test: trigger dependency guard with devDependency change

Preserve OpenClaw-owned embedded system prompts after active tool selection in both normal embedded attempts and compaction. Adds an exact base prompt path on AgentSession that keeps active tool prompt metadata current for extension hooks.

Fixes #87807.

Verification:
- mise exec node@24.16.0 -- node scripts/run-vitest.mjs src/agents/sessions/sdk.test.ts src/agents/embedded-agent-runner/system-prompt.test.ts src/agents/embedded-agent-runner/run/attempt.spawn-workspace.context-engine.test.ts src/agents/embedded-agent-runner/compact.hooks.test.ts --reporter=dot
- mise exec node@24.16.0 -- pnpm tsgo:core
- git diff --check
- .agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main

Thanks @shakkernerd.

.agents/skills/autoreview/SKILL.md

@@ -50,8 +50,9 @@ Dirty local work:
 ```
 
 Use this only when the patch is actually unstaged/staged/untracked in the
-current checkout. For committed, pushed, or PR work, point the helper at the commit
-or branch diff instead; do not force `--mode local` / `--uncommitted` just
+current checkout. `--mode uncommitted` is accepted as an alias for `--mode local`.
+For committed, pushed, or PR work, point the helper at the commit
+or branch diff instead; do not force dirty modes just
 because the helper docs mention dirty work first. A clean local review
 only proves there is no local patch.
 
@@ -164,6 +165,7 @@ If installed from `agent-scripts`, path is:
 The helper:
 
 - chooses dirty local changes first
+- accepts `--mode uncommitted` as an alias for `--mode local`
 - otherwise uses current PR base if `gh pr view` works
 - otherwise uses `origin/main` for non-main branches
 - supports `--engine codex`, `claude`, `droid`, and `copilot`; default is `AUTOREVIEW_ENGINE` or `codex`; Codex should remain the default when nothing is set

.agents/skills/autoreview/scripts/autoreview

@@ -238,6 +238,7 @@ def is_dirty(repo: Path) -> bool:
 
 
 def choose_target(repo: Path, mode: str, base_ref: str | None) -> tuple[str, str | None]:
+    mode = "local" if mode == "uncommitted" else mode
     branch = current_branch(repo)
     if mode == "local" or (mode == "auto" and is_dirty(repo)):
         return "local", None
@@ -889,7 +890,7 @@ def finish_parallel_tests(proc: subprocess.Popen, started: float) -> int:
 
 def parse_args() -> argparse.Namespace:
     parser = argparse.ArgumentParser(description="Bundle-driven AI code review.")
-    parser.add_argument("--mode", choices=["auto", "local", "branch", "commit"], default="auto")
+    parser.add_argument("--mode", choices=["auto", "local", "uncommitted", "branch", "commit"], default="auto")
     parser.add_argument("--base")
     parser.add_argument("--commit", default="HEAD")
     parser.add_argument("--engine", choices=ENGINES, default=os.environ.get("AUTOREVIEW_ENGINE", "codex"))

.agents/skills/clawdtributor/SKILL.md

@@ -98,7 +98,7 @@ Do not close from title alone. If closing as done on main or nonsensical, prove
 
 When asked for `5 new`, exclude refs already surfaced in the session and refill from the archive until there are 5 live-open candidates. If fewer than 5 remain open, list all open ones and say how many short.
 
-When asked to `update`, `refresh`, `recheck`, `check again`, or similar, return an updated live-open candidate list. Do not fill the main list with items that merely merged/closed since the last pass; put those numbers in a short bottom line.
+When asked to `update`, `refresh`, `recheck`, `check again`, or similar, return an updated live-open candidate list. Sort by maintainer importance, not recency: high-impact ready fixes first, then useful-but-review-first, then open/not-ready items. Do not include a "changed since last pass" section or bottom-line merged/closed summary unless the user explicitly asks for churn.
 
 Prefer:
 
@@ -142,18 +142,20 @@ No Markdown tables. Compact bullets. Use color/risk markers:
 Required line shape:
 
 ```markdown
-- **PR #81244** `@whatsskill.` `+118/-1` `bug` 🟢 verifiable: yes. This prevents chat action buttons from overlapping short assistant replies. Blast: web chat rendering, low.
-- **Issue #81245** `@alice` `LOC n/a` `bug` 🟡 verifiable: partial. This reports duplicate Telegram replies when reconnecting after gateway restart. Blast: Telegram channel runtime, medium.
+- **PR #81244** `@whatsskill.` `+118/-1` `bug` 🟢 https://github.com/openclaw/openclaw/pull/81244 - Prevents chat action buttons from overlapping short assistant replies. Verifiable: yes. Blast: web chat rendering, low.
+- **Issue #81245** `@alice` `LOC n/a` `bug` 🟡 https://github.com/openclaw/openclaw/issues/81245 - Reports duplicate Telegram replies when reconnecting after gateway restart. Verifiable: partial. Blast: Telegram channel runtime, medium.
 ```
 
 Rules:
 
 - Bold the `PR #n` or `Issue #n` marker.
 - Use `@handle`, not author bio text.
+- Always include the full GitHub URL.
+- Include a one-line description after the URL, separated with `-`.
 - PR LOC is `+additions/-deletions`; issue LOC is `LOC n/a`.
 - Type: `bug`, `feature`, `perf`, `security`, `docs`, `test`, `chore`, or `refactor`.
 - Write a full sentence for what it does.
 - Always include blast radius in one phrase.
 - Always include `verifiable: yes|partial|no` plus the shortest proof hint when helpful.
 - If status is not open, still show it only when the user asked for all surfaced refs; use ✅ or ⚪ and state merged/closed.
-- For refresh-style asks, bottom line: `Merged/closed since last pass: #81016 merged, #81026 closed.` Omit if none.
+- For refresh-style asks, prefer section order: `Best Open Now`, `Useful But Review First`, `Still Open / Not Ready`. Omit merged/closed churn by default.

.agents/skills/crabbox/SKILL.md

@@ -44,7 +44,9 @@ pnpm crabbox:run -- --help | sed -n '1,120p'
 - OpenClaw scripts prefer `../crabbox/bin/crabbox` when present. The user PATH
   shim can be stale.
 - Check `.crabbox.yaml` for direct-provider defaults. Omitting `--provider`
-  means brokered AWS today.
+  means brokered AWS for normal Linux/macOS paths; the wrapper selects Azure
+  for unqualified Windows/WSL2 runs when the local Crabbox binary advertises
+  Azure.
 - The brokered AWS default is a Linux developer image in `eu-west-1`; the repo
   config pins hot `eu-west-1a/b/c` placement so Fast Snapshot Restore can apply.
   If warmup drifts well past the minute-scale path, verify image promotion,
@@ -82,18 +84,16 @@ Use these only when the task needs an existing non-Linux host. OpenClaw broad
 Linux validation uses the repo Crabbox config unless a provider is explicitly
 requested.
 
-Native brokered Windows is available for Windows-specific proof. Use the AWS
-developer image in `us-west-2` on demand; it has the expected OpenClaw developer
-toolchain and Docker image cache. Keep broad Linux gates on Linux/Testbox unless
-the bug is Windows-specific:
+Native brokered Windows is available for Windows-specific proof. Prefer Azure
+for Windows/WSL2 when the subscription has quota or credits and the local
+Crabbox binary advertises Azure. Keep broad Linux gates on Linux/Testbox unless
+the bug is Windows-specific, and only force AWS when the operator asks for the
+older AWS developer image/cache path or Azure is unavailable:
 
 ```sh
-../crabbox/bin/crabbox warmup \
-  --provider aws \
+pnpm crabbox:warmup -- \
   --target windows \
-  --windows-mode normal \
-  --region us-west-2 \
-  --market on-demand \
+  --windows-mode wsl2 \
   --timing-json
 ```
 

.agents/skills/openclaw-changelog-update/SKILL.md

@@ -46,6 +46,8 @@ preserving issue/PR refs and thanks.
    - `### Fixes`: user-facing fixes first, grouped by impact and surface
 6. Preserve attribution:
    - keep `#issue`, `(#PR)`, `Fixes #...`, and `Thanks @...`
+   - every human-authored merged PR represented by a user-facing entry needs
+     its PR ref and `Thanks @author`, even when the PR had no linked issue
    - do not add GHSA references, advisory IDs, or security advisory slugs to
      changelog entries or GitHub release-note text unless explicitly requested
    - never thank bots, `@openclaw`, `@clawsweeper`, or `@steipete`

.agents/skills/openclaw-ghsa-maintainer/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: openclaw-ghsa-maintainer
-description: Inspect, patch, validate, publish, or confirm OpenClaw GHSA security advisories and private-fork state.
+description: "Inspect, patch, validate, publish, or confirm OpenClaw GHSA security advisories and private-fork state."
 ---
 
 # OpenClaw GHSA Maintainer
@@ -85,3 +85,4 @@ jq -r .description < /tmp/ghsa.refetch.json | rg '\\\\n'
 - Publishing fails with HTTP 422 if required fields are missing or the private fork still has open PRs.
 - A payload that looks correct in shell can still be wrong if Markdown was assembled with escaped newline strings.
 - Advisory PATCH sequencing matters; separate field updates when GHSA API constraints require it.
+- Public hardening/no-publish comments and draft text should avoid raw commit hashes, PR titles/numbers, and fix-mechanism summaries. Prefer patched-version fields or release-only wording; keep SHAs, PRs, and implementation notes in internal evidence.

.agents/skills/openclaw-testing/SKILL.md

@@ -213,7 +213,7 @@ workflow only spends setup and queue time on that suite.
 ### Release Evidence
 
 After release-candidate validation or before a release decision, record the
-important run ids in the private `openclaw/releases-private` evidence ledger.
+important run ids in the public `openclaw/releases` evidence ledger.
 Use the manual `OpenClaw Release Evidence`
 (`openclaw-release-evidence.yml`) workflow there. It writes durable summaries
 under `evidence/<release-id>/` and commits:
@@ -236,13 +236,13 @@ short release-manager notes there. Do not store raw logs, provider
 prompts/responses, channel transcripts, signing material, or secret-bearing
 config in git; raw logs stay in Actions artifacts.
 
-When `Full Release Validation` completes and
-`OPENCLAW_RELEASES_PRIVATE_DISPATCH_TOKEN` is configured in the public repo, it
-requests the private `OpenClaw Release Evidence From Full Validation` workflow.
-That private workflow reads the parent full-validation run, extracts the child
-CI/release-checks/Telegram run ids from the parent logs, and opens the evidence
-PR automatically. If the token is absent or the run predates this wiring, trigger
-that private workflow manually with the full-validation run id.
+When `Full Release Validation` completes and `OPENCLAW_RELEASES_DISPATCH_TOKEN`
+is configured in the source repo, it requests the public
+`OpenClaw Release Evidence From Full Validation` workflow. That workflow reads
+the parent full-validation run, extracts the child CI/release-checks/Telegram
+run ids from the parent logs, and opens the evidence PR automatically. If the
+token is absent or the run predates this wiring, trigger that workflow manually
+with the full-validation run id.
 
 ### Release Checks
 

.agents/skills/release-openclaw-announcement/SKILL.md

@@ -0,0 +1,85 @@
+---
+name: release-openclaw-announcement
+description: "Draft or post OpenClaw beta/stable Discord release announcements from changelog, GitHub release, registry, and validation evidence. Use when announcing a beta, stable release, release candidate, or asking what users should test after an OpenClaw release."
+---
+
+# OpenClaw Release Announcement
+
+Use with `release-openclaw-maintainer` after a beta or stable release is live.
+Use with `openclaw-discord` when actually posting to Discord.
+
+## Evidence First
+
+Before drafting focus areas, read real release evidence:
+
+1. Current GitHub release body for the tag.
+2. `CHANGELOG.md` section for the released base version.
+3. Commits since the previous shipped version or the operator-specified base.
+4. Registry/package metadata for the exact version and current dist-tag.
+5. Validation status that is relevant to user confidence.
+
+Do not claim a full changelog audit unless you did it. If you only read the
+generated release notes or top changelog section, say that and either audit
+properly or draft with that limitation.
+
+For beta focus areas, prioritize user-observable changes over internal test or
+CI mechanics:
+
+- install/update paths
+- OS/platform-specific behavior
+- Gateway startup/restart, config, and runtime behavior
+- provider/model/runtime routing
+- plugin loading and local plugin development
+- channels and media paths
+- security/data-loss/user-impact fixes
+
+Do not let late release-branch fixes automatically dominate the announcement.
+If the version includes a large delta from the previous shipped version, rank
+focus areas by the whole release delta and expected user impact; mention late
+fixes in their natural category.
+
+## Required Copy
+
+Every beta announcement must make beta status explicit and include:
+
+- exact version, e.g. `OpenClaw 2026.5.25-beta.1`
+- one-sentence risk framing: beta, useful for testing, not stable promotion
+- focused test areas derived from evidence, not guesswork
+- update command promoted near the top:
+  ```sh
+  openclaw update --channel beta --yes
+  openclaw --version
+  ```
+- fresh install path:
+  `Install from https://openclaw.ai`
+- GitHub release link
+- concise validation note, without making CI the headline
+
+Do not suggest npm install commands in beta announcements unless the operator
+explicitly asks for npm-specific copy or troubleshooting text. It is fine to use
+registry metadata as evidence; do not turn that into public install guidance.
