only source replies as terminal", async () => {
-    const bridge = createBridgeWithToolResult(
-      "message",
-      textToolResult("Sent.", { messageId: "imessage-6264" }),
-      { sourceReplyDeliveryMode: "message_tool_only" },
-    );
-
-    const result = await handleMessageToolCall(bridge, {
-      action: "send",
-      message: "visible reply",
-    });
-
-    expect(result).toEqual(expectInputText("Sent."));
-    expect(result.terminate).toBe(true);
-    expect(bridge.telemetry.didDeliverSourceReplyViaMessageTool).toBe(true);
-    expect(Object.keys(result)).not.toContain("terminate");
-  });
-
-  it("keeps message-tool-only source replies terminal when middleware redacts receipt details", async () => {
-    const registry = createEmptyPluginRegistry();
-    registry.agentToolResultMiddlewares.push({
-      pluginId: "receipt-redactor",
-      pluginName: "Receipt redactor",
-      rawHandler: () => undefined,
-      handler: (event: { result: AgentToolResult<unknown> }) => ({
-        result: {
-          content: event.result.content,
-          details: { redacted: true },
-        },
-      }),
-      runtimes: ["codex"],
-      source: "test",
-    });
-    setActivePluginRegistry(registry);
-    const bridge = createBridgeWithToolResult(
-      "message",
-      textToolResult("Sent.", {
-        receipt: {
-          primaryPlatformMessageId: "imessage-6264",
-          platformMessageIds: ["imessage-6264"],
-        },
-      }),
-      { sourceReplyDeliveryMode: "message_tool_only" },
-    );
-
-    const result = await handleMessageToolCall(bridge, {
-      action: "send",
-      message: "visible reply",
-    });
-
-    expect(result).toEqual(expectInputText("Sent."));
-    expect(result.terminate).toBe(true);
-    expect(Object.keys(result)).not.toContain("terminate");
-  });
-
-  it("does not treat target telemetry alone as delivered message-tool-only source reply evidence", async () => {
-    const bridge = createBridgeWithToolResult("message", textToolResult("Sent."), {
-      sourceReplyDeliveryMode: "message_tool_only",
-      currentChannelProvider: "imessage",
-      currentChannelId: "chat-1",
-    });
-
-    const result = await handleMessageToolCall(bridge, {
-      action: "send",
-      message: "visible reply",
-    });
-
-    expect(result).toEqual(expectInputText("Sent."));
-    expect(bridge.telemetry.messagingToolSentTargets).toEqual([
-      expect.objectContaining({
-        tool: "message",
-        provider: "imessage",
-        to: "chat-1",
-        text: "visible reply",
-      }),
-    ]);
-    expect(result.terminate).toBeUndefined();
-    expect(bridge.telemetry.didDeliverSourceReplyViaMessageTool).toBe(false);
-  });
-
-  it("keeps message-tool-only source replies terminal for explicit current source routes", async () => {
-    const bridge = createBridgeWithToolResult(
-      "message",
-      textToolResult("Sent.", { ok: true, messageId: "imessage-853" }),
-      {
-        sourceReplyDeliveryMode: "message_tool_only",
-        currentChannelProvider: "imessage",
-        currentChannelId: "imessage:+12069106512",
-        currentMessagingTarget: "+12069106512",
-      },
-    );
-
-    const result = await handleMessageToolCall(bridge, {
-      action: "reply",
-      channel: "imessage",
-      target: "+12069106512",
-      messageId: "853",
-      message: "visible reply",
-      buttons: [],
-    });
-
-    expect(result).toEqual(expectInputText("Sent."));
-    expect(result.terminate).toBe(true);
-    expect(bridge.telemetry.didDeliverSourceReplyViaMessageTool).toBe(true);
-    expect(Object.keys(result)).not.toContain("terminate");
-  });
-
-  it("keeps normalized explicit source routes terminal", async () => {
-    setActivePluginRegistry(
-      createTestRegistry([
-        {
-          pluginId: "sms",
-          plugin: {
-            id: "sms",
-            messaging: {
-              normalizeTarget: (raw: string) => {
-                const digits = raw.replace(/\D/gu, "");
-                return digits.length === 11 && digits.startsWith("1") ? `+${digits}` : raw.trim();
-              },
-            },
-          },
-          source: "test",
-        },
-      ]),
-    );
-    const bridge = createBridgeWithToolResult(
-      "message",
-      textToolResult("Sent.", { ok: true, messageId: "sms-853" }),
-      {
-        sourceReplyDeliveryMode: "message_tool_only",
-        currentChannelProvider: "sms",
-        currentChannelId: "sms:+12069106512",
-        currentMessagingTarget: "+12069106512",
-      },
-    );
-
-    const result = await handleMessageToolCall(bridge, {
-      action: "reply",
-      channel: "sms",
-      target: "+1 (206) 910-6512",
-      messageId: "853",
-      message: "visible reply",
-    });
-
-    expect(result).toEqual(expectInputText("Sent."));
-    expect(bridge.telemetry.messagingToolSentTargets).toEqual([
-      expect.objectContaining({
-        tool: "message",
-        provider: "sms",
-        to: "+12069106512",
-        text: "visible reply",
-      }),
-    ]);
-    expect(result.terminate).toBe(true);
-    expect(bridge.telemetry.didDeliverSourceReplyViaMessageTool).toBe(true);
-    expect(Object.keys(result)).not.toContain("terminate");
-  });
-
-  it("keeps message-tool-only source replies terminal when the reply receipt matches the current message id", async () => {
-    const bridge = createBridgeWithToolResult(
-      "message",
-      textToolResult("Sent.", {
-        ok: true,
-        messageId: "provider-message-1",
-        repliedTo: "provider-guid-857",
-      }),
-      {
-        sourceReplyDeliveryMode: "message_tool_only",
-        currentChannelProvider: "imessage",
-        currentChannelId: "imessage:any;-;+12069106512",
-        currentMessageId: "provider-guid-857",
-      },
-    );
-
-    const result = await handleMessageToolCall(bridge, {
-      action: "reply",
-      channel: "imessage",
-      target: "+12069106512",
-      messageId: "857",
-      message: "visible reply",
-      buttons: [],
-    });
-
-    expect(result).toEqual(expectInputText("Sent."));
-    expect(bridge.telemetry.messagingToolSentTargets).toEqual([
-      expect.objectContaining({
-        tool: "message",
-        provider: "imessage",
-        to: "+12069106512",
-        text: "visible reply",
-      }),
-    ]);
-    expect(result.terminate).toBe(true);
-    expect(bridge.telemetry.didDeliverSourceReplyViaMessageTool).toBe(true);
-    expect(Object.keys(result)).not.toContain("terminate");
-  });
-
-  it("keeps message-tool-only source replies terminal when a text receipt matches the current message id", async () => {
-    const receiptText = JSON.stringify({
-      ok: true,
-      messageId: "provider-message-1",
-      repliedTo: "provider-guid-861",
-    });
-    const bridge = createBridgeWithToolResult("message", textToolResult(receiptText), {
-      sourceReplyDeliveryMode: "message_tool_only",
-      currentChannelProvider: "imessage",
-      currentChannelId: "imessage:any;-;+12069106512",
-      currentMessageId: "provider-guid-861",
-    });
-
-    const result = await handleMessageToolCall(bridge, {
-      action: "reply",
-      channel: "imessage",
-      target: "+12069106512",
-      messageId: "861",
-      message: "visible reply",
-      buttons: [],
-    });
-
-    expect(result).toEqual(expectInputText(receiptText));
-    expect(result.terminate).toBe(true);
-    expect(bridge.telemetry.didDeliverSourceReplyViaMessageTool).toBe(true);
-    expect(Object.keys(result)).not.toContain("terminate");
-  });
-
-  it("does not let dry-run reply receipts terminate message-tool-only source replies", async () => {
-    const receiptText = JSON.stringify({
-      deliveryStatus: "dry_run",
-      dryRun: true,
-      replyToId: "provider-guid-862",
-    });
-    const bridge = createBridgeWithToolResult("message", textToolResult(receiptText), {
-      sourceReplyDeliveryMode: "message_tool_only",
-      currentChannelProvider: "imessage",
-      currentChannelId: "imessage:any;-;+12069106512",
-      currentMessageId: "provider-guid-862",
-    });
-
-    const result = await handleMessageToolCall(bridge, {
-      action: "reply",
-      channel: "imessage",
-      target: "+12069106512",
-      messageId: "862",
-      message: "visible reply",
-      buttons: [],
-    });
-
-    expect(result).toEqual(expectInputText(receiptText));
-    expect(result.terminate).toBeUndefined();
-    expect(bridge.telemetry.didDeliverSourceReplyViaMessageTool).toBe(false);
-  });
-
-  it("does not record dry-run reply actions as committed sends", async () => {
-    const bridge = createBridgeWithToolResult(
-      "message",
-      textToolResult("Dry run.", {
-        deliveryStatus: "dry_run",
-        dryRun: true,
-      }),
-      {
-        sourceReplyDeliveryMode: "message_tool_only",
-        currentChannelProvider: "imessage",
-        currentChannelId: "imessage:+12069106512",
-        currentMessagingTarget: "+12069106512",
-        currentMessageId: "provider-guid-862",
-      },
-    );
-
-    const result = await handleMessageToolCall(bridge, {
-      action: "reply",
-      channel: "imessage",
-      target: "+12069106512",
-      messageId: "862",
-      message: "visible reply",
-    });
-
-    expect(result).toEqual(expectInputText("Dry run."));
-    expect(result.terminate).toBeUndefined();
-    expect(bridge.telemetry.didSendViaMessagingTool).toBe(false);
-    expect(bridge.telemetry.messagingToolSentTargets).toEqual([]);
-    expect(bridge.telemetry.didDeliverSourceReplyViaMessageTool).toBe(false);
-  });
-
-  it("keeps message-tool-only source replies terminal for explicit native target segments", async () => {
-    const bridge = createBridgeWithToolResult("message", textToolResult("Sent.", { ok: true }), {
-      sourceReplyDeliveryMode: "message_tool_only",
-      currentChannelProvider: "imessage",
-      currentChannelId: "imessage:any;-;+12069106512",
-    });
-
-    const result = await handleMessageToolCall(bridge, {
-      action: "reply",
-      channel: "imessage",
-      target: "+12069106512",
-      messageId: "863",
-      message: "visible reply",
-      buttons: [],
-    });
-
-    expect(result).toEqual(expectInputText("Sent."));
-    expect(result.terminate).toBe(true);
-    expect(bridge.telemetry.didDeliverSourceReplyViaMessageTool).toBe(true);
-    expect(Object.keys(result)).not.toContain("terminate");
-  });
-
-  it("keeps message-tool-only source replies terminal when the provider is only in the current channel id", async () => {
-    const bridge = createBridgeWithToolResult("message", textToolResult("Sent.", { ok: true }), {
-      sourceReplyDeliveryMode: "message_tool_only",
-      currentChannelId: "imessage:any;-;+12069106512",
-    });
-
-    const result = await handleMessageToolCall(bridge, {
-      action: "reply",
-      channel: "imessage",
-      target: "+12069106512",
-      messageId: "865",
-      message: "visible reply",
-      buttons: [],
-    });
-
-    expect(result).toEqual(expectInputText("Sent."));
-    expect(result.terminate).toBe(true);
-    expect(bridge.telemetry.didDeliverSourceReplyViaMessageTool).toBe(true);
-    expect(Object.keys(result)).not.toContain("terminate");
-  });
-
-  it("records message-tool-owned terminal replies as delivered source replies", async () => {
-    const bridge = createBridgeWithToolResult(
-      "message",
-      {
-        ...textToolResult("Sent.", { ok: true }),
-        terminate: true,
-      } as AgentToolResult<unknown>,
-      { sourceReplyDeliveryMode: "message_tool_only" },
-    );
-
-    const result = await handleMessageToolCall(bridge, {
-      action: "reply",
-      channel: "imessage",
-      target: "+12069106512",
-      messageId: "867",
-      message: "visible reply",
-      buttons: [],
-    });
-
-    expect(result).toEqual(expectInputText("Sent."));
-    expect(result.terminate).toBe(true);
-    expect(bridge.telemetry.didDeliverSourceReplyViaMessageTool).toBe(true);
-    expect(Object.keys(result)).not.toContain("terminate");
-  });
-
-  it("does not treat bare send telemetry as delivered message-tool-only source reply evidence", async () => {
-    const bridge = createBridgeWithToolResult("message", textToolResult("Sent."), {
-      sourceReplyDeliveryMode: "message_tool_only",
-    });
-
-    const result = await handleMessageToolCall(bridge, {
-      action: "send",
-      message: "visible reply",
-    });
-
-    expect(result).toEqual(expectInputText("Sent."));
-    expect(bridge.telemetry.didSendViaMessagingTool).toBe(true);
-    expect(result.terminate).toBeUndefined();
-    expect(bridge.telemetry.didDeliverSourceReplyViaMessageTool).toBe(false);
-  });
-
-  it("does not let prior message-send telemetry terminate a later non-delivery tool result", async () => {
-    const execute = vi
-      .fn()
-      .mockResolvedValueOnce(textToolResult("Sent.", { messageId: "source-reply-1" }))
-      .mockResolvedValueOnce(textToolResult("No message sent.", { ok: true }));
-    const bridge = createCodexDynamicToolBridge({
-      tools: [createTool({ name: "message", execute })],
-      signal: new AbortController().signal,
-      hookContext: { sourceReplyDeliveryMode: "message_tool_only" },
-    });
-
-    const firstResult = await handleMessageToolCall(bridge, {
-      action: "send",
-      message: "visible reply",
-    });
-    const secondResult = await bridge.handleToolCall({
-      threadId: "thread-1",
-      turnId: "turn-1",
-      callId: "call-2",
-      namespace: null,
-      tool: "message",
-      arguments: { action: "inspect" },
-    });
-
-    expect(firstResult.terminate).toBe(true);
-    expect(bridge.telemetry.didSendViaMessagingTool).toBe(true);
-    expect(secondResult).toEqual(expectInputText("No message sent."));
-    expect(secondResult.terminate).toBeUndefined();
-  });
-
-  it("does not mark explicit message-tool sends as terminal source replies", async () => {
-    const bridge = createBridgeWithToolResult(
-      "message",
-      textToolResult("Sent.", { messageId: "other-chat-message" }),
-      { sourceReplyDeliveryMode: "message_tool_only" },
-    );
-
-    const result = await handleMessageToolCall(bridge, {
-      action: "send",
-      target: "channel:other",
-      message: "cross-channel reply",
-    });
-
-    expect(result).toEqual(expectInputText("Sent."));
-    expect(result.terminate).toBeUndefined();
-    expect(bridge.telemetry.didDeliverSourceReplyViaMessageTool).toBe(false);
-  });
-
-  it("does not mark mismatched explicit message-tool sends as terminal source replies", async () => {
-    const bridge = createBridgeWithToolResult("message", textToolResult("Sent."), {
-      sourceReplyDeliveryMode: "message_tool_only",
-      currentChannelProvider: "imessage",
-      currentChannelId: "imessage:+12069106512",
-      currentMessagingTarget: "+12069106512",
-    });
-
-    const result = await handleMessageToolCall(bridge, {
-      action: "reply",
-      channel: "slack",
-      target: "+12069106512",
-      messageId: "853",
-      message: "cross-provider reply",
-    });
-
-    expect(result).toEqual(expectInputText("Sent."));
-    expect(result.terminate).toBeUndefined();
-    expect(bridge.telemetry.didDeliverSourceReplyViaMessageTool).toBe(false);
-  });
-
-  it("does not mark same-target sibling-thread replies as terminal source replies", async () => {
-    const bridge = createBridgeWithToolResult("message", textToolResult("Sent.", { ok: true }), {
-      sourceReplyDeliveryMode: "message_tool_only",
-      currentChannelProvider: "slack",
-      currentChannelId: "slack:C123",
-      currentMessagingTarget: "C123",
-      currentThreadId: "171.222",
-    });
-
-    const result = await handleMessageToolCall(bridge, {
-      action: "reply",
-      channel: "slack",
-      target: "C123",
-      threadId: "171.333",
-      message: "sibling thread reply",
-    });
-
-    expect(result).toEqual(expectInputText("Sent."));
-    expect(result.terminate).toBeUndefined();
-    expect(bridge.telemetry.didDeliverSourceReplyViaMessageTool).toBe(false);
-  });
-
-  it("does not mark implicit-target sibling-thread replies as terminal source replies", async () => {
-    const bridge = createBridgeWithToolResult("message", textToolResult("Sent.", { ok: true }), {
-      sourceReplyDeliveryMode: "message_tool_only",
-      currentChannelProvider: "slack",
-      currentChannelId: "slack:C123",
-      currentMessagingTarget: "C123",
-      currentThreadId: "171.222",
-    });
-
-    const result = await handleMessageToolCall(bridge, {
-      action: "reply",
-      channel: "slack",
-      threadId: "171.333",
-      message: "sibling thread reply",
-    });
-
-    expect(result).toEqual(expectInputText("Sent."));
-    expect(result.terminate).toBeUndefined();
-    expect(bridge.telemetry.didDeliverSourceReplyViaMessageTool).toBe(false);
-  });
-
-  it("does not mark top-level source replies with explicit thread routes as terminal", async () => {
-    const bridge = createBridgeWithToolResult("message", textToolResult("Sent.", { ok: true }), {
-      sourceReplyDeliveryMode: "message_tool_only",
-      currentChannelProvider: "slack",
-      currentChannelId: "slack:C123",
-      currentMessagingTarget: "C123",
-    });
-
-    const result = await handleMessageToolCall(bridge, {
-      action: "reply",
-      channel: "slack",
-      target: "C123",
-      threadId: "171.333",
-      message: "thread reply from top-level source",
-    });
-
-    expect(result).toEqual(expectInputText("Sent."));
-    expect(result.terminate).toBeUndefined();
-    expect(bridge.telemetry.didDeliverSourceReplyViaMessageTool).toBe(false);
-  });
-
-  it("does not let matching reply receipts override explicit non-source routes", async () => {
-    const bridge = createBridgeWithToolResult(
-      "message",
-      textToolResult("Sent.", {
-        ok: true,
-        messageId: "other-chat-message",
-        repliedTo: "provider-guid-853",
-      }),
-      {
-        sourceReplyDeliveryMode: "message_tool_only",
-        currentChannelProvider: "imessage",
-        currentChannelId: "imessage:+12069106512",
-        currentMessagingTarget: "+12069106512",
-        currentMessageId: "provider-guid-853",
-      },
-    );
-
-    const result = await handleMessageToolCall(bridge, {
-      action: "reply",
-      channel: "imessage",
-      target: "other-chat",
-      message: "cross-channel reply",
-    });
-
-    expect(result).toEqual(expectInputText("Sent."));
-    expect(result.terminate).toBeUndefined();
-    expect(bridge.telemetry.didDeliverSourceReplyViaMessageTool).toBe(false);
-  });
-
-  it("does not let provider target aliases override source routes", async () => {
-    setActivePluginRegistry(
-      createTestRegistry([
-        {
-          pluginId: "slack",
-          plugin: {
-            id: "slack",
-            messaging: { normalizeTarget: (raw: string) => raw.trim().toLowerCase() },
-            actions: {
-              messageActionTargetAliases: {
-                reply: {
-                  aliases: ["chatGuid"],
-                  deliveryTargetAliases: ["chatGuid"],
-                },
-              },
-            },
-          },
-          source: "test",
-        },
-      ]),
-    );
-    const bridge = createBridgeWithToolResult("message", textToolResult("Sent.", { ok: true }), {
-      sourceReplyDeliveryMode: "message_tool_only",
-      currentChannelProvider: "slack",
-      currentChannelId: "channel:c1",
-      currentMessagingTarget: "channel:c1",
-      currentMessageId: "provider-guid-854",
-    });
-
-    const result = await handleMessageToolCall(bridge, {
-      action: "reply",
-      channel: "slack",
-      chatGuid: "Channel:C2",
-      messageId: "854",
-      message: "cross-chat reply",
-    });
-
-    expect(result).toEqual(expectInputText("Sent."));
-    expect(bridge.telemetry.messagingToolSentTargets).toEqual([
-      expect.objectContaining({
-        tool: "message",
-        provider: "slack",
-        to: "channel:c2",
-        text: "cross-chat reply",
-      }),
-    ]);
-    expect(result.terminate).toBeUndefined();
-    expect(bridge.telemetry.didDeliverSourceReplyViaMessageTool).toBe(false);
-  });
-
   it("does not record messaging side effects when the send fails", async () => {
     const tool = createTool({
       name: "message",

extensions/codex/src/app-server/dynamic-tools.ts

@@ -18,8 +18,6 @@ import {
   getChannelAgentToolMeta,
   getPluginToolMeta,
   type EmbeddedRunAttemptParams,
-  isDeliveredMessageToolOnlySourceReplyResult,
-  isDeliveredMessagingToolResult,
   isReplaySafeToolCall,
   isToolWrappedWithBeforeToolCallHook,
   isToolResultError,
@@ -65,11 +63,9 @@ type CodexDynamicToolHookContext = {
   currentChannelProvider?: string;
   currentChannelId?: string;
   currentMessagingTarget?: string;
-  currentMessageId?: string | number;
   currentThreadId?: string;
   replyToMode?: "off" | "first" | "all" | "batched";
   hasRepliedRef?: { value: boolean };
-  sourceReplyDeliveryMode?: EmbeddedRunAttemptParams["sourceReplyDeliveryMode"];
   onToolOutcome?: EmbeddedRunAttemptParams["onToolOutcome"];
   allocateToolOutcomeOrdinal?: EmbeddedRunAttemptParams["allocateToolOutcomeOrdinal"];
 };
@@ -104,225 +100,6 @@ function applyCurrentMessageProvider(
   return { ...args, provider };
 }
 
-function normalizeRouteToken(value: string | number | undefined): string | undefined {
-  if (typeof value === "number") {
-    return Number.isFinite(value) ? String(value) : undefined;
-  }
-  const normalized = value?.trim().toLowerCase();
-  return normalized ? normalized : undefined;
-}
-
-function sourceRouteTokens(hookContext: CodexDynamicToolHookContext | undefined): Set<string> {
-  const tokens = new Set<string>();
-  const currentTarget = normalizeRouteToken(hookContext?.currentMessagingTarget);
-  const currentChannel = normalizeRouteToken(hookContext?.currentChannelId);
-  const currentProvider = normalizeRouteToken(hookContext?.currentChannelProvider);
-  if (currentTarget) {
-    tokens.add(currentTarget);
-  }
-  if (currentChannel) {
-    tokens.add(currentChannel);
-  }
-  const channelPrefixIndex = currentChannel?.indexOf(":") ?? -1;
-  if (channelPrefixIndex >= 0 && currentChannel) {
-    const unprefixedChannel = currentChannel.slice(channelPrefixIndex + 1);
-    if (unprefixedChannel) {
-      tokens.add(unprefixedChannel);
-      for (const segment of unprefixedChannel.split(/[;,]/u)) {
-        const token = normalizeRouteToken(segment);
-        if (token) {
-          tokens.add(token);
-        }
-      }
-    }
-  }
-  if (currentProvider && currentChannel?.startsWith(`${currentProvider}:`)) {
-    const unprefixedChannel = currentChannel.slice(currentProvider.length + 1);
-    if (unprefixedChannel) {
-      tokens.add(unprefixedChannel);
-    }
-  }
-  return tokens;
-}
-
-function routeTokenMatchesSource(
-  token: string | undefined,
-  hookContext: CodexDynamicToolHookContext | undefined,
-): boolean {
-  const normalized = normalizeRouteToken(token);
-  return normalized !== undefined && sourceRouteTokens(hookContext).has(normalized);
-}
-
-function routeProviderMatchesSource(
-  provider: string | undefined,
-  hookContext: CodexDynamicToolHookContext | undefined,
-): boolean {
-  const normalized = normalizeRouteToken(provider);
-  if (!normalized) {
-    return false;
-  }
-  const currentProvider = normalizeRouteToken(hookContext?.currentChannelProvider);
-  const currentChannel = normalizeRouteToken(hookContext?.currentChannelId);
-  return currentProvider === normalized || currentChannel?.startsWith(`${normalized}:`) === true;
-}
-
-function routeTokenMatchesCurrentMessage(
-  token: string | number | undefined,
-  hookContext: CodexDynamicToolHookContext | undefined,
-): boolean {
-  const normalized = normalizeRouteToken(token);
-  return (
-    normalized !== undefined && normalized === normalizeRouteToken(hookContext?.currentMessageId)
-  );
-}
-
-function readRouteToken(record: Record<string, unknown>, key: string): string | number | undefined {
-  const value = record[key];
-  return typeof value === "string" || typeof value === "number" ? value : undefined;
-}
-
-function explicitRouteTokensMismatchCurrent(
-  args: Record<string, unknown>,
-  keys: readonly string[],
-  currentToken: string | number | undefined,
-): boolean {
-  const normalizedCurrent = normalizeRouteToken(currentToken);
-  if (!normalizedCurrent) {
-    return false;
-  }
-  return keys.some((key) => {
-    const normalized = normalizeRouteToken(readRouteToken(args, key));
-    return normalized !== undefined && normalized !== normalizedCurrent;
-  });
-}
-
-function explicitThreadRouteTargetsNonSource(
-  args: Record<string, unknown>,
-  hookContext: CodexDynamicToolHookContext | undefined,
-  messagingTarget: MessagingToolSend | undefined,
-): boolean {
-  const normalizedCurrentThread = normalizeRouteToken(hookContext?.currentThreadId);
-  const explicitThreadTokens = [
-    ...EXPLICIT_MESSAGE_THREAD_KEYS.map((key) => normalizeRouteToken(readRouteToken(args, key))),
-    normalizeRouteToken(messagingTarget?.threadId),
-  ].filter((value): value is string => value !== undefined);
-
-  if (explicitThreadTokens.length === 0) {
-    return false;
-  }
-  return (
-    normalizedCurrentThread === undefined ||
-    explicitThreadTokens.some((value) => value !== normalizedCurrentThread)
-  );
-}
-
-function replyReceiptMatchesCurrentMessage(
-  value: unknown,
-  hookContext: CodexDynamicToolHookContext | undefined,
-  depth = 0,
-): boolean {
-  if (depth > 4 || value === null) {
-    return false;
-  }
-  if (typeof value === "string") {
-    const trimmed = value.trim();
-    if (!trimmed || !["{", "["].includes(trimmed[0] ?? "")) {
-      return false;
-    }
-    try {
-      return replyReceiptMatchesCurrentMessage(JSON.parse(trimmed), hookContext, depth + 1);
-    } catch {
-      return false;
-    }
-  }
-  if (typeof value !== "object") {
-    return false;
-  }
-  if (Array.isArray(value)) {
-    return value.some((item) => replyReceiptMatchesCurrentMessage(item, hookContext, depth + 1));
-  }
-  const record = value as Record<string, unknown>;
-  for (const key of ["repliedTo", "replyTo", "replyToId", "replyToIdFull"]) {
-    if (
-      routeTokenMatchesCurrentMessage(
-        typeof record[key] === "string" ? record[key] : undefined,
-        hookContext,
-      )
-    ) {
-      return true;
-    }
-  }
-  for (const key of [
-    "content",
-    "details",
-    "payload",
-    "receipt",
-    "result",
-    "results",
-    "sendResult",
-    "text",
-  ]) {
-    if (replyReceiptMatchesCurrentMessage(record[key], hookContext, depth + 1)) {
-      return true;
-    }
-  }
-  return false;
-}
-
-function hasExplicitNonSourceMessageRoute(
-  args: Record<string, unknown>,
-  hookContext: CodexDynamicToolHookContext | undefined,
-  messagingTarget: MessagingToolSend | undefined,
-): boolean {
-  const currentProvider = normalizeRouteToken(hookContext?.currentChannelProvider);
-  for (const key of EXPLICIT_MESSAGE_PROVIDER_KEYS) {
-    const provider = normalizeRouteToken(typeof args[key] === "string" ? args[key] : undefined);
-    if (
-      provider &&
-      currentProvider !== provider &&
-      !routeProviderMatchesSource(provider, hookContext)
-    ) {
-      return true;
-    }
-  }
-  const targetValues = [
-    ...EXPLICIT_MESSAGE_TARGET_KEYS.map((key) =>
-      typeof args[key] === "string" ? args[key] : undefined,
-    ),
-    ...(Array.isArray(args.targets)
-      ? args.targets.map((value) => (typeof value === "string" ? value : undefined))
-      : []),
-  ].filter((value): value is string => normalizeRouteToken(value) !== undefined);
-  if (explicitThreadRouteTargetsNonSource(args, hookContext, messagingTarget)) {
-    return true;
-  }
-  if (
-    explicitRouteTokensMismatchCurrent(
-      args,
-      EXPLICIT_MESSAGE_REPLY_KEYS,
-      hookContext?.currentMessageId,
-    )
-  ) {
-    return true;
-  }
-  if (
-    messagingTarget?.to !== undefined &&
-    !routeTokenMatchesSource(messagingTarget.to, hookContext)
-  ) {
-    return true;
-  }
-  if (messagingTarget?.to !== undefined) {
-    return false;
-  }
-  if (targetValues.length === 0) {
-    return false;
-  }
-  if (targetValues.some((value) => !routeTokenMatchesSource(value, hookContext))) {
-    return true;
-  }
-  return false;
-}
-
 /** Runtime bridge returned to Codex app-server attempt code. */
 export type CodexDynamicToolBridge = {
   availableSpecs: CodexDynamicToolSpec[];
@@ -337,7 +114,6 @@ export type CodexDynamicToolBridge = {
   ) => Promise<CodexDynamicToolCallResponse>;
   telemetry: {
     didSendViaMessagingTool: boolean;
-    didDeliverSourceReplyViaMessageTool: boolean;
     messagingToolSentTexts: string[];
     messagingToolSentMediaUrls: string[];
     messagingToolSentTargets: MessagingToolSend[];
@@ -356,10 +132,6 @@ export const CODEX_OPENCLAW_DYNAMIC_TOOL_NAMESPACE = "openclaw";
 // Keep OpenClaw session spawning searchable in Codex mode so Codex's native
 // spawn_agent remains the primary Codex subagent surface.
 const ALWAYS_DIRECT_DYNAMIC_TOOL_NAMES = new Set(["sessions_yield"]);
-const EXPLICIT_MESSAGE_PROVIDER_KEYS = ["channel", "provider"];
-const EXPLICIT_MESSAGE_TARGET_KEYS = ["target", "to", "channelId"];
-const EXPLICIT_MESSAGE_THREAD_KEYS = ["threadId", "thread_id", "messageThreadId", "topicId"];
-const EXPLICIT_MESSAGE_REPLY_KEYS = ["replyTo", "replyToId", "replyToIdFull"];
 const DEFAULT_CODEX_DYNAMIC_TOOL_RESULT_MAX_CHARS = 16_000;
 