+
+For stable announcements, use the stable channel wording:
+
+```sh
+openclaw update --channel stable --yes
+openclaw --version
+```
+
+Fresh installs still point to `https://openclaw.ai`.
+
+## Style
+
+- Discord Markdown, no tables.
+- Keep it skimmable: short intro, bullets, commands, links.
+- Lead with what users can feel or test, not proof plumbing.
+- Mention validation only after install/update instructions.
+- Be specific about where feedback is useful.
+- Do not mention private local proof paths in public announcements.
+- Do not overstate unverified platforms, channels, or provider behavior.
+
+## Posting
+
+When asked to post, use the configured Discord workflow from
+`openclaw-discord` or the approved OpenClaw relay. Never print tokens.
+For public channels, inspect the final body before sending.

.agents/skills/release-openclaw-announcement/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "OpenClaw Release Announcement"
+  short_description: "Draft Discord beta/stable release announcements from evidence."
+  default_prompt: "Use this skill to draft an OpenClaw beta or stable Discord announcement from changelog, release notes, npm/GitHub release proof, and validation evidence."

.agents/skills/security-triage/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: security-triage
-description: Triage OpenClaw security advisories, drafts, and GHSA reports with shipped-tag and trust-model proof.
+description: "Triage OpenClaw security advisories, drafts, and GHSA reports with shipped-tag and trust-model proof."
 ---
 
 # Security Triage
@@ -87,11 +87,19 @@ When preparing a maintainer-ready close reply:
    - exact reason for close
    - exact code refs
    - exact shipped tag / release facts
-   - exact fix commit or canonical duplicate GHSA when applicable
+   - fix provenance or canonical duplicate GHSA when applicable
    - optional hardening note only if worthwhile and functionality-preserving
 
 Keep tone firm, specific, non-defensive.
 
+## Public Wording Hygiene
+
+- Keep raw commit hashes, PR titles/numbers, and fix-mechanism summaries out of public advisory text. Use the patched release/version field only.
+- Keep exact commit SHAs, PRs, and implementation notes in internal notes and verification files.
+- For hardening/no-publish outcomes, do not add exploit-heavy details, "Fixed by" text, or a "Fix Commit(s)" section. Thank reporters, preserve credit, state the `SECURITY.md` boundary, and say clearly that the GHSA will close without publication.
+- For published CVE/GHSA text, prefer `### Patched Versions` with the fixed release. Do not explain how the patch works unless Peter explicitly asks for that public detail.
+- Keep GHSA ids out of changelog and release-note wording unless Peter explicitly asks.
+
 ## Discussion Mode
 
 When Peter is manually posting GHSA comments, use this flow:

.agents/skills/verify-release/SKILL.md

@@ -0,0 +1,87 @@
+---
+name: verify-release
+description: "Verify an OpenClaw release is fully published across GitHub, npm, plugins, ClawHub, package smoke, and live Gateway agent turns."
+---
+
+# Verify Release
+
+Use this when asked whether an OpenClaw release is fully released, published,
+promoted, smoke-tested, or live-verified. This is a verification skill, not a
+publish skill; use `$release-openclaw-maintainer` before changing release state.
+
+## Rules
+
+- Resolve short suffixes like `.27` to the concrete CalVer version from the
+  current date/context, then say the resolved version.
+- Verify live state. Do not trust local checkout state, release notes, or old
+  memory as current truth.
+- If the checkout is dirty or divergent, use it only for scripts/reference.
+  For version metadata, fetch from GitHub release/tag or unpack the tag tarball
+  under `/tmp`.
+- Never print secrets. Use inherited live keys only for scoped smoke commands.
+- Keep the final terse: `yes/no`, evidence bullets, caveats, cleanup.
+
+## Core Checks
+
+1. GitHub release:
+   - `gh release view v<VERSION> --repo openclaw/openclaw --json tagName,name,publishedAt,isDraft,isPrerelease,targetCommitish,url,body,assets`
+   - Confirm stable releases are not draft/prerelease.
+   - Confirm release body has npm, CI, plugin npm, ClawHub, mac/appcast evidence
+     links when expected.
+   - Confirm assets expected for stable mac releases are uploaded: zip, dmg,
+     dSYM, dependency evidence when present.
+2. Root npm:
+   - `npm view openclaw@<VERSION> version dist-tags.latest dist.tarball dist.integrity time.<VERSION> --json`
+   - `latest` must equal `<VERSION>` for stable.
+   - Record tarball, integrity, publish time.
+3. Plugin publish set:
+   - Get exact tag metadata from GitHub, not the local checkout when dirty:
+     download `https://api.github.com/repos/openclaw/openclaw/tarball/v<VERSION>`
+     into `/tmp/openclaw-v<VERSION>-src`.
+   - Count `extensions/*/package.json` with
+     `openclaw.release.publishToNpm === true` and
+     `openclaw.release.publishToClawHub === true`.
+   - Compare expected counts to workflow job counts:
+     `gh api repos/openclaw/openclaw/actions/runs/<RUN>/jobs --paginate`.
+   - Each expected npm plugin must have version `<VERSION>` and
+     `dist-tags.latest === <VERSION>`.
+4. ClawHub:
+   - Check the Plugin ClawHub Release workflow conclusion and publish job count.
+   - Use OpenClaw itself for live registry proof:
+     `openclaw plugins search <known-plugin> --json`.
+   - Install one official plugin from ClawHub in an isolated HOME:
+     `openclaw plugins install clawhub:@openclaw/matrix --pin`.
+     Prefer `matrix` unless that plugin is not in the expected set.
+5. Release workflows:
+   - Verify conclusions for release notes evidence links:
+     Full Release Validation, OpenClaw Release Checks, OpenClaw NPM Release,
+     Plugin NPM Release, Plugin ClawHub Release, mac preflight/validation/publish
+     when stable mac assets are expected.
+   - Summarize only relevant successful/failed jobs; ignore routine skipped
+     optional lanes unless the release body promised them.
+6. Published package smoke:
+   - In `/tmp`, isolated HOME:
+     `npm exec --yes --package openclaw@<VERSION> -- openclaw --version`.
+   - Run at least one harmless command that touches the published CLI surface,
+     for example `plugins --help` or `gateway --help`.
+7. Dev Gateway live model smoke:
+   - Use temp HOME/workspace, not the user's normal state:
+     `HOME=/tmp/openclaw-release-smoke/home OPENCLAW_WORKSPACE=/tmp/openclaw-release-smoke/work pnpm openclaw --dev gateway run --auth none --force --verbose`.
+   - Health check via CLI: `openclaw --dev gateway health --json`.
+   - Run one Gateway-backed agent turn with inherited `OPENAI_API_KEY`, short
+     prompt, explicit session key, JSON output, and a known-available model.
+   - If the configured default model fails as unavailable, record that caveat
+     and retry with the newest known-good OpenAI model instead of declaring the
+     release failed.
+   - Stop the gateway and verify the port is not listening.
+
+## Caveats To Report
+
+- Dist-tag caveat: stable `latest` is release truth; if optional `beta` mirrors
+  still point at a beta version, report it as a caveat, not a stable-release
+  blocker, unless the user asked to verify beta promotion.
+- Divergent checkout caveat: say when local source SHA differs from release tag
+  or origin and which live sources were used instead.
+- Smoke caveat: distinguish Gateway-backed agent success from local embedded
+  fallback. A valid Gateway smoke has health OK plus gateway log/run id for the
+  agent call.

.crabbox.yaml

@@ -20,7 +20,8 @@ actions:
   workflow: .github/workflows/crabbox-hydrate.yml
   # Default AWS hydration uses local Actions replay. Use
   # `crabbox actions hydrate --github-runner --job hydrate-github` when the
-  # hydrate job needs GitHub secrets.
+  # hydrate job needs GitHub secrets, or `--github-runner --job
+  # hydrate-windows-daemon` for focused native Windows daemon proof.
   job: hydrate
   ref: main
   runnerLabels:
@@ -28,6 +29,11 @@ actions:
     - openclaw
   runnerVersion: latest
   ephemeral: true
+blacksmith:
+  org: openclaw
+  workflow: .github/workflows/ci-check-testbox.yml
+  job: check
+  ref: main
 aws:
   region: eu-west-1
   rootGB: 400

.gitattributes

@@ -1,3 +1,6 @@
 * text=auto eol=lf
 CLAUDE.md -text
 src/gateway/server-methods/CLAUDE.md -text
+ui/src/i18n/.i18n/* linguist-generated
+ui/src/i18n/locales/*.ts linguist-generated
+ui/src/i18n/locales/en.ts -linguist-generated

.github/CODEOWNERS

@@ -13,6 +13,8 @@
 /.github/workflows/codeql-critical-quality.yml @openclaw/openclaw-secops
 /.github/workflows/dependency-change-awareness.yml @openclaw/openclaw-secops
 /test/scripts/dependency-change-awareness-workflow.test.ts @openclaw/openclaw-secops
+/test/scripts/dependency-change-awareness-script.test.ts @openclaw/openclaw-secops
+/scripts/github/dependency-change-awareness.mjs @openclaw/openclaw-secops
 /package-lock.json @openclaw/openclaw-secops
 /npm-shrinkwrap.json @openclaw/openclaw-secops
 /extensions/*/package-lock.json @openclaw/openclaw-secops

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -11,6 +11,8 @@ body:
         Do not speculate or infer beyond the evidence. If a narrative section cannot be answered from the available evidence, respond with exactly `NOT_ENOUGH_INFO`.
 
         If this is a plugin beta-release blocker, rename the issue title to `Beta blocker: <plugin-name> - <summary>` and apply the `beta-blocker` label after filing.
+
+        Please only report one issue per submission. Break multiple issues up into separate submissions.
   - type: dropdown
     id: bug_type
     attributes:

.github/actionlint.yaml

@@ -14,6 +14,10 @@ self-hosted-runner:
     - blacksmith-16vcpu-ubuntu-2404-arm
     - blacksmith-6vcpu-macos-latest
     - blacksmith-12vcpu-macos-latest
+    - blacksmith-6vcpu-macos-15
+    - blacksmith-12vcpu-macos-15
+    - blacksmith-6vcpu-macos-26
+    - blacksmith-12vcpu-macos-26
 
 # Ignore patterns for known issues
 paths:

.github/actions/detect-docs-changes/action.yml

@@ -35,17 +35,29 @@ runs:
           exit 0
         fi
 
-        # Check if any changed file is a doc
-        DOCS=$(echo "$CHANGED" | grep -E '^docs/|\.md$|\.mdx$' || true)
-        if [ -n "$DOCS" ]; then
+        docs_changed=false
+        non_docs=false
+        while IFS= read -r changed_path; do
+          case "$changed_path" in
+            test/fixtures/*)
+              non_docs=true
+              ;;
+            docs/* | *.md | *.mdx)
+              docs_changed=true
+              ;;
+            *)
+              non_docs=true
+              ;;
+          esac
+        done <<< "$CHANGED"
+
+        if [ "$docs_changed" = "true" ]; then
           echo "docs_changed=true" >> "$GITHUB_OUTPUT"
         else
           echo "docs_changed=false" >> "$GITHUB_OUTPUT"
         fi
 
-        # Check if all changed files are docs or markdown
-        NON_DOCS=$(echo "$CHANGED" | grep -vE '^docs/|\.md$|\.mdx$' || true)
-        if [ -z "$NON_DOCS" ]; then
+        if [ "$non_docs" = "false" ]; then
           echo "docs_only=true" >> "$GITHUB_OUTPUT"
           echo "Docs-only change detected — skipping heavy jobs"
         else

.github/actions/setup-node-env/action.yml

@@ -20,9 +20,13 @@ inputs:
     required: false
     default: "true"
   use-actions-cache:
-    description: Whether to restore and save the pnpm store with actions/cache.
+    description: Whether to restore the pnpm store with actions/cache.
     required: false
     default: "true"
+  save-actions-cache:
+    description: Whether to save the pnpm store with actions/cache after install when no exact cache restored.
+    required: false
+    default: "false"
 runs:
   using: composite
   steps:
@@ -45,6 +49,7 @@ runs:
         openclaw_ensure_node "$REQUESTED_NODE_VERSION"
 
     - name: Setup pnpm
+      id: setup-pnpm
       uses: ./.github/actions/setup-pnpm-store-cache
       with:
         node-version: ${{ inputs.node-version }}
@@ -130,3 +135,10 @@ runs:
           ln -sfn "$PNPM_CONFIG_MODULES_DIR" node_modules
           ln -sfn . "$PNPM_CONFIG_MODULES_DIR/node_modules"
         fi
+
+    - name: Save pnpm store cache
+      if: ${{ inputs.install-deps == 'true' && inputs.use-actions-cache == 'true' && inputs.save-actions-cache == 'true' && runner.os != 'Windows' && steps.setup-pnpm.outputs.store-cache-hit != 'true' }}
+      uses: actions/cache/save@v5
+      with:
+        path: ${{ steps.setup-pnpm.outputs.store-path }}
+        key: ${{ steps.setup-pnpm.outputs.store-cache-primary-key }}

.github/actions/setup-pnpm-store-cache/action.yml

@@ -14,7 +14,7 @@ inputs:
     required: false
     default: ""
   use-actions-cache:
-    description: Whether actions/cache should cache the pnpm store.