 /**
@@ -404,7 +176,6 @@ export function createCodexDynamicToolBridge(params: {
   emitQuarantinedDynamicToolDiagnostics(quarantinedTools, params.hookContext);
   const telemetry: CodexDynamicToolBridge["telemetry"] = {
     didSendViaMessagingTool: false,
-    didDeliverSourceReplyViaMessageTool: false,
     messagingToolSentTexts: [],
     messagingToolSentMediaUrls: [],
     messagingToolSentTargets: [],
@@ -562,9 +333,10 @@ export function createCodexDynamicToolBridge(params: {
           executedArgs,
           params.hookContext?.currentChannelProvider,
         );
-        const messagingTarget = isMessagingTool(toolName)
-          ? extractMessagingToolSend(toolName, messagingTelemetryArgs, messagingContext)
-          : undefined;
+        const messagingTarget =
+          isMessagingTool(toolName) && isMessagingToolSendAction(toolName, executedArgs)
+            ? extractMessagingToolSend(toolName, messagingTelemetryArgs, messagingContext)
+            : undefined;
         const confirmedMessagingTarget =
           !rawIsError && messagingTarget
             ? extractMessagingToolSendResult(messagingTarget, telemetryRawResult)
@@ -586,53 +358,12 @@ export function createCodexDynamicToolBridge(params: {
           },
           terminalType,
         );
-        const blocksSourceReplyTermination = hasExplicitNonSourceMessageRoute(
-          executedArgs,
-          params.hookContext,
-          confirmedMessagingTarget,
-        );
-        const deliveredSourceReply = isDeliveredMessageToolOnlySourceReplyResult({
-          sourceReplyDeliveryMode: params.hookContext?.sourceReplyDeliveryMode,
-          toolName,
-          args: executedArgs,
-          result,
-          hookResult: rawResult,
-          isError: resultIsError,
-          allowExplicitSourceRoute: !blocksSourceReplyTermination,
-        });
-        const receiptConfirmedSourceReply =
-          params.hookContext?.sourceReplyDeliveryMode === "message_tool_only" &&
-          toolName === "message" &&
-          normalizeRouteToken(
-            typeof executedArgs.action === "string" ? executedArgs.action : undefined,
-          ) === "reply" &&
-          !resultIsError &&
-          !blocksSourceReplyTermination &&
-          isDeliveredMessagingToolResult({
-            toolName,
-            args: executedArgs,
-            result,
-            hookResult: rawResult,
-            isError: resultIsError,
-          }) &&
-          (replyReceiptMatchesCurrentMessage(rawResult, params.hookContext) ||
-            replyReceiptMatchesCurrentMessage(result, params.hookContext));
-        const toolConfirmedSourceReply =
-          params.hookContext?.sourceReplyDeliveryMode === "message_tool_only" &&
-          toolName === "message" &&
-          !resultIsError &&
-          (rawResult.terminate === true || result.terminate === true);
-        if (deliveredSourceReply || receiptConfirmedSourceReply || toolConfirmedSourceReply) {
-          telemetry.didDeliverSourceReplyViaMessageTool = true;
-        }
         withDynamicToolTermination(
           response,
           rawResult.terminate === true ||
             result.terminate === true ||
             isToolResultYield(rawResult) ||
-            isToolResultYield(result) ||
-            deliveredSourceReply ||
-            receiptConfirmedSourceReply,
+            isToolResultYield(result),
         );
         const asyncStarted =
           isAsyncStartedToolResult(rawResult) || isAsyncStartedToolResult(result);
@@ -1070,22 +801,9 @@ function collectToolTelemetry(params: {
       }
     }
   }
-  if (!isMessagingTool(params.toolName)) {
-    return;
-  }
-  const isMessagingSendAction = isMessagingToolSendAction(params.toolName, params.args);
-  if (!isMessagingSendAction && !params.messagingTarget) {
-    return;
-  }
   if (
-    !isMessagingSendAction &&
-    !isDeliveredMessagingToolResult({
-      toolName: params.toolName,
-      args: params.args,
-      result: params.result,
-      hookResult: params.mediaTrustResult,
-      isError: params.isError,
-    })
+    !isMessagingTool(params.toolName) ||
+    !isMessagingToolSendAction(params.toolName, params.args)
   ) {
     return;
   }

extensions/codex/src/app-server/elicitation-bridge.test.ts

@@ -157,7 +157,7 @@ function buildConnectorPluginApprovalElicitation(overrides: Record<string, unkno
 function createPluginAppPolicyContext(
   params: {
     allowDestructiveActions?: boolean;
-    destructiveApprovalMode?: "allow" | "deny" | "auto" | "always";
+    destructiveApprovalMode?: "allow" | "deny" | "auto";
     apps?: Array<{ appId: string; pluginName: string; mcpServerNames: string[] }>;
   } = {},
 ) {
@@ -1017,96 +1017,6 @@ describe("Codex app-server elicitation bridge", () => {
     });
   });
 
-  it("does not expose allow-always for always plugin policy", async () => {
-    mockCallGatewayTool
-      .mockResolvedValueOnce({ id: "plugin:approval-calendar-always-policy", status: "accepted" })
-      .mockResolvedValueOnce({
-        id: "plugin:approval-calendar-always-policy",
-        decision: "allow-once",
-      });
-
-    const result = await handleCodexAppServerElicitationRequest({
-      requestParams: buildConnectorPluginApprovalElicitation({
-        _meta: {
-          codex_approval_kind: "mcp_tool_call",
-          source: "connector",
-          connector_id: "connector_google_calendar",
-          connector_name: "Google Calendar",
-          persist: ["session", "always"],
-          tool_title: "create_event",
-        },
-      }),
-      paramsForRun: createParams(),
-      threadId: "thread-1",
-      turnId: "turn-1",
-      pluginAppPolicyContext: createPluginAppPolicyContext({
-        allowDestructiveActions: true,
-        destructiveApprovalMode: "always",
-        apps: [
-          {
-            appId: "connector_google_calendar",
-            pluginName: "google-calendar",
-            mcpServerNames: [],
-          },
-        ],
-      }),
-    });
-
-    expect(result).toEqual({
-      action: "accept",
-      content: null,
-      _meta: null,
-    });
-    expect(gatewayToolArg(0, 2)).toMatchObject({
-      allowedDecisions: ["allow-once", "deny"],
-    });
-  });
-
-  it("maps unexpected allow-always decisions to one-shot for always plugin policy", async () => {
-    mockCallGatewayTool
-      .mockResolvedValueOnce({
-        id: "plugin:approval-calendar-unexpected-always",
-        status: "accepted",
-      })
-      .mockResolvedValueOnce({
-        id: "plugin:approval-calendar-unexpected-always",
-        decision: "allow-always",
-      });
-
-    const result = await handleCodexAppServerElicitationRequest({
-      requestParams: buildConnectorPluginApprovalElicitation({
-        _meta: {
-          codex_approval_kind: "mcp_tool_call",
-          source: "connector",
-          connector_id: "connector_google_calendar",
-          connector_name: "Google Calendar",
-          persist: ["session", "always"],
-          tool_title: "create_event",
-        },
-      }),
-      paramsForRun: createParams(),
-      threadId: "thread-1",
-      turnId: "turn-1",
-      pluginAppPolicyContext: createPluginAppPolicyContext({
-        allowDestructiveActions: true,
-        destructiveApprovalMode: "always",
-        apps: [
-          {
-            appId: "connector_google_calendar",
-            pluginName: "google-calendar",
-            mcpServerNames: [],
-          },
-        ],
-      }),
-    });
-
-    expect(result).toEqual({
-      action: "accept",
-      content: null,
-      _meta: null,
-    });
-  });
-
   it("declines denied auto plugin app approvals", async () => {
     mockCallGatewayTool
       .mockResolvedValueOnce({ id: "plugin:approval-calendar-deny", status: "accepted" })

extensions/codex/src/app-server/elicitation-bridge.ts

@@ -318,13 +318,10 @@ async function buildPluginPolicyElicitationResponse(params: {
       paramsForRun: params.paramsForRun,
       title: approvalPrompt.title,
       description: approvalPrompt.description,
-      allowedDecisions: allowedPluginPolicyApprovalDecisions(mode, approvalPrompt),
+      allowedDecisions: approvalPrompt.allowedDecisions,
       signal: params.signal,
     });
-    return buildElicitationResponse(
-      approvalPrompt,
-      oneShotPluginPolicyApprovalOutcome(mode, outcome),
-    );
+    return buildElicitationResponse(approvalPrompt, outcome);
   }
   logPluginElicitationDecline("unmappable_schema", params.requestParams);
   return declineElicitationResponse();
@@ -332,28 +329,10 @@ async function buildPluginPolicyElicitationResponse(params: {
 
 function resolvePluginDestructiveApprovalMode(
   entry: PluginAppPolicyContextEntry,
-): "allow" | "deny" | "auto" | "always" {
+): "allow" | "deny" | "auto" {
   return entry.destructiveApprovalMode ?? (entry.allowDestructiveActions ? "allow" : "deny");
 }
 
-function allowedPluginPolicyApprovalDecisions(
-  mode: "allow" | "deny" | "auto" | "always",
-  approvalPrompt: BridgeableApprovalElicitation,
-): ExecApprovalDecision[] {
-  const allowedDecisions = approvalPrompt.allowedDecisions ?? ["allow-once", "deny"];
-  if (mode !== "always") {
-    return allowedDecisions;
-  }
-  return allowedDecisions.filter((decision) => decision !== "allow-always");
-}
-
-function oneShotPluginPolicyApprovalOutcome(
-  mode: "allow" | "deny" | "auto" | "always",
-  outcome: AppServerApprovalOutcome,
-): AppServerApprovalOutcome {
-  return mode === "always" && outcome === "approved-session" ? "approved-once" : outcome;
-}
-
 function readPluginApprovalElicitation(
   entry: PluginAppPolicyContextEntry,
   requestParams: JsonObject,

extensions/codex/src/app-server/event-projector.test.ts

@@ -836,19 +836,6 @@ describe("CodexAppServerEventProjector", () => {
     expect(result.toolMediaUrls).toStrictEqual([]);
   });
 
-  it("propagates message-tool-only source reply delivery telemetry", async () => {
-    const projector = await createProjector();
-
-    const result = projector.buildResult({
-      ...buildEmptyToolTelemetry(),
-      didSendViaMessagingTool: true,
-      didDeliverSourceReplyViaMessageTool: true,
-    });
-
-    expect(result.didSendViaMessagingTool).toBe(true);
-    expect(result.didDeliverSourceReplyViaMessageTool).toBe(true);
-  });
-
   it("does not promote repeated tool progress text to the final assistant reply", async () => {
     const onToolResult = vi.fn();
     const projector = await createProjector({

extensions/codex/src/app-server/event-projector.ts

@@ -53,7 +53,6 @@ import { attachCodexMirrorIdentity, buildCodexUserPromptMessage } from "./transc
 
 export type CodexAppServerToolTelemetry = {
   didSendViaMessagingTool: boolean;
-  didDeliverSourceReplyViaMessageTool?: boolean;
   messagingToolSentTexts: string[];
   messagingToolSentMediaUrls: string[];
   messagingToolSentTargets: MessagingToolSend[];
@@ -412,8 +411,6 @@ export class CodexAppServerEventProjector {
       currentAttemptAssistant,
       ...(this.lastNativeToolError ? { lastToolError: this.lastNativeToolError } : {}),
       didSendViaMessagingTool: toolTelemetry.didSendViaMessagingTool,
-      didDeliverSourceReplyViaMessageTool:
-        toolTelemetry.didDeliverSourceReplyViaMessageTool === true,
       messagingToolSentTexts: toolTelemetry.messagingToolSentTexts,
       messagingToolSentMediaUrls: toolTelemetry.messagingToolSentMediaUrls,
       messagingToolSentTargets: toolTelemetry.messagingToolSentTargets,

extensions/codex/src/app-server/plugin-thread-config.test.ts

@@ -170,379 +170,6 @@ describe("Codex plugin thread config", () => {
     });
   });
 
-  it("exposes destructive app access while clearing only durable approval overrides for always mode", async () => {
-    const appCache = new CodexAppInventoryCache();
-    await appCache.refreshNow({
-      key: "runtime",
-      nowMs: 0,
-      request: async () => ({
-        data: [appInfo("google-calendar-app", true)],
-        nextCursor: null,
-      }),
-    });
-    let configReadCount = 0;
-    const request = vi.fn(async (method: string) => {
-      if (method === "plugin/list") {
-        return pluginList([pluginSummary("google-calendar", { installed: true, enabled: true })]);
-      }
-      if (method === "plugin/read") {
-        return pluginDetail(
-          "google-calendar",
-          [appSummary("google-calendar-app")],
-          ["google-calendar"],
-        );
-      }
-      if (method === "config/read") {
-        configReadCount += 1;
-        if (configReadCount > 1) {
-          return {
-            config: {
-              apps: {
-                "google-calendar-app": {
-                  tools: {
-                    "calendar/read": {
-                      enabled: false,
-                    },
-                  },
-                },
-              },
-            },
-          };
-        }
-        return {
-          config: {
-            apps: {
-              "google-calendar-app": {
-                tools: {
-                  "calendar/create": {
-                    approval_mode: "approve",
-                    enabled: false,
-                  },
-                  "calendar/read": {
-                    enabled: false,
-                  },
-                  "calendar/update": {
-                    approvalMode: "approve",
-                  },
-                },
-              },
-            },
-          },
-        };
-      }
-      if (method === "config/value/write") {
-        return {};
-      }
-      throw new Error(`unexpected request ${method}`);
-    });
-
-    const config = await buildCodexPluginThreadConfig({
-      pluginConfig: {
-        codexPlugins: {
-          enabled: true,
-          allow_destructive_actions: "always",
-          plugins: {
-            "google-calendar": {
-              marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
-              pluginName: "google-calendar",
-            },
-          },
-        },
-      },
-      appCache,
-      appCacheKey: "runtime",
-      nowMs: 1,
-      request,
-    });
-
-    const apps = config.configPatch?.apps as Record<string, unknown> | undefined;
-    expect(apps?.["google-calendar-app"]).toEqual({
-      enabled: true,
-      destructive_enabled: true,
-      open_world_enabled: true,
-      default_tools_approval_mode: "auto",
-    });
-    expect(config.policyContext.apps["google-calendar-app"]).toMatchObject({
-      allowDestructiveActions: true,
-      destructiveApprovalMode: "always",
-    });
-    expect(request).toHaveBeenCalledWith("config/read", { includeLayers: false });
-    expect(request.mock.calls.filter(([method]) => method === "config/read")).toHaveLength(2);
-    expect(request).toHaveBeenCalledWith("config/value/write", {
-      keyPath: 'apps."google-calendar-app".tools."calendar/create".approval_mode',
-      value: null,
-      mergeStrategy: "replace",
-    });
-    expect(request).toHaveBeenCalledWith("config/value/write", {
-      keyPath: 'apps."google-calendar-app".tools."calendar/update".approval_mode',
-      value: null,
-      mergeStrategy: "replace",
-    });
-    expect(request).not.toHaveBeenCalledWith("config/value/write", {
-      keyPath: 'apps."google-calendar-app".tools',
-      value: null,
-      mergeStrategy: "replace",
-    });
-  });
-
-  it("omits always policy apps when cwd effective approval overrides remain after cleanup", async () => {
-    const appCache = new CodexAppInventoryCache();
-    await appCache.refreshNow({
-      key: "runtime",
-      nowMs: 0,
-      request: async () => ({
-        data: [appInfo("google-calendar-app", true)],
-        nextCursor: null,
-      }),
-    });
-    let configReadCount = 0;
-    const request = vi.fn(async (method: string) => {
-      if (method === "plugin/list") {
-        return pluginList([pluginSummary("google-calendar", { installed: true, enabled: true })]);
-      }
-      if (method === "plugin/read") {
-        return pluginDetail(
-          "google-calendar",
-          [appSummary("google-calendar-app")],
-          ["google-calendar"],
-        );
-      }
-      if (method === "config/read") {
-        configReadCount += 1;
-        return {
-          config: {
-            apps: {
-              "google-calendar-app": {
-                tools: {
-                  "calendar/create": {
-                    approval_mode: "approve",
-                    source: configReadCount === 1 ? "user" : "project",
-                  },
-                },
-              },
-            },
-          },
-        };
-      }
-      if (method === "config/value/write") {
-        return { status: "ok" };
-      }
-      throw new Error(`unexpected request ${method}`);
-    });
-
-    const config = await buildCodexPluginThreadConfig({
-      pluginConfig: {
-        codexPlugins: {
-          enabled: true,
-          allow_destructive_actions: "always",
-          plugins: {
-            "google-calendar": {
-              marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
-              pluginName: "google-calendar",
-            },
-          },
-        },
-      },
-      appCache,
-      appCacheKey: "runtime",
-      configCwd: "/repo/project",
-      nowMs: 1,
-      request,
-    });
-
-    expect(config.configPatch).toEqual({
-      apps: {
-        _default: {
-          enabled: false,
-          destructive_enabled: false,
-          open_world_enabled: false,
-        },
-      },
-    });
-    expect(config.policyContext.apps).toStrictEqual({});
-    expect(request).toHaveBeenCalledWith("config/read", {
-      includeLayers: false,
-      cwd: "/repo/project",
-    });
-    expect(request.mock.calls.filter(([method]) => method === "config/read")).toHaveLength(2);
-    expect(config.diagnostics).toStrictEqual([
-      {
-        code: "approval_overrides_clear_failed",
-        plugin: {
-          configKey: "google-calendar",
-          marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
-          pluginName: "google-calendar",
-          enabled: true,
-          allowDestructiveActions: true,
-          destructiveApprovalMode: "always",
-        },
-        message:
-          "Could not clear durable Codex app approval overrides for google-calendar-app: effective approval overrides remain for calendar/create",
-      },
-    ]);
-  });
-
-  it("omits always policy apps when approval override writes are overridden", async () => {
-    const appCache = new CodexAppInventoryCache();
-    await appCache.refreshNow({
-      key: "runtime",
-      nowMs: 0,
-      request: async () => ({
-        data: [appInfo("google-calendar-app", true)],
-        nextCursor: null,
-      }),
-    });
-    const request = vi.fn(async (method: string) => {
-      if (method === "plugin/list") {
-        return pluginList([pluginSummary("google-calendar", { installed: true, enabled: true })]);
-      }
-      if (method === "plugin/read") {
-        return pluginDetail(
-          "google-calendar",
-          [appSummary("google-calendar-app")],
-          ["google-calendar"],
-        );
-      }
-      if (method === "config/read") {
-        return {
-          config: {
-            apps: {
-              "google-calendar-app": {
-                tools: {
-                  "calendar/create": {
-                    approval_mode: "approve",
-                  },
-                },
-              },
-            },
-          },
-        };
-      }
-      if (method === "config/value/write") {
-        return { status: "okOverridden" };
-      }
-      throw new Error(`unexpected request ${method}`);
-    });
-
-    const config = await buildCodexPluginThreadConfig({
-      pluginConfig: {
-        codexPlugins: {
-          enabled: true,
-          allow_destructive_actions: "always",
-          plugins: {
-            "google-calendar": {
-              marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
-              pluginName: "google-calendar",
-            },
-          },
-        },
-      },
-      appCache,
-      appCacheKey: "runtime",
-      configCwd: "/repo/project",
-      nowMs: 1,
-      request,
-    });
-
-    expect(config.configPatch).toEqual({
-      apps: {
-        _default: {
-          enabled: false,
-          destructive_enabled: false,
-          open_world_enabled: false,
-        },
-      },
-    });
-    expect(config.policyContext.apps).toStrictEqual({});
-    expect(config.diagnostics).toStrictEqual([
-      {
-        code: "approval_overrides_clear_failed",
-        plugin: {
-          configKey: "google-calendar",
-          marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
-          pluginName: "google-calendar",
-          enabled: true,
-          allowDestructiveActions: true,
-          destructiveApprovalMode: "always",
-        },
-        message:
-          "Could not clear durable Codex app approval overrides for google-calendar-app: approval override for calendar/create is controlled by another config layer",
-      },
-    ]);
-  });
-
-  it("omits always policy apps when durable approval override cleanup fails", async () => {
-    const appCache = new CodexAppInventoryCache();
-    await appCache.refreshNow({
-      key: "runtime",
-      nowMs: 0,
-      request: async () => ({
-        data: [appInfo("google-calendar-app", true)],
-        nextCursor: null,
-      }),
-    });
-
-    const config = await buildCodexPluginThreadConfig({
-      pluginConfig: {
-        codexPlugins: {
-          enabled: true,
-          allow_destructive_actions: "always",
-          plugins: {
-            "google-calendar": {
-              marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
-              pluginName: "google-calendar",
-            },
-          },
-        },
-      },
-      appCache,
-      appCacheKey: "runtime",
-      nowMs: 1,
-      request: async (method) => {
-        if (method === "plugin/list") {
-          return pluginList([pluginSummary("google-calendar", { installed: true, enabled: true })]);
-        }
-        if (method === "plugin/read") {
-          return pluginDetail(
-            "google-calendar",
-            [appSummary("google-calendar-app")],
-            ["google-calendar"],
-          );
-        }
-        if (method === "config/read") {
-          throw new Error("readonly config");
-        }
-        throw new Error(`unexpected request ${method}`);
-      },
-    });
-
-    expect(config.configPatch).toEqual({
-      apps: {
-        _default: {
-          enabled: false,
-          destructive_enabled: false,
-          open_world_enabled: false,
-        },
-      },
-    });
-    expect(config.policyContext.apps).toStrictEqual({});
-    expect(config.diagnostics).toStrictEqual([
-      {
-        code: "approval_overrides_clear_failed",
-        plugin: {
-          configKey: "google-calendar",
-          marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
-          pluginName: "google-calendar",
-          enabled: true,
-          allowDestructiveActions: true,
-          destructiveApprovalMode: "always",
-        },
-        message:
-          "Could not clear durable Codex app approval overrides for google-calendar-app: readonly config",
-      },
-    ]);
-  });
-
   it("builds a restrictive app config when native plugin support is disabled", async () => {
     expect(
       shouldBuildCodexPluginThreadConfig({

extensions/codex/src/app-server/plugin-thread-config.ts

@@ -29,7 +29,7 @@ import {
   type CodexPluginOwnedApp,
   type CodexPluginRuntimeRequest,
 } from "./plugin-inventory.js";
-import { isJsonObject, type JsonObject, type JsonValue } from "./protocol.js";
+import type { JsonObject, JsonValue } from "./protocol.js";
 
 /** Policy context for one app id exposed by a configured Codex plugin. */
 export type PluginAppPolicyContextEntry = {
@@ -52,7 +52,7 @@ export type PluginAppPolicyContext = {
 export type CodexPluginThreadConfigDiagnostic =
   | CodexPluginInventoryDiagnostic
   | {
-      code: "plugin_activation_failed" | "app_not_ready" | "approval_overrides_clear_failed";
+      code: "plugin_activation_failed" | "app_not_ready";
       plugin?: ResolvedCodexPluginPolicy;
       message: string;
     };
@@ -72,7 +72,6 @@ export type CodexPluginThreadConfig = {
 export type BuildCodexPluginThreadConfigParams = {
   pluginConfig?: unknown;
   request: CodexPluginRuntimeRequest;
-  configCwd?: string;
   appCache?: CodexAppInventoryCache;
   appCacheKey: string;
   nowMs?: number;
@@ -251,18 +250,6 @@ export async function buildCodexPluginThreadConfig(
         });
         continue;
       }
-      if (
-        record.policy.destructiveApprovalMode === "always" &&
-        !(await clearPersistedAppToolApprovalOverrides({
-          request: params.request,
-          configCwd: params.configCwd,
-          plugin: record.policy,
-          app,
-          diagnostics,
-        }))
-      ) {
-        continue;
-      }
       const appConfig: JsonObject = {
         enabled: true,
         destructive_enabled: record.policy.allowDestructiveActions,
@@ -380,86 +367,6 @@ function buildPluginAppPolicyContext(
   };
 }
 
-async function clearPersistedAppToolApprovalOverrides(params: {
-  request: CodexPluginRuntimeRequest;
-  configCwd?: string;
-  plugin: ResolvedCodexPluginPolicy;
-  app: CodexPluginOwnedApp;
-  diagnostics: CodexPluginThreadConfigDiagnostic[];
-}): Promise<boolean> {
-  try {
-    const overrideNames = await readPersistedAppToolApprovalOverrideNames(params);
-    for (const toolName of overrideNames) {
-      const response = await params.request("config/value/write", {
-        keyPath: `apps.${quoteConfigKeyPathSegment(params.app.id)}.tools.${quoteConfigKeyPathSegment(
-          toolName,
-        )}.approval_mode`,
-        value: null,
-        mergeStrategy: "replace",
-      });
-      if (isOverriddenConfigWriteResponse(response)) {
-        throw new Error(`approval override for ${toolName} is controlled by another config layer`);
-      }
-    }
-    const remainingOverrideNames = await readPersistedAppToolApprovalOverrideNames(params);
-    if (remainingOverrideNames.length > 0) {
-      throw new Error(
-        `effective approval overrides remain for ${remainingOverrideNames.join(", ")}`,
-      );
-    }
-    return true;
-  } catch (error) {
-    params.diagnostics.push({
-      code: "approval_overrides_clear_failed",
-      plugin: params.plugin,
-      message: `Could not clear durable Codex app approval overrides for ${params.app.id}: ${
-        error instanceof Error ? error.message : String(error)
-      }`,
-    });
-    return false;
-  }
-}
-
-async function readPersistedAppToolApprovalOverrideNames(params: {
-  request: CodexPluginRuntimeRequest;
-  configCwd?: string;
-  app: CodexPluginOwnedApp;
-}): Promise<string[]> {
-  const response = await params.request("config/read", {
-    includeLayers: false,
-    ...(params.configCwd ? { cwd: params.configCwd } : {}),
-  });
-  const config = isJsonObject(response) ? response.config : undefined;
-  const appsRoot = isJsonObject(config) ? config.apps : undefined;
-  const nestedApps = isJsonObject(appsRoot) ? appsRoot.apps : undefined;
-  const appConfig = isJsonObject(appsRoot)
-    ? (appsRoot[params.app.id] ??
-      (isJsonObject(nestedApps) ? nestedApps[params.app.id] : undefined))
-    : undefined;
-  const tools = isJsonObject(appConfig) ? appConfig.tools : undefined;
-  if (!isJsonObject(tools)) {
-    return [];
-  }
-  return Object.entries(tools)
-    .filter(([, value]) => hasPersistedToolApprovalOverride(value))
-    .map(([toolName]) => toolName)
-    .toSorted();
-}
-
-function hasPersistedToolApprovalOverride(value: JsonValue): boolean {
-  return (
-    isJsonObject(value) && (value.approval_mode !== undefined || value.approvalMode !== undefined)
-  );
-}
-
-function isOverriddenConfigWriteResponse(response: unknown): boolean {
-  return isJsonObject(response) && response.status === "okOverridden";
-}
-
-function quoteConfigKeyPathSegment(segment: string): string {
-  return `"${segment.replace(/["\\]/g, (char) => `\\${char}`)}"`;
-}
-
 function shouldWaitForInitialAppInventory(
   params: BuildCodexPluginThreadConfigParams,
   policy: ResolvedCodexPluginsPolicy,

extensions/codex/src/app-server/protocol.ts

@@ -575,8 +575,6 @@ type CodexAppServerRequestResultMap = {
   "account/read": CodexGetAccountResponse;
   "app/list": CodexAppsListResponse;
   "config/mcpServer/reload": JsonValue;
-  "config/read": JsonValue;
-  "config/value/write": JsonValue;
   "environment/add": JsonValue;
   "experimentalFeature/enablement/set": JsonValue;
   "feedback/upload": JsonValue;

extensions/codex/src/app-server/request.test.ts

@@ -112,44 +112,6 @@ describe("requestCodexAppServerJson sandbox guard", () => {
     expect(request).toHaveBeenCalledWith("thread/list", { limit: 10 }, { timeoutMs: 60_000 });
   });
 
-  it("allows config value writes in sandboxed sessions", async () => {
-    const request = vi.fn(async () => ({ ok: true }));
-    sharedClientMocks.getSharedCodexAppServerClient.mockResolvedValue({ request });
-    const params = {
-      keyPath: 'apps."google-calendar-app".tools',
-      value: null,
-      mergeStrategy: "replace",
-    };
-
-    await expect(
-      requestCodexAppServerJson({
-        method: "config/value/write",
-        requestParams: params,
-        config: { agents: { defaults: { sandbox: { mode: "all" } } } },
-        sessionKey: "sandboxed-session",
-      }),
-    ).resolves.toEqual({ ok: true });
-
-    expect(request).toHaveBeenCalledWith("config/value/write", params, { timeoutMs: 60_000 });
-  });
-
-  it("allows config reads in sandboxed sessions", async () => {
-    const request = vi.fn(async () => ({ config: { apps: { apps: {} } } }));
-    sharedClientMocks.getSharedCodexAppServerClient.mockResolvedValue({ request });
-    const params = { includeLayers: false };
-
-    await expect(
-      requestCodexAppServerJson({
-        method: "config/read",
-        requestParams: params,
-        config: { agents: { defaults: { sandbox: { mode: "all" } } } },
-        sessionKey: "sandboxed-session",
-      }),
-    ).resolves.toEqual({ config: { apps: { apps: {} } } });
-
-    expect(request).toHaveBeenCalledWith("config/read", params, { timeoutMs: 60_000 });
-  });
-
   it("allows sandbox-pinned thread starts in sandboxed sessions", async () => {
     const request = vi.fn(async () => ({ thread: { id: "thread-1" }, model: "gpt-5.5" }));
     sharedClientMocks.getSharedCodexAppServerClient.mockResolvedValue({ request });

extensions/codex/src/app-server/run-attempt.ts

@@ -841,11 +841,9 @@ export async function runCodexAppServerAttempt(
       currentChannelProvider: resolveCodexMessageToolProvider(params),
       currentChannelId: params.currentChannelId,
       currentMessagingTarget: params.currentMessagingTarget,
-      currentMessageId: params.currentMessageId,
       currentThreadId: params.currentThreadTs,
       replyToMode: params.replyToMode,
       hasRepliedRef: params.hasRepliedRef,
-      sourceReplyDeliveryMode: params.sourceReplyDeliveryMode,
       onToolOutcome: onCodexToolOutcome,
       allocateToolOutcomeOrdinal: allocateCodexToolOutcomeOrdinal,
     },
@@ -1580,7 +1578,6 @@ export async function runCodexAppServerAttempt(
   let activeAppServerTurnRequests = 0;
   const pendingOpenClawDynamicToolCompletionIds = new Set<string>();
   const activeTurnItemIds = new Set<string>();
-  const activeCompletionBlockerItemIds = new Set<string>();
   let turnCrossedToolHandoff = false;
   let pendingTerminalDynamicToolRelease:
     | {
@@ -1630,7 +1627,6 @@ export async function runCodexAppServerAttempt(
     isTerminalTurnNotificationQueued: () => terminalTurnNotificationQueued,
     getActiveAppServerTurnRequests: () => activeAppServerTurnRequests,
     getActiveTurnItemCount: () => activeTurnItemIds.size,
-    getActiveCompletionBlockerItemCount: () => activeCompletionBlockerItemIds.size,
     turnCompletionIdleTimeoutMs,
     turnAssistantCompletionIdleTimeoutMs,
     turnAttemptIdleTimeoutMs,
@@ -1903,7 +1899,6 @@ export async function runCodexAppServerAttempt(
       currentPromptTexts: [codexTurnPromptText],
       turnWatches,
       activeTurnItemIds,
-      activeCompletionBlockerItemIds,
       activeAppServerTurnRequests,
       pendingOpenClawDynamicToolCompletionIds,
       turnCrossedToolHandoff,

extensions/codex/src/app-server/run-attempt.turn-watches.test.ts

@@ -49,7 +49,9 @@ const DISABLED_CODEX_WEB_SEARCH_THREAD_CONFIG_FINGERPRINT = JSON.stringify({
   web_search: "disabled",
 });
 
-function writeCodexAppServerBinding(...args: Parameters<typeof writeRawCodexAppServerBinding>) {
+function writeCodexAppServerBinding(
+  ...args: Parameters<typeof writeRawCodexAppServerBinding>
+) {
   const [sessionFile, binding, lookup] = args;
   return writeRawCodexAppServerBinding(
     sessionFile,
@@ -76,7 +78,6 @@ describe("createCodexAttemptTurnWatchController", () => {
       isTerminalTurnNotificationQueued: () => false,
       getActiveAppServerTurnRequests: () => 0,
       getActiveTurnItemCount: () => 0,
-      getActiveCompletionBlockerItemCount: () => 0,
       turnCompletionIdleTimeoutMs: 500,
       turnAssistantCompletionIdleTimeoutMs: 500,
       turnAttemptIdleTimeoutMs: 200,
@@ -806,93 +807,6 @@ describe("runCodexAppServerAttempt turn watches", () => {
     expect(result.promptError).toBeNull();
   });
 
-  it("keeps an eliciting MCP tool active past the completion timeout", async () => {
-    const harness = createStartedThreadHarness();
-    const bridgedResponse = {
-      action: "accept",
-      content: null,
-      _meta: null,
-    } as const;
-    vi.spyOn(elicitationBridge, "handleCodexAppServerElicitationRequest").mockResolvedValue(
-      bridgedResponse,
-    );
-    const params = createParams(
-      path.join(tempDir, "session-mcp-elicitation.jsonl"),
-      path.join(tempDir, "workspace-mcp-elicitation"),
-    );
-    params.timeoutMs = 500;
-
-    let settled = false;
-    const run = runCodexAppServerAttempt(params, {
-      turnCompletionIdleTimeoutMs: 15,
-      turnAssistantCompletionIdleTimeoutMs: 1_000,
-      turnTerminalIdleTimeoutMs: 1_000,
-    }).finally(() => {
-      settled = true;
-    });
-    await harness.waitForMethod("turn/start");
-    await harness.notify({
-      method: "item/started",
-      params: {
-        threadId: "thread-1",
-        turnId: "turn-1",
-        item: {
-          id: "mcp-1",
-          type: "mcpToolCall",
-          server: "computer-use",
-          tool: "computer",
-          status: "inProgress",
-          arguments: {},
-        },
-      },
-    });
-
-    await expect(
-      harness.handleServerRequest({
-        id: "request-mcp-elicitation",
-        method: "mcpServer/elicitation/request",
-        params: {
-          threadId: "thread-1",
-          turnId: "turn-1",
-          mode: "form",
-          message: "Approve?",
-          requestedSchema: { type: "object", properties: {} },
-          serverName: "computer-use",
-          _meta: null,
-        },
-      }),
-    ).resolves.toEqual(bridgedResponse);
-
-    await new Promise((resolve) => {
-      setTimeout(resolve, 40);
-    });
-    expect(settled).toBe(false);
-    expect(harness.request.mock.calls.some(([method]) => method === "turn/interrupt")).toBe(false);
-
-    await harness.notify({
-      method: "item/completed",
-      params: {
-        threadId: "thread-1",
-        turnId: "turn-1",
-        item: {
-          id: "mcp-1",
-          type: "mcpToolCall",
-          server: "computer-use",
-          tool: "computer",
-          status: "completed",
-          arguments: {},
-          result: { content: [] },
-        },
-      },
-    });
-    await harness.completeTurn({ threadId: "thread-1", turnId: "turn-1" });
-
-    const result = await run;
-    expect(result.aborted).toBe(false);
-    expect(result.timedOut).toBe(false);
-    expect(result.promptError).toBeNull();
-  });
-
   it("counts pending user input requests as turn attempt progress", async () => {
     const harness = createStartedThreadHarness();
     const params = createParams(

extensions/codex/src/app-server/sandbox-guard.ts

@@ -19,8 +19,6 @@ const DIRECT_METHOD_POLICIES = new Map<string, DirectMethodPolicy>([
   ["account/read", "allowed-control-plane"],
   ["app/list", "allowed-control-plane"],
   ["config/mcpServer/reload", "allowed-control-plane"],
-  ["config/read", "allowed-control-plane"],
-  ["config/value/write", "allowed-control-plane"],
   ["environment/add", "allowed-control-plane"],
   ["experimentalFeature/enablement/set", "allowed-control-plane"],
   ["feedback/upload", "allowed-control-plane"],

extensions/codex/src/app-server/session-binding.test.ts

@@ -145,35 +145,6 @@ describe("codex app-server session binding", () => {
     expect(binding?.pluginAppPolicyContext).toEqual(pluginAppPolicyContext);
   });
 
-  it("round-trips always plugin app policy context destructive approval mode", async () => {
-    const sessionFile = path.join(tempDir, "session.json");
-    const pluginAppPolicyContext = {
-      fingerprint: "plugin-policy-always",
-      apps: {
-        "google-calendar-app": {
-          configKey: "google-calendar",
-          marketplaceName: "openai-curated" as const,
-          pluginName: "google-calendar",
-          allowDestructiveActions: true,
-          destructiveApprovalMode: "always" as const,
-          mcpServerNames: ["google-calendar"],
-        },
-      },
-      pluginAppIds: {
-        "google-calendar": ["google-calendar-app"],
-      },
-    };
-    await writeCodexAppServerBinding(sessionFile, {
-      threadId: "thread-123",
-      cwd: tempDir,
-      pluginAppPolicyContext,
-    });
-
-    const binding = await readCodexAppServerBinding(sessionFile);
-
-    expect(binding?.pluginAppPolicyContext).toEqual(pluginAppPolicyContext);
-  });
-
   it("normalizes v1 plugin app policy context destructive approval modes", async () => {
     const sessionFile = path.join(tempDir, "session.json");
     await fs.writeFile(

extensions/codex/src/app-server/session-binding.ts

@@ -421,9 +421,6 @@ function readDestructiveApprovalMode(
   if (value === "auto") {
     return bindingSchemaVersion === 1 ? "allow" : "auto";
   }
-  if (value === "always" && bindingSchemaVersion === 2) {
-    return "always";
-  }
   if (value === "on-request" && bindingSchemaVersion === 1) {
     return "auto";
   }

extensions/codex/src/app-server/trajectory.test.ts

@@ -5,7 +5,6 @@ import path from "node:path";
 import { afterEach, describe, expect, it } from "vitest";
 import {
   createCodexTrajectoryRecorder,
-  recordCodexTrajectoryCompletion,
   recordCodexTrajectoryContext,
   resolveCodexTrajectoryAppendFlags,
   resolveCodexTrajectoryPointerFlags,
@@ -81,9 +80,7 @@ describe("Codex trajectory recorder", () => {
     expect(content).not.toContain("secret");
     expect(content).not.toContain("sk-test-secret-token");
     expect(content).not.toContain("sk-other-secret-token");
-    if (process.platform !== "win32") {
-      expect(fs.statSync(filePath).mode & 0o777).toBe(0o600);
-    }
+    expect(fs.statSync(filePath).mode & 0o777).toBe(0o600);
     expect(fs.existsSync(path.join(tmpDir, "session.trajectory-path.json"))).toBe(true);
   });
 
@@ -256,235 +253,4 @@ describe("Codex trajectory recorder", () => {
     expect(parsed.data?.truncated).toBe(true);
     expect(parsed.data?.reason).toBe("trajectory-event-size-limit");
   });
-
-  it("preserves usage when truncating oversized model completion events", async () => {
-    const tmpDir = makeTempDir();
-    const sessionFile = path.join(tmpDir, "session.jsonl");
-    const attempt = {
-      sessionFile,
-      sessionId: "session-1",
-      sessionKey: "agent:main:session-1",
-      runId: "run-1",
-      provider: "codex",
-      modelId: "gpt-5.4",
-      model: { api: "responses" },
-    } as never;
-    const usage = {
-      input: 384_954,
-      output: 5_624,
-      cacheRead: 333_824,
-      reasoningTokens: 2_038,
-      total: 724_402,
-    };
-    const recorder = createCodexTrajectoryRecorder({
-      cwd: tmpDir,
-      attempt,
-      env: {},
-    });
-
-    const trajectoryRecorder = expectTrajectoryRecorder(recorder);
-    recordCodexTrajectoryCompletion(trajectoryRecorder, {
-      attempt,
-      threadId: "thread-1",
-      turnId: "turn-1",
-      timedOut: false,
-      result: {
-        aborted: false,
-        attemptUsage: usage,
-        assistantTexts: ["done"],
-        messagesSnapshot: Array.from({ length: 20 }, (_value, index) => ({
-          role: index % 2 === 0 ? "user" : "assistant",
-          content: `message-${index} ${"x".repeat(32_000)}`,
-        })),
-      } as never,
-    });
-    await trajectoryRecorder.flush();
-
-    const parsed = JSON.parse(
-      fs.readFileSync(path.join(tmpDir, "session.trajectory.jsonl"), "utf8"),
-    );
-    expect(parsed.type).toBe("model.completed");
-    expect(parsed.data).toMatchObject({
-      truncated: true,
-      reason: "trajectory-event-size-limit",
-      usage,
-    });
-    expect(parsed.data.messagesSnapshot).toBeUndefined();
-    expect(parsed.data.droppedFields).toContain("messagesSnapshot");
-    expect(Buffer.byteLength(JSON.stringify(parsed), "utf8")).toBeLessThanOrEqual(256 * 1024);
-  });
-
-  it("drops oversized preserved fields when needed to keep completion events bounded", async () => {
-    const tmpDir = makeTempDir();
-    const sessionFile = path.join(tmpDir, "session.jsonl");
-    const attempt = {
-      sessionFile,
-      sessionId: "session-1",
-      sessionKey: "agent:main:session-1",
-      runId: "run-1",
-      provider: "codex",
-      modelId: "gpt-5.4",
-      model: { api: "responses" },
-    } as never;
-    const oversizedUsage = Object.fromEntries(
-      Array.from({ length: 100 }, (_value, index) => [`field-${index}`, "x".repeat(5_000)]),
-    );
-    const recorder = createCodexTrajectoryRecorder({
-      cwd: tmpDir,
-      attempt,
-      env: {},
-    });
-
-    const trajectoryRecorder = expectTrajectoryRecorder(recorder);
-    recordCodexTrajectoryCompletion(trajectoryRecorder, {
-      attempt,
-      threadId: "thread-1",
-      turnId: "turn-1",
-      timedOut: false,
-      result: {
-        aborted: false,
-        attemptUsage: oversizedUsage,
-        assistantTexts: ["x".repeat(32_000)],
-        messagesSnapshot: [{ role: "assistant", content: "x".repeat(32_000) }],
-      } as never,
-    });
-    await trajectoryRecorder.flush();
-
-    const parsed = JSON.parse(
-      fs.readFileSync(path.join(tmpDir, "session.trajectory.jsonl"), "utf8"),
-    );
-    expect(parsed.data).toMatchObject({
-      truncated: true,
-      reason: "trajectory-event-size-limit",
-    });
-    expect(parsed.data.usage).toBeUndefined();
-    expect(parsed.data.droppedFields).toEqual(
-      expect.arrayContaining(["usage", "assistantTexts", "messagesSnapshot"]),
-    );
-    expect(Buffer.byteLength(JSON.stringify(parsed), "utf8")).toBeLessThanOrEqual(256 * 1024);
-  });
-
-  it("preserves usage on non-final oversized model completion events", async () => {
-    const tmpDir = makeTempDir();
-    const sessionFile = path.join(tmpDir, "session.jsonl");
-    const attempt = {
-      sessionFile,
-      sessionId: "session-1",
-      sessionKey: "agent:main:session-1",
-      runId: "run-1",
-      provider: "codex",
-      modelId: "gpt-5.4",
-      model: { api: "responses" },
-    } as never;
-    const firstUsage = {
-      input: 384_954,
-      output: 5_624,
-      cacheRead: 333_824,
-      reasoningTokens: 2_038,
-      total: 724_402,
-    };
-    const secondUsage = { input: 12, output: 3, total: 15 };
-    const recorder = createCodexTrajectoryRecorder({
-      cwd: tmpDir,
-      attempt,
-      env: {},
-    });
-
-    const trajectoryRecorder = expectTrajectoryRecorder(recorder);
-    recordCodexTrajectoryCompletion(trajectoryRecorder, {
-      attempt,
-      threadId: "thread-1",
-      turnId: "turn-1",
-      timedOut: false,
-      result: {
-        aborted: false,
-        attemptUsage: firstUsage,
-        assistantTexts: ["first"],
-        messagesSnapshot: Array.from({ length: 20 }, (_value, index) => ({
-          role: index % 2 === 0 ? "user" : "assistant",
-          content: `message-${index} ${"x".repeat(32_000)}`,
-        })),
-      } as never,
-    });
-    recordCodexTrajectoryCompletion(trajectoryRecorder, {
-      attempt,
-      threadId: "thread-1",
-      turnId: "turn-2",
-      timedOut: false,
-      result: {
-        aborted: false,
-        attemptUsage: secondUsage,
-        assistantTexts: ["final answer"],
-        messagesSnapshot: [{ role: "assistant", content: "final answer" }],
-      } as never,
-    });
-    await trajectoryRecorder.flush();
-
-    const events = fs
-      .readFileSync(path.join(tmpDir, "session.trajectory.jsonl"), "utf8")
-      .trim()
-      .split(/\r?\n/u)
-      .map((line) => JSON.parse(line));
-    expect(events).toHaveLength(2);
-    expect(events[0].data).toMatchObject({
-      truncated: true,
-      usage: firstUsage,
-    });
-    expect(events[1].data).toMatchObject({
-      turnId: "turn-2",
-      usage: secondUsage,
-      assistantTexts: ["final answer"],
-    });
-    expect(events[1].data.truncated).toBeUndefined();
-  });
-
-  it("redacts secrets before preserving usage in truncated completion events", async () => {
-    const tmpDir = makeTempDir();
-    const sessionFile = path.join(tmpDir, "session.jsonl");
-    const attempt = {
-      sessionFile,
-      sessionId: "session-1",
-      sessionKey: "agent:main:session-1",
-      runId: "run-1",
-      provider: "codex",
-      modelId: "gpt-5.4",
-      model: { api: "responses" },
-    } as never;
-    const recorder = createCodexTrajectoryRecorder({
-      cwd: tmpDir,
-      attempt,
-      env: {},
-    });
-
-    const trajectoryRecorder = expectTrajectoryRecorder(recorder);
-    recordCodexTrajectoryCompletion(trajectoryRecorder, {
-      attempt,
-      threadId: "thread-1",
-      turnId: "turn-1",
-      timedOut: false,
-      result: {
-        aborted: false,
-        attemptUsage: {
-          total: 1,
-          apiKey: "sk-test-secret-token",
-          authorization: "Bearer sk-other-secret-token",
-        },
-        assistantTexts: ["done"],
-        messagesSnapshot: Array.from({ length: 20 }, (_value, index) => ({
-          role: index % 2 === 0 ? "user" : "assistant",
-          content: `message-${index} ${"x".repeat(32_000)}`,
-        })),
-      } as never,
-    });
-    await trajectoryRecorder.flush();
-
-    const parsed = JSON.parse(
-      fs.readFileSync(path.join(tmpDir, "session.trajectory.jsonl"), "utf8"),
-    );
-    const preservedUsage = JSON.stringify(parsed.data.usage);
-    expect(parsed.data.truncated).toBe(true);
-    expect(preservedUsage).toContain("redacted");
-    expect(preservedUsage).not.toContain("sk-test-secret-token");
-    expect(preservedUsage).not.toContain("sk-other-secret-token");
-  });
 });

extensions/codex/src/app-server/trajectory.ts

@@ -40,7 +40,6 @@ const JWT_VALUE_RE = /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]
 const COOKIE_PAIR_RE = /\b([A-Za-z][A-Za-z0-9_.-]{1,64})=([A-Za-z0-9+/._~%=-]{16,})(?=;|\s|$)/gu;
 const TRAJECTORY_RUNTIME_FILE_MAX_BYTES = 50 * 1024 * 1024;
 const TRAJECTORY_RUNTIME_EVENT_MAX_BYTES = 256 * 1024;
-const TRAJECTORY_RUNTIME_OVERSIZE_PRESERVED_DATA_KEYS = ["usage", "promptCache"] as const;
 
 type CodexTrajectoryOpenFlagConstants = Pick<
   typeof nodeFs.constants,
@@ -83,57 +82,19 @@ function boundedTrajectoryLine(event: Record<string, unknown>): string | undefin
   if (bytes <= TRAJECTORY_RUNTIME_EVENT_MAX_BYTES) {
     return `${line}\n`;
   }
-
-  const originalData =
-    event.data && typeof event.data === "object" && !Array.isArray(event.data)
-      ? (event.data as Record<string, unknown>)
-      : {};
-  const originalDataKeys = Object.keys(originalData);
-  const preservedDataKeys = new Set<string>();
-  const baseData = {
-    truncated: true,
-    originalBytes: bytes,
-    limitBytes: TRAJECTORY_RUNTIME_EVENT_MAX_BYTES,
-    reason: "trajectory-event-size-limit",
-  };
-  const buildTruncatedLine = (includeDroppedFields: boolean): string | undefined => {
-    const data: Record<string, unknown> = { ...baseData };
-    for (const key of TRAJECTORY_RUNTIME_OVERSIZE_PRESERVED_DATA_KEYS) {
-      if (preservedDataKeys.has(key)) {
-        data[key] = originalData[key];
-      }
-    }
-    if (includeDroppedFields) {
-      const droppedFields = originalDataKeys.filter((key) => !preservedDataKeys.has(key));
-      if (droppedFields.length > 0) {
-        data.droppedFields = droppedFields;
-      }
-    }
-    const truncated = JSON.stringify({ ...event, data });
-    if (Buffer.byteLength(truncated, "utf8") <= TRAJECTORY_RUNTIME_EVENT_MAX_BYTES) {
-      return `${truncated}\n`;
-    }
-    return undefined;
-  };
-
-  let best = buildTruncatedLine(true) ?? buildTruncatedLine(false);
-  if (!best) {
-    return undefined;
+  const truncated = JSON.stringify({
+    ...event,
+    data: {
+      truncated: true,
+      originalBytes: bytes,
+      limitBytes: TRAJECTORY_RUNTIME_EVENT_MAX_BYTES,
+      reason: "trajectory-event-size-limit",
+    },
+  });
+  if (Buffer.byteLength(truncated, "utf8") <= TRAJECTORY_RUNTIME_EVENT_MAX_BYTES) {
+    return `${truncated}\n`;
   }
-
-  for (const key of TRAJECTORY_RUNTIME_OVERSIZE_PRESERVED_DATA_KEYS) {
-    if (!Object.hasOwn(originalData, key)) {
-      continue;
-    }
-    preservedDataKeys.add(key);
-    const next = buildTruncatedLine(true) ?? buildTruncatedLine(false);
-    if (next) {
-      best = next;
-      continue;
-    }
-    preservedDataKeys.delete(key);
-  }
-  return best;
+  return undefined;
 }
 
 function resolveTrajectoryPointerFilePath(sessionFile: string): string {

extensions/codex/src/command-plugins-management.ts

@@ -23,7 +23,7 @@ export type CodexPluginConfigEntry = {
   enabled?: boolean;
   marketplaceName?: string;
   pluginName?: string;
-  allow_destructive_actions?: boolean | "auto" | "always";
+  allow_destructive_actions?: boolean | "auto";
 };
 
 export type CodexPluginsConfigBlock = {

extensions/codex/src/migration/plan.ts

@@ -43,7 +43,7 @@ export type CodexPluginMigrationConfigEntry = {
   configKey: string;
   pluginName: string;
   enabled: boolean;
-  allowDestructiveActions?: "auto" | "always";
+  allowDestructiveActions?: "auto";
 };
 
 type CodexPluginMigrationBlockSkipDetails = {
@@ -168,18 +168,15 @@ function isLegacyDestructivePolicyRepair(
   );
 }
 