+    description: Whether actions/cache should restore the pnpm store.
     required: false
     default: "true"
 outputs:
@@ -24,6 +24,15 @@ outputs:
   project-dir:
     description: Directory containing the packageManager file used for pnpm resolution.
     value: ${{ steps.setup-pnpm.outputs.project-dir }}
+  store-cache-hit:
+    description: Whether the pnpm store cache restored an exact key.
+    value: ${{ steps.pnpm-store-cache.outputs.cache-hit }}
+  store-cache-primary-key:
+    description: Exact pnpm store cache key used for restore/save.
+    value: ${{ steps.pnpm-store-cache.outputs.cache-primary-key }}
+  store-path:
+    description: Resolved pnpm store path.
+    value: ${{ steps.pnpm-store.outputs.path }}
 runs:
   using: composite
   steps:
@@ -81,14 +90,15 @@ runs:
         echo "path=$store_path" >> "$GITHUB_OUTPUT"
 
     - name: Restore pnpm store cache
+      id: pnpm-store-cache
       if: ${{ inputs.use-actions-cache == 'true' && runner.os != 'Windows' }}
-      uses: actions/cache@v5
+      uses: actions/cache/restore@v5
       with:
         path: ${{ steps.pnpm-store.outputs.path }}
-        key: pnpm-store-${{ runner.os }}-${{ inputs.node-version }}-${{ hashFiles(inputs.lockfile-path) }}
+        key: pnpm-store-${{ runner.os }}-${{ runner.arch }}-${{ inputs.node-version }}-${{ hashFiles(inputs.package-manager-file) }}-${{ hashFiles(inputs.lockfile-path) }}
         restore-keys: |
-          pnpm-store-${{ runner.os }}-${{ inputs.node-version }}-
-          pnpm-store-${{ runner.os }}-
+          pnpm-store-${{ runner.os }}-${{ runner.arch }}-${{ inputs.node-version }}-${{ hashFiles(inputs.package-manager-file) }}-
+          pnpm-store-${{ runner.os }}-${{ runner.arch }}-${{ inputs.node-version }}-
 
     - name: Record pnpm version
       id: pnpm-version

.github/actions/setup-pnpm-store-cache/ensure-node.sh

@@ -53,14 +53,16 @@ openclaw_active_node_version() {
 
 openclaw_prepend_node_bin() {
   local node_bin_dir="$1"
+  local github_path_dir="${2:-$node_bin_dir}"
   local shell_node_bin_dir="$node_bin_dir"
   if command -v cygpath >/dev/null 2>&1; then
     shell_node_bin_dir="$(cygpath -u "$node_bin_dir" 2>/dev/null || printf '%s' "$node_bin_dir")"
   fi
   export PATH="$shell_node_bin_dir:$PATH"
   if [[ -n "${GITHUB_PATH:-}" ]]; then
-    local github_node_bin_dir="$shell_node_bin_dir"
-    if command -v cygpath >/dev/null 2>&1; then
+    local github_node_bin_dir="$github_path_dir"
+    if [[ $# -lt 2 ]] && command -v cygpath >/dev/null 2>&1; then
+      github_node_bin_dir="$shell_node_bin_dir"
       github_node_bin_dir="$(cygpath -w "$shell_node_bin_dir" 2>/dev/null || printf '%s' "$shell_node_bin_dir")"
     fi
     echo "$github_node_bin_dir" >> "$GITHUB_PATH"
@@ -93,7 +95,7 @@ openclaw_find_toolcache_node() {
   done
 
   local node_root candidate candidate_version
-  for node_root in "${roots[@]}"; do
+  for node_root in ${roots[@]+"${roots[@]}"}; do
     while IFS= read -r candidate; do
       candidate_version="$("$candidate" -p 'process.versions.node' 2>/dev/null || true)"
       if openclaw_node_version_matches "$candidate_version" "$requested_node"; then
@@ -139,6 +141,7 @@ openclaw_node_download_platform() {
     MINGW*:x86_64 | MSYS*:x86_64 | CYGWIN*:x86_64 | MINGW*:AMD64 | MSYS*:AMD64 | CYGWIN*:AMD64)
       printf 'win-x64\n'
       ;;
+    MINGW*:aarch64 | MINGW*:arm64 | MSYS*:aarch64 | MSYS*:arm64 | CYGWIN*:aarch64 | CYGWIN*:arm64) printf 'win-arm64\n' ;;
     *)
       return 1
       ;;
@@ -147,31 +150,47 @@ openclaw_node_download_platform() {
 
 openclaw_download_node() {
   local requested_node="$1"
-  local version platform archive_url install_root
+  local version platform archive_url install_root temp_root
   version="$(openclaw_resolve_node_download_version "$requested_node")"
   platform="$(openclaw_node_download_platform)" || return 1
-  install_root="${RUNNER_TEMP:-/tmp}/openclaw-node-${version}-${platform}"
-  mkdir -p "$install_root"
+  temp_root="${RUNNER_TEMP:-/tmp}"
+  if command -v cygpath >/dev/null 2>&1; then
+    temp_root="$(cygpath -u "$temp_root" 2>/dev/null || printf '%s\n' "$temp_root")"
+  fi
+  install_root="${temp_root}/openclaw-node-${version}-${platform}"
   if [[ "$platform" == win-* ]]; then
-    local archive_path
+    local archive_path ps_archive_path ps_install_root ps_bin_dir node_bin_dir
+    archive_path="${temp_root}/node-${version}-${platform}.zip"
     archive_url="https://nodejs.org/dist/${version}/node-${version}-${platform}.zip"
-    archive_path="${RUNNER_TEMP:-/tmp}/node-${version}-${platform}.zip"
+    rm -rf "$install_root"
+    mkdir -p "$install_root"
     echo "Downloading Node ${version} from ${archive_url}"
-    curl -fsSL "$archive_url" -o "$archive_path"
-    if command -v powershell.exe >/dev/null 2>&1 && command -v cygpath >/dev/null 2>&1; then
-      powershell.exe -NoLogo -NoProfile -Command \
-        "Expand-Archive -LiteralPath '$(cygpath -w "$archive_path")' -DestinationPath '$(cygpath -w "$install_root")' -Force"
+    curl -fsSL -o "$archive_path" "$archive_url"
+    ps_archive_path="$archive_path"
+    ps_install_root="$install_root"
+    if command -v cygpath >/dev/null 2>&1; then
+      ps_archive_path="$(cygpath -w "$archive_path")"
+      ps_install_root="$(cygpath -w "$install_root")"
+    fi
+    ps_bin_dir="$ps_install_root\\node-${version}-${platform}"
+    node_bin_dir="$install_root/node-${version}-${platform}"
+    if command -v pwsh >/dev/null 2>&1; then
+      pwsh -NoLogo -NoProfile -Command "Expand-Archive -LiteralPath '${ps_archive_path}' -DestinationPath '${ps_install_root}' -Force"
+      openclaw_prepend_node_bin "$node_bin_dir" "$ps_bin_dir"
+    elif command -v powershell.exe >/dev/null 2>&1; then
+      powershell.exe -NoLogo -NoProfile -Command "Expand-Archive -LiteralPath '${ps_archive_path}' -DestinationPath '${ps_install_root}' -Force"
+      openclaw_prepend_node_bin "$node_bin_dir" "$ps_bin_dir"
     else
       unzip -q "$archive_path" -d "$install_root"
+      openclaw_prepend_node_bin "$node_bin_dir"
     fi
-    openclaw_prepend_node_bin "$install_root/node-${version}-${platform}"
-    return 0
+  else
+    archive_url="https://nodejs.org/dist/${version}/node-${version}-${platform}.tar.xz"
+    mkdir -p "$install_root"
+    echo "Downloading Node ${version} from ${archive_url}"
+    curl -fsSL "$archive_url" | tar -xJ -C "$install_root" --strip-components=1
+    openclaw_prepend_node_bin "$install_root/bin"
   fi
-
-  archive_url="https://nodejs.org/dist/${version}/node-${version}-${platform}.tar.xz"
-  echo "Downloading Node ${version} from ${archive_url}"
-  curl -fsSL "$archive_url" | tar -xJ -C "$install_root" --strip-components=1
-  openclaw_prepend_node_bin "$install_root/bin"
 }
 
 openclaw_ensure_node() {

.github/codeql/codeql-agent-runtime-boundary-critical-quality.yml

@@ -17,7 +17,8 @@ paths:
   - src/acp/control-plane
   - src/agents/command
   - src/agents/cli-runner
-  - src/agents/pi-embedded-runner
+  - src/agents/embedded-agent-runner
+  - src/agents/sessions
   - src/agents/tools
   - src/agents/*completion*.ts
   - src/agents/*transport*.ts

.github/codeql/codeql-core-auth-secrets-critical-quality.yml

@@ -22,6 +22,8 @@ paths:
   - src/agents/sandbox
   - src/agents/sandbox.ts
   - src/agents/sandbox-*.ts
+  - src/agents/sessions/*auth*.ts
+  - src/agents/sessions/**/*auth*.ts
   - src/cron/service/jobs.ts
   - src/cron/stagger.ts
   - src/gateway/*auth*.ts

.github/codeql/codeql-mcp-process-tool-boundary-critical-security.yml

@@ -24,14 +24,15 @@ paths:
   - src/agents/openclaw-plugin-tools.ts
   - src/agents/openclaw-tools.runtime.ts
   - src/agents/openclaw-tools.registration.ts
-  - src/agents/pi-tool-definition-adapter.ts
-  - src/agents/pi-tools.abort.ts
-  - src/agents/pi-tools.before-tool-call*.ts
-  - src/agents/pi-tools.host-edit.ts
-  - src/agents/pi-tools-parameter-schema.ts
-  - src/agents/pi-embedded-runner/effective-tool-policy.ts
-  - src/agents/pi-embedded-runner/tool-name-allowlist.ts
-  - src/agents/pi-embedded-runner/tool-schema-runtime.ts
+  - src/agents/agent-tool-definition-adapter.ts
+  - src/agents/agent-tools.abort.ts
+  - src/agents/agent-tools.before-tool-call*.ts
+  - src/agents/agent-tools.read.ts
+  - src/agents/agent-tools-parameter-schema.ts
+  - src/agents/sessions/tools/**
+  - src/agents/embedded-agent-runner/effective-tool-policy.ts
+  - src/agents/embedded-agent-runner/tool-name-allowlist.ts
+  - src/agents/embedded-agent-runner/tool-schema-runtime.ts
   - src/agents/tools/gateway-tool.ts
   - src/agents/tools/message-tool.ts
   - src/agents/tools/sessions-send-tool.ts

.github/labeler.yml

@@ -10,6 +10,11 @@
           - "extensions/file-transfer/**"
           - "docs/nodes/index.md"
           - "docs/plugins/sdk-runtime.md"
+"plugin: pixverse":
+  - changed-files:
+      - any-glob-to-any-file:
+          - "extensions/pixverse/**"
+          - "docs/providers/pixverse.md"
 "channel: discord":
   - changed-files:
       - any-glob-to-any-file:
@@ -491,6 +496,7 @@
   - changed-files:
       - any-glob-to-any-file:
           - "extensions/diffs/**"
+          - "extensions/diffs-language-pack/**"
 "extensions: elevenlabs":
   - changed-files:
       - any-glob-to-any-file:

.github/workflows/ci.yml

@@ -79,12 +79,20 @@ jobs:
         env:
           CHECKOUT_REPO: ${{ github.repository }}
           CHECKOUT_REF: ${{ inputs.target_ref || github.sha }}
+          CHECKOUT_FALLBACK_REF: ${{ github.sha }}
+          GITHUB_EVENT_NAME: ${{ github.event_name }}
         run: |
           set -euo pipefail
           git init "$GITHUB_WORKSPACE"
           git -C "$GITHUB_WORKSPACE" config gc.auto 0
           git -C "$GITHUB_WORKSPACE" remote add origin "https://github.com/${CHECKOUT_REPO}.git"
-          git -C "$GITHUB_WORKSPACE" fetch --no-tags --depth=1 origin "+${CHECKOUT_REF}:refs/remotes/origin/checkout"
+          if ! git -C "$GITHUB_WORKSPACE" fetch --no-tags --depth=1 origin "+${CHECKOUT_REF}:refs/remotes/origin/checkout"; then
+            if [ "$GITHUB_EVENT_NAME" != "workflow_dispatch" ] || [ "$CHECKOUT_REF" = "$CHECKOUT_FALLBACK_REF" ]; then
+              exit 1
+            fi
+            echo "::warning::workflow_dispatch target_ref '$CHECKOUT_REF' is unavailable; falling back to head SHA '$CHECKOUT_FALLBACK_REF'"
+            git -C "$GITHUB_WORKSPACE" fetch --no-tags --depth=1 origin "+${CHECKOUT_FALLBACK_REF}:refs/remotes/origin/checkout"
+          fi
           git -C "$GITHUB_WORKSPACE" checkout --detach refs/remotes/origin/checkout
 
       - name: Resolve checkout SHA
@@ -306,12 +314,20 @@ jobs:
         env:
           CHECKOUT_REPO: ${{ github.repository }}
           CHECKOUT_REF: ${{ inputs.target_ref || github.sha }}
+          CHECKOUT_FALLBACK_REF: ${{ github.sha }}
+          GITHUB_EVENT_NAME: ${{ github.event_name }}
         run: |
           set -euo pipefail
           git init "$GITHUB_WORKSPACE"
           git -C "$GITHUB_WORKSPACE" config gc.auto 0
           git -C "$GITHUB_WORKSPACE" remote add origin "https://github.com/${CHECKOUT_REPO}.git"
-          git -C "$GITHUB_WORKSPACE" fetch --no-tags --depth=1 origin "+${CHECKOUT_REF}:refs/remotes/origin/checkout"
+          if ! git -C "$GITHUB_WORKSPACE" fetch --no-tags --depth=1 origin "+${CHECKOUT_REF}:refs/remotes/origin/checkout"; then
+            if [ "$GITHUB_EVENT_NAME" != "workflow_dispatch" ] || [ "$CHECKOUT_REF" = "$CHECKOUT_FALLBACK_REF" ]; then
+              exit 1
+            fi
+            echo "::warning::workflow_dispatch target_ref '$CHECKOUT_REF' is unavailable; falling back to head SHA '$CHECKOUT_FALLBACK_REF'"
+            git -C "$GITHUB_WORKSPACE" fetch --no-tags --depth=1 origin "+${CHECKOUT_FALLBACK_REF}:refs/remotes/origin/checkout"
+          fi
           git -C "$GITHUB_WORKSPACE" checkout --detach refs/remotes/origin/checkout
 
       - name: Ensure security base commit
@@ -398,13 +414,73 @@ jobs:
       - name: Audit production dependencies
         run: node scripts/pre-commit/pnpm-audit-prod.mjs --audit-level=high
 
+  # Warm the lockfile- and pnpm-pinned store once before Linux Node shards fan out.
+  # On a cold key this job owns the save, so later shards restore the exact key.
+  pnpm-store-warmup:
+    permissions:
+      contents: read
+    needs: [preflight]
+    if: needs.preflight.outputs.run_node == 'true' || needs.preflight.outputs.run_check_docs == 'true'
+    runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-24.04') }}
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        shell: bash
+        env:
+          CHECKOUT_REPO: ${{ github.repository }}
+          CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_revision }}
+        run: |
+          set -euo pipefail
+
+          workdir="$GITHUB_WORKSPACE"
+          reset_checkout_dir() {
+            mkdir -p "$workdir"
+            find "$workdir" -mindepth 1 -maxdepth 1 -exec rm -rf {} +
+          }
+
+          checkout_attempt() {
+            local attempt="$1"
+
+            reset_checkout_dir
+            git init "$workdir" >/dev/null
+            git config --global --add safe.directory "$workdir"
+            git -C "$workdir" remote add origin "https://github.com/${CHECKOUT_REPO}.git"
+            git -C "$workdir" config gc.auto 0
+
+            timeout --signal=TERM --kill-after=10s 30s git -C "$workdir" \
+              -c protocol.version=2 \
+              fetch --no-tags --prune --no-recurse-submodules --depth=1 origin \
+              "+${CHECKOUT_SHA}:refs/remotes/origin/ci-target" || return 1
+
+            git -C "$workdir" checkout --force --detach "$CHECKOUT_SHA" || return 1
+            test -f "$workdir/.github/actions/setup-node-env/action.yml" || return 1
+            echo "checkout attempt ${attempt}/5 succeeded"
+          }
+
+          for attempt in 1 2 3 4 5; do
+            if checkout_attempt "$attempt"; then
+              exit 0
+            fi
+            echo "checkout attempt ${attempt}/5 failed"
+            sleep $((attempt * 5))
+          done
+
+          echo "checkout failed after 5 attempts" >&2
+          exit 1
+
+      - name: Setup Node environment
+        uses: ./.github/actions/setup-node-env
+        with:
+          install-bun: "false"
+          save-actions-cache: "true"
+
   # Build dist once for Node-relevant changes and share it with downstream jobs.
   # Keep this overlapping with the fast correctness lanes so green PRs get heavy
   # test/build feedback sooner instead of waiting behind a full `check` pass.
   build-artifacts:
     permissions:
       contents: read
-    needs: [preflight]
+    needs: [preflight, pnpm-store-warmup]
     if: needs.preflight.outputs.run_build_artifacts == 'true'
     runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && 'blacksmith-16vcpu-ubuntu-2404' || 'ubuntu-24.04') }}
     timeout-minutes: 20
@@ -474,9 +550,6 @@ jobs:
           NODE_OPTIONS: --max-old-space-size=8192
         run: pnpm build:ci-artifacts
 
-      - name: Build Control UI
-        run: pnpm ui:build
-
       - name: Check Control UI i18n
         if: needs.preflight.outputs.run_control_ui_i18n == 'true'
         run: pnpm ui:i18n:check
@@ -569,6 +642,20 @@ jobs:
             pids+=("$!")
           }
 
+          if [ "$RUN_GATEWAY_WATCH" = "true" ]; then
+            gateway_watch_log="${RUNNER_TEMP}/gateway-watch.log"
+            echo "starting gateway-watch: node scripts/check-gateway-watch-regression.mjs --skip-build --ready-timeout-ms 5000"
+            if node scripts/check-gateway-watch-regression.mjs --skip-build --ready-timeout-ms 5000 >"$gateway_watch_log" 2>&1; then
+              result="success"
+            else
+              result="failure"
+            fi
+            echo "::group::gateway-watch log"
+            cat "$gateway_watch_log"
+            echo "::endgroup::"
+            results["gateway-watch"]="$result"
+          fi
+
           if [ "$RUN_CHANNELS" = "true" ]; then
             start_check "channels" env \
               NODE_OPTIONS=--max-old-space-size=8192 \
@@ -583,10 +670,6 @@ jobs:
               node scripts/run-vitest.mjs run --config test/vitest/vitest.full-core-support-boundary.config.ts
           fi
 
-          if [ "$RUN_GATEWAY_WATCH" = "true" ]; then
-            start_check "gateway-watch" node scripts/check-gateway-watch-regression.mjs --skip-build --ready-timeout-ms 5000
-          fi
-
           for index in "${!pids[@]}"; do
             name="${names[$index]}"
             log="${logs[$index]}"
@@ -629,7 +712,7 @@ jobs:
     permissions:
       contents: read
     name: ${{ matrix.check_name }}
-    needs: [preflight]
+    needs: [preflight, pnpm-store-warmup]
     if: needs.preflight.outputs.run_checks_fast_core == 'true'
     runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-24.04') }}
     timeout-minutes: 60
@@ -718,7 +801,7 @@ jobs:
     permissions:
       contents: read
     name: ${{ matrix.checkName }}
-    needs: [preflight]
+    needs: [preflight, pnpm-store-warmup]
     if: needs.preflight.outputs.run_plugin_contracts_shards == 'true'
     runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-24.04') }}
     timeout-minutes: 60
@@ -798,7 +881,7 @@ jobs:
     permissions:
       contents: read
     name: ${{ matrix.checkName }}
-    needs: [preflight]
+    needs: [preflight, pnpm-store-warmup]
     if: needs.preflight.outputs.run_checks_fast == 'true'
     runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-24.04') }}
     timeout-minutes: 60
@@ -950,9 +1033,9 @@ jobs:
     permissions:
       contents: read
     name: ${{ matrix.check_name }}
-    needs: [preflight]
+    needs: [preflight, pnpm-store-warmup]
     if: needs.preflight.outputs.run_checks_node_core_nondist == 'true'
-    runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && (matrix.runner || 'ubuntu-24.04') || 'ubuntu-24.04') }}
+    runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && (matrix.runner || 'blacksmith-8vcpu-ubuntu-2404') || 'ubuntu-24.04') }}
     timeout-minutes: 60
     strategy:
       fail-fast: false
@@ -1056,9 +1139,9 @@ jobs:
     permissions:
       contents: read
     name: ${{ matrix.check_name }}
-    needs: [preflight]
-    if: ${{ !cancelled() && always() && needs.preflight.outputs.run_check == 'true' }}
-    runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && matrix.runner || 'ubuntu-24.04') }}
+    needs: [preflight, pnpm-store-warmup]
+    if: ${{ !cancelled() && always() && needs.preflight.outputs.run_check == 'true' && needs.pnpm-store-warmup.result == 'success' }}
+    runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && (matrix.runner || 'blacksmith-4vcpu-ubuntu-2404') || 'ubuntu-24.04') }}
     timeout-minutes: 20
     strategy:
       fail-fast: false
@@ -1149,7 +1232,7 @@ jobs:
               pnpm lint:auth:pairing-account-scope
               pnpm check:import-cycles
               # build-artifacts already runs the tsdown/runtime build for the same Node-relevant changes.
-              pnpm build:plugin-sdk:strict-smoke
+              NODE_OPTIONS=--max-old-space-size=8192 pnpm build:plugin-sdk:strict-smoke
               ;;
             prod-types)
               pnpm tsgo:prod
@@ -1187,8 +1270,8 @@ jobs:
     permissions:
       contents: read
     name: ${{ matrix.check_name }}
-    needs: [preflight]
-    if: ${{ !cancelled() && always() && needs.preflight.outputs.run_check_additional == 'true' }}
+    needs: [preflight, pnpm-store-warmup]
+    if: ${{ !cancelled() && always() && needs.preflight.outputs.run_check_additional == 'true' && needs.pnpm-store-warmup.result == 'success' }}
     runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && 'blacksmith-8vcpu-ubuntu-2404' || 'ubuntu-24.04') }}
     timeout-minutes: 20
     strategy:
@@ -1354,7 +1437,7 @@ jobs:
   check-docs:
     permissions:
       contents: read
-    needs: [preflight]
+    needs: [preflight, pnpm-store-warmup]
     if: needs.preflight.outputs.run_check_docs == 'true'
     runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-24.04') }}
     timeout-minutes: 20
@@ -1411,11 +1494,44 @@ jobs:
       - name: Checkout ClawHub docs source
         run: |
           set -euo pipefail
-          git init clawhub-source
-          git -C clawhub-source config gc.auto 0
-          git -C clawhub-source remote add origin "https://github.com/openclaw/clawhub.git"
-          git -C clawhub-source fetch --no-tags --depth=1 origin "+HEAD:refs/remotes/origin/checkout"
-          git -C clawhub-source checkout --detach refs/remotes/origin/checkout
+
+          workdir="$GITHUB_WORKSPACE/clawhub-source"
+          started_at="$(date +%s)"
+
+          reset_checkout_dir() {
+            mkdir -p "$workdir"
+            find "$workdir" -mindepth 1 -maxdepth 1 -exec rm -rf {} +
+          }
+
+          checkout_attempt() {
+            local attempt="$1"
+
+            reset_checkout_dir
+            git init "$workdir" >/dev/null
+            git -C "$workdir" config gc.auto 0
+            git -C "$workdir" remote add origin "https://github.com/openclaw/clawhub.git"
+
+            timeout --signal=TERM --kill-after=10s 30s git -C "$workdir" \
+              -c protocol.version=2 \
+              fetch --no-tags --prune --no-recurse-submodules --depth=1 origin \
+              "+refs/heads/main:refs/remotes/origin/checkout" || return 1
+
+            git -C "$workdir" checkout --force --detach refs/remotes/origin/checkout || return 1
+            echo "ClawHub checkout attempt ${attempt}/5 succeeded"
+          }
+
+          for attempt in 1 2 3 4 5; do
+            if checkout_attempt "$attempt"; then
+              elapsed="$(( $(date +%s) - started_at ))"
+              echo "ClawHub checkout completed in ${elapsed}s"
+              exit 0
+            fi
+            echo "ClawHub checkout attempt ${attempt}/5 failed"
+            sleep $((attempt * 5))
+          done
+
+          echo "ClawHub checkout failed after 5 attempts" >&2
+          exit 1
 
       - name: Check docs
         env:
@@ -1572,7 +1688,7 @@ jobs:
     name: ${{ matrix.check_name }}
     needs: [preflight]
     if: ${{ !cancelled() && always() && needs.preflight.outputs.run_macos_node == 'true' }}
-    runs-on: ${{ github.event_name == 'workflow_dispatch' && 'macos-latest' || (github.repository == 'openclaw/openclaw' && 'blacksmith-6vcpu-macos-latest' || 'macos-latest') }}
+    runs-on: ${{ github.event_name == 'workflow_dispatch' && 'macos-15' || (github.repository == 'openclaw/openclaw' && 'blacksmith-6vcpu-macos-15' || 'macos-15') }}
     timeout-minutes: 20
     strategy:
       fail-fast: false
@@ -1621,7 +1737,7 @@ jobs:
     name: "macos-swift"
     needs: [preflight]
     if: needs.preflight.outputs.run_macos_swift == 'true'
-    runs-on: ${{ github.event_name == 'workflow_dispatch' && 'macos-26' || (github.repository == 'openclaw/openclaw' && 'blacksmith-12vcpu-macos-latest' || 'macos-26') }}
+    runs-on: ${{ github.event_name == 'workflow_dispatch' && 'macos-26' || (github.repository == 'openclaw/openclaw' && 'blacksmith-12vcpu-macos-26' || 'macos-26') }}
     timeout-minutes: 20
     steps:
       - name: Checkout
@@ -1844,3 +1960,53 @@ jobs:
               exit 1