-function readExistingPluginAllowDestructiveActions(
+function isLegacyDestructivePolicyConfigEntryRepair(
   existing: unknown,
   pluginName: string,
-): "auto" | "always" | undefined {
+): boolean {
   const existingEntry = isRecord(existing) ? existing : undefined;
-  if (existingEntry?.pluginName !== pluginName) {
-    return undefined;
-  }
-  const normalized = normalizeExistingAllowDestructiveActions(
-    existingEntry.allow_destructive_actions,
+  return (
+    existingEntry?.allow_destructive_actions === "on-request" &&
+    existingEntry.pluginName === pluginName
   );
-  return normalized === "auto" || normalized === "always" ? normalized : undefined;
 }
 
 function buildPluginItems(
@@ -206,15 +203,12 @@ function buildPluginItems(
         enabled: true,
         marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
         pluginName: plugin.pluginName,
-        ...(() => {
-          const allowDestructiveActions = readExistingPluginAllowDestructiveActions(
-            existingPluginEntries[configKey],
-            plugin.pluginName,
-          );
-          return allowDestructiveActions
-            ? { allow_destructive_actions: allowDestructiveActions }
-            : {};
-        })(),
+        ...(isLegacyDestructivePolicyConfigEntryRepair(
+          existingPluginEntries[configKey],
+          plugin.pluginName,
+        )
+          ? { allow_destructive_actions: "auto" }
+          : {}),
       };
       const conflict =
         !ctx.overwrite &&
@@ -240,9 +234,8 @@ function buildPluginItems(
             pluginName: plugin.pluginName,
             sourceInstalled: plugin.installed === true,
             sourceEnabled: plugin.enabled === true,
-            ...(plannedEntry.allow_destructive_actions === "auto" ||
-            plannedEntry.allow_destructive_actions === "always"
-              ? { allowDestructiveActions: plannedEntry.allow_destructive_actions }
+            ...(plannedEntry.allow_destructive_actions === "auto"
+              ? { allowDestructiveActions: "auto" }
               : {}),
             ...(plugin.apps && plugin.apps.length > 0 && !shouldVerifyPluginApps(ctx)
               ? { sourceAppVerification: CODEX_PLUGIN_SOURCE_APP_VERIFICATION_UNVERIFIED }
@@ -317,15 +310,13 @@ export function readCodexPluginMigrationConfigEntry(
     configKey,
     pluginName,
     enabled,
-    ...(allowDestructiveActions === "auto" || allowDestructiveActions === "always"
-      ? { allowDestructiveActions }
-      : {}),
+    ...(allowDestructiveActions === "auto" ? { allowDestructiveActions: "auto" } : {}),
   };
 }
 
 function readExistingAllowDestructiveActions(
   config: MigrationProviderContext["config"],
-): boolean | "auto" | "always" | undefined {
+): boolean | "auto" | undefined {
   const value = readMigrationConfigPath(config as Record<string, unknown>, [
     ...CODEX_PLUGIN_NATIVE_CONFIG_PATH,
     "allow_destructive_actions",
@@ -333,16 +324,8 @@ function readExistingAllowDestructiveActions(
   return normalizeExistingAllowDestructiveActions(value);
 }
 
-function normalizeExistingAllowDestructiveActions(
-  value: unknown,
-): boolean | "auto" | "always" | undefined {
-  if (value === "auto" || value === "on-request") {
-    return "auto";
-  }
-  if (value === "always") {
-    return "always";
-  }
-  return asBoolean(value);
+function normalizeExistingAllowDestructiveActions(value: unknown): boolean | "auto" | undefined {
+  return value === "auto" || value === "on-request" ? "auto" : asBoolean(value);
 }
 
 function readExistingPluginPolicyRepairs(

extensions/codex/src/migration/provider.test.ts

@@ -2108,76 +2108,6 @@ describe("buildCodexMigrationProvider", () => {
     });
   });
 
-  it("preserves global always destructive plugin policy during migration", async () => {
-    const fixture = await createCodexFixture();
-    const configState: MigrationProviderContext["config"] = {
-      plugins: {
-        entries: {
-          codex: {
-            enabled: true,
-            config: {
-              codexPlugins: {
-                enabled: true,
-                allow_destructive_actions: "always",
-                plugins: {},
-              },
-            },
-          },
-        },
-      },
-      agents: { defaults: { workspace: fixture.workspaceDir } },
-    } as MigrationProviderContext["config"];
-    appServerRequest.mockImplementation(async ({ method }: { method: string }) => {
-      if (method === "plugin/list") {
-        return pluginList([pluginSummary("google-calendar", { installed: true, enabled: true })]);
-      }
-      if (method === "plugin/read") {
-        return pluginRead("google-calendar");
-      }
-      if (method === "plugin/install") {
-        return { authPolicy: "ON_USE", appsNeedingAuth: [] } satisfies v2.PluginInstallResponse;
-      }
-      if (method === "skills/list") {
-        return { data: [] } satisfies v2.SkillsListResponse;
-      }
-      if (method === "hooks/list") {
-        return { data: [] } satisfies v2.HooksListResponse;
-      }
-      if (method === "config/mcpServer/reload") {
-        return {};
-      }
-      if (method === "app/list") {
-        return appsList([]);
-      }
-      throw new Error(`unexpected request ${method}`);
-    });
-    const provider = buildCodexMigrationProvider({
-      runtime: createConfigRuntime(configState),
-    });
-
-    const result = await provider.apply(
-      makeContext({
-        source: fixture.codexHome,
-        stateDir: fixture.stateDir,
-        workspaceDir: fixture.workspaceDir,
-        config: configState,
-      }),
-    );
-
-    expectRecordFields(findItem(result.items, "config:codex-plugins"), { status: "migrated" });
-    expect(configState.plugins?.entries?.codex?.config?.codexPlugins).toEqual({
-      enabled: true,
-      allow_destructive_actions: "always",
-      plugins: {
-        "google-calendar": {
-          enabled: true,
-          marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
-          pluginName: "google-calendar",
-        },
-      },
-    });
-  });
-
   it("records auth-required plugin installs as disabled explicit config entries", async () => {
     const fixture = await createCodexFixture();
     const configState: MigrationProviderContext["config"] = {

extensions/codex/src/node-cli-sessions.test.ts

@@ -207,65 +207,4 @@ describe("codex cli node sessions", () => {
       }),
     ).rejects.toThrow("Codex CLI node command returned malformed payloadJSON.");
   });
-
-  it("keeps Codex history session previews on UTF-16 code point boundaries", async () => {
-    const sessionId = "019e2007-1f7e-7eb1-a42b-8c01f4b9b5ce";
-    const text = `${"a".repeat(136)}🤖tail`;
-    await fs.writeFile(
-      path.join(tempDir, "history.jsonl"),
-      JSON.stringify({ session_id: sessionId, ts: 1778678322, text }),
-    );
-
-    const command = createCodexCliSessionNodeHostCommands().find(
-      (entry) => entry.command === CODEX_CLI_SESSIONS_LIST_COMMAND,
-    );
-    const raw = await command?.handle(JSON.stringify({ filter: "", limit: 5 }));
-    const parsed = JSON.parse(raw ?? "{}") as {
-      sessions?: Array<{ lastMessage?: string }>;
-    };
-
-    expect(parsed.sessions?.[0]?.lastMessage).toBe(`${"a".repeat(136)}...`);
-    expect(parsed.sessions?.[0]?.lastMessage).not.toContain("\ud83e");
-    expect(parsed.sessions?.[0]?.lastMessage).not.toContain("\udd16");
-  });
-
-  it("keeps Codex session-file previews on UTF-16 code point boundaries", async () => {
-    const sessionId = "019e23d1-f33d-78e3-959e-0f56f30a5248";
-    const sessionDir = path.join(tempDir, "sessions", "2026", "05", "14");
-    const sessionFile = path.join(sessionDir, `rollout-2026-05-14T00-10-22-${sessionId}.jsonl`);
-    const text = `${"b".repeat(136)}🤖tail`;
-
-    await fs.mkdir(sessionDir, { recursive: true });
-    await fs.writeFile(
-      sessionFile,
-      [
-        JSON.stringify({
-          timestamp: "2026-05-14T00:10:23.618Z",
-          type: "session_meta",
-          payload: { id: sessionId, cwd: "/tmp/codex-work" },
-        }),
-        JSON.stringify({
-          timestamp: "2026-05-14T00:10:23.619Z",
-          type: "response_item",
-          payload: {
-            type: "message",
-            role: "user",
-            content: [{ type: "input_text", text }],
-          },
-        }),
-      ].join("\n"),
-    );
-
-    const command = createCodexCliSessionNodeHostCommands().find(
-      (entry) => entry.command === CODEX_CLI_SESSIONS_LIST_COMMAND,
-    );
-    const raw = await command?.handle(JSON.stringify({ filter: "", limit: 5 }));
-    const parsed = JSON.parse(raw ?? "{}") as {
-      sessions?: Array<{ lastMessage?: string }>;
-    };
-
-    expect(parsed.sessions?.[0]?.lastMessage).toBe(`${"b".repeat(136)}...`);
-    expect(parsed.sessions?.[0]?.lastMessage).not.toContain("\ud83e");
-    expect(parsed.sessions?.[0]?.lastMessage).not.toContain("\udd16");
-  });
 });

extensions/codex/src/node-cli-sessions.ts

@@ -12,7 +12,6 @@ import type {
 import type { PluginRuntime } from "openclaw/plugin-sdk/plugin-runtime";
 import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { resolvePreferredOpenClawTmpDir } from "openclaw/plugin-sdk/temp-path";
-import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import {
   materializeWindowsSpawnProgram,
   resolveWindowsSpawnProgram,
@@ -692,10 +691,7 @@ function normalizeTimeoutMs(value: unknown): number {
 }
 
 function truncateText(value: string, max: number): string {
-  if (value.length <= max) {
-    return value;
-  }
-  return `${truncateUtf16Safe(value, Math.max(0, max - 3))}...`;
+  return value.length > max ? `${value.slice(0, max - 3)}...` : value;
 }
 
 function compareOptionalStringsDesc(a?: string, b?: string): number {

extensions/duckduckgo/src/ddg-client.ts

@@ -36,10 +36,6 @@ type DuckDuckGoResult = {
   snippet: string;
 };
 
-function isDecodableCodePoint(cp: number): boolean {
-  return Number.isInteger(cp) && cp >= 0 && cp <= 0x10ffff && (cp < 0xd800 || cp > 0xdfff);
-}
-
 function decodeHtmlEntities(text: string): string {
   return text.replace(
     /&(?:lt|gt|quot|apos|#39|#x27|#x2F|nbsp|ndash|mdash|hellip|amp|#\d+|#x[0-9a-f]+);/gi,
@@ -76,12 +72,10 @@ function decodeHtmlEntities(text: string): string {
         return "&";
       }
       if (normalized.startsWith("&#x")) {
-        const codePoint = Number.parseInt(normalized.slice(3, -1), 16);
-        return isDecodableCodePoint(codePoint) ? String.fromCodePoint(codePoint) : entity;
+        return String.fromCodePoint(Number.parseInt(normalized.slice(3, -1), 16));
       }
       if (normalized.startsWith("&#")) {
-        const codePoint = Number.parseInt(normalized.slice(2, -1), 10);
-        return isDecodableCodePoint(codePoint) ? String.fromCodePoint(codePoint) : entity;
+        return String.fromCodePoint(Number.parseInt(normalized.slice(2, -1), 10));
       }
       return entity;
     },

extensions/duckduckgo/src/ddg-search-provider.test.ts

@@ -205,20 +205,6 @@ describe("duckduckgo web search provider", () => {
     );
   });
 
-  it("leaves out-of-range numeric html entities intact instead of throwing", () => {
-    expect(() => ddgClientTesting.decodeHtmlEntities("Result � end")).not.toThrow();
-    expect(ddgClientTesting.decodeHtmlEntities("Result � end")).toBe(
-      "Result � end",
-    );
-    expect(ddgClientTesting.decodeHtmlEntities("Hex � tail")).toBe("Hex � tail");
-    // Surrogate-range entities would decode to lone UTF-16 surrogates; keep them intact.
-    expect(ddgClientTesting.decodeHtmlEntities("Bad � end")).toBe("Bad � end");
-    expect(ddgClientTesting.decodeHtmlEntities("Bad � end")).toBe("Bad � end");
-    expect(ddgClientTesting.decodeHtmlEntities("Bad � end")).toBe("Bad � end");
-    // A valid supplementary-plane entity still decodes.
-    expect(ddgClientTesting.decodeHtmlEntities("Smile 😀")).toBe("Smile 😀");
-  });
-
   it("does not double-decode escaped entities (decodes & last)", () => {
     // A result whose text literally shows "<" arrives double-encoded as
     // "&amp;lt;". Decoding &amp; first would re-decode it into "<", corrupting

extensions/feishu/src/app-registration.test.ts

@@ -1,21 +1,16 @@
 // Feishu tests cover app registration plugin behavior.
 import { MAX_TIMER_TIMEOUT_MS } from "openclaw/plugin-sdk/number-runtime";
 import { afterEach, describe, expect, it, vi } from "vitest";
-import { beginAppRegistration, pollAppRegistration, printQrCode } from "./app-registration.js";
+import { beginAppRegistration, pollAppRegistration } from "./app-registration.js";
 
-const { fetchWithSsrFGuardMock, renderQrTerminalMock } = vi.hoisted(() => ({
+const { fetchWithSsrFGuardMock } = vi.hoisted(() => ({
   fetchWithSsrFGuardMock: vi.fn(),
-  renderQrTerminalMock: vi.fn(async () => "terminal-qr"),
 }));
 
 vi.mock("openclaw/plugin-sdk/ssrf-runtime", () => ({
   fetchWithSsrFGuard: fetchWithSsrFGuardMock,
 }));
 
-vi.mock("./qr-terminal.js", () => ({
-  renderQrTerminal: renderQrTerminalMock,
-}));
-
 function mockFeishuJson(payload: unknown) {
   fetchWithSsrFGuardMock.mockResolvedValueOnce({
     response: new Response(JSON.stringify(payload), { status: 200 }),
@@ -28,7 +23,6 @@ describe("Feishu app registration", () => {
     vi.useRealTimers();
     vi.restoreAllMocks();
     fetchWithSsrFGuardMock.mockReset();
-    renderQrTerminalMock.mockClear();
   });
 
   it("defaults unsafe begin polling lifetimes from provider responses", async () => {
@@ -65,16 +59,4 @@ describe("Feishu app registration", () => {
     await vi.runOnlyPendingTimersAsync();
     await expect(poll).resolves.toEqual({ status: "timeout" });
   });
-
-  it("prints scan-to-create QR codes with compact terminal rendering", async () => {
-    const writeSpy = vi.spyOn(process.stdout, "write").mockImplementation(() => true);
-
-    await printQrCode("https://accounts.feishu.cn/verify?device_code=long-device-code");
-
-    expect(renderQrTerminalMock).toHaveBeenCalledWith(
-      "https://accounts.feishu.cn/verify?device_code=long-device-code",
-      { small: true },
-    );
-    expect(writeSpy).toHaveBeenCalledWith("terminal-qr\n");
-  });
 });

extensions/feishu/src/app-registration.ts

@@ -266,7 +266,7 @@ export async function pollAppRegistration(params: {
  * otherwise the pattern is corrupted and cannot be scanned.
  */
 export async function printQrCode(url: string): Promise<void> {
-  const output = await renderQrTerminal(url, { small: true });
+  const output = await renderQrTerminal(url);
   process.stdout.write(output.endsWith("\n") ? output : `${output}\n`);
 }
 

extensions/google/media-understanding-provider.ts

@@ -11,7 +11,6 @@ import {
 import {
   assertOkOrThrowProviderError,
   postJsonRequest,
-  readProviderJsonResponse,
   type ProviderRequestTransportOverrides,
 } from "openclaw/plugin-sdk/provider-http";
 import {
@@ -98,11 +97,11 @@ async function generateGeminiInlineDataText(params: {
   try {
     await assertOkOrThrowProviderError(res, params.httpErrorLabel);
 
-    const payload = await readProviderJsonResponse<{
+    const payload = (await res.json()) as {
       candidates?: Array<{
         content?: { parts?: Array<{ text?: string }> };
       }>;
-    }>(res, params.httpErrorLabel);
+    };
     const parts = payload.candidates?.[0]?.content?.parts ?? [];
     const text = parts
       .map((part) => part?.text?.trim())

extensions/google/media-understanding-provider.video.test.ts

@@ -1,5 +1,4 @@
 // Google tests cover media understanding provider.video plugin behavior.
-import { createServer, type Server } from "node:http";
 import {
   createRequestCaptureJsonFetch,
   installPinnedHostnameTestHooks,
@@ -11,49 +10,6 @@ import { resolveGoogleGenerativeAiHttpRequestConfig } from "./runtime-api.js";
 
 installPinnedHostnameTestHooks();
 
-const LOOPBACK_RESPONSE_BYTES = 18 * 1024 * 1024;
-
-async function listenLoopbackServer(server: Server): Promise<number> {
-  return await new Promise((resolve, reject) => {
-    server.once("error", reject);
-    server.listen(0, "127.0.0.1", () => {
-      server.off("error", reject);
-      const address = server.address();
-      if (!address || typeof address === "string") {
-        reject(new Error("expected loopback TCP address"));
-        return;
-      }
-      resolve(address.port);
-    });
-  });
-}
-
-function createOversizedJsonServer(): { server: Server; closed: Promise<number> } {
-  let resolveClosed: (sentBytes: number) => void = () => {};
-  const closed = new Promise<number>((resolve) => {
-    resolveClosed = resolve;
-  });
-  const server = createServer((_req, res) => {
-    let sentBytes = 0;
-    const chunk = Buffer.alloc(64 * 1024, 0x20);
-    res.writeHead(200, { "content-type": "application/json" });
-    const timer = setInterval(() => {
-      if (sentBytes >= LOOPBACK_RESPONSE_BYTES) {
-        clearInterval(timer);
-        res.end();
-        return;
-      }
-      sentBytes += chunk.length;
-      res.write(chunk);
-    }, 1);
-    res.on("close", () => {
-      clearInterval(timer);
-      resolveClosed(sentBytes);
-    });
-  });
-  return { server, closed };
-}
-
 describe("describeGeminiVideo", () => {
   it("respects case-insensitive x-goog-api-key overrides", async () => {
     let seenKey: string | null = null;
@@ -158,29 +114,6 @@ describe("describeGeminiVideo", () => {
     );
   });
 
-  it("bounds oversized video JSON responses and closes the stream early", async () => {
-    const { server, closed } = createOversizedJsonServer();
-    const port = await listenLoopbackServer(server);
-    const fetchFn = withFetchPreconnect(async () =>
-      fetch(`http://127.0.0.1:${port}/google-video-json`),
-    );
-
-    try {
-      await expect(
-        describeGeminiVideo({
-          buffer: Buffer.from("video-bytes"),
-          fileName: "clip.mp4",
-          apiKey: "test-key",
-          timeoutMs: 1500,
-          fetchFn,
-        }),
-      ).rejects.toThrow(/JSON response exceeds 16777216 bytes/u);
-      await expect(closed).resolves.toBeLessThan(LOOPBACK_RESPONSE_BYTES);
-    } finally {
-      server.close();
-    }
-  });
-
   it("rejects non-Google video base URLs before sending authenticated requests", async () => {
     await expect(
       describeGeminiVideo({

extensions/google/speech-provider.test.ts

@@ -20,8 +20,6 @@ const {
 let buildGoogleSpeechProvider: typeof import("./speech-provider.js").buildGoogleSpeechProvider;
 let testing: typeof import("./speech-provider.js").testing;
 
-const GOOGLE_TTS_JSON_CAP_BYTES = 16 * 1024 * 1024;
-
 beforeAll(async () => {
   ({ buildGoogleSpeechProvider, testing } = await import("./speech-provider.js"));
 });
@@ -58,26 +56,6 @@ function installGoogleTtsRequestMock(pcm = Buffer.from([1, 0, 2, 0])) {
   return postJsonRequestMock;
 }
 
-function oversizedGoogleTtsJsonResponse(onCancel: () => void): Response {
-  const response = new Response(
-    new ReadableStream<Uint8Array>({
-      start(controller) {
-        controller.enqueue(new Uint8Array(GOOGLE_TTS_JSON_CAP_BYTES + 1));
-      },
-      cancel() {
-        onCancel();
-      },
-    }),
-    { headers: { "content-type": "application/json" }, status: 200 },
-  );
-  Object.defineProperty(response, "json", {
-    value: async () => {
-      throw new Error("unbounded json reader was used");
-    },
-  });
-  return response;
-}
-
 function expectRecordFields(value: unknown, expected: Record<string, unknown>) {
   if (!value || typeof value !== "object") {
     throw new Error("Expected record");
@@ -171,39 +149,6 @@ describe("Google speech provider", () => {
     expect(transcodeAudioBufferToOpusMock).not.toHaveBeenCalled();
   });
 
-  it("bounds oversized Gemini TTS success JSON responses and cancels the stream", async () => {
-    let cancelCount = 0;
-    const release = vi.fn(async () => {});
-    postJsonRequestMock
-      .mockResolvedValueOnce({
-        response: oversizedGoogleTtsJsonResponse(() => {
-          cancelCount += 1;
-        }),
-        release,
-      })
-      .mockResolvedValueOnce({
-        response: oversizedGoogleTtsJsonResponse(() => {
-          cancelCount += 1;
-        }),
-        release,
-      });
-    const provider = buildGoogleSpeechProvider();
-
-    await expect(
-      provider.synthesize({
-        text: "oversized tts response",
-        cfg: {},
-        providerConfig: {
-          apiKey: "google-test-key",
-        },
-        target: "audio-file",
-        timeoutMs: 12_000,
-      }),
-    ).rejects.toThrow("Google TTS response: JSON response exceeds 16777216 bytes");
-    expect(cancelCount).toBe(2);
-    expect(release).toHaveBeenCalledTimes(2);
-  });
-
   it("transcodes Gemini PCM to Opus for voice-note targets", async () => {
     installGoogleTtsRequestMock(Buffer.from([5, 0, 6, 0]));
     transcodeAudioBufferToOpusMock.mockResolvedValueOnce(Buffer.from("google-opus"));

extensions/google/speech-provider.ts

@@ -3,7 +3,6 @@ import { transcodeAudioBufferToOpus } from "openclaw/plugin-sdk/media-runtime";
 import {
   assertOkOrThrowProviderError,
   postJsonRequest,
-  readProviderJsonResponse,
   sanitizeConfiguredModelProviderRequest,
 } from "openclaw/plugin-sdk/provider-http";
 import type { OpenClawConfig } from "openclaw/plugin-sdk/provider-onboard";
@@ -504,11 +503,7 @@ async function synthesizeGoogleTtsPcmOnce(params: {
       }
     }
     try {
-      const payload = await readProviderJsonResponse<GoogleGenerateSpeechResponse>(
-        res,
-        "Google TTS response",
-      );
-      return extractGoogleSpeechPcm(payload);
+      return extractGoogleSpeechPcm((await res.json()) as GoogleGenerateSpeechResponse);
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       throw new GoogleTtsRetryableError(message);

extensions/google/transport-stream.test.ts

@@ -476,45 +476,6 @@ describe("google transport stream", () => {
     expect(result.content[2]).toHaveProperty("thoughtSignature", "Y2FsbF9zaWdfMQ==");
   });
 