               ;;
           esac
+
+  ci-timings-summary:
+    permissions:
+      actions: read
+      contents: read
+    name: ci-timings-summary
+    needs:
+      - preflight
+      - security-fast
+      - pnpm-store-warmup
+      - build-artifacts
+      - checks-fast-core
+      - checks-fast-plugin-contracts-shard
+      - checks-fast-channel-contracts-shard
+      - checks-node-compat
+      - checks-node-core-test-nondist-shard
+      - check-shard
+      - check-additional-shard
+      - check-docs
+      - skills-python
+      - checks-windows
+      - macos-node
+      - macos-swift
+      - android
+    if: ${{ !cancelled() && always() && (github.event_name != 'pull_request' || !github.event.pull_request.draft) }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - name: Checkout timing summary helper
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || needs.preflight.outputs.checkout_revision || github.sha }}
+          fetch-depth: 1
+          fetch-tags: false
+          persist-credentials: false
+          submodules: false
+
+      - name: Write CI timing summary
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          node scripts/ci-run-timings.mjs "$GITHUB_RUN_ID" --limit 25 > ci-timings-summary.txt
+          cat ci-timings-summary.txt >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Upload CI timing summary
+        uses: actions/upload-artifact@v7
+        with:
+          name: ci-timings-summary
+          path: ci-timings-summary.txt
+          retention-days: 14

.github/workflows/codeql-critical-quality.yml

@@ -71,7 +71,9 @@ on:
       - "src/acp/control-plane/**"
       - "src/agents/cli-runner/**"
       - "src/agents/command/**"
-      - "src/agents/pi-embedded-runner/**"
+      - "src/agents/embedded-agent-runner/**"
+      - "src/agents/sessions/**"
+      - "src/agents/sessions/tools/**"
       - "src/agents/tools/**"
       - "src/agents/*completion*.ts"
       - "src/agents/*transport*.ts"
@@ -222,7 +224,15 @@ jobs:
                   network_runtime=true
                   session_diagnostics=true
                   ;;
-                src/acp/control-plane/*|src/agents/cli-runner/*|src/agents/command/*|src/agents/pi-embedded-runner/*|src/agents/tools/*|src/agents/*completion*.ts|src/agents/*transport*.ts|src/agents/model-*.ts|src/agents/openclaw-tools*.ts|src/agents/provider-*.ts|src/agents/session*.ts|src/agents/tool-call*.ts|src/auto-reply/reply/agent-runner*.ts|src/auto-reply/reply/commands*.ts|src/auto-reply/reply/directive-handling*.ts|src/auto-reply/reply/dispatch-*.ts|src/auto-reply/reply/get-reply-run*.ts|src/auto-reply/reply/provider-dispatcher*.ts|src/auto-reply/reply/queue*.ts|src/auto-reply/reply/reply-run-registry*.ts|src/auto-reply/reply/session*.ts)
+                src/agents/sessions/tools/*)
+                  agent=true
+                  mcp_process=true
+                  ;;
+                src/agents/sessions/*auth*.ts|src/agents/sessions/**/*auth*.ts)
+                  agent=true
+                  core_auth_secrets=true
+                  ;;
+                src/acp/control-plane/*|src/agents/cli-runner/*|src/agents/command/*|src/agents/embedded-agent-runner/*|src/agents/sessions/*|src/agents/tools/*|src/agents/*completion*.ts|src/agents/*transport*.ts|src/agents/model-*.ts|src/agents/openclaw-tools*.ts|src/agents/provider-*.ts|src/agents/session*.ts|src/agents/tool-call*.ts|src/auto-reply/reply/agent-runner*.ts|src/auto-reply/reply/commands*.ts|src/auto-reply/reply/directive-handling*.ts|src/auto-reply/reply/dispatch-*.ts|src/auto-reply/reply/get-reply-run*.ts|src/auto-reply/reply/provider-dispatcher*.ts|src/auto-reply/reply/queue*.ts|src/auto-reply/reply/reply-run-registry*.ts|src/auto-reply/reply/session*.ts)
                   agent=true
                   ;;
                 src/auto-reply/reply/post-compaction-context.ts|src/auto-reply/reply/queue/*|src/auto-reply/reply/startup-context.ts|src/commands/doctor-session-*.ts|src/commands/session-store-targets.ts|src/commands/sessions*.ts|src/infra/diagnostic-*.ts|src/infra/diagnostics-timeline.ts|src/infra/session-delivery-queue*.ts|src/logging/diagnostic*.ts)

.github/workflows/codeql-macos-critical-security.yml

@@ -20,7 +20,7 @@ permissions:
 jobs:
   macos:
     name: Critical Security (macOS)
-    runs-on: blacksmith-6vcpu-macos-latest
+    runs-on: blacksmith-6vcpu-macos-15
     timeout-minutes: 45
     steps:
       - name: Checkout

.github/workflows/codeql.yml

@@ -19,6 +19,15 @@ on:
       - ".github/workflows/**"
       - "packages/**"
       - "src/**"
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/actions/**"
+      - ".github/codeql/**"
+      - ".github/workflows/**"
+      - "packages/**"
+      - "src/**"
   schedule:
     - cron: "0 6 * * *"
 
@@ -76,10 +85,21 @@ jobs:
             config_file: ./.github/codeql/codeql-actions-critical-security.yml
     steps:
       - name: Checkout
+        if: ${{ matrix.category != 'actions' }}
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           submodules: false
 
+      - name: Checkout Actions security sources
+        if: ${{ matrix.category == 'actions' }}
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          submodules: false
+          sparse-checkout: |
+            .github/actions
+            .github/workflows
+            .github/codeql
+
       - name: Initialize CodeQL
         uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
         with:

.github/workflows/crabbox-hydrate.yml

@@ -41,7 +41,7 @@ env:
 jobs:
   hydrate:
     name: hydrate
-    if: ${{ inputs.crabbox_job != 'hydrate-github' }}
+    if: ${{ inputs.crabbox_job != 'hydrate-github' && inputs.crabbox_job != 'hydrate-windows-daemon' }}
     runs-on: [self-hosted, "${{ inputs.crabbox_runner_label }}"]
     timeout-minutes: 120
     steps:
@@ -131,7 +131,7 @@ jobs:
             ln -sfn . "$PNPM_CONFIG_MODULES_DIR/node_modules"
           fi
 
-      - name: Prepare Crabbox shell
+      - name: Fetch main ref
         shell: bash
         run: |
           set -euo pipefail
@@ -140,6 +140,11 @@ jobs:
             git fetch --no-tags --depth=50 origin "+refs/heads/main:refs/remotes/origin/main"
           fi
 
+      - name: Prepare Crabbox shell
+        shell: bash
+        run: |
+          set -euo pipefail
+
           node_bin="$(dirname "$(node -p 'process.execPath')")"
           sudo ln -sf "$node_bin/node" /usr/local/bin/node
           sudo ln -sf "$node_bin/npm" /usr/local/bin/npm
@@ -245,7 +250,7 @@ jobs:
             fi
           }
           {
-            for key in CI GITHUB_ACTIONS GITHUB_WORKSPACE GITHUB_REPOSITORY GITHUB_RUN_ID GITHUB_RUN_NUMBER GITHUB_RUN_ATTEMPT GITHUB_REF GITHUB_REF_NAME GITHUB_SHA GITHUB_EVENT_NAME GITHUB_ACTOR RUNNER_OS RUNNER_ARCH RUNNER_TEMP RUNNER_TOOL_CACHE XDG_CACHE_HOME COREPACK_HOME PNPM_HOME PNPM_CONFIG_CHILD_CONCURRENCY PNPM_CONFIG_MODULES_DIR PNPM_CONFIG_NETWORK_CONCURRENCY PNPM_CONFIG_STORE_DIR PNPM_CONFIG_VERIFY_DEPS_BEFORE_RUN PNPM_CONFIG_VIRTUAL_STORE_DIR; do
+            for key in CI GITHUB_ACTIONS GITHUB_WORKSPACE GITHUB_REPOSITORY GITHUB_RUN_ID GITHUB_RUN_NUMBER GITHUB_RUN_ATTEMPT GITHUB_REF GITHUB_REF_NAME GITHUB_SHA GITHUB_EVENT_NAME GITHUB_ACTOR RUNNER_OS RUNNER_ARCH RUNNER_TEMP RUNNER_TOOL_CACHE XDG_CACHE_HOME COREPACK_HOME NODE_BIN PNPM_HOME PNPM_CONFIG_CHILD_CONCURRENCY PNPM_CONFIG_MODULES_DIR PNPM_CONFIG_NETWORK_CONCURRENCY PNPM_CONFIG_STORE_DIR PNPM_CONFIG_VERIFY_DEPS_BEFORE_RUN PNPM_CONFIG_VIRTUAL_STORE_DIR PATH; do
               write_export "$key"
             done
           } > "${env_file}.tmp"
@@ -292,6 +297,200 @@ jobs:
             sleep 15
           done
 
+  hydrate-windows-daemon:
+    name: hydrate-windows-daemon
+    if: ${{ inputs.crabbox_job == 'hydrate-windows-daemon' }}
+    runs-on: [self-hosted, "${{ inputs.crabbox_runner_label }}"]
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.ref || github.ref }}
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: "24"
+
+      - name: Fetch main ref
+        shell: powershell
+        run: |
+          $ErrorActionPreference = "Stop"
+
+          if (git rev-parse --is-inside-work-tree 2>$null) {
+            git fetch --no-tags --depth=50 origin "+refs/heads/main:refs/remotes/origin/main"
+          }
+
+      - name: Setup pnpm and dependencies
+        shell: powershell
+        env:
+          CI: "true"
+          COREPACK_ENABLE_DOWNLOAD_PROMPT: "0"
+        run: |
+          $ErrorActionPreference = "Stop"
+
+          $workspace = (Get-Location).Path
+          $cacheRoot = if ($env:RUNNER_TEMP) { $env:RUNNER_TEMP } else { [System.IO.Path]::GetTempPath() }
+          $env:XDG_CACHE_HOME = Join-Path $cacheRoot "cache"
+          $env:COREPACK_HOME = Join-Path $env:XDG_CACHE_HOME "corepack"
+          $env:PNPM_HOME = Join-Path $cacheRoot "pnpm-home"
+          $env:PNPM_CONFIG_STORE_DIR = Join-Path $cacheRoot "openclaw-pnpm-store"
+          $env:PNPM_CONFIG_MODULES_DIR = Join-Path $workspace "node_modules"
+          $env:PNPM_CONFIG_VIRTUAL_STORE_DIR = Join-Path $workspace "node_modules\.pnpm"
+          $env:PNPM_CONFIG_CHILD_CONCURRENCY = "4"
+          $env:PNPM_CONFIG_NETWORK_CONCURRENCY = "8"
+          $env:PNPM_CONFIG_VERIFY_DEPS_BEFORE_RUN = "false"
+          $env:PNPM_CONFIG_SIDE_EFFECTS_CACHE = "false"
+          function Add-GitHubCommandLine([string]$Path, [string]$Value) {
+            $Value | Out-File -FilePath $Path -Encoding utf8 -Append
+          }
+          New-Item -ItemType Directory -Force `
+            $env:XDG_CACHE_HOME, `
+            $env:COREPACK_HOME, `
+            $env:PNPM_HOME, `
+            $env:PNPM_CONFIG_STORE_DIR | Out-Null
+          $env:PATH = "$env:PNPM_HOME;$env:PATH"
+          @(
+            "XDG_CACHE_HOME=$env:XDG_CACHE_HOME"
+            "COREPACK_HOME=$env:COREPACK_HOME"
+            "PNPM_HOME=$env:PNPM_HOME"
+            "PNPM_CONFIG_STORE_DIR=$env:PNPM_CONFIG_STORE_DIR"
+            "PNPM_CONFIG_MODULES_DIR=$env:PNPM_CONFIG_MODULES_DIR"
+            "PNPM_CONFIG_VIRTUAL_STORE_DIR=$env:PNPM_CONFIG_VIRTUAL_STORE_DIR"
+            "PNPM_CONFIG_CHILD_CONCURRENCY=$env:PNPM_CONFIG_CHILD_CONCURRENCY"
+            "PNPM_CONFIG_NETWORK_CONCURRENCY=$env:PNPM_CONFIG_NETWORK_CONCURRENCY"
+            "PNPM_CONFIG_VERIFY_DEPS_BEFORE_RUN=$env:PNPM_CONFIG_VERIFY_DEPS_BEFORE_RUN"
+            "PNPM_CONFIG_SIDE_EFFECTS_CACHE=$env:PNPM_CONFIG_SIDE_EFFECTS_CACHE"
+          ) | ForEach-Object { Add-GitHubCommandLine $env:GITHUB_ENV $_ }
+          Add-GitHubCommandLine $env:GITHUB_PATH $env:PNPM_HOME
+
+          $packageManager = (Get-Content package.json -Raw | ConvertFrom-Json).packageManager
+          if (-not $packageManager -or -not $packageManager.StartsWith("pnpm@")) {
+            Write-Error "Expected packageManager to pin pnpm, got '$packageManager'"
+          }
+          corepack enable --install-directory $env:PNPM_HOME
+          for ($attempt = 1; $attempt -le 3; $attempt++) {
+            corepack prepare $packageManager --activate
+            if ($LASTEXITCODE -eq 0) {
+              break
+            }
+            if ($attempt -eq 3) {
+              exit $LASTEXITCODE
+            }
+            Start-Sleep -Seconds ($attempt * 5)
+          }
+          $nodeBin = Split-Path -Parent (node -p "process.execPath")
+          Add-GitHubCommandLine $env:GITHUB_ENV "NODE_BIN=$nodeBin"
+          Add-GitHubCommandLine $env:GITHUB_PATH $nodeBin
+          $env:PATH = "$nodeBin;$env:PATH"
+
+          node -v
+          npm -v
+          pnpm -v
+
+          $installArgs = @(
+            "install",
+            "--filter",
+            "openclaw",
+            "--prefer-offline",
+            "--ignore-scripts=true",
+            "--config.engine-strict=false",
+            "--config.enable-pre-post-scripts=false",
+            "--config.side-effects-cache=false",
+            "--frozen-lockfile",
+            "--child-concurrency=$env:PNPM_CONFIG_CHILD_CONCURRENCY",
+            "--modules-dir=$env:PNPM_CONFIG_MODULES_DIR",
+            "--network-concurrency=$env:PNPM_CONFIG_NETWORK_CONCURRENCY",
+            "--store-dir=$env:PNPM_CONFIG_STORE_DIR",
+            "--virtual-store-dir=$env:PNPM_CONFIG_VIRTUAL_STORE_DIR"
+          )
+          pnpm @installArgs
+          if ($LASTEXITCODE -ne 0) {
+            exit $LASTEXITCODE
+          }
+          $corepackShimDir = Join-Path $nodeBin "node_modules\corepack\shims"
+          if (Test-Path $corepackShimDir) {
+            $env:PNPM_HOME = $corepackShimDir
+            Add-GitHubCommandLine $env:GITHUB_ENV "PNPM_HOME=$env:PNPM_HOME"
+            Add-GitHubCommandLine $env:GITHUB_PATH $env:PNPM_HOME
+          }
+
+      - name: Mark Crabbox ready
+        shell: powershell
+        env:
+          CRABBOX_ID: ${{ inputs.crabbox_id }}
+          CRABBOX_JOB: ${{ inputs.crabbox_job }}
+        run: |
+          $ErrorActionPreference = "Stop"
+          $job = if ($env:CRABBOX_JOB) { $env:CRABBOX_JOB } else { "hydrate-windows-daemon" }
+          if (-not $env:CRABBOX_ID -or $env:CRABBOX_ID -notmatch '^[A-Za-z0-9._-]+$') {
+            Write-Error "Invalid crabbox_id"
+          }
+          $actionsRoot = Join-Path $HOME ".crabbox\actions"
+          New-Item -ItemType Directory -Force $actionsRoot | Out-Null
+          $state = Join-Path $actionsRoot "$env:CRABBOX_ID.env"
+          $envFile = Join-Path $actionsRoot "$env:CRABBOX_ID.env.ps1"
+          $servicesFile = Join-Path $actionsRoot "$env:CRABBOX_ID.services"
+          $keys = @(
+            "CI", "GITHUB_ACTIONS", "GITHUB_WORKSPACE", "GITHUB_REPOSITORY",
+            "GITHUB_RUN_ID", "GITHUB_RUN_NUMBER", "GITHUB_RUN_ATTEMPT",
+            "GITHUB_REF", "GITHUB_REF_NAME", "GITHUB_SHA", "GITHUB_EVENT_NAME",
+            "GITHUB_ACTOR", "RUNNER_OS", "RUNNER_ARCH", "RUNNER_TEMP",
+            "RUNNER_TOOL_CACHE", "XDG_CACHE_HOME", "COREPACK_HOME", "NODE_BIN",
+            "PNPM_HOME", "PNPM_CONFIG_CHILD_CONCURRENCY", "PNPM_CONFIG_MODULES_DIR",
+            "PNPM_CONFIG_NETWORK_CONCURRENCY", "PNPM_CONFIG_STORE_DIR",
+            "PNPM_CONFIG_VERIFY_DEPS_BEFORE_RUN", "PNPM_CONFIG_VIRTUAL_STORE_DIR",
+            "PNPM_CONFIG_SIDE_EFFECTS_CACHE", "PATH"
+          )
+          $envLines = foreach ($key in $keys) {
+            $value = [Environment]::GetEnvironmentVariable($key)
+            if ($value) {
+              "$key=$value"
+            }
+          }
+          $utf8NoBom = [System.Text.UTF8Encoding]::new($false)
+          [System.IO.File]::WriteAllLines("$envFile.tmp", $envLines, $utf8NoBom)
+          Move-Item -Force "$envFile.tmp" $envFile
+          [System.IO.File]::WriteAllLines(
+            "$servicesFile.tmp",
+            @("# Docker containers visible from the hydrated runner", "docker not available on native Windows hydration"),
+            $utf8NoBom
+          )
+          Move-Item -Force "$servicesFile.tmp" $servicesFile
+          $stateLines = @(
+            "WORKSPACE=$env:GITHUB_WORKSPACE",
+            "RUN_ID=$env:GITHUB_RUN_ID",
+            "JOB=$job",
+            "ENV_FILE=$envFile",
+            "SERVICES_FILE=$servicesFile",
+            "READY_AT=$((Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ"))"
+          )
+          [System.IO.File]::WriteAllLines("$state.tmp", $stateLines, $utf8NoBom)
+          Move-Item -Force "$state.tmp" $state
+
+      - name: Keep Crabbox job alive
+        shell: powershell
+        env:
+          CRABBOX_ID: ${{ inputs.crabbox_id }}
+          CRABBOX_KEEP_ALIVE_MINUTES: ${{ inputs.crabbox_keep_alive_minutes }}
+        run: |
+          $ErrorActionPreference = "Stop"
+          if (-not $env:CRABBOX_ID -or $env:CRABBOX_ID -notmatch '^[A-Za-z0-9._-]+$') {
+            Write-Error "Invalid crabbox_id"
+          }
+          $minutes = 90
+          if ($env:CRABBOX_KEEP_ALIVE_MINUTES -match '^[0-9]+$') {
+            $minutes = [int]$env:CRABBOX_KEEP_ALIVE_MINUTES
+          }
+          $stop = Join-Path $HOME ".crabbox\actions\$env:CRABBOX_ID.stop"
+          $deadline = (Get-Date).AddMinutes($minutes)
+          while ((Get-Date) -lt $deadline) {
+            if (Test-Path $stop) {
+              exit 0
+            }
+            Start-Sleep -Seconds 15
+          }
+
   hydrate-github:
     name: hydrate-github
     if: ${{ inputs.crabbox_job == 'hydrate-github' }}
@@ -445,7 +644,7 @@ jobs:
             fi
           }
           {
-            for key in CI GITHUB_ACTIONS GITHUB_WORKSPACE GITHUB_REPOSITORY GITHUB_RUN_ID GITHUB_RUN_NUMBER GITHUB_RUN_ATTEMPT GITHUB_REF GITHUB_REF_NAME GITHUB_SHA GITHUB_EVENT_NAME GITHUB_ACTOR RUNNER_OS RUNNER_ARCH RUNNER_TEMP RUNNER_TOOL_CACHE PNPM_CONFIG_CHILD_CONCURRENCY PNPM_CONFIG_MODULES_DIR PNPM_CONFIG_NETWORK_CONCURRENCY PNPM_CONFIG_STORE_DIR PNPM_CONFIG_VERIFY_DEPS_BEFORE_RUN PNPM_CONFIG_VIRTUAL_STORE_DIR; do
+            for key in CI GITHUB_ACTIONS GITHUB_WORKSPACE GITHUB_REPOSITORY GITHUB_RUN_ID GITHUB_RUN_NUMBER GITHUB_RUN_ATTEMPT GITHUB_REF GITHUB_REF_NAME GITHUB_SHA GITHUB_EVENT_NAME GITHUB_ACTOR RUNNER_OS RUNNER_ARCH RUNNER_TEMP RUNNER_TOOL_CACHE NODE_BIN PNPM_HOME PNPM_CONFIG_CHILD_CONCURRENCY PNPM_CONFIG_MODULES_DIR PNPM_CONFIG_NETWORK_CONCURRENCY PNPM_CONFIG_STORE_DIR PNPM_CONFIG_VERIFY_DEPS_BEFORE_RUN PNPM_CONFIG_VIRTUAL_STORE_DIR PATH; do
               write_export "$key"
             done
           } > "${env_file}.tmp"

.github/workflows/dependency-change-awareness.yml

@@ -1,10 +1,11 @@
 name: Dependency Change Awareness
 
 on:
-  pull_request_target: # zizmor: ignore[dangerous-triggers] metadata-only workflow; no checkout or untrusted code execution
+  pull_request_target: # zizmor: ignore[dangerous-triggers] checks trusted base script only; never checks out PR head
     types: [opened, reopened, synchronize, ready_for_review]
 
 permissions:
+  contents: read
   pull-requests: write
   issues: write
 
@@ -18,159 +19,15 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
-      - name: Label and comment on dependency changes
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
+      - name: Check out trusted base workflow scripts
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
-          script: |
-            const marker = "<!-- openclaw:dependency-change-awareness -->";
-            const labelName = "dependencies-changed";
-            const maxListedFiles = 25;
-            const pullRequest = context.payload.pull_request;
+          ref: ${{ github.event.pull_request.base.sha }}
+          persist-credentials: false
 
-            if (!pullRequest) {
-              core.info("No pull_request payload found; skipping.");
-              return;
-            }
-
-            const isDependencyFile = (filename) =>
-              filename === "package.json" ||
-              filename === "package-lock.json" ||
-              filename === "npm-shrinkwrap.json" ||
-              filename === "pnpm-lock.yaml" ||
-              filename === "pnpm-workspace.yaml" ||
-              filename === "ui/package.json" ||
-              filename.startsWith("patches/") ||
-              /^packages\/[^/]+\/package\.json$/u.test(filename) ||
-              /^extensions\/[^/]+\/package-lock\.json$/u.test(filename) ||
-              /^extensions\/[^/]+\/npm-shrinkwrap\.json$/u.test(filename) ||
-              /^extensions\/[^/]+\/package\.json$/u.test(filename);
-
-            const sanitizeDisplayValue = (value) =>
-              String(value)
-                .replace(/[\u0000-\u001f\u007f]/gu, "?")
-                .slice(0, 240);
-            const markdownCode = (value) =>
-              `\`${sanitizeDisplayValue(value).replaceAll("`", "\\`")}\``;
-            const ignoreUnavailableWritePermission = (action) => (error) => {
-              if (error?.status === 403) {
-                core.warning(
-                  `Skipping dependency change ${action}; token does not have issue write permission.`,
-                );
-                return;
-              }
-              if (error?.status === 404 || error?.status === 422) {
-                core.warning(`Dependency change ${action} is unavailable.`);
-                return;
-              }
-              throw error;
-            };
-
-            const files = await github.paginate(github.rest.pulls.listFiles, {
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              pull_number: pullRequest.number,
-              per_page: 100,
-            });
-            const dependencyFiles = files
-              .map((file) => file.filename)
-              .filter((filename) => typeof filename === "string" && isDependencyFile(filename))
-              .sort((left, right) => left.localeCompare(right));
-
-            const comments = await github.paginate(github.rest.issues.listComments, {
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: pullRequest.number,
-              per_page: 100,
-            });
-            const existingComment = comments.find(
-              (comment) =>
-                comment.user?.login === "github-actions[bot]" && comment.body?.includes(marker),
-            );
-
-            const labels = await github.paginate(github.rest.issues.listLabelsOnIssue, {
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: pullRequest.number,
-              per_page: 100,
-            });
-            const hasLabel = labels.some((label) => label.name === labelName);
-
-            if (dependencyFiles.length === 0) {
-              if (hasLabel) {
-                await github.rest.issues.removeLabel({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  issue_number: pullRequest.number,
-                  name: labelName,
-                }).catch(ignoreUnavailableWritePermission("label removal"));
-              }
-              if (existingComment) {
-                await github.rest.issues.deleteComment({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  comment_id: existingComment.id,
-                }).catch(ignoreUnavailableWritePermission("comment deletion"));
-              }
-              await core.summary
-                .addHeading("Dependency Change Awareness")
-                .addRaw("No dependency-related file changes detected.")