-  it("preserves MAX_TOKENS when the partial response contains a function call", async () => {
-    guardedFetchMock.mockResolvedValueOnce(
-      buildSseResponse([
-        {
-          candidates: [
-            {
-              content: {
-                parts: [{ functionCall: { name: "lookup", args: { q: "hello" } } }],
-              },
-              finishReason: "MAX_TOKENS",
-            },
-          ],
-        },
-      ]),
-    );
-
-    const streamFn = createGoogleGenerativeAiTransportStreamFn();
-    const stream = await Promise.resolve(
-      streamFn(
-        buildGeminiModel(),
-        {
-          messages: [{ role: "user", content: "hello", timestamp: 0 }],
-          tools: [
-            {
-              name: "lookup",
-              description: "Look up a value",
-              parameters: { type: "object" },
-            },
-          ],
-        } as Parameters<typeof streamFn>[1],
-        { apiKey: "gemini-api-key" } as Parameters<typeof streamFn>[2],
-      ),
-    );
-    const result = await stream.result();
-
-    expect(result.stopReason).toBe("length");
-    expect(result.content).toEqual([expect.objectContaining({ type: "toolCall", name: "lookup" })]);
-  });
-
   it("strips redundant google provider prefixes from Gemini API model paths", async () => {
     guardedFetchMock.mockResolvedValueOnce(buildSseResponse([]));
 

extensions/google/transport-stream.ts

@@ -1404,12 +1404,7 @@ function createGoogleTransportStreamFn(kind: CanonicalGoogleTransportApi): Strea
           }
           if (typeof candidate?.finishReason === "string") {
             output.stopReason = mapStopReasonString(candidate.finishReason);
-            // MAX_TOKENS can leave a complete-looking partial call. Only a normal
-            // Google stop may promote parsed calls into an executable tool-use turn.
-            if (
-              output.stopReason === "stop" &&
-              output.content.some((block) => block.type === "toolCall")
-            ) {
+            if (output.content.some((block) => block.type === "toolCall")) {
               output.stopReason = "toolUse";
             }
           }

extensions/googlechat/src/api.ts

@@ -2,10 +2,6 @@
 import crypto from "node:crypto";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { parseMediaContentLength } from "openclaw/plugin-sdk/media-runtime";
-import {
-  readProviderJsonResponse,
-  readResponseTextLimited,
-} from "openclaw/plugin-sdk/provider-http";
 import { readResponseWithLimit } from "openclaw/plugin-sdk/response-limit-runtime";
 import { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime";
 import type { ResolvedGoogleChatAccount } from "./accounts.js";
@@ -17,7 +13,11 @@ const CHAT_API_BASE = "https://chat.googleapis.com/v1";
 const CHAT_UPLOAD_BASE = "https://chat.googleapis.com/upload/v1";
 
 async function readGoogleChatJsonResponse<T>(response: Response, label: string): Promise<T> {
-  return readProviderJsonResponse<T>(response, label);
+  try {
+    return (await response.json()) as T;
+  } catch (cause) {
+    throw new Error(`${label}: malformed JSON response`, { cause });
+  }
 }
 
 const headersToObject = (headers?: HeadersInit): Record<string, string> =>
@@ -57,7 +57,7 @@ async function withGoogleChatResponse<T>(params: {
   });
   try {
     if (!response.ok) {
-      const text = await readResponseTextLimited(response).catch(() => "");
+      const text = await response.text().catch(() => "");
       throw new Error(`${errorPrefix} ${response.status}: ${text || response.statusText}`);
     }
     return await handleResponse(response);

extensions/googlechat/src/approval-handler.runtime.test.ts

@@ -110,45 +110,6 @@ function createDeferred<T>(): {
   return { promise, reject, resolve };
 }
 
-type CardPayloadWithTextWidgets = {
-  cardsV2: Array<{
-    card: {
-      sections?: Array<{
-        header?: string;
-        widgets?: Array<{ textParagraph?: { text: string } }>;
-      }>;
-    };
-  }>;
-};
-
-function getTextParagraphText(payload: unknown, header: string): string {
-  const text = (payload as CardPayloadWithTextWidgets).cardsV2[0]?.card.sections?.find(
-    (section) => section.header === header,
-  )?.widgets?.[0]?.textParagraph?.text;
-  if (typeof text !== "string") {
-    throw new Error(`Expected ${header} text paragraph`);
-  }
-  return text;
-}
-
-function isUtf16WellFormed(value: string): boolean {
-  for (let index = 0; index < value.length; index += 1) {
-    const codeUnit = value.charCodeAt(index);
-    if (codeUnit >= 0xd800 && codeUnit <= 0xdbff) {
-      const nextCodeUnit = index + 1 < value.length ? value.charCodeAt(index + 1) : -1;
-      if (nextCodeUnit < 0xdc00 || nextCodeUnit > 0xdfff) {
-        return false;
-      }
-      index += 1;
-      continue;
-    }
-    if (codeUnit >= 0xdc00 && codeUnit <= 0xdfff) {
-      return false;
-    }
-  }
-  return true;
-}
-
 describe("googleChatApprovalNativeRuntime", () => {
   async function preparePendingDelivery(view = createPendingView()) {
     const nowMs = Date.now();
@@ -188,31 +149,6 @@ describe("googleChatApprovalNativeRuntime", () => {
     return { pendingPayload, plannedTarget, prepared, request, view };
   }
 
-  it("keeps truncated pending command card text UTF-16 well formed", async () => {
-    const view = createPendingView();
-    view.commandText = `${"a".repeat(1796)}😀${"b".repeat(100)}`;
-
-    const { pendingPayload } = await preparePendingDelivery(view);
-    const commandText = getTextParagraphText(pendingPayload, "Command");
-
-    expect(commandText.length).toBeLessThanOrEqual(1800);
-    expect(commandText.endsWith("...")).toBe(true);
-    expect(isUtf16WellFormed(commandText)).toBe(true);
-    expect(JSON.stringify(pendingPayload.cardsV2)).not.toContain("\\ud83d");
-  });
-
-  it("preserves a complete astral character when it fits before the truncation suffix", async () => {
-    const view = createPendingView();
-    view.commandText = `${"a".repeat(1795)}😀${"b".repeat(100)}`;
-
-    const { pendingPayload } = await preparePendingDelivery(view);
-    const commandText = getTextParagraphText(pendingPayload, "Command");
-
-    expect(commandText).toBe(`${"a".repeat(1795)}😀...`);
-    expect(commandText.length).toBe(1800);
-    expect(isUtf16WellFormed(commandText)).toBe(true);
-  });
-
   it("sends pending cards and updates the delivered message without buttons", async () => {
     sendGoogleChatMessage.mockResolvedValue({ messageName: "spaces/AAA/messages/msg-1" });
     updateGoogleChatMessage.mockResolvedValue({ messageName: "spaces/AAA/messages/msg-1" });

extensions/googlechat/src/approval-handler.runtime.ts

@@ -9,7 +9,6 @@ import { buildChannelApprovalNativeTargetKey } from "openclaw/plugin-sdk/approva
 import type { ExecApprovalDecision } from "openclaw/plugin-sdk/approval-runtime";
 import { createSubsystemLogger } from "openclaw/plugin-sdk/runtime-env";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { resolveGoogleChatAccount, type ResolvedGoogleChatAccount } from "./accounts.js";
 import { sendGoogleChatMessage, updateGoogleChatMessage } from "./api.js";
 import {
@@ -88,7 +87,7 @@ function escapeGoogleChatText(text: string): string {
 }
 
 function truncateText(text: string, maxChars = MAX_TEXT_PARAGRAPH_CHARS): string {
-  return text.length <= maxChars ? text : `${truncateUtf16Safe(text, maxChars - 3)}...`;
+  return text.length <= maxChars ? text : `${text.slice(0, maxChars - 3)}...`;
 }
 
 function buildMetadataText(metadata: readonly { label: string; value: string }[]): string {

extensions/googlechat/src/auth.ts

@@ -1,5 +1,4 @@
 // Googlechat plugin module implements auth behavior.
-import { readProviderJsonResponse } from "openclaw/plugin-sdk/provider-http";
 import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { fetchWithSsrFGuard } from "../runtime-api.js";
 import type { ResolvedGoogleChatAccount } from "./accounts.js";
@@ -18,10 +17,11 @@ const CHAT_CERTS_URL =
   "https://www.googleapis.com/service_accounts/v1/metadata/x509/chat@system.gserviceaccount.com";
 
 async function readGoogleChatCertsResponse(response: Response): Promise<Record<string, string>> {
-  return readProviderJsonResponse<Record<string, string>>(
-    response,
-    "Google Chat cert fetch failed",
-  );
+  try {
+    return (await response.json()) as Record<string, string>;
+  } catch (cause) {
+    throw new Error("Google Chat cert fetch failed: malformed JSON response", { cause });
+  }
 }
 
 // Size-capped to prevent unbounded growth in long-running deployments (#4948)

extensions/googlechat/src/targets.test.ts

@@ -568,137 +568,4 @@ describe("verifyGoogleChatRequest", () => {
     });
     expect(release).toHaveBeenCalledOnce();
   });
-
-  describe("bounded JSON read (readProviderJsonResponse delegation)", () => {
-    afterEach(() => {
-      authTesting.resetGoogleChatAuthForTests();
-      mocks.fetchWithSsrFGuard.mockClear();
-      vi.unstubAllGlobals();
-    });
-
-    it("cancels oversized cert fetch JSON body via the 16 MiB provider cap", async () => {
-      const ONE_MIB = 1024 * 1024;
-      const TOTAL_CHUNKS = 32;
-      const chunk = new Uint8Array(ONE_MIB);
-
-      let bytesPulled = 0;
-      let canceled = false;
-      const oversizedJson = new Response(
-        new ReadableStream<Uint8Array>({
-          pull(controller) {
-            if (bytesPulled >= TOTAL_CHUNKS * ONE_MIB) {
-              controller.close();
-              return;
-            }
-            bytesPulled += chunk.length;
-            controller.enqueue(chunk);
-          },
-          cancel() {
-            canceled = true;
-          },
-        }),
-        { status: 200, headers: { "Content-Type": "application/json" } },
-      );
-      const release = vi.fn(async () => {});
-      mocks.fetchWithSsrFGuard.mockResolvedValueOnce({
-        response: oversizedJson,
-        release,
-      });
-
-      const result = await verifyGoogleChatRequest({
-        bearer: "token",
-        audienceType: "project-number",
-        audience: "123456789",
-      });
-
-      expect(result.ok).toBe(false);
-      expect(result.reason).toMatch(/JSON response exceeds 16777216 bytes/);
-      expect(canceled).toBe(true);
-      expect(bytesPulled).toBeLessThan(TOTAL_CHUNKS * ONE_MIB);
-      expect(release).toHaveBeenCalledOnce();
-    });
-
-    it("rejects oversized sendMessage JSON body via the 16 MiB provider cap", async () => {
-      const ONE_MIB = 1024 * 1024;
-      const TOTAL_CHUNKS = 32;
-      const chunk = new Uint8Array(ONE_MIB);
-
-      let bytesPulled = 0;
-      let canceled = false;
-      const oversizedJson = new Response(
-        new ReadableStream<Uint8Array>({
-          pull(controller) {
-            if (bytesPulled >= TOTAL_CHUNKS * ONE_MIB) {
-              controller.close();
-              return;
-            }
-            bytesPulled += chunk.length;
-            controller.enqueue(chunk);
-          },
-          cancel() {
-            canceled = true;
-          },
-        }),
-        { status: 200, headers: { "Content-Type": "application/json" } },
-      );
-      const release = vi.fn(async () => {});
-      mocks.fetchWithSsrFGuard.mockResolvedValueOnce({
-        response: oversizedJson,
-        release,
-      });
-
-      await expect(
-        sendGoogleChatMessage({
-          account,
-          space: "spaces/AAA",
-          text: "hello",
-        }),
-      ).rejects.toThrow(/Google Chat API request failed: JSON response exceeds 16777216 bytes/);
-
-      expect(canceled).toBe(true);
-      expect(bytesPulled).toBeLessThan(TOTAL_CHUNKS * ONE_MIB);
-    });
-
-    it("caps non-OK sendMessage error bodies before formatting the API error", async () => {
-      const ONE_MIB = 1024 * 1024;
-      const TOTAL_CHUNKS = 32;
-      const chunk = new TextEncoder().encode("x".repeat(ONE_MIB));
-
-      let bytesPulled = 0;
-      let canceled = false;
-      const oversizedError = new Response(
-        new ReadableStream<Uint8Array>({
-          pull(controller) {
-            if (bytesPulled >= TOTAL_CHUNKS * ONE_MIB) {
-              controller.close();
-              return;
-            }
-            bytesPulled += chunk.length;
-            controller.enqueue(chunk);
-          },
-          cancel() {
-            canceled = true;
-          },
-        }),
-        { status: 500, statusText: "Internal Server Error" },
-      );
-      const release = vi.fn(async () => {});
-      mocks.fetchWithSsrFGuard.mockResolvedValueOnce({
-        response: oversizedError,
-        release,
-      });
-
-      await expect(
-        sendGoogleChatMessage({
-          account,
-          space: "spaces/AAA",
-          text: "hello",
-        }),
-      ).rejects.toThrow(/^Google Chat API 500: x+/);
-
-      expect(canceled).toBe(true);
-      expect(bytesPulled).toBeLessThan(TOTAL_CHUNKS * ONE_MIB);
-      expect(release).toHaveBeenCalledOnce();
-    });
-  });
 });

extensions/irc/src/channel.test.ts

@@ -15,21 +15,3 @@ describe("irc outbound chunking", () => {
     expect(ircOutboundBaseAdapter.textChunkLimit).toBe(350);
   });
 });
-
-describe("irc outbound sanitizeText", () => {
-  afterEach(() => {
-    clearIrcRuntime();
-  });
-
-  it("strips internal tool-trace banners before outbound delivery", () => {
-    const text = "Done.\n⚠️ 🛠️ `search repos (agent)` failed";
-
-    expect(ircOutboundBaseAdapter.sanitizeText({ text })).toBe("Done.");
-  });
-
-  it("preserves ordinary assistant prose while sanitizing", () => {
-    const text = "The pipeline has 3 open deals.";
-
-    expect(ircOutboundBaseAdapter.sanitizeText({ text })).toBe(text);
-  });
-});

extensions/irc/src/outbound-base.ts

@@ -1,6 +1,5 @@
 // Irc plugin module implements outbound base behavior.
 import { sanitizeForPlainText } from "openclaw/plugin-sdk/channel-outbound";
-import { sanitizeAssistantVisibleText } from "openclaw/plugin-sdk/text-chunking";
 import { chunkTextForOutbound } from "./channel-api.js";
 
 export const ircOutboundBaseAdapter = {
@@ -8,9 +7,5 @@ export const ircOutboundBaseAdapter = {
   chunker: chunkTextForOutbound,
   chunkerMode: "markdown" as const,
   textChunkLimit: 350,
-  // IRC's plain-text pass does not remove assistant scaffolding. Run the
-  // canonical delivery sanitizer first so internal tool traces are dropped
-  // before channel formatting.
-  sanitizeText: ({ text }: { text: string }) =>
-    sanitizeForPlainText(sanitizeAssistantVisibleText(text)),
+  sanitizeText: ({ text }: { text: string }) => sanitizeForPlainText(text),
 };

extensions/matrix/src/matrix/monitor/thread-context.test.ts

@@ -23,23 +23,6 @@ describe("matrix thread context", () => {
     ).toBe("Thread starter body");
   });
 
-  it("truncates long thread starter bodies on code-point boundaries", () => {
-    const summary = summarizeMatrixThreadStarterEvent({
-      event_id: "$root",
-      sender: "@alice:example.org",
-      type: "m.room.message",
-      origin_server_ts: Date.now(),
-      content: {
-        msgtype: "m.text",
-        // 496 "a" + astral emoji (surrogate pair at units 496-497) + tail.
-        // A raw slice(0, 497) would cut the pair and leave a lone high surrogate.
-        body: `${"a".repeat(496)}\u{1F600}bcd`,
-      },
-    } as MatrixRawEvent);
-    expect(summary).toBe(`${"a".repeat(496)}...`);
-    expect(summary && /[\uD800-\uDFFF]/.test(summary)).toBe(false);
-  });
-
   it("marks media-only thread starter events instead of returning bare filenames", () => {
     expect(
       summarizeMatrixThreadStarterEvent({

extensions/matrix/src/matrix/monitor/thread-context.ts

@@ -1,5 +1,4 @@
 // Matrix plugin module implements thread context behavior.
-import { sliceUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import type { MatrixClient } from "../sdk.js";
 import { summarizeMatrixMessageContextEvent, trimMatrixMaybeString } from "./context-summary.js";
 import type { MatrixRawEvent } from "./types.js";
@@ -18,7 +17,7 @@ function truncateThreadStarterBody(value: string): string {
   if (value.length <= MAX_THREAD_STARTER_BODY_LENGTH) {
     return value;
   }
-  return `${sliceUtf16Safe(value, 0, MAX_THREAD_STARTER_BODY_LENGTH - 3)}...`;
+  return `${value.slice(0, MAX_THREAD_STARTER_BODY_LENGTH - 3)}...`;
 }
 
 export function summarizeMatrixThreadStarterEvent(event: MatrixRawEvent): string | undefined {

extensions/memory-core/src/memory/qmd-manager.test.ts

@@ -199,17 +199,11 @@ vi.mock("openclaw/plugin-sdk/file-lock", async () => {
 import { spawn as mockedSpawn } from "node:child_process";
 import type { OpenClawConfig } from "openclaw/plugin-sdk/memory-core-host-engine-foundation";
 import {
-  type MemorySearchRuntimeDebug,
   requireNodeSqlite,
   resolveMemoryBackendConfig,
 } from "openclaw/plugin-sdk/memory-core-host-engine-storage";
 import { MAX_TIMER_TIMEOUT_MS } from "openclaw/plugin-sdk/number-runtime";
 import { formatSessionTranscriptMemoryHitKey } from "openclaw/plugin-sdk/session-transcript-hit";
-import {
-  configureMemoryCoreDreamingState,
-  configureMemoryCoreDreamingStateForTests,
-  resetMemoryCoreDreamingStateForTests,
-} from "../dreaming-state.js";
 import { resolveQmdSessionArtifactIdentity } from "../qmd-session-artifacts.js";
 import { QmdMemoryManager, resolveQmdMcporterSearchProcessTimeoutMs } from "./qmd-manager.js";
 
@@ -276,14 +270,6 @@ describe("QmdMemoryManager", () => {
     return mock.mock.calls.map((call: unknown[]) => String(call[0]));
   }
 
-  function qmdCommandCalls(): string[][] {
-    return spawnMock.mock.calls.map((call: unknown[]) => call[1] as string[]);
-  }
-
-  function countQmdCommand(predicate: (args: string[]) => boolean): number {
-    return qmdCommandCalls().filter(predicate).length;
-  }
-
   function expectMockMessageContains(mock: Mock, text: string): void {
     expect(mockMessages(mock).join("\n")).toContain(text);
   }
@@ -304,387 +290,6 @@ describe("QmdMemoryManager", () => {
     );
   });
 