-                .write();
-              core.info("No dependency-related file changes detected.");
-              return;
-            }
-
-            if (!hasLabel) {
-              await github.rest.issues.addLabels({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: pullRequest.number,
-                labels: [labelName],
-              }).catch(ignoreUnavailableWritePermission(`label "${labelName}" update`));
-            }
-
-            const listedFiles = dependencyFiles.slice(0, maxListedFiles);
-            const omittedCount = dependencyFiles.length - listedFiles.length;
-            const fileLines = listedFiles.map((filename) => `- ${markdownCode(filename)}`);
-            if (omittedCount > 0) {
-              fileLines.push(`- ${omittedCount} additional dependency-related files not shown`);
-            }
-
-            const body = [
-              marker,
-              "",
-              "### Dependency Changes Detected",
-              "",
-              "This PR changes dependency-related files. Maintainers should confirm these changes are intentional.",
-              "",
-              "Changed files:",
-              ...fileLines,
-              "",
-              "Maintainer follow-up:",
-              "- Review whether the dependency changes are intentional.",
-              "- Inspect resolved package deltas when lockfile, shrinkwrap, or workspace dependency policy changes are present.",
-              "- Treat `package-lock.json` and `npm-shrinkwrap.json` diffs as security-review surfaces.",
-              "- Run `pnpm deps:changes:report -- --base-ref origin/main --markdown /tmp/dependency-changes.md --json /tmp/dependency-changes.json` locally for detailed release-style evidence.",
-            ].join("\n");
-
-            if (existingComment) {
-              await github.rest.issues.updateComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existingComment.id,
-                body,
-              }).catch(ignoreUnavailableWritePermission("comment update"));
-            } else {
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: pullRequest.number,
-                body,
-              }).catch(ignoreUnavailableWritePermission("comment creation"));
-            }
-
-            await core.summary
-              .addHeading("Dependency Change Awareness")
-              .addRaw(`Detected ${dependencyFiles.length} dependency-related file change(s).`)
-              .addList(dependencyFiles.map((filename) => markdownCode(filename)))
-              .write();
-            core.notice(`Detected ${dependencyFiles.length} dependency-related file change(s).`);
+      - name: Label, comment, and guard dependency changes
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          OPENCLAW_SECURITY_APPROVERS: vincentkoc,steipete,joshavant
+          OPENCLAW_SECURITY_TEAM_SLUG: openclaw-secops
+        run: node scripts/github/dependency-change-awareness.mjs

.github/workflows/docker-release.yml

@@ -75,6 +75,7 @@ jobs:
       contents: read
     outputs:
       digest: ${{ steps.build.outputs.digest }}
+      browser_digest: ${{ steps.build-browser.outputs.digest }}
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -102,14 +103,18 @@ jobs:
           set -euo pipefail
           tags=()
           slim_tags=()
-          if [[ "${SOURCE_REF}" == "refs/heads/main" ]]; then
-            tags+=("${IMAGE}:main-amd64")
-            slim_tags+=("${IMAGE}:main-slim-amd64")
+          browser_tags=()
+          browser_supported=0
+          if grep -q '^ARG OPENCLAW_INSTALL_BROWSER' Dockerfile; then
+            browser_supported=1
           fi
           if [[ "${SOURCE_REF}" == refs/tags/v* ]]; then
             version="${SOURCE_REF#refs/tags/v}"
             tags+=("${IMAGE}:${version}-amd64")
             slim_tags+=("${IMAGE}:${version}-slim-amd64")
+            if [[ "${browser_supported}" == "1" ]]; then
+              browser_tags+=("${IMAGE}:${version}-browser-amd64")
+            fi
           fi
           if [[ ${#tags[@]} -eq 0 ]]; then
             echo "::error::No amd64 tags resolved for ref ${SOURCE_REF}"
@@ -119,6 +124,9 @@ jobs:
             echo "value<<EOF"
             printf "%s\n" "${tags[@]}" "${slim_tags[@]}"
             echo "EOF"
+            echo "browser<<EOF"
+            printf "%s\n" "${browser_tags[@]}"
+            echo "EOF"
           } >> "$GITHUB_OUTPUT"
 
       - name: Resolve OCI labels (amd64)
@@ -162,6 +170,91 @@ jobs:
           provenance: mode=max
           push: true
 
+      - name: Build and push amd64 browser image
+        id: build-browser
+        if: steps.tags.outputs.browser != ''
+        # WARNING: KEEP THE OFFICIAL DOCKER ACTION HERE; DO NOT SWITCH THIS BACK TO BLACKSMITH BLINDLY.
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        with:
+          context: .
+          platforms: linux/amd64
+          cache-from: |
+            type=gha,scope=docker-release-amd64
+            type=gha,scope=docker-release-browser-amd64
+          cache-to: type=gha,mode=max,scope=docker-release-browser-amd64
+          build-args: |
+            OPENCLAW_EXTENSIONS=diagnostics-otel,codex
+            OPENCLAW_INSTALL_BROWSER=1
+          tags: ${{ steps.tags.outputs.browser }}
+          labels: ${{ steps.labels.outputs.value }}
+          sbom: true
+          provenance: mode=max
+          push: true
+
+      - name: Smoke test amd64 runtime workspace templates
+        shell: bash
+        env:
+          IMAGE_REFS: ${{ steps.tags.outputs.value }}
+        run: |
+          set -euo pipefail
+          mapfile -t image_refs <<< "${IMAGE_REFS}"
+          image_ref="${image_refs[0]}"
+          if [[ -z "${image_ref}" ]]; then
+            echo "::error::No amd64 image ref resolved for runtime template smoke"
+            exit 1
+          fi
+          docker run --rm --entrypoint /bin/sh "${image_ref}" -lc '
+            set -eu
+            test -f /app/src/agents/templates/HEARTBEAT.md
+            temp_root="$(mktemp -d)"
+            trap "rm -rf \"${temp_root}\"" EXIT
+            mkdir -p "${temp_root}/home" "${temp_root}/cwd"
+            cd "${temp_root}/cwd"
+            set +e
+            HOME="${temp_root}/home" \
+            USERPROFILE="${temp_root}/home" \
+            OPENCLAW_HOME="${temp_root}/home" \
+            OPENCLAW_NO_ONBOARD=1 \
+            OPENCLAW_SUPPRESS_NOTES=1 \
+            OPENCLAW_DISABLE_BUNDLED_PLUGINS=1 \
+            OPENCLAW_DISABLE_BUNDLED_ENTRY_SOURCE_FALLBACK=1 \
+            AWS_EC2_METADATA_DISABLED=true \
+            AWS_SHARED_CREDENTIALS_FILE="${temp_root}/home/.aws/credentials" \
+            AWS_CONFIG_FILE="${temp_root}/home/.aws/config" \
+              node /app/openclaw.mjs agent --message "workspace bootstrap smoke" --session-id "workspace-bootstrap-smoke" --local --timeout 1 --json \
+              >"${temp_root}/out.log" 2>&1
+            status="$?"
+            set -e
+            if grep -F "Missing workspace template:" "${temp_root}/out.log"; then
+              cat "${temp_root}/out.log"
+              exit 1
+            fi
+            test -f "${temp_root}/home/.openclaw/workspace/HEARTBEAT.md"
+            if [ "${status}" -ne 0 ]; then
+              cat "${temp_root}/out.log"
+            fi
+          '
+
+      - name: Smoke test amd64 browser image
+        if: steps.tags.outputs.browser != ''
+        shell: bash
+        env:
+          IMAGE_REFS: ${{ steps.tags.outputs.browser }}
+        run: |
+          set -euo pipefail
+          mapfile -t image_refs <<< "${IMAGE_REFS}"
+          image_ref="${image_refs[0]}"
+          if [[ -z "${image_ref}" ]]; then
+            echo "::error::No amd64 browser image ref resolved"
+            exit 1
+          fi
+          docker run --rm --entrypoint /bin/sh "${image_ref}" -lc '
+            set -eu
+            browser="$(find /home/node/.cache/ms-playwright -maxdepth 5 -type f \( -name chrome -o -name chromium -o -name chrome-headless-shell \) -print | head -1)"
+            test -n "${browser}"
+            "${browser}" --version
+          '
+
   # Build arm64 image. Default and slim tags point to the same slim runtime.
   build-arm64:
     needs: [approve_manual_backfill]
@@ -173,6 +266,7 @@ jobs:
       contents: read
     outputs:
       digest: ${{ steps.build.outputs.digest }}
+      browser_digest: ${{ steps.build-browser.outputs.digest }}
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -200,14 +294,18 @@ jobs:
           set -euo pipefail
           tags=()
           slim_tags=()
-          if [[ "${SOURCE_REF}" == "refs/heads/main" ]]; then
-            tags+=("${IMAGE}:main-arm64")
-            slim_tags+=("${IMAGE}:main-slim-arm64")
+          browser_tags=()
+          browser_supported=0
+          if grep -q '^ARG OPENCLAW_INSTALL_BROWSER' Dockerfile; then
+            browser_supported=1
           fi
           if [[ "${SOURCE_REF}" == refs/tags/v* ]]; then
             version="${SOURCE_REF#refs/tags/v}"
             tags+=("${IMAGE}:${version}-arm64")
             slim_tags+=("${IMAGE}:${version}-slim-arm64")
+            if [[ "${browser_supported}" == "1" ]]; then
+              browser_tags+=("${IMAGE}:${version}-browser-arm64")
+            fi
           fi
           if [[ ${#tags[@]} -eq 0 ]]; then
             echo "::error::No arm64 tags resolved for ref ${SOURCE_REF}"
@@ -217,6 +315,9 @@ jobs:
             echo "value<<EOF"
             printf "%s\n" "${tags[@]}" "${slim_tags[@]}"
             echo "EOF"
+            echo "browser<<EOF"
+            printf "%s\n" "${browser_tags[@]}"
+            echo "EOF"
           } >> "$GITHUB_OUTPUT"
 
       - name: Resolve OCI labels (arm64)
@@ -260,6 +361,91 @@ jobs:
           provenance: mode=max
           push: true
 
+      - name: Build and push arm64 browser image
+        id: build-browser
+        if: steps.tags.outputs.browser != ''
+        # WARNING: KEEP THE OFFICIAL DOCKER ACTION HERE; DO NOT SWITCH THIS BACK TO BLACKSMITH BLINDLY.
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        with:
+          context: .
+          platforms: linux/arm64
+          cache-from: |
+            type=gha,scope=docker-release-arm64
+            type=gha,scope=docker-release-browser-arm64
+          cache-to: type=gha,mode=max,scope=docker-release-browser-arm64
+          build-args: |
+            OPENCLAW_EXTENSIONS=diagnostics-otel,codex
+            OPENCLAW_INSTALL_BROWSER=1
+          tags: ${{ steps.tags.outputs.browser }}
+          labels: ${{ steps.labels.outputs.value }}
+          sbom: true
+          provenance: mode=max
+          push: true
+
+      - name: Smoke test arm64 runtime workspace templates
+        shell: bash
+        env:
+          IMAGE_REFS: ${{ steps.tags.outputs.value }}
+        run: |
+          set -euo pipefail
+          mapfile -t image_refs <<< "${IMAGE_REFS}"
+          image_ref="${image_refs[0]}"
+          if [[ -z "${image_ref}" ]]; then
+            echo "::error::No arm64 image ref resolved for runtime template smoke"
+            exit 1
+          fi
+          docker run --rm --entrypoint /bin/sh "${image_ref}" -lc '
+            set -eu
+            test -f /app/src/agents/templates/HEARTBEAT.md
+            temp_root="$(mktemp -d)"
+            trap "rm -rf \"${temp_root}\"" EXIT
+            mkdir -p "${temp_root}/home" "${temp_root}/cwd"
+            cd "${temp_root}/cwd"
+            set +e
+            HOME="${temp_root}/home" \
+            USERPROFILE="${temp_root}/home" \
+            OPENCLAW_HOME="${temp_root}/home" \
+            OPENCLAW_NO_ONBOARD=1 \
+            OPENCLAW_SUPPRESS_NOTES=1 \
+            OPENCLAW_DISABLE_BUNDLED_PLUGINS=1 \
+            OPENCLAW_DISABLE_BUNDLED_ENTRY_SOURCE_FALLBACK=1 \
+            AWS_EC2_METADATA_DISABLED=true \
+            AWS_SHARED_CREDENTIALS_FILE="${temp_root}/home/.aws/credentials" \
+            AWS_CONFIG_FILE="${temp_root}/home/.aws/config" \
+              node /app/openclaw.mjs agent --message "workspace bootstrap smoke" --session-id "workspace-bootstrap-smoke" --local --timeout 1 --json \
+              >"${temp_root}/out.log" 2>&1
+            status="$?"
+            set -e
+            if grep -F "Missing workspace template:" "${temp_root}/out.log"; then
+              cat "${temp_root}/out.log"
+              exit 1
+            fi
+            test -f "${temp_root}/home/.openclaw/workspace/HEARTBEAT.md"
+            if [ "${status}" -ne 0 ]; then
+              cat "${temp_root}/out.log"
+            fi
+          '
+
+      - name: Smoke test arm64 browser image
+        if: steps.tags.outputs.browser != ''
+        shell: bash
+        env:
+          IMAGE_REFS: ${{ steps.tags.outputs.browser }}
+        run: |
+          set -euo pipefail
+          mapfile -t image_refs <<< "${IMAGE_REFS}"
+          image_ref="${image_refs[0]}"
+          if [[ -z "${image_ref}" ]]; then
+            echo "::error::No arm64 browser image ref resolved"
+            exit 1
+          fi
+          docker run --rm --entrypoint /bin/sh "${image_ref}" -lc '
+            set -eu
+            browser="$(find /home/node/.cache/ms-playwright -maxdepth 5 -type f \( -name chrome -o -name chromium -o -name chrome-headless-shell \) -print | head -1)"
+            test -n "${browser}"
+            "${browser}" --version
+          '
+
   # Create multi-platform manifests
   create-manifest:
     needs: [approve_manual_backfill, build-amd64, build-arm64]
@@ -294,18 +480,25 @@ jobs:
           set -euo pipefail
           tags=()
           slim_tags=()
-          if [[ "${SOURCE_REF}" == "refs/heads/main" ]]; then
-            tags+=("${IMAGE}:main")
-            slim_tags+=("${IMAGE}:main-slim")
+          browser_tags=()
+          browser_supported=0
+          if grep -q '^ARG OPENCLAW_INSTALL_BROWSER' Dockerfile; then
+            browser_supported=1
           fi
           if [[ "${SOURCE_REF}" == refs/tags/v* ]]; then
             version="${SOURCE_REF#refs/tags/v}"
             tags+=("${IMAGE}:${version}")
             slim_tags+=("${IMAGE}:${version}-slim")
+            if [[ "${browser_supported}" == "1" ]]; then
+              browser_tags+=("${IMAGE}:${version}-browser")