-  it("reuses persisted collection validation across transient cli managers", async () => {
-    await configureMemoryCoreDreamingStateForTests();
-    const first = await createManager({ mode: "cli" });
-    await first.manager.close();
-    expect(countQmdCommand((args) => args[0] === "collection" && args[1] === "list")).toBe(1);
-
-    spawnMock.mockClear();
-    const second = await createManager({ mode: "cli" });
-    await second.manager.close();
-
-    expect(countQmdCommand((args) => args[0] === "collection" && args[1] === "list")).toBe(0);
-    expect(countQmdCommand((args) => args[0] === "collection" && args[1] === "show")).toBe(0);
-    expect(countQmdCommand((args) => args[0] === "collection" && args[1] === "add")).toBe(0);
-  });
-
-  it("does not cache incomplete collection validation", async () => {
-    await configureMemoryCoreDreamingStateForTests();
-    spawnMock.mockImplementation((_cmd: string, args: string[]) => {
-      if (args[0] === "collection" && args[1] === "add") {
-        const child = createMockChild({ autoClose: false });
-        emitAndClose(child, "stderr", "permission denied", 1);
-        return child;
-      }
-      return createMockChild();
-    });
-
-    const first = await createManager({ mode: "cli" });
-    await first.manager.close();
-
-    spawnMock.mockClear();
-    spawnMock.mockImplementation(() => createMockChild());
-    const second = await createManager({ mode: "cli" });
-    await second.manager.close();
-
-    expect(countQmdCommand((args) => args[0] === "collection" && args[1] === "list")).toBe(1);
-    expect(countQmdCommand((args) => args[0] === "collection" && args[1] === "add")).toBe(1);
-  });
-
-  it("runs collection validation when the runtime cache store is unavailable", async () => {
-    configureMemoryCoreDreamingState(() => {
-      throw new Error("state store unavailable");
-    });
-    try {
-      const manager = await createManager({ mode: "cli" });
-      await manager.manager.close();
-    } finally {
-      await configureMemoryCoreDreamingStateForTests();
-    }
-
-    expect(countQmdCommand((args) => args[0] === "collection" && args[1] === "list")).toBe(1);
-    expect(countQmdCommand((args) => args[0] === "collection" && args[1] === "add")).toBe(1);
-  });
-
-  it("reports collection validation debug only once per validation run", async () => {
-    await configureMemoryCoreDreamingStateForTests();
-    spawnMock.mockImplementation((_cmd: string, args: string[]) => {
-      if (args[0] === "query" || args[0] === "search" || args[0] === "vsearch") {
-        const child = createMockChild({ autoClose: false });
-        emitAndClose(child, "stdout", "[]");
-        return child;
-      }
-      return createMockChild();
-    });
-    const { manager } = await createManager({ mode: "cli" });
-    const firstDebug: MemorySearchRuntimeDebug[] = [];
-    const secondDebug: MemorySearchRuntimeDebug[] = [];
-
-    await manager.search("fact", {
-      sessionKey: "agent:main:slack:dm:u123",
-      onDebug: (entry) => {
-        firstDebug.push(entry);
-      },
-    });
-    await manager.search("fact again", {
-      sessionKey: "agent:main:slack:dm:u123",
-      onDebug: (entry) => {
-        secondDebug.push(entry);
-      },
-    });
-
-    expect(firstDebug.at(-1)?.qmd?.collectionValidation?.cacheState).toBe("write");
-    expect(secondDebug.at(-1)?.qmd?.collectionValidation).toBeUndefined();
-  });
-
-  it("misses collection validation cache when managed collection config changes", async () => {
-    await configureMemoryCoreDreamingStateForTests();
-    const first = await createManager({ mode: "cli" });
-    await first.manager.close();
-
-    const otherWorkspaceDir = path.join(tmpRoot, "other-workspace");
-    await fs.mkdir(otherWorkspaceDir, { recursive: true });
-    const changedCfg = {
-      ...cfg,
-      memory: {
-        backend: "qmd",
-        qmd: {
-          ...cfg.memory?.qmd,
-          paths: [{ path: otherWorkspaceDir, pattern: "**/*.md", name: "workspace" }],
-        },
-      },
-    } as OpenClawConfig;
-
-    spawnMock.mockClear();
-    const second = await createManager({ mode: "cli", cfg: changedCfg });
-    await second.manager.close();
-
-    expect(countQmdCommand((args) => args[0] === "collection" && args[1] === "list")).toBe(1);
-  });
-
-  it("bypasses validation cache for missing-collection search repair", async () => {
-    await configureMemoryCoreDreamingStateForTests();
-    const { manager } = await createManager();
-    spawnMock.mockClear();
-    let searchAttempts = 0;
-    spawnMock.mockImplementation((_cmd: string, args: string[]) => {
-      if (args[0] === "query" || args[0] === "search" || args[0] === "vsearch") {
-        const child = createMockChild({ autoClose: false });
-        searchAttempts += 1;
-        if (searchAttempts === 1) {
-          emitAndClose(child, "stderr", "collection workspace-main not found", 1);
-        } else {
-          emitAndClose(child, "stdout", "[]");
-        }
-        return child;
-      }
-      return createMockChild();
-    });
-    const debug: MemorySearchRuntimeDebug[] = [];
-
-    await manager.search("fact", {
-      sessionKey: "agent:main:slack:dm:u123",
-      onDebug: (entry) => {
-        debug.push(entry);
-      },
-    });
-
-    expect(searchAttempts).toBe(2);
-    expect(countQmdCommand((args) => args[0] === "collection" && args[1] === "list")).toBe(1);
-    expect(debug.at(-1)?.qmd?.collectionValidation?.cacheState).toBe("bypass-force");
-  });
-
-  it("reuses persisted qmd multi-collection support probe across managers", async () => {
-    await configureMemoryCoreDreamingStateForTests();
-    cfg = {
-      ...cfg,
-      memory: {
-        backend: "qmd",
-        qmd: {
-          includeDefaultMemory: false,
-          update: { interval: "0s", debounceMs: 60_000, onBoot: false },
-          sessions: { enabled: true },
-          paths: [{ path: workspaceDir, pattern: "**/*.md", name: "workspace" }],
-        },
-      },
-    } as OpenClawConfig;
-    spawnMock.mockImplementation((_cmd: string, args: string[]) => {
-      if (args[0] === "--help") {
-        const child = createMockChild({ autoClose: false });
-        emitAndClose(child, "stdout", "Usage: qmd search -c one or more collections");
-        return child;
-      }
-      if (args[0] === "search") {
-        const child = createMockChild({ autoClose: false });
-        emitAndClose(child, "stdout", "[]");
-        return child;
-      }
-      return createMockChild();
-    });
-
-    const first = await createManager({ mode: "cli" });
-    await first.manager.search("fact", {
-      sessionKey: "agent:main:slack:dm:u123",
-    });
-    await first.manager.close();
-    expect(countQmdCommand((args) => args[0] === "--help")).toBe(1);
-
-    spawnMock.mockClear();
-    const second = await createManager({ mode: "cli" });
-    const debug: MemorySearchRuntimeDebug[] = [];
-    await second.manager.search("fact", {
-      sessionKey: "agent:main:slack:dm:u123",
-      onDebug: (entry) => {
-        debug.push(entry);
-      },
-    });
-    await second.manager.close();
-
-    expect(countQmdCommand((args) => args[0] === "--help")).toBe(0);
-    expect(debug.at(-1)?.qmd?.multiCollectionProbe?.cacheState).toBe("hit");
-    expect(debug.at(-1)?.qmd?.searchPlan?.groupCount).toBe(2);
-  });
-
-  it("reports multi-collection probe debug only when the probe runs", async () => {
-    await configureMemoryCoreDreamingStateForTests();
-    cfg = {
-      ...cfg,
-      memory: {
-        backend: "qmd",
-        qmd: {
-          includeDefaultMemory: false,
-          update: { interval: "0s", debounceMs: 60_000, onBoot: false },
-          sessions: { enabled: true },
-          paths: [{ path: workspaceDir, pattern: "**/*.md", name: "workspace" }],
-        },
-      },
-    } as OpenClawConfig;
-    spawnMock.mockImplementation((_cmd: string, args: string[]) => {
-      if (args[0] === "--help") {
-        const child = createMockChild({ autoClose: false });
-        emitAndClose(child, "stdout", "Usage: qmd search -c one or more collections");
-        return child;
-      }
-      if (args[0] === "search") {
-        const child = createMockChild({ autoClose: false });
-        emitAndClose(child, "stdout", "[]");
-        return child;
-      }
-      return createMockChild();
-    });
-    const { manager } = await createManager({ mode: "cli" });
-    const firstDebug: MemorySearchRuntimeDebug[] = [];
-    const secondDebug: MemorySearchRuntimeDebug[] = [];
-
-    await manager.search("fact", {
-      sessionKey: "agent:main:slack:dm:u123",
-      onDebug: (entry) => {
-        firstDebug.push(entry);
-      },
-    });
-    await manager.search("fact again", {
-      sessionKey: "agent:main:slack:dm:u123",
-      onDebug: (entry) => {
-        secondDebug.push(entry);
-      },
-    });
-
-    expect(firstDebug.at(-1)?.qmd?.multiCollectionProbe?.cacheState).toBe("write");
-    expect(secondDebug.at(-1)?.qmd?.multiCollectionProbe).toBeUndefined();
-  });
-
-  it("keeps concurrent search debug isolated on a shared qmd manager", async () => {
-    await configureMemoryCoreDreamingStateForTests();
-    cfg = {
-      ...cfg,
-      memory: {
-        backend: "qmd",
-        qmd: {
-          includeDefaultMemory: false,
-          update: { interval: "0s", debounceMs: 60_000, onBoot: false },
-          sessions: { enabled: true },
-          paths: [{ path: workspaceDir, pattern: "**/*.md", name: "workspace" }],
-        },
-      },
-    } as OpenClawConfig;
-    let firstSearchChild: MockChild | undefined;
-    let searchCalls = 0;
-    spawnMock.mockImplementation((_cmd: string, args: string[]) => {
-      if (args[0] === "search") {
-        searchCalls += 1;
-        const child = createMockChild({ autoClose: false });
-        if (searchCalls === 1) {
-          firstSearchChild = child;
-          return child;
-        }
-        emitAndClose(child, "stdout", "[]");
-        return child;
-      }
-      if (args[0] === "--version") {
-        const child = createMockChild({ autoClose: false });
-        emitAndClose(child, "stdout", "qmd 1.0.0");
-        return child;
-      }
-      return createMockChild();
-    });
-    const { manager } = await createManager({ mode: "full" });
-    const firstDebug: MemorySearchRuntimeDebug[] = [];
-    const secondDebug: MemorySearchRuntimeDebug[] = [];
-
-    const firstSearch = manager.search("memory fact", {
-      sessionKey: "agent:main:slack:dm:u123",
-      sources: ["memory"],
-      onDebug: (entry) => {
-        firstDebug.push(entry);
-      },
-    });
-    await waitUntil(() => searchCalls === 1);
-    const secondSearch = manager.search("session fact", {
-      sessionKey: "agent:main:slack:dm:u123",
-      sources: ["sessions"],
-      onDebug: (entry) => {
-        secondDebug.push(entry);
-      },
-    });
-    await waitUntil(() => searchCalls === 2);
-    emitAndClose(requireValue(firstSearchChild, "first search child missing"), "stdout", "[]");
-
-    await Promise.all([firstSearch, secondSearch]);
-
-    expect(firstDebug.at(-1)?.qmd?.searchPlan?.sources).toEqual(["memory"]);
-    expect(secondDebug.at(-1)?.qmd?.searchPlan?.sources).toEqual(["sessions"]);
-  });
-
-  it("rewrites stale multi-collection probe cache when combined filters are rejected", async () => {
-    await configureMemoryCoreDreamingStateForTests();
-    const otherWorkspaceDir = path.join(tmpRoot, "other-workspace");
-    await fs.mkdir(otherWorkspaceDir, { recursive: true });
-    cfg = {
-      ...cfg,
-      memory: {
-        backend: "qmd",
-        qmd: {
-          includeDefaultMemory: false,
-          update: { interval: "0s", debounceMs: 60_000, onBoot: false },
-          paths: [
-            { path: workspaceDir, pattern: "**/*.md", name: "workspace" },
-            { path: otherWorkspaceDir, pattern: "**/*.md", name: "other" },
-          ],
-        },
-      },
-    } as OpenClawConfig;
-    const isCombinedSearch = (args: string[]) =>
-      (args[0] === "search" || args[0] === "query") &&
-      args.filter((token) => token === "-c").length > 1;
-    spawnMock.mockImplementation((_cmd: string, args: string[]) => {
-      if (args[0] === "--version") {
-        const child = createMockChild({ autoClose: false });
-        emitAndClose(child, "stdout", "qmd 1.0.0");
-        return child;
-      }
-      if (args[0] === "--help") {
-        const child = createMockChild({ autoClose: false });
-        emitAndClose(child, "stdout", "Usage: qmd search -c one or more collections");
-        return child;
-      }
-      if (isCombinedSearch(args)) {
-        const child = createMockChild({ autoClose: false });
-        emitAndClose(child, "stderr", "unknown flag: -c", 1);
-        return child;
-      }
-      if (args[0] === "search" || args[0] === "query" || args[0] === "vsearch") {
-        const child = createMockChild({ autoClose: false });
-        emitAndClose(child, "stdout", "[]");
-        return child;
-      }
-      return createMockChild();
-    });
-
-    const first = await createManager({ mode: "cli" });
-    const firstDebug: MemorySearchRuntimeDebug[] = [];
-    await first.manager.search("fact", {
-      sessionKey: "agent:main:slack:dm:u123",
-      onDebug: (entry) => {
-        firstDebug.push(entry);
-      },
-    });
-    await first.manager.close();
-
-    expect(firstDebug.at(-1)?.qmd?.multiCollectionProbe).toMatchObject({
-      cacheState: "write",
-      supported: false,
-    });
-
-    spawnMock.mockClear();
-    const second = await createManager({ mode: "cli" });
-    const secondDebug: MemorySearchRuntimeDebug[] = [];
-    await second.manager.search("fact", {
-      sessionKey: "agent:main:slack:dm:u123",
-      onDebug: (entry) => {
-        secondDebug.push(entry);
-      },
-    });
-    await second.manager.close();
-
-    expect(countQmdCommand((args) => args[0] === "--help")).toBe(0);
-    expect(countQmdCommand(isCombinedSearch)).toBe(0);
-    expect(secondDebug.at(-1)?.qmd?.multiCollectionProbe).toMatchObject({
-      cacheState: "hit",
-      supported: false,
-    });
-  });
-
   async function expectPathMissing(targetPath: string): Promise<void> {
     try {
       await fs.lstat(targetPath);
@@ -814,7 +419,6 @@ describe("QmdMemoryManager", () => {
     delete (globalThis as Record<PropertyKey, unknown>)[MCPORTER_STATE_KEY];
     delete (globalThis as Record<PropertyKey, unknown>)[QMD_EMBED_QUEUE_KEY];
     delete (globalThis as Record<PropertyKey, unknown>)[MEMORY_EMBEDDING_PROVIDERS_KEY];
-    resetMemoryCoreDreamingStateForTests();
   });
 
   it("debounces back-to-back sync calls", async () => {

extensions/memory-core/src/memory/qmd-manager.ts

@@ -74,16 +74,6 @@ import {
   type QmdSessionArtifactMapping,
 } from "../qmd-session-artifacts.js";
 import { resolveQmdCollectionPatternFlags, type QmdCollectionPatternFlag } from "./qmd-compat.js";
-import {
-  clearQmdMultiCollectionProbeCache,
-  readQmdCollectionValidationCache,
-  readQmdMultiCollectionProbeCache,
-  writeQmdCollectionValidationCache,
-  writeQmdMultiCollectionProbeCache,
-  type QmdRuntimeCollectionValidationCacheContext,
-  type QmdRuntimeManagedCollection,
-  type QmdRuntimeMultiCollectionProbeCacheContext,
-} from "./qmd-runtime-cache.js";
 import {
   countChokidarWatchedEntries,
   type MemoryWatchPressureWarningState,
@@ -334,19 +324,6 @@ type ManagedCollection = {
   kind: "memory" | "custom" | "sessions";
 };
 
-type QmdCollectionValidationDebug = NonNullable<
-  NonNullable<MemorySearchRuntimeDebug["qmd"]>["collectionValidation"]
->;
-type QmdMultiCollectionProbeDebug = NonNullable<
-  NonNullable<MemorySearchRuntimeDebug["qmd"]>["multiCollectionProbe"]
->;
-type QmdSearchPlanDebug = NonNullable<NonNullable<MemorySearchRuntimeDebug["qmd"]>["searchPlan"]>;
-type QmdSearchRuntimeDebugContext = {
-  collectionValidation?: QmdCollectionValidationDebug;
-  multiCollectionProbe?: QmdMultiCollectionProbeDebug;
-  searchPlan?: QmdSearchPlanDebug;
-};
-
 type QmdManagerMode = "full" | "status" | "cli";
 type QmdManagerRuntimeConfig = {
   workspaceDir: string;
@@ -464,7 +441,6 @@ export class QmdMemoryManager implements MemorySearchManager {
   private mode: QmdManagerMode = "full";
   private readonly closeSignal: Promise<void>;
   private resolveCloseSignal!: () => void;
-  private qmdRuntimeIdentityPromise: Promise<string> | null = null;
   private db: SqliteDatabase | null = null;
   private lastUpdateAt: number | null = null;
   private lastEmbedAt: number | null = null;
@@ -477,7 +453,6 @@ export class QmdMemoryManager implements MemorySearchManager {
   private readonly sessionWarm = new Set<string>();
   private collectionPatternFlag: QmdCollectionPatternFlag | null = "--mask";
   private multiCollectionFilterSupported: boolean | null = null;
-  private pendingCollectionValidationDebug: QmdCollectionValidationDebug | undefined;
 
   private constructor(params: {
     agentId: string;
@@ -637,171 +612,11 @@ export class QmdMemoryManager implements MemorySearchManager {
     }
   }
 
-  private qmdRuntimeCacheSources(): string[] {
-    return [...this.sources].toSorted();
-  }
-
-  private qmdRuntimeCacheCollections(): QmdRuntimeManagedCollection[] {
-    return this.qmd.collections.map((collection) => ({
-      name: collection.name,
-      kind: collection.kind,
-      path: collection.path,
-      pattern: collection.pattern,
-    }));
-  }
-
-  private buildQmdRuntimeEnvironmentHash(): string {
-    const relevantEnv = Object.fromEntries(
-      Object.keys(this.env)
-        .filter(
-          (key) =>
-            key === "PATH" ||
-            key === "HOME" ||
-            key === "LOCALAPPDATA" ||
-            key === "XDG_CONFIG_HOME" ||
-            key === "XDG_CACHE_HOME" ||
-            key === "QMD_CONFIG_DIR" ||
-            key.startsWith("QMD_"),
-        )
-        .toSorted()
-        .map((key) => [key, this.env[key] ?? ""]),
-    );
-    return crypto.createHash("sha256").update(JSON.stringify(relevantEnv)).digest("hex");
-  }
-
-  private async buildQmdCollectionValidationCacheContext(): Promise<QmdRuntimeCollectionValidationCacheContext> {
-    return {
-      workspaceDir: this.workspaceDir,
-      agentId: this.agentId,
-      qmdCommand: this.qmd.command,
-      qmdVersion: await this.resolveQmdRuntimeIdentity(),
-      qmdEnvironmentHash: this.buildQmdRuntimeEnvironmentHash(),
-      qmdIndexPath: this.indexPath,
-      searchMode: this.qmd.searchMode,
-      collections: this.qmdRuntimeCacheCollections(),
-      sources: this.qmdRuntimeCacheSources(),
-    };
-  }
-
-  private async buildQmdMultiCollectionProbeCacheContext(): Promise<QmdRuntimeMultiCollectionProbeCacheContext> {
-    return {
-      workspaceDir: this.workspaceDir,
-      agentId: this.agentId,
-      qmdCommand: this.qmd.command,
-      qmdVersion: await this.resolveQmdRuntimeIdentity(),
-      qmdEnvironmentHash: this.buildQmdRuntimeEnvironmentHash(),
-      qmdIndexPath: this.indexPath,
-      searchMode: this.qmd.searchMode,
-      sources: this.qmdRuntimeCacheSources(),
-    };
-  }
-
-  private resolveQmdRuntimeIdentity(): Promise<string> {
-    this.qmdRuntimeIdentityPromise ??= this.readQmdRuntimeIdentity();
-    return this.qmdRuntimeIdentityPromise;
-  }
-
-  private async readQmdRuntimeIdentity(): Promise<string> {
-    const commandIdentity = `command:${this.qmd.command}`;
-    try {
-      const result = await this.runQmd(["--version"], {
-        timeoutMs: Math.min(this.qmd.limits.timeoutMs, 2_000),
-      });
-      const versionText = `${result.stdout}\n${result.stderr}`.trim();
-      return versionText ? `${commandIdentity};version:${versionText}` : commandIdentity;
-    } catch {
-      return commandIdentity;
-    }
-  }
-
-  private recordSearchPlanDebug(params: {
-    debugContext: QmdSearchRuntimeDebugContext;
-    command: "query" | "search" | "vsearch";
-    collectionNames: string[];
-    collectionGroups: string[][];
-  }): void {
-    const sources = uniqueValues(
-      params.collectionNames
-        .map((collectionName) => this.collectionRoots.get(collectionName)?.kind)
-        .filter((source): source is MemorySource => Boolean(source)),
-    );
-    params.debugContext.searchPlan = {
-      command: params.command,
-      collectionCount: params.collectionNames.length,
-      groupCount: params.collectionGroups.length,
-      sources,
-    };
-  }
-
-  private beginQmdSearchRuntimeDebug(): QmdSearchRuntimeDebugContext {
-    const debugContext: QmdSearchRuntimeDebugContext = {};
-    if (this.pendingCollectionValidationDebug) {
-      debugContext.collectionValidation = this.pendingCollectionValidationDebug;
-      this.pendingCollectionValidationDebug = undefined;
-    }
-    return debugContext;
-  }
-
-  private consumeQmdRuntimeDebug(
-    debugContext: QmdSearchRuntimeDebugContext,
-  ): MemorySearchRuntimeDebug["qmd"] | undefined {
-    const debug: NonNullable<MemorySearchRuntimeDebug["qmd"]> = {};
-    if (debugContext.collectionValidation) {
-      debug.collectionValidation = debugContext.collectionValidation;
-    }
-    if (debugContext.multiCollectionProbe) {
-      debug.multiCollectionProbe = debugContext.multiCollectionProbe;
-    }
-    if (debugContext.searchPlan) {
-      debug.searchPlan = debugContext.searchPlan;
-    }
-    return Object.keys(debug).length > 0 ? debug : undefined;
-  }
-
-  private async ensureCollectionPathsBestEffort(): Promise<void> {
-    for (const collection of this.qmd.collections) {
-      try {
-        await this.ensureCollectionPath(collection);
-      } catch (err) {
-        log.warn(
-          `qmd collection path prepare failed for ${collection.name}: ${formatErrorMessage(err)}`,
-        );
-      }
-    }
-  }
-
-  private async ensureCollections(options?: {
-    force?: boolean;
-    debugContext?: QmdSearchRuntimeDebugContext;
-  }): Promise<void> {
-    const startedAt = Date.now();
-    const cacheContext = await this.buildQmdCollectionValidationCacheContext();
-    if (!options?.force) {
-      const cached = await readQmdCollectionValidationCache(cacheContext);
-      if (cached.state === "hit") {
-        await this.ensureCollectionPathsBestEffort();
-        const debug: QmdCollectionValidationDebug = {
-          cacheState: "hit",
-          elapsedMs: Math.max(0, Date.now() - startedAt),
-          collectionCount: cached.value.validation.collectionCount,
-          listCalls: 0,
-          showCalls: 0,
-        };
-        if (options?.debugContext) {
-          options.debugContext.collectionValidation = debug;
-        } else {
-          this.pendingCollectionValidationDebug = debug;
-        }
-        return;
-      }
-    }
-
-    const stats = { listCalls: 0, showCalls: 0 };
-    let validationComplete = true;
+  private async ensureCollections(): Promise<void> {
     // QMD collections are persisted inside the index database and must be created
     // via the CLI. Prefer listing existing collections when supported, otherwise
     // fall back to best-effort idempotent `qmd collection add`.
-    const existing = await this.listCollectionsBestEffort(stats);
+    const existing = await this.listCollectionsBestEffort();
 
     await this.migrateLegacyUnscopedCollections(existing);
 
@@ -816,7 +631,6 @@ export class QmdMemoryManager implements MemorySearchManager {
         } catch (err) {
           const message = formatErrorMessage(err);
           if (!this.isCollectionMissingError(message)) {
-            validationComplete = false;
             log.warn(`qmd collection remove failed for ${collection.name}: ${message}`);
           }
         }
@@ -847,36 +661,13 @@ export class QmdMemoryManager implements MemorySearchManager {
               pattern: collection.pattern,
             });
           } else {
-            validationComplete = false;
             log.warn(`qmd collection add skipped for ${collection.name}: ${message}`);
           }
           continue;
         }
-        validationComplete = false;
         log.warn(`qmd collection add failed for ${collection.name}: ${message}`);
       }
     }
-    const wroteCache = validationComplete
-      ? await writeQmdCollectionValidationCache(cacheContext)
-      : false;
-    const debug: QmdCollectionValidationDebug = {
-      cacheState: validationComplete
-        ? options?.force
-          ? "bypass-force"
-          : wroteCache
-            ? "write"
-            : "error"
-        : "error",
-      elapsedMs: Math.max(0, Date.now() - startedAt),
-      collectionCount: this.qmd.collections.length,
-      listCalls: stats.listCalls,
-      showCalls: stats.showCalls,
-    };
-    if (options?.debugContext) {
-      options.debugContext.collectionValidation = debug;
-    } else {
-      this.pendingCollectionValidationDebug = debug;
-    }
   }
 
   private async tryRebindSameNameCollection(params: {
@@ -922,15 +713,9 @@ export class QmdMemoryManager implements MemorySearchManager {
     );
   }
 
-  private async listCollectionsBestEffort(stats?: {
-    listCalls: number;
-    showCalls: number;
-  }): Promise<Map<string, ListedCollection>> {
+  private async listCollectionsBestEffort(): Promise<Map<string, ListedCollection>> {
     const existing = new Map<string, ListedCollection>();
     try {
-      if (stats) {
-        stats.listCalls += 1;
-      }
       const result = await this.runQmd(["collection", "list", "--json"], {
         timeoutMs: this.qmd.update.commandTimeoutMs,
       });
@@ -952,9 +737,6 @@ export class QmdMemoryManager implements MemorySearchManager {
         continue;
       }
       try {
-        if (stats) {
-          stats.showCalls += 1;
-        }
         const showResult = await this.runQmd(["collection", "show", collection.name], {
           timeoutMs: this.qmd.update.commandTimeoutMs,
         });
@@ -1174,17 +956,14 @@ export class QmdMemoryManager implements MemorySearchManager {
     );
   }
 
-  private async tryRepairMissingCollectionSearch(
-    err: unknown,
-    debugContext: QmdSearchRuntimeDebugContext,
-  ): Promise<boolean> {
+  private async tryRepairMissingCollectionSearch(err: unknown): Promise<boolean> {
     if (!this.isMissingCollectionSearchError(err)) {
       return false;
     }
     log.warn(
       "qmd search failed because a managed collection is missing; repairing collections and retrying once",
     );
-    await this.ensureCollections({ force: true, debugContext });
+    await this.ensureCollections();
     return true;
   }
 
@@ -1539,7 +1318,6 @@ export class QmdMemoryManager implements MemorySearchManager {
     if (searchSignal?.aborted) {
       throw asAbortError(searchSignal);
     }
-    const debugContext = this.beginQmdSearchRuntimeDebug();
     const trimmed = query.trim();
     if (!trimmed) {
       return [];
@@ -1566,7 +1344,6 @@ export class QmdMemoryManager implements MemorySearchManager {
     const runSearchAttempt = async (
       allowMissingCollectionRepair: boolean,
     ): Promise<QmdQueryResult[]> => {
-      let attemptedCombinedCollectionFilter = false;
       try {
         if (mcporterEnabled) {
           const minScore = opts?.minScore ?? 0;
@@ -1625,15 +1402,7 @@ export class QmdMemoryManager implements MemorySearchManager {
         const collectionGroups = await this.resolveCollectionSearchGroups(
           collectionNames,
           searchSignal,
-          debugContext,
         );
-        this.recordSearchPlanDebug({
-          debugContext,
-          command: qmdSearchCommand,
-          collectionNames,
-          collectionGroups,
-        });
-        attemptedCombinedCollectionFilter = collectionGroups.some((group) => group.length > 1);
         if (collectionGroups.length > 1) {
           return await this.runQueryAcrossCollectionGroups(
             trimmed,
@@ -1655,9 +1424,6 @@ export class QmdMemoryManager implements MemorySearchManager {
           qmdSearchCommand !== "query" &&
           this.isUnsupportedQmdOptionError(err)
         ) {
-          if (attemptedCombinedCollectionFilter) {
-            await this.markQmdMultiCollectionFiltersUnsupported(debugContext);
-          }
           effectiveSearchMode = "query";
           searchFallbackReason = "unsupported-search-flags";
           log.warn(
@@ -1667,14 +1433,7 @@ export class QmdMemoryManager implements MemorySearchManager {
             const collectionGroups = await this.resolveCollectionSearchGroups(
               collectionNames,
               searchSignal,
-              debugContext,
             );
-            this.recordSearchPlanDebug({
-              debugContext,
-              command: "query",
-              collectionNames,
-              collectionGroups,
-            });
             if (collectionGroups.length > 1) {
               return await this.runQueryAcrossCollectionGroups(
                 trimmed,
@@ -1704,7 +1463,7 @@ export class QmdMemoryManager implements MemorySearchManager {
     try {
       parsed = await runSearchAttempt(true);
     } catch (err) {
-      if (!(await this.tryRepairMissingCollectionSearch(err, debugContext))) {
+      if (!(await this.tryRepairMissingCollectionSearch(err))) {
         throw err instanceof Error ? err : new Error(String(err));
       }
       parsed = await runSearchAttempt(false);
@@ -1753,7 +1512,6 @@ export class QmdMemoryManager implements MemorySearchManager {
       configuredMode: qmdSearchCommand,
       effectiveMode: effectiveSearchMode,
       fallback: searchFallbackReason,
-      qmd: this.consumeQmdRuntimeDebug(debugContext),
     });
     let ranked = results;
     if (opts?.sources?.length) {
@@ -3612,41 +3370,23 @@ export class QmdMemoryManager implements MemorySearchManager {
   private async resolveCollectionSearchGroups(
     collectionNames: string[],
     signal?: AbortSignal,
-    debugContext?: QmdSearchRuntimeDebugContext,
   ): Promise<string[][]> {
     if (collectionNames.length <= 1) {
       return [collectionNames];
     }
-    if (!(await this.supportsQmdMultiCollectionFilters(signal, debugContext))) {
+    if (!(await this.supportsQmdMultiCollectionFilters(signal))) {
       return collectionNames.map((collectionName) => [collectionName]);
     }
     return this.groupCollectionNamesBySource(collectionNames);
   }
 
-  private async supportsQmdMultiCollectionFilters(
-    signal?: AbortSignal,
-    debugContext?: QmdSearchRuntimeDebugContext,
-  ): Promise<boolean> {
+  private async supportsQmdMultiCollectionFilters(signal?: AbortSignal): Promise<boolean> {
     if (signal?.aborted) {
       throw asAbortError(signal);
     }
     if (this.multiCollectionFilterSupported !== null) {
       return this.multiCollectionFilterSupported;
     }
-    const startedAt = Date.now();
-    const cacheContext = await this.buildQmdMultiCollectionProbeCacheContext();
-    const cached = await readQmdMultiCollectionProbeCache(cacheContext);
-    if (cached.state === "hit") {
-      this.multiCollectionFilterSupported = cached.value.multiCollectionProbe.supported;
-      if (debugContext) {
-        debugContext.multiCollectionProbe = {
-          cacheState: "hit",
-          elapsedMs: Math.max(0, Date.now() - startedAt),
-          supported: this.multiCollectionFilterSupported,
-        };
-      }
-      return this.multiCollectionFilterSupported;
-    }
     try {
       const result = await this.runQmd(["--help"], {
         timeoutMs: Math.min(this.qmd.limits.timeoutMs, 5_000),
@@ -3655,50 +3395,17 @@ export class QmdMemoryManager implements MemorySearchManager {
       const helpText = `${result.stdout}\n${result.stderr}`;
       this.multiCollectionFilterSupported =
         /\b(?:one or more collections|collection\(s\)|multiple -c flags)\b/i.test(helpText);
-      const wroteCache = await writeQmdMultiCollectionProbeCache(
-        cacheContext,
-        this.multiCollectionFilterSupported,
-      );
-      if (debugContext) {
-        debugContext.multiCollectionProbe = {
-          cacheState: wroteCache ? "write" : "error",
-          elapsedMs: Math.max(0, Date.now() - startedAt),
-          supported: this.multiCollectionFilterSupported,
-        };
-      }
     } catch (err) {
       // Cancellation says nothing about QMD capabilities; leave the probe uncached.
       if (signal?.aborted) {
         throw asAbortError(signal);
       }
       this.multiCollectionFilterSupported = false;
-      if (debugContext) {
-        debugContext.multiCollectionProbe = {
-          cacheState: "error",
-          elapsedMs: Math.max(0, Date.now() - startedAt),
-          supported: false,
-        };
-      }
       log.debug(`qmd multi-collection filter probe failed: ${String(err)}`);
     }
     return this.multiCollectionFilterSupported;
   }
 
-  private async markQmdMultiCollectionFiltersUnsupported(
-    debugContext: QmdSearchRuntimeDebugContext,
-  ): Promise<void> {
-    const startedAt = Date.now();
-    const cacheContext = await this.buildQmdMultiCollectionProbeCacheContext();
-    this.multiCollectionFilterSupported = false;
-    await clearQmdMultiCollectionProbeCache(cacheContext);
-    const wroteCache = await writeQmdMultiCollectionProbeCache(cacheContext, false);
-    debugContext.multiCollectionProbe = {
-      cacheState: wroteCache ? "write" : "error",
-      elapsedMs: Math.max(0, Date.now() - startedAt),
-      supported: false,
-    };
-  }
-
   private async runQueryAcrossCollectionGroups(
     query: string,
     limit: number,

extensions/memory-core/src/memory/qmd-runtime-cache.test.ts

@@ -1,323 +0,0 @@
-import path from "node:path";
-import { withTempDir } from "openclaw/plugin-sdk/test-env";
-import { afterAll, afterEach, beforeAll, describe, expect, it } from "vitest";
-import {
-  configureMemoryCoreDreamingState,
-  configureMemoryCoreDreamingStateForTests,
-  openMemoryCoreStateStore,
-  memoryCoreWorkspaceEntryKey,
-  resetMemoryCoreDreamingStateForTests,
-} from "../dreaming-state.js";
-import {
-  QMD_RUNTIME_CACHE_COLLECTION_VALIDATION_NAMESPACE,
-  QMD_RUNTIME_CACHE_COLLECTION_VALIDATION_TTL_MS,
-  QMD_RUNTIME_CACHE_MULTI_COLLECTION_PROBE_NAMESPACE,
-  QMD_RUNTIME_CACHE_MULTI_COLLECTION_PROBE_TTL_MS,
-  buildQmdMultiCollectionProbeCacheContextHash,
-  clearQmdCollectionValidationCache,
-  clearQmdMultiCollectionProbeCache,
-  readQmdCollectionValidationCache,
-  readQmdMultiCollectionProbeCache,
-  type QmdRuntimeCollectionValidationCacheContext,
-  type QmdRuntimeManagedCollection,
-  type QmdRuntimeMultiCollectionProbeCacheContext,
-  writeQmdCollectionValidationCache,
-  writeQmdMultiCollectionProbeCache,
-} from "./qmd-runtime-cache.js";
-
-beforeAll(async () => {
-  await configureMemoryCoreDreamingStateForTests();
-});
-
-afterAll(async () => {
-  resetMemoryCoreDreamingStateForTests();
-});
-
-async function clearStore(namespace: string): Promise<void> {
-  try {
-    await openMemoryCoreStateStore({
-      namespace,
-      maxEntries: 1_000,
-    }).clear();
-  } catch {
-    // fail open
-  }
-}
-
-afterEach(async () => {
-  await clearStore(QMD_RUNTIME_CACHE_COLLECTION_VALIDATION_NAMESPACE);
-  await clearStore(QMD_RUNTIME_CACHE_MULTI_COLLECTION_PROBE_NAMESPACE);
-});
-
-async function withWorkspace<T>(run: (workspaceDir: string) => Promise<T>): Promise<T> {
-  return await withTempDir("qmd-runtime-cache-", run);
-}
-
-function managedCollections(): QmdRuntimeManagedCollection[] {
-  return [
-    {
-      name: "project-notes",
-      kind: "memory",
-      path: "/repo/project-notes",
-      pattern: "*.md",
-    },
-    {
-      name: "sessions",
-      kind: "sessions",
-      path: "/repo/sessions",
-      pattern: "*",
-    },
-  ];
-}
-
-function collectionValidationContext(
-  workspaceDir: string,
-): QmdRuntimeCollectionValidationCacheContext {
-  return {
-    workspaceDir,
-    agentId: "agent-a",
-    qmdCommand: "qmd",
-    qmdIndexPath: path.join(workspaceDir, ".openclaw", "index.sqlite"),
-    searchMode: "search",
-    collections: managedCollections(),
-    sources: ["memory", "sessions"],
-  };
-}
-
-function multiCollectionProbeContext(
-  workspaceDir: string,
-): QmdRuntimeMultiCollectionProbeCacheContext {
-  return {
-    workspaceDir,
-    agentId: "agent-a",
-    qmdCommand: "qmd",
-    qmdIndexPath: path.join(workspaceDir, ".openclaw", "index.sqlite"),
-    searchMode: "search",
-    sources: ["memory", "sessions"],
-  };
-}
-
-describe("qmd-runtime-cache", () => {
-  it("writes and reads collection validation cache entries", async () => {
-    await withWorkspace(async (workspaceDir) => {
-      const context = collectionValidationContext(workspaceDir);
-      const writeStartedAtMs = 1_000;
-
-      const writeOk = await writeQmdCollectionValidationCache(context, writeStartedAtMs);
-      expect(writeOk).toBe(true);
-
-      const read = await readQmdCollectionValidationCache(
-        { ...context, sources: ["sessions", "memory"] },
-        writeStartedAtMs + 1,
-      );
-      expect(read).toMatchObject({
-        state: "hit",
-        value: {
-          validation: {
-            ok: true,
-            collectionCount: context.collections.length,
-          },
-        },
-      });
-    });
-  });
-
-  it("writes and reads multi-collection probe cache entries", async () => {
-    await withWorkspace(async (workspaceDir) => {
-      const context = multiCollectionProbeContext(workspaceDir);
-      const writeStartedAtMs = 2_000;
-
-      const writeOk = await writeQmdMultiCollectionProbeCache(context, true, writeStartedAtMs);
-      expect(writeOk).toBe(true);
-
-      const read = await readQmdMultiCollectionProbeCache(context, writeStartedAtMs + 1);
-      expect(read).toMatchObject({
-        state: "hit",
-        value: {
-          multiCollectionProbe: {
-            supported: true,
-          },
-        },
-      });
-    });
-  });
-
-  it("scopes cache entries by workspace", async () => {
-    await withWorkspace(async (firstWorkspace) => {
-      await withWorkspace(async (secondWorkspace) => {
-        const context = collectionValidationContext(firstWorkspace);
-
-        expect(await writeQmdCollectionValidationCache(context, 3_000)).toBe(true);
-
-        const sameLogicalDifferentWorkspace: QmdRuntimeCollectionValidationCacheContext = {
-          ...context,
-          workspaceDir: secondWorkspace,
-          qmdIndexPath: path.join(secondWorkspace, ".openclaw", "index.sqlite"),
-        };
-
-        const miss = await readQmdCollectionValidationCache(sameLogicalDifferentWorkspace, 3_001);
-        expect(miss).toStrictEqual({ state: "miss" });
-      });
-    });
-  });
-
-  it("misses collection validation cache when managed collection paths change", async () => {
-    await withWorkspace(async (workspaceDir) => {
-      const context = collectionValidationContext(workspaceDir);
-
-      expect(await writeQmdCollectionValidationCache(context, 3_500)).toBe(true);
-
-      const changedContext: QmdRuntimeCollectionValidationCacheContext = {
-        ...context,
-        collections: context.collections.map((collection) =>
-          collection.name === "project-notes"
-            ? {
-                name: collection.name,
-                kind: collection.kind,
-                path: `${collection.path}-moved`,
-                pattern: collection.pattern,
-              }
-            : collection,
-        ),
-      };
-
-      expect(await readQmdCollectionValidationCache(changedContext, 3_501)).toStrictEqual({
-        state: "miss",
-      });
-    });
-  });
-
-  it("misses validation and probe caches when qmd runtime environment changes", async () => {
-    await withWorkspace(async (workspaceDir) => {
-      const validationContext = {
-        ...collectionValidationContext(workspaceDir),
-        qmdEnvironmentHash: "env-a",
-      };
-      const probeContext = {
-        ...multiCollectionProbeContext(workspaceDir),
-        qmdEnvironmentHash: "env-a",
-      };
-
-      expect(await writeQmdCollectionValidationCache(validationContext, 3_600)).toBe(true);
-      expect(await writeQmdMultiCollectionProbeCache(probeContext, true, 3_600)).toBe(true);
-
-      expect(
-        await readQmdCollectionValidationCache(
-          { ...validationContext, qmdEnvironmentHash: "env-b" },
-          3_601,
-        ),
-      ).toStrictEqual({ state: "miss" });
-      expect(
-        await readQmdMultiCollectionProbeCache(
-          { ...probeContext, qmdEnvironmentHash: "env-b" },
-          3_601,
-        ),
-      ).toStrictEqual({ state: "miss" });
-    });
-  });
-
-  it("treats cache misses for malformed values and expired entries", async () => {
-    await withWorkspace(async (workspaceDir) => {
-      const context = multiCollectionProbeContext(workspaceDir);
-      const nowMs = 4_000;
-      await writeQmdMultiCollectionProbeCache(context, false, nowMs);
-
-      const key = memoryCoreWorkspaceEntryKey(
-        workspaceDir,
-        `qmd-runtime-cache.multi-collection-probe:${buildQmdMultiCollectionProbeCacheContextHash(context)}`,
-      );
-      const store = openMemoryCoreStateStore({
-        namespace: QMD_RUNTIME_CACHE_MULTI_COLLECTION_PROBE_NAMESPACE,
-        maxEntries: 1_000,
-      });
-
-      await store.register(key, {
-        version: 1,
-        createdAtMs: "bad",
-        expiresAtMs: 0,
-        keyHash: "bad",
-        multiCollectionProbe: { supported: true },
-      });
-
-      const malformed = await readQmdMultiCollectionProbeCache(context, nowMs + 1);
-      expect(malformed).toStrictEqual({ state: "miss" });
-
-      const expired = await readQmdMultiCollectionProbeCache(
-        context,
-        nowMs + QMD_RUNTIME_CACHE_MULTI_COLLECTION_PROBE_TTL_MS + 1,
-      );
-      expect(expired).toStrictEqual({ state: "miss" });
-    });
-  });
-
-  it("uses separate namespaces for validation and probe entries", async () => {
-    await withWorkspace(async (workspaceDir) => {
-      const validationContext = collectionValidationContext(workspaceDir);
-      const probeContext = multiCollectionProbeContext(workspaceDir);
-
-      expect(await writeQmdCollectionValidationCache(validationContext, 5_000)).toBe(true);
-      expect(await writeQmdMultiCollectionProbeCache(probeContext, true, 5_000)).toBe(true);
-
-      const validationStore = openMemoryCoreStateStore({
-        namespace: QMD_RUNTIME_CACHE_COLLECTION_VALIDATION_NAMESPACE,
-        maxEntries: 1_000,
-      });
-      const probeStore = openMemoryCoreStateStore({
-        namespace: QMD_RUNTIME_CACHE_MULTI_COLLECTION_PROBE_NAMESPACE,
-        maxEntries: 1_000,
-      });
-
-      expect((await validationStore.entries()).length).toBeGreaterThan(0);
-      expect((await probeStore.entries()).length).toBeGreaterThan(0);
-    });
-  });
-
-  it("fails open when state store is unavailable", async () => {
-    await withWorkspace(async (workspaceDir) => {
-      const validationContext = collectionValidationContext(workspaceDir);
-      const probeContext = multiCollectionProbeContext(workspaceDir);
-
-      configureMemoryCoreDreamingState(() => {
-        throw new Error("state store unavailable");
-      });
-
-      try {
-        expect(await readQmdCollectionValidationCache(validationContext)).toStrictEqual({
-          state: "miss",
-        });
-        expect(await writeQmdCollectionValidationCache(validationContext)).toBe(false);
-        expect(await readQmdMultiCollectionProbeCache(probeContext)).toStrictEqual({
-          state: "miss",
-        });
-        expect(await writeQmdMultiCollectionProbeCache(probeContext, true)).toBe(false);
-      } finally {
-        await configureMemoryCoreDreamingStateForTests();
-      }
-    });
-  });
-
-  it("exposes bounded TTL windows", () => {
-    expect(QMD_RUNTIME_CACHE_COLLECTION_VALIDATION_TTL_MS).toBe(5 * 60_000);
-    expect(QMD_RUNTIME_CACHE_MULTI_COLLECTION_PROBE_TTL_MS).toBe(10 * 60_000);
-  });
-
-  it("can clear cache keys explicitly", async () => {
-    await withWorkspace(async (workspaceDir) => {
-      const validationContext = collectionValidationContext(workspaceDir);
-      const probeContext = multiCollectionProbeContext(workspaceDir);
-
-      expect(await writeQmdCollectionValidationCache(validationContext)).toBe(true);
-      expect(await writeQmdMultiCollectionProbeCache(probeContext, true)).toBe(true);
-
-      await clearQmdCollectionValidationCache(validationContext);
-      await clearQmdMultiCollectionProbeCache(probeContext);
-
-      expect(await readQmdCollectionValidationCache(validationContext)).toStrictEqual({
-        state: "miss",
-      });
-      expect(await readQmdMultiCollectionProbeCache(probeContext)).toStrictEqual({
-        state: "miss",
-      });
-    });
-  });
-});

extensions/memory-core/src/memory/qmd-runtime-cache.ts

@@ -1,435 +0,0 @@
-// Memory Core QMD runtime cache helpers.
-import { createHash } from "node:crypto";
-import type { PluginStateKeyedStore } from "openclaw/plugin-sdk/plugin-state-runtime";
-import { memoryCoreWorkspaceEntryKey, openMemoryCoreStateStore } from "../dreaming-state.js";
-
-export const QMD_RUNTIME_CACHE_COLLECTION_VALIDATION_NAMESPACE =
-  "qmd-runtime-cache.collection-validation";
-export const QMD_RUNTIME_CACHE_MULTI_COLLECTION_PROBE_NAMESPACE =
-  "qmd-runtime-cache.multi-collection-probe";
-export const QMD_RUNTIME_CACHE_COLLECTION_VALIDATION_MAX_ENTRIES = 1_000;
-export const QMD_RUNTIME_CACHE_MULTI_COLLECTION_PROBE_MAX_ENTRIES = 1_000;
-export const QMD_RUNTIME_CACHE_COLLECTION_VALIDATION_TTL_MS = 5 * 60_000;
-export const QMD_RUNTIME_CACHE_MULTI_COLLECTION_PROBE_TTL_MS = 10 * 60_000;
-
-const QMD_RUNTIME_CACHE_ENTRY_VERSION = 1;
-
-export type QmdRuntimeManagedCollection = {
-  name: string;
-  kind: "memory" | "custom" | "sessions";
-  path: string;
-  pattern: string;
-};
-
-type QmdRuntimeCacheContextBase = {
-  workspaceDir: string;
-  agentId: string;
-  qmdCommand: string;
-  qmdVersion?: string;
-  qmdEnvironmentHash?: string;
-  qmdIndexPath: string;
-  searchMode: string;
-};
-
-export type QmdRuntimeCollectionValidationCacheContext = QmdRuntimeCacheContextBase & {
-  collections: readonly QmdRuntimeManagedCollection[];
-  sources: readonly string[];
-};
-
-export type QmdRuntimeMultiCollectionProbeCacheContext = QmdRuntimeCacheContextBase & {
-  sources: readonly string[];
-};
-
-export type QmdRuntimeCacheCollectionValidationEntry = {
-  version: 1;
-  createdAtMs: number;
-  expiresAtMs: number;
-  keyHash: string;
-  validation: {
-    ok: true;
-    collectionConfigHash: string;
-    collectionCount: number;
-  };
-};
-
-export type QmdRuntimeCacheMultiCollectionProbeEntry = {
-  version: 1;
-  createdAtMs: number;
-  expiresAtMs: number;
-  keyHash: string;
-  multiCollectionProbe: {
-    supported: boolean;
-  };
-};
-
-export type QmdRuntimeCacheResult<T> =
-  | {
-      state: "hit";
-      value: T;
-    }
-  | { state: "miss" };
-
-function normalizeText(value: string): string {
-  return value.trim();
-}
-
-function normalizeCollection(collection: QmdRuntimeManagedCollection) {
-  return {
-    name: normalizeText(collection.name),
-    kind: collection.kind,
-    pathHash: normalizePathIdentity(collection.path),
-    pattern: normalizeText(collection.pattern),
-  };
-}
-
-function hashText(value: string): string {
-  return createHash("sha256").update(value).digest("hex");
-}
-
-function normalizePathIdentity(value: string): string {
-  const normalized =
-    process.platform === "win32" ? normalizeText(value).toLowerCase() : normalizeText(value);
-  return hashText(normalized);
-}
-
-function sortedUnique(values: readonly string[]): string[] {
-  return [...new Set(values.map((value) => normalizeText(value)).filter(Boolean))].toSorted();
-}
-
-function buildCollectionConfigHash(collections: readonly QmdRuntimeManagedCollection[]): string {
-  const normalized = collections
-    .map((collection) => ({
-      ...normalizeCollection(collection),
-    }))
-    .toSorted(
-      (left, right) =>
-        left.name.localeCompare(right.name) ||
-        left.kind.localeCompare(right.kind) ||
-        left.pathHash.localeCompare(right.pathHash) ||
-        left.pattern.localeCompare(right.pattern),
-    )
-    .map((entry) => `${entry.name}|${entry.kind}|${entry.pathHash}|${entry.pattern}`)
-    .join(";");
-  return hashText(normalized);
-}
-
-function buildCollectionValidationCacheContextInput(
-  params: QmdRuntimeCollectionValidationCacheContext,
-): string {
-  return JSON.stringify({
-    agentId: normalizeText(params.agentId),
-    commandHash: hashText(normalizeText(params.qmdCommand)),
-    environmentHash: normalizeText(params.qmdEnvironmentHash ?? ""),
-    indexPathHash: normalizePathIdentity(params.qmdIndexPath),
-    qmdVersion: normalizeText(params.qmdVersion ?? ""),
-    searchMode: params.searchMode,
-    sourceSet: sortedUnique(params.sources),
-    collectionConfigHash: buildCollectionConfigHash(params.collections),
-  });
-}
-
-function buildMultiCollectionProbeCacheContextInput(
-  params: QmdRuntimeMultiCollectionProbeCacheContext,
-): string {
-  return JSON.stringify({
-    agentId: normalizeText(params.agentId),
-    commandHash: hashText(normalizeText(params.qmdCommand)),
-    environmentHash: normalizeText(params.qmdEnvironmentHash ?? ""),
-    indexPathHash: normalizePathIdentity(params.qmdIndexPath),
-    qmdVersion: normalizeText(params.qmdVersion ?? ""),
-    searchMode: params.searchMode,
-    sourceSet: sortedUnique(params.sources),
-  });
-}
-
-function buildCollectionValidationCacheHash(
-  params: QmdRuntimeCollectionValidationCacheContext,
-): string {
-  return hashText(buildCollectionValidationCacheContextInput(params));
-}
-
-function buildMultiCollectionProbeCacheHash(
-  params: QmdRuntimeMultiCollectionProbeCacheContext,
-): string {
-  return hashText(buildMultiCollectionProbeCacheContextInput(params));
-}
-
-export function buildQmdCollectionValidationCacheContextHash(
-  params: QmdRuntimeCollectionValidationCacheContext,
-): string {
-  return buildCollectionValidationCacheHash(params);
-}
-
-export function buildQmdMultiCollectionProbeCacheContextHash(
-  params: QmdRuntimeMultiCollectionProbeCacheContext,
-): string {
-  return buildMultiCollectionProbeCacheHash(params);
-}
-
-function collectionValidationStore(): PluginStateKeyedStore<QmdRuntimeCacheCollectionValidationEntry> {
-  return openMemoryCoreStateStore<QmdRuntimeCacheCollectionValidationEntry>({
-    namespace: QMD_RUNTIME_CACHE_COLLECTION_VALIDATION_NAMESPACE,
-    maxEntries: QMD_RUNTIME_CACHE_COLLECTION_VALIDATION_MAX_ENTRIES,
-  });
-}
-
-function multiCollectionProbeStore(): PluginStateKeyedStore<QmdRuntimeCacheMultiCollectionProbeEntry> {
-  return openMemoryCoreStateStore<QmdRuntimeCacheMultiCollectionProbeEntry>({
-    namespace: QMD_RUNTIME_CACHE_MULTI_COLLECTION_PROBE_NAMESPACE,
-    maxEntries: QMD_RUNTIME_CACHE_MULTI_COLLECTION_PROBE_MAX_ENTRIES,
-  });
-}
-
-function collectionValidationEntryKey(params: QmdRuntimeCollectionValidationCacheContext): string {
-  return memoryCoreWorkspaceEntryKey(
-    params.workspaceDir,
-    `qmd-runtime-cache.collection-validation:${buildCollectionValidationCacheHash(params)}`,
-  );
-}
-
-function multiCollectionProbeEntryKey(params: QmdRuntimeMultiCollectionProbeCacheContext): string {
-  return memoryCoreWorkspaceEntryKey(
-    params.workspaceDir,
-    `qmd-runtime-cache.multi-collection-probe:${buildMultiCollectionProbeCacheHash(params)}`,
-  );
-}
-
-function normalizeCollectionValidationEntry(
-  value: unknown,
-  nowMs: number,
-  expectedKeyHash: string,
-): QmdRuntimeCacheCollectionValidationEntry | undefined {
-  if (typeof value !== "object" || value === null) {
-    return undefined;
-  }
-  const record = value as Record<string, unknown>;
-  if (record.version !== QMD_RUNTIME_CACHE_ENTRY_VERSION) {
-    return undefined;
-  }
-
-  const createdAtMs =
-    typeof record.createdAtMs === "number"
-      ? Math.max(0, Math.floor(record.createdAtMs))
-      : Number.NaN;
-  const expiresAtMs =
-    typeof record.expiresAtMs === "number"
-      ? Math.max(0, Math.floor(record.expiresAtMs))
-      : Number.NaN;
-  if (
-    !Number.isFinite(createdAtMs) ||
-    !Number.isFinite(expiresAtMs) ||
-    !Number.isFinite(nowMs) ||
-    nowMs >= expiresAtMs
-  ) {
-    return undefined;
-  }
-
-  const keyHash = normalizeText(typeof record.keyHash === "string" ? record.keyHash : "");
-  if (keyHash !== expectedKeyHash) {
-    return undefined;
-  }
-
-  const validation = record.validation;
-  if (typeof validation !== "object" || validation === null) {
-    return undefined;
-  }
-  const validationRecord = validation as Record<string, unknown>;
-  if (validationRecord.ok !== true) {
-    return undefined;
-  }
-  if (typeof validationRecord.collectionConfigHash !== "string") {
-    return undefined;
-  }
-  if (typeof validationRecord.collectionCount !== "number") {
-    return undefined;
-  }
-
-  return {
-    version: QMD_RUNTIME_CACHE_ENTRY_VERSION,
-    createdAtMs,
-    expiresAtMs,
-    keyHash,
-    validation: {
-      ok: true,
-      collectionConfigHash: normalizeText(validationRecord.collectionConfigHash),
-      collectionCount: Math.max(0, Math.floor(validationRecord.collectionCount)),
-    },
-  };
-}
-
-function normalizeMultiCollectionProbeEntry(
-  value: unknown,
-  nowMs: number,
-  expectedKeyHash: string,
-): QmdRuntimeCacheMultiCollectionProbeEntry | undefined {
-  if (typeof value !== "object" || value === null) {
-    return undefined;
-  }
-  const record = value as Record<string, unknown>;
-  if (record.version !== QMD_RUNTIME_CACHE_ENTRY_VERSION) {
-    return undefined;
-  }
-
-  const createdAtMs =
-    typeof record.createdAtMs === "number"
-      ? Math.max(0, Math.floor(record.createdAtMs))
-      : Number.NaN;
-  const expiresAtMs =
-    typeof record.expiresAtMs === "number"
-      ? Math.max(0, Math.floor(record.expiresAtMs))
-      : Number.NaN;
-  if (
-    !Number.isFinite(createdAtMs) ||
-    !Number.isFinite(expiresAtMs) ||
-    !Number.isFinite(nowMs) ||
-    nowMs >= expiresAtMs
-  ) {
-    return undefined;
-  }
-
-  const keyHash = normalizeText(typeof record.keyHash === "string" ? record.keyHash : "");
-  if (keyHash !== expectedKeyHash) {
-    return undefined;
-  }
-
-  const probe = record.multiCollectionProbe;
-  if (typeof probe !== "object" || probe === null) {
-    return undefined;
-  }
-  const probeRecord = probe as Record<string, unknown>;
-  if (typeof probeRecord.supported !== "boolean") {
-    return undefined;
-  }
-
-  return {
-    version: QMD_RUNTIME_CACHE_ENTRY_VERSION,
-    createdAtMs,
-    expiresAtMs,
-    keyHash,
-    multiCollectionProbe: {
-      supported: probeRecord.supported,
-    },
-  };
-}
-
-export async function readQmdCollectionValidationCache(
-  params: QmdRuntimeCollectionValidationCacheContext,
-  nowMs = Date.now(),
-): Promise<QmdRuntimeCacheResult<QmdRuntimeCacheCollectionValidationEntry>> {
-  try {
-    const store = collectionValidationStore();
-    const key = collectionValidationEntryKey(params);
-    const expectedKeyHash = buildCollectionValidationCacheHash(params);
-    const raw = await store.lookup(key);
-    if (!raw) {
-      return { state: "miss" };
-    }
-    const validated = normalizeCollectionValidationEntry(raw, nowMs, expectedKeyHash);
-    return validated ? { state: "hit", value: validated } : { state: "miss" };
-  } catch {
-    return { state: "miss" };
-  }
-}
-
-export async function writeQmdCollectionValidationCache(
-  params: QmdRuntimeCollectionValidationCacheContext,
-  nowMs = Date.now(),
-): Promise<boolean> {
-  try {
-    const key = collectionValidationEntryKey(params);
-    const keyHash = buildCollectionValidationCacheHash(params);
-    const collectionConfigHash = buildCollectionConfigHash(params.collections);
-    const createdAtMs = Math.max(0, Math.floor(nowMs));
-    const ttlMs = QMD_RUNTIME_CACHE_COLLECTION_VALIDATION_TTL_MS;
-    const store = collectionValidationStore();
-    await store.register(
-      key,
-      {
-        version: QMD_RUNTIME_CACHE_ENTRY_VERSION,
-        createdAtMs,
-        expiresAtMs: createdAtMs + ttlMs,
-        keyHash,
-        validation: {
-          ok: true,
-          collectionConfigHash,
-          collectionCount: params.collections.length,
-        },
-      },
-      { ttlMs },
-    );
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-export async function clearQmdCollectionValidationCache(
-  params: QmdRuntimeCollectionValidationCacheContext,
-): Promise<void> {
-  try {
-    const store = collectionValidationStore();
-    await store.delete(collectionValidationEntryKey(params));
-  } catch {
-    // fail open
-  }
-}
-
-export async function readQmdMultiCollectionProbeCache(
-  params: QmdRuntimeMultiCollectionProbeCacheContext,
-  nowMs = Date.now(),
-): Promise<QmdRuntimeCacheResult<QmdRuntimeCacheMultiCollectionProbeEntry>> {
-  try {
-    const store = multiCollectionProbeStore();
-    const key = multiCollectionProbeEntryKey(params);
-    const expectedKeyHash = buildMultiCollectionProbeCacheHash(params);
-    const raw = await store.lookup(key);
-    if (!raw) {
-      return { state: "miss" };
-    }
-    const validated = normalizeMultiCollectionProbeEntry(raw, nowMs, expectedKeyHash);
-    return validated ? { state: "hit", value: validated } : { state: "miss" };
-  } catch {
-    return { state: "miss" };
-  }
-}
-
-export async function writeQmdMultiCollectionProbeCache(
-  params: QmdRuntimeMultiCollectionProbeCacheContext,
-  supported: boolean,
-  nowMs = Date.now(),
-): Promise<boolean> {
-  try {
-    const key = multiCollectionProbeEntryKey(params);
-    const keyHash = buildMultiCollectionProbeCacheHash(params);
-    const createdAtMs = Math.max(0, Math.floor(nowMs));
-    const ttlMs = QMD_RUNTIME_CACHE_MULTI_COLLECTION_PROBE_TTL_MS;
-    const store = multiCollectionProbeStore();
-    await store.register(
-      key,
-      {
-        version: QMD_RUNTIME_CACHE_ENTRY_VERSION,
-        createdAtMs,
-        expiresAtMs: createdAtMs + ttlMs,
-        keyHash,
-        multiCollectionProbe: {
-          supported,
-        },
-      },
-      { ttlMs },
-    );
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-export async function clearQmdMultiCollectionProbeCache(
-  params: QmdRuntimeMultiCollectionProbeCacheContext,
-): Promise<void> {
-  try {
-    const store = multiCollectionProbeStore();
-    await store.delete(multiCollectionProbeEntryKey(params));
-  } catch {
-    // fail open
-  }
-}

extensions/memory-core/src/memory/search-manager.test.ts

@@ -326,10 +326,6 @@ describe("getMemorySearchManager caching", () => {
 
     expect(first.manager).toBe(second.manager);
     expect(createQmdManagerMock.mock.calls).toHaveLength(1);
-    expect(first.debug?.managerCacheState).toBe("cached-full-miss");
-    expect(second.debug?.managerCacheState).toBe("cached-full-hit");
-    expect(first.debug?.qmdIdentityHash).toMatch(/^[0-9a-f]{64}$/);
-    expect(second.debug?.qmdIdentityHash).toBe(first.debug?.qmdIdentityHash);
   });
 
   it("keeps the cached QMD manager active when the caller cancels a search", async () => {
@@ -810,10 +806,6 @@ describe("getMemorySearchManager caching", () => {
     const fullManager = requireManager(full);
     const cliManager = requireManager(cli);
 