+            fi
             # Manual backfills should only republish the requested version tags.
             if [[ "${IS_MANUAL_BACKFILL}" != "1" && "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9]+)?$ ]]; then
-              tags+=("${IMAGE}:latest")
-              slim_tags+=("${IMAGE}:slim")
+              tags+=("${IMAGE}:latest" "${IMAGE}:main")
+              slim_tags+=("${IMAGE}:slim" "${IMAGE}:main-slim")
+              if [[ "${browser_supported}" == "1" ]]; then
+                browser_tags+=("${IMAGE}:latest-browser" "${IMAGE}:main-browser")
+              fi
             fi
           fi
           if [[ ${#tags[@]} -eq 0 ]]; then
@@ -316,25 +509,39 @@ jobs:
             echo "value<<EOF"
             printf "%s\n" "${tags[@]}" "${slim_tags[@]}"
             echo "EOF"
+            echo "browser<<EOF"
+            printf "%s\n" "${browser_tags[@]}"
+            echo "EOF"
           } >> "$GITHUB_OUTPUT"
 
       - name: Create and push manifest
         shell: bash
         env:
           TAGS: ${{ steps.tags.outputs.value }}
+          BROWSER_TAGS: ${{ steps.tags.outputs.browser }}
           AMD64_DIGEST: ${{ needs.build-amd64.outputs.digest }}
           ARM64_DIGEST: ${{ needs.build-arm64.outputs.digest }}
+          AMD64_BROWSER_DIGEST: ${{ needs.build-amd64.outputs.browser_digest }}
+          ARM64_BROWSER_DIGEST: ${{ needs.build-arm64.outputs.browser_digest }}
         run: |
           set -euo pipefail
           mapfile -t tags <<< "${TAGS}"
-          args=()
-          for tag in "${tags[@]}"; do
-            [ -z "$tag" ] && continue
-            args+=("-t" "$tag")
-          done
-          docker buildx imagetools create "${args[@]}" \
-            "${AMD64_DIGEST}" \
-            "${ARM64_DIGEST}"
+          mapfile -t browser_tags <<< "${BROWSER_TAGS}"
+          create_manifest() {
+            local amd64_digest="$1"
+            local arm64_digest="$2"
+            shift 2
+            local args=()
+            for tag in "$@"; do
+              [ -z "$tag" ] && continue
+              args+=("-t" "$tag")
+            done
+            docker buildx imagetools create "${args[@]}" "$amd64_digest" "$arm64_digest"
+          }
+          create_manifest "${AMD64_DIGEST}" "${ARM64_DIGEST}" "${tags[@]}"
+          if [[ -n "${BROWSER_TAGS}" ]]; then
+            create_manifest "${AMD64_BROWSER_DIGEST}" "${ARM64_BROWSER_DIGEST}" "${browser_tags[@]}"
+          fi
 
   verify-attestations:
     needs: [create-manifest]
@@ -372,21 +579,39 @@ jobs:
           slim_multi_refs=()
           amd64_refs=()
           arm64_refs=()
-          if [[ "${SOURCE_REF}" == "refs/heads/main" ]]; then
-            multi_refs+=("${IMAGE}:main")
-            slim_multi_refs+=("${IMAGE}:main-slim")
-            amd64_refs+=("${IMAGE}:main-amd64" "${IMAGE}:main-slim-amd64")
-            arm64_refs+=("${IMAGE}:main-arm64" "${IMAGE}:main-slim-arm64")
+          browser_supported=0
+          if [[ "${SOURCE_REF}" == refs/tags/v* ]]; then
+            tag="${SOURCE_REF#refs/tags/}"
+            git fetch --depth=1 origin "refs/tags/${tag}:refs/tags/${tag}"
+            if git show "${SOURCE_REF}:Dockerfile" | grep -q '^ARG OPENCLAW_INSTALL_BROWSER'; then
+              browser_supported=1
+            fi
+          elif grep -q '^ARG OPENCLAW_INSTALL_BROWSER' Dockerfile; then
+            browser_supported=1
           fi
           if [[ "${SOURCE_REF}" == refs/tags/v* ]]; then
             version="${SOURCE_REF#refs/tags/v}"
             multi_refs+=("${IMAGE}:${version}")
             slim_multi_refs+=("${IMAGE}:${version}-slim")
-            amd64_refs+=("${IMAGE}:${version}-amd64" "${IMAGE}:${version}-slim-amd64")
-            arm64_refs+=("${IMAGE}:${version}-arm64" "${IMAGE}:${version}-slim-arm64")
+            amd64_refs+=(
+              "${IMAGE}:${version}-amd64"
+              "${IMAGE}:${version}-slim-amd64"
+            )
+            arm64_refs+=(
+              "${IMAGE}:${version}-arm64"
+              "${IMAGE}:${version}-slim-arm64"
+            )
+            if [[ "${browser_supported}" == "1" ]]; then
+              multi_refs+=("${IMAGE}:${version}-browser")
+              amd64_refs+=("${IMAGE}:${version}-browser-amd64")
+              arm64_refs+=("${IMAGE}:${version}-browser-arm64")
+            fi
             if [[ "${IS_MANUAL_BACKFILL}" != "1" && "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9]+)?$ ]]; then
-              multi_refs+=("${IMAGE}:latest")
-              slim_multi_refs+=("${IMAGE}:slim")
+              multi_refs+=("${IMAGE}:latest" "${IMAGE}:main")
+              slim_multi_refs+=("${IMAGE}:slim" "${IMAGE}:main-slim")
+              if [[ "${browser_supported}" == "1" ]]; then
+                multi_refs+=("${IMAGE}:latest-browser" "${IMAGE}:main-browser")
+              fi
             fi
           fi
           if [[ ${#multi_refs[@]} -eq 0 || ${#amd64_refs[@]} -eq 0 || ${#arm64_refs[@]} -eq 0 ]]; then

.github/workflows/full-release-validation.yml

@@ -80,7 +80,7 @@ on:
         default: ""
         type: string
       evidence_package_spec:
-        description: Optional published package spec to prove in the private release evidence report
+        description: Optional published package spec to prove in the release evidence report
         required: false
         default: ""
         type: string
@@ -225,7 +225,7 @@ jobs:
           } >> "$GITHUB_STEP_SUMMARY"
 
   docker_runtime_assets_preflight:
-    name: Verify Docker runtime-assets prune path
+    name: Verify Docker runtime image assets
     needs: [resolve_target]
     if: inputs.rerun_group == 'all'
     runs-on: ubuntu-24.04
@@ -250,6 +250,49 @@ jobs:
             --build-arg OPENCLAW_EXTENSIONS="diagnostics-otel,codex" \
             .
 
+      - name: Build and smoke test final Docker runtime image
+        env:
+          DOCKER_BUILDKIT: "1"
+          TARGET_SHA: ${{ needs.resolve_target.outputs.sha }}
+        run: |
+          set -euo pipefail
+          image_ref="openclaw-release-runtime-smoke:${TARGET_SHA}"
+          timeout --kill-after=30s 35m docker build \
+            --build-arg OPENCLAW_EXTENSIONS="diagnostics-otel,codex" \
+            -t "${image_ref}" \
+            .
+          docker run --rm --entrypoint /bin/sh "${image_ref}" -lc '
+            set -eu
+            test -f /app/src/agents/templates/HEARTBEAT.md
+            temp_root="$(mktemp -d)"
+            trap "rm -rf \"${temp_root}\"" EXIT
+            mkdir -p "${temp_root}/home" "${temp_root}/cwd"
+            cd "${temp_root}/cwd"
+            set +e
+            HOME="${temp_root}/home" \
+            USERPROFILE="${temp_root}/home" \
+            OPENCLAW_HOME="${temp_root}/home" \
+            OPENCLAW_NO_ONBOARD=1 \
+            OPENCLAW_SUPPRESS_NOTES=1 \
+            OPENCLAW_DISABLE_BUNDLED_PLUGINS=1 \
+            OPENCLAW_DISABLE_BUNDLED_ENTRY_SOURCE_FALLBACK=1 \
+            AWS_EC2_METADATA_DISABLED=true \
+            AWS_SHARED_CREDENTIALS_FILE="${temp_root}/home/.aws/credentials" \
+            AWS_CONFIG_FILE="${temp_root}/home/.aws/config" \
+              node /app/openclaw.mjs agent --message "workspace bootstrap smoke" --session-id "workspace-bootstrap-smoke" --local --timeout 1 --json \
+              >"${temp_root}/out.log" 2>&1
+            status="$?"
+            set -e
+            if grep -F "Missing workspace template:" "${temp_root}/out.log"; then
+              cat "${temp_root}/out.log"
+              exit 1
+            fi
+            test -f "${temp_root}/home/.openclaw/workspace/HEARTBEAT.md"
+            if [ "${status}" -ne 0 ]; then
+              cat "${temp_root}/out.log"
+            fi
+          '
+
   normal_ci:
     name: Run normal full CI
     needs: [resolve_target, docker_runtime_assets_preflight]
@@ -1407,9 +1450,9 @@ jobs:
 
           exit "$failed"
 
-      - name: Request private evidence update
+      - name: Request release evidence update
         env:
-          RELEASE_PRIVATE_DISPATCH_TOKEN: ${{ secrets.OPENCLAW_RELEASES_PRIVATE_DISPATCH_TOKEN }}
+          RELEASES_DISPATCH_TOKEN: ${{ secrets.OPENCLAW_RELEASES_DISPATCH_TOKEN }}
           TARGET_REF: ${{ inputs.ref }}
           PACKAGE_SPEC: ${{ inputs.evidence_package_spec || inputs.npm_telegram_package_spec }}
           GITHUB_RUN_ID_VALUE: ${{ github.run_id }}
@@ -1417,11 +1460,11 @@ jobs:
         run: |
           set -euo pipefail
           if [[ "$RELEASE_CHECKS_RESULT" == "skipped" ]]; then
-            echo "Release checks were skipped by rerun group; skipping automatic private evidence update."
+            echo "Release checks were skipped by rerun group; skipping automatic release evidence update."
             exit 0
           fi
-          if [[ -z "${RELEASE_PRIVATE_DISPATCH_TOKEN// }" ]]; then
-            echo "OPENCLAW_RELEASES_PRIVATE_DISPATCH_TOKEN is not configured; skipping automatic private evidence update."
+          if [[ -z "${RELEASES_DISPATCH_TOKEN// }" ]]; then
+            echo "OPENCLAW_RELEASES_DISPATCH_TOKEN is not configured; skipping automatic release evidence update."
             exit 0
           fi
 
@@ -1440,7 +1483,7 @@ jobs:
           fi
           release_id="$(printf '%s' "$release_id" | tr '/:@ ' '----' | tr -cd 'A-Za-z0-9._-')"
           if [[ -z "$release_id" ]]; then
-            echo "::warning::Could not derive release evidence id from target ref '${TARGET_REF}'; skipping automatic private evidence update."
+            echo "::warning::Could not derive release evidence id from target ref '${TARGET_REF}'; skipping automatic release evidence update."
             exit 0
           fi
 
@@ -1466,18 +1509,18 @@ jobs:
           if ! curl --fail-with-body \
             -X POST \
             -H "Accept: application/vnd.github+json" \
-            -H "Authorization: Bearer ${RELEASE_PRIVATE_DISPATCH_TOKEN}" \
+            -H "Authorization: Bearer ${RELEASES_DISPATCH_TOKEN}" \
             -H "X-GitHub-Api-Version: 2022-11-28" \
-            https://api.github.com/repos/openclaw/releases-private/dispatches \
+            https://api.github.com/repos/openclaw/releases/dispatches \
             -d "$payload"; then
-            echo "::warning::Automatic private release evidence dispatch failed; child workflow validation remains authoritative."
+            echo "::warning::Automatic release evidence dispatch failed; child workflow validation remains authoritative."
             {
-              echo "### Private release evidence dispatch failed"
+              echo "### Release evidence dispatch failed"
               echo
-              echo "Child workflow validation remains authoritative. Backfill durable evidence from \`openclaw/releases-private\`:"
+              echo "Child workflow validation remains authoritative. Backfill durable evidence from \`openclaw/releases\`:"
               echo
               echo "\`\`\`bash"
-              echo "gh workflow run openclaw-release-evidence-from-full-validation.yml --repo openclaw/releases-private --ref main -f full_validation_run_id=${GITHUB_RUN_ID_VALUE} -f release_id=${release_id} -f release_ref=${TARGET_REF} -f package_spec=${evidence_package_spec}"
+              echo "gh workflow run openclaw-release-evidence-from-full-validation.yml --repo openclaw/releases --ref main -f full_validation_run_id=${GITHUB_RUN_ID_VALUE} -f release_id=${release_id} -f release_ref=${TARGET_REF} -f package_spec=${evidence_package_spec}"
               echo "\`\`\`"
             } >> "$GITHUB_STEP_SUMMARY"
           fi

.github/workflows/install-smoke.yml

@@ -143,7 +143,7 @@ jobs:
               for (const [dep, rel] of Object.entries(workspace.patchedDependencies ?? {})) {
                 const absolute = path.join(\"/app\", rel);
                 if (!fs.existsSync(absolute)) {
-                  throw new Error(`missing patch for ${dep}: ${rel}`);
+                  throw