-    expect(cli.debug?.managerCacheState).toBe("transient-cli");
-    expect(full.debug?.managerCacheState).toBe("cached-full-miss");
-    expect(full.debug?.qmdIdentityHash).toMatch(/^[0-9a-f]{64}$/);
-    expect(cli.debug?.qmdIdentityHash).toBe(full.debug?.qmdIdentityHash);
     expect(cliManager).toBe(cliPrimary);
     expect(cliManager).not.toBe(fullManager);
     const fullCreateParams = qmdCreateParams();

extensions/memory-core/src/memory/search-manager.ts

@@ -1,4 +1,3 @@
-import { createHash } from "node:crypto";
 // Memory Core plugin module implements search manager behavior.
 import fs from "node:fs/promises";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
@@ -49,24 +48,6 @@ type QmdManagerOpenFailure = {
   retryAfterMs: number;
 };
 
-type MemorySearchManagerCacheState =
-  | "cached-full-hit"
-  | "cached-full-miss"
-  | "transient-cli"
-  | "transient-status"
-  | "pending-create-wait"
-  | "fallback-builtin"
-  | "recent-failure-cooldown";
-
-export type MemorySearchManagerDebug = {
-  backend?: "builtin" | "qmd";
-  purpose?: MemorySearchManagerPurpose;
-  managerMs?: number;
-  managerCacheState?: MemorySearchManagerCacheState;
-  qmdIdentityHash?: string;
-  failureCode?: "qmd-unavailable";
-};
-
 type MemorySearchManagerCacheStore = {
   qmdManagerCache: Map<string, CachedQmdManagerEntry>;
   pendingQmdManagerCreates: Map<string, PendingQmdManagerCreate>;
@@ -128,7 +109,6 @@ function loadQmdManagerModule() {
 export type MemorySearchManagerResult = {
   manager: Maybe<MemorySearchManager>;
   error?: string;
-  debug?: MemorySearchManagerDebug;
 };
 
 export type MemorySearchManagerPurpose = "default" | "status" | "cli";
@@ -169,42 +149,11 @@ function clearQmdManagerOpenFailure(scopeKey: string, identityKey: string): void
   }
 }
 
-function hashQmdManagerIdentity(identityKey: string): string {
-  return createHash("sha256").update(identityKey).digest("hex");
-}
-
-function applyManagerDebug(
-  result: MemorySearchManagerResult,
-  debug: MemorySearchManagerDebug,
-): MemorySearchManagerResult {
-  if (result.debug && Object.keys(result.debug).length > 0 && Object.keys(debug).length === 0) {
-    return result;
-  }
-  return {
-    ...result,
-    debug: {
-      ...result.debug,
-      ...debug,
-    },
-  };
-}
-
 export async function getMemorySearchManager(params: {
   cfg: OpenClawConfig;
   agentId: string;
   purpose?: MemorySearchManagerPurpose;
 }): Promise<MemorySearchManagerResult> {
-  const acquireStartedAt = Date.now();
-  const purpose = params.purpose ?? "default";
-  const finish = (
-    result: MemorySearchManagerResult,
-    debug: MemorySearchManagerDebug,
-  ): MemorySearchManagerResult =>
-    applyManagerDebug(result, {
-      purpose,
-      managerMs: Math.max(0, Date.now() - acquireStartedAt),
-      ...debug,
-    });
   const resolved = resolveMemoryBackendConfig(params);
   if (resolved.backend === "qmd" && resolved.qmd) {
     const qmdResolved = resolved.qmd;
@@ -214,7 +163,6 @@ export async function getMemorySearchManager(params: {
     const transient = params.purpose === "status" || params.purpose === "cli";
     const scopeKey = buildQmdManagerScopeKey(normalizedAgentId);
     const identityKey = buildQmdManagerIdentityKey(normalizedAgentId, qmdResolved, runtimeConfig);
-    const debugIdentityHash = hashQmdManagerIdentity(identityKey);
 
     const createPrimaryQmdManager = async (
       mode: "full" | "status" | "cli",
@@ -306,24 +254,10 @@ export async function getMemorySearchManager(params: {
         // Status callers often close the manager they receive. Wrap the live
         // full manager with a no-op close so health/status probes do not tear
         // down the active QMD manager for the process.
-        return finish(
-          { manager: new BorrowedMemoryManager(cached.manager) },
-          {
-            backend: "qmd",
-            managerCacheState: "cached-full-hit",
-            qmdIdentityHash: debugIdentityHash,
-          },
-        );
+        return { manager: new BorrowedMemoryManager(cached.manager) };
       }
       if (params.purpose !== "cli") {
-        return finish(
-          { manager: cached.manager },
-          {
-            backend: "qmd",
-            managerCacheState: "cached-full-hit",
-            qmdIdentityHash: debugIdentityHash,
-          },
-        );
+        return { manager: cached.manager };
       }
     }
 
@@ -332,44 +266,20 @@ export async function getMemorySearchManager(params: {
         params.purpose === "cli" ? "cli" : "status",
       );
       return manager
-        ? finish(
-            { manager },
-            {
-              backend: "qmd",
-              managerCacheState: params.purpose === "cli" ? "transient-cli" : "transient-status",
-              qmdIdentityHash: debugIdentityHash,
-            },
-          )
-        : finish(await getBuiltinMemorySearchManagerAfterQmdFailure(params, failureReason), {
-            backend: "qmd",
-            managerCacheState: "fallback-builtin",
-            qmdIdentityHash: debugIdentityHash,
-            failureCode: "qmd-unavailable",
-          });
+        ? { manager }
+        : await getBuiltinMemorySearchManagerAfterQmdFailure(params, failureReason);
     }
 
     const recentFailure = getActiveQmdManagerOpenFailure(scopeKey, identityKey);
     if (recentFailure) {
       log.debug?.(`qmd memory unavailable; using builtin during cooldown: ${recentFailure.reason}`);
-      return finish(
-        await getBuiltinMemorySearchManagerAfterQmdFailure(params, recentFailure.reason),
-        {
-          backend: "qmd",
-          managerCacheState: "recent-failure-cooldown",
-          qmdIdentityHash: debugIdentityHash,
-          failureCode: "qmd-unavailable",
-        },
-      );
+      return await getBuiltinMemorySearchManagerAfterQmdFailure(params, recentFailure.reason);
     }
 
     const pending = PENDING_QMD_MANAGER_CREATES.get(scopeKey);
     if (pending) {
       await pending.promise;
-      return finish(await getMemorySearchManager(params), {
-        backend: "qmd",
-        managerCacheState: "pending-create-wait",
-        qmdIdentityHash: debugIdentityHash,
-      });
+      return await getMemorySearchManager(params);
     }
 
     let pendingFailureReason: string | undefined;
@@ -399,25 +309,11 @@ export async function getMemorySearchManager(params: {
     PENDING_QMD_MANAGER_CREATES.set(scopeKey, pendingCreate);
     const manager = await pendingCreate.promise;
     return manager
-      ? finish(
-          { manager },
-          {
-            backend: "qmd",
-            managerCacheState: "cached-full-miss",
-            qmdIdentityHash: debugIdentityHash,
-          },
-        )
-      : finish(await getBuiltinMemorySearchManagerAfterQmdFailure(params, pendingFailureReason), {
-          backend: "qmd",
-          managerCacheState: "fallback-builtin",
-          qmdIdentityHash: debugIdentityHash,
-          failureCode: "qmd-unavailable",
-        });
+      ? { manager }
+      : await getBuiltinMemorySearchManagerAfterQmdFailure(params, pendingFailureReason);
   }
 
-  return finish(await getBuiltinMemorySearchManager(params), {
-    backend: "builtin",
-  });
+  return await getBuiltinMemorySearchManager(params);
 }
 
 async function getBuiltinMemorySearchManagerAfterQmdFailure(

extensions/memory-core/src/runtime-provider.test.ts

@@ -1,44 +0,0 @@
-// Memory Core provider tests cover plugin runtime integration.
-import type { OpenClawConfig } from "openclaw/plugin-sdk/memory-core-host-runtime-core";
-import { describe, expect, it, vi } from "vitest";
-
-const managerDebug = {
-  backend: "qmd" as const,
-  purpose: "default" as const,
-  managerMs: 7,
-  managerCacheState: "cached-full-hit" as const,
-  qmdIdentityHash: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-};
-
-const getMemorySearchManagerMock = vi.hoisted(() =>
-  vi.fn(async () => ({
-    manager: null,
-    debug: managerDebug,
-    error: undefined,
-  })),
-);
-
-vi.mock("./memory/index.js", () => ({
-  closeAllMemorySearchManagers: vi.fn(async () => {}),
-  closeMemorySearchManager: vi.fn(async () => {}),
-  getMemorySearchManager: getMemorySearchManagerMock,
-}));
-
-import { memoryRuntime } from "./runtime-provider.js";
-
-describe("memoryRuntime", () => {
-  it("preserves manager debug metadata", async () => {
-    const cfg = {} as OpenClawConfig;
-
-    const result = await memoryRuntime.getMemorySearchManager({
-      cfg,
-      agentId: "main",
-    });
-
-    expect(result.debug).toEqual(managerDebug);
-    expect(getMemorySearchManagerMock).toHaveBeenCalledWith({
-      cfg,
-      agentId: "main",
-    });
-  });
-});

extensions/memory-core/src/runtime-provider.ts

@@ -9,10 +9,9 @@ import {
 
 export const memoryRuntime: MemoryPluginRuntime = {
   async getMemorySearchManager(params) {
-    const { manager, debug, error } = await getMemorySearchManager(params);
+    const { manager, error } = await getMemorySearchManager(params);
     return {
       manager,
-      debug,
       error,
     };
   },

extensions/memory-core/src/tools.shared.ts

@@ -67,28 +67,18 @@ export async function getMemoryManagerContextWithPurpose(params: {
 }): Promise<
   | {
       manager: NonNullable<MemorySearchManagerResult["manager"]>;
-      debug?: NonNullable<MemorySearchManagerResult["debug"]>;
     }
   | {
       error: string | undefined;
     }
 > {
   const { getMemorySearchManager } = await loadMemoryToolRuntime();
-  const startedAt = Date.now();
-  const { manager, debug, error } = await getMemorySearchManager({
+  const { manager, error } = await getMemorySearchManager({
     cfg: params.cfg,
     agentId: params.agentId,
     purpose: params.purpose,
   });
-  return manager
-    ? {
-        manager,
-        debug: {
-          ...debug,
-          managerMs: debug?.managerMs ?? Math.max(0, Date.now() - startedAt),
-        },
-      }
-    : { error };
+  return manager ? { manager } : { error };
 }
 
 export function createMemoryTool(params: {

extensions/memory-core/src/tools.test.ts

@@ -1,5 +1,4 @@
 // Memory Core tests cover tools plugin behavior.
-import type { MemorySearchRuntimeDebug } from "openclaw/plugin-sdk/memory-core-host-runtime-files";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 import {
   getMemoryCloseMockCalls,
@@ -382,95 +381,6 @@ describe("memory_search unavailable payloads", () => {
     expect(searchCalls).toBe(2);
   });
 
-  it("merges qmd runtime debug across zero-hit retry attempts", async () => {
-    setMemoryBackend("qmd");
-    let searchCalls = 0;
-    setMemorySearchImpl(async (opts) => {
-      searchCalls += 1;
-      if (searchCalls === 1) {
-        opts?.onDebug?.({
-          backend: "qmd",
-          configuredMode: "search",
-          effectiveMode: "search",
-          qmd: {
-            collectionValidation: {
-              cacheState: "hit",
-              elapsedMs: 2,
-              collectionCount: 2,
-              listCalls: 0,
-              showCalls: 0,
-            },
-            multiCollectionProbe: {
-              cacheState: "hit",
-              elapsedMs: 1,
-              supported: true,
-            },
-          },
-        });
-        return [];
-      }
-      opts?.onDebug?.({
-        backend: "qmd",
-        configuredMode: "search",
-        effectiveMode: "query",
-        fallback: "unsupported-search-flags",
-        qmd: {
-          searchPlan: {
-            command: "query",
-            collectionCount: 2,
-            groupCount: 2,
-            sources: ["memory", "sessions"],
-          },
-        },
-      });
-      return [
-        {
-          path: "MEMORY.md",
-          startLine: 1,
-          endLine: 1,
-          score: 0.9,
-          snippet: "Thread-hidden codename: ORBIT-22.",
-          source: "memory" as const,
-        },
-      ];
-    });
-
-    const tool = createMemorySearchToolOrThrow({
-      config: {
-        agents: { list: [{ id: "main", default: true }] },
-        memory: { backend: "qmd", citations: "off" },
-      },
-    });
-    const result = await tool.execute("zero-hit-debug-retry", {
-      query: "hidden thread codename",
-    });
-    const details = result.details as {
-      debug?: {
-        effectiveMode?: string;
-        fallback?: string;
-        qmd?: MemorySearchRuntimeDebug["qmd"];
-      };
-    };
-
-    expect(searchCalls).toBe(2);
-    expect(details.debug?.effectiveMode).toBe("query");
-    expect(details.debug?.fallback).toBe("unsupported-search-flags");
-    expect(details.debug?.qmd?.collectionValidation).toMatchObject({
-      cacheState: "hit",
-      collectionCount: 2,
-    });
-    expect(details.debug?.qmd?.multiCollectionProbe).toMatchObject({
-      cacheState: "hit",
-      supported: true,
-    });
-    expect(details.debug?.qmd?.searchPlan).toEqual({
-      command: "query",
-      collectionCount: 2,
-      groupCount: 2,
-      sources: ["memory", "sessions"],
-    });
-  });
-
   it("returns unavailable metadata when the index identity is paused", async () => {
     let searchCalls = 0;
     setMemorySearchImpl(async () => {
@@ -512,14 +422,6 @@ describe("memory_search unavailable payloads", () => {
         configuredMode: opts.qmdSearchModeOverride ?? "query",
         effectiveMode: "query",
         fallback: "unsupported-search-flags",
-        qmd: {
-          searchPlan: {
-            command: "query",
-            collectionCount: 2,
-            groupCount: 2,
-            sources: ["memory", "sessions"],
-          },
-        },
       });
       return [
         {
@@ -568,18 +470,6 @@ describe("memory_search unavailable payloads", () => {
         fallback?: unknown;
         hits?: unknown;
         searchMs?: number;
-        toolMs?: number;
-        managerMs?: number;
-        outsideSearchMs?: number;
-        managerCacheState?: unknown;
-        qmd?: {
-          searchPlan?: {
-            command?: unknown;
-            collectionCount?: unknown;
-            groupCount?: unknown;
-            sources?: unknown;
-          };
-        };
       };
     };
     expect(details.mode).toBe("query");
@@ -589,94 +479,6 @@ describe("memory_search unavailable payloads", () => {
     expect(details.debug?.fallback).toBe("unsupported-search-flags");
     expect(details.debug?.hits).toBe(1);
     expect(details.debug?.searchMs).toBeGreaterThanOrEqual(0);
-    expect(details.debug?.toolMs).toBeGreaterThanOrEqual(details.debug?.searchMs ?? 0);
-    expect(details.debug?.outsideSearchMs).toBeGreaterThanOrEqual(0);
-    expect(details.debug?.managerMs).toBeGreaterThanOrEqual(0);
-    expect(details.debug?.managerCacheState).toBeUndefined();
-    expect(details.debug?.qmd?.searchPlan).toEqual({
-      command: "query",
-      collectionCount: 2,
-      groupCount: 2,
-      sources: ["memory", "sessions"],
-    });
-  });
-
-  it("includes manager acquisition timing and cache-state debug payload", async () => {
-    setMemorySearchManagerImpl(
-      async () =>
-        ({
-          manager: {
-            search: vi.fn(async () => {
-              return [
-                {
-                  path: "MEMORY.md",
-                  startLine: 1,
-                  endLine: 2,
-                  score: 0.9,
-                  snippet: "ramen",
-                  source: "memory",
-                },
-              ];
-            }),
-            readFile: vi.fn(),
-            status: vi.fn(() => ({
-              backend: "qmd",
-              provider: "qmd",
-              model: "qmd",
-              requestedProvider: "qmd",
-              files: 0,
-              chunks: 0,
-              dirty: false,
-              workspaceDir: "/tmp/workspace",
-              dbPath: "/tmp/workspace/index.sqlite",
-              sources: ["memory"],
-              sourceCounts: [{ source: "memory", files: 0, chunks: 0 }],
-            })),
-            sync: vi.fn(async () => {}),
-            probeEmbeddingAvailability: vi.fn(async () => ({ ok: true })),
-            probeVectorAvailability: vi.fn(async () => true),
-          },
-          debug: {
-            managerMs: 17,
-            managerCacheState: "cached-full-hit",
-          },
-        }) as any,
-    );
-    setMemorySearchImpl(async () => [
-      {
-        path: "MEMORY.md",
-        startLine: 1,
-        endLine: 2,
-        score: 0.9,
-        snippet: "ramen",
-        source: "memory",
-      },
-    ]);
-
-    const tool = createMemorySearchToolOrThrow({
-      config: {
-        agents: { list: [{ id: "main", default: true }] },
-        memory: { backend: "qmd" },
-      },
-    });
-    const result = await tool.execute("manager-debug", { query: "favorite food" });
-    const details = result.details as {
-      debug?: {
-        backend?: string;
-        managerMs?: number;
-        toolMs?: number;
-        outsideSearchMs?: number;
-        managerCacheState?: string;
-        hits?: number;
-        searchMs?: number;
-      };
-    };
-
-    expect(details.debug?.backend).toBe("qmd");
-    expect(details.debug?.managerMs).toBe(17);
-    expect(details.debug?.toolMs).toBeGreaterThanOrEqual(details.debug?.searchMs ?? 0);
-    expect(details.debug?.outsideSearchMs).toBeGreaterThanOrEqual(0);
-    expect(details.debug?.managerCacheState).toBe("cached-full-hit");
   });
 });
 

extensions/memory-core/src/tools.ts

@@ -44,35 +44,12 @@ type MemorySearchToolResult =
   | MemoryCorpusSearchResult;
 type MemoryManagerContext = Awaited<ReturnType<typeof getMemoryManagerContextWithPurpose>>;
 type ActiveMemoryManagerContext = Extract<MemoryManagerContext, { manager: unknown }>;
-type QmdRuntimeDebug = NonNullable<MemorySearchRuntimeDebug["qmd"]>;
 
 const MEMORY_SEARCH_TOOL_TIMEOUT_MS = 15_000;
 const MEMORY_SEARCH_TOOL_COOLDOWN_MS = 60_000;
 
 const memorySearchToolCooldowns = new Map<string, { until: number; error: string }>();
 
-function mergeQmdRuntimeDebug(
-  entries: readonly MemorySearchRuntimeDebug[],
-): MemorySearchRuntimeDebug["qmd"] | undefined {
-  const merged: QmdRuntimeDebug = {};
-  for (const entry of entries) {
-    const qmd = entry.qmd;
-    if (!qmd) {
-      continue;
-    }
-    if (!merged.collectionValidation && qmd.collectionValidation) {
-      merged.collectionValidation = qmd.collectionValidation;
-    }
-    if (qmd.multiCollectionProbe) {
-      merged.multiCollectionProbe = qmd.multiCollectionProbe;
-    }
-    if (qmd.searchPlan) {
-      merged.searchPlan = qmd.searchPlan;
-    }
-  }
-  return Object.keys(merged).length > 0 ? merged : undefined;
-}
-
 function resolveMemorySearchToolCooldownKey(options: {
   agentId?: string;
   agentSessionKey?: string;
@@ -438,7 +415,6 @@ export function createMemorySearchTool(options: {
         const outcome = await runMemorySearchToolWithDeadline({
           timeoutMs: MEMORY_SEARCH_TOOL_TIMEOUT_MS,
           run: async (deadlineSignal) => {
-            const toolStartedAt = Date.now();
             const { resolveMemoryBackendConfig } = await loadMemoryToolRuntime();
             const shouldQuerySupplements = requestedCorpus === "wiki" || requestedCorpus === "all";
             const shouldQueryMemory = requestedCorpus !== "wiki" && !cooldown;
@@ -495,20 +471,13 @@ export function createMemorySearchTool(options: {
               let fallback: unknown;
               let searchMode: string | undefined;
               let pausedIndexIdentityReason: string | undefined;
-              let managerMs: number | undefined;
-              let managerCacheState: string | undefined;
               let searchDebug:
                 | {
                     backend: string;
                     configuredMode?: string;
                     effectiveMode?: string;
                     fallback?: string;
-                    toolMs?: number;
-                    managerMs?: number;
-                    outsideSearchMs?: number;
                     searchMs: number;
-                    managerCacheState?: string;
-                    qmd?: MemorySearchRuntimeDebug["qmd"];
                     hits: number;
                   }
                 | undefined;
@@ -537,8 +506,6 @@ export function createMemorySearchTool(options: {
                     },
                     ...(searchSources ? { sources: searchSources } : {}),
                   };
-                  managerMs = memory.debug?.managerMs;
-                  managerCacheState = memory.debug?.managerCacheState;
                   try {
                     rawResults = await activeMemory.manager.search(query, searchOptions);
                   } catch (error) {
@@ -555,8 +522,6 @@ export function createMemorySearchTool(options: {
                     if ("error" in refreshed) {
                       throw error;
                     }
-                    managerMs = refreshed.debug?.managerMs;
-                    managerCacheState = refreshed.debug?.managerCacheState;
                     activeMemory = refreshed;
                     rawResults = await activeMemory.manager.search(query, searchOptions);
                   }
@@ -615,9 +580,7 @@ export function createMemorySearchTool(options: {
                   model = status.model;
                   fallback = status.fallback;
                   const latestDebug = runtimeDebug.at(-1);
-                  const qmdDebug = mergeQmdRuntimeDebug(runtimeDebug);
                   searchMode = latestDebug?.effectiveMode;
-                  const searchMs = Math.max(0, Date.now() - searchStartedAt);
                   searchDebug = {
                     backend: status.backend,
                     configuredMode: latestDebug?.configuredMode,
@@ -626,10 +589,7 @@ export function createMemorySearchTool(options: {
                         ? (latestDebug?.effectiveMode ?? latestDebug?.configuredMode)
                         : "n/a",
                     fallback: latestDebug?.fallback,
-                    managerMs,
-                    searchMs,
-                    managerCacheState,
-                    qmd: qmdDebug,
+                    searchMs: Math.max(0, Date.now() - searchStartedAt),
                     hits: rawResults.length,
                   };
                 });
@@ -660,14 +620,6 @@ export function createMemorySearchTool(options: {
                 maxResults: effectiveMax,
                 balanceCorpora: requestedCorpus === "all",
               });
-              if (searchDebug) {
-                const finalToolMs = Math.max(0, Date.now() - toolStartedAt);
-                searchDebug = {
-                  ...searchDebug,
-                  toolMs: finalToolMs,
-                  outsideSearchMs: Math.max(0, finalToolMs - searchDebug.searchMs),
-                };
-              }
               return jsonResult({
                 results,
                 provider,

extensions/msteams/src/feedback-reflection-prompt.ts

@@ -1,6 +1,5 @@
 // Msteams plugin module implements feedback reflection prompt behavior.
 import { normalizeOptionalLowercaseString } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 
 /** Max chars of the thumbed-down response to include in the reflection prompt. */
 const MAX_RESPONSE_CHARS = 500;
@@ -20,7 +19,7 @@ export function buildReflectionPrompt(params: {
   if (params.thumbedDownResponse) {
     const truncated =
       params.thumbedDownResponse.length > MAX_RESPONSE_CHARS
-        ? `${truncateUtf16Safe(params.thumbedDownResponse, MAX_RESPONSE_CHARS)}...`
+        ? `${params.thumbedDownResponse.slice(0, MAX_RESPONSE_CHARS)}...`
         : params.thumbedDownResponse;
     parts.push(`\nYour response was:\n> ${truncated}`);
   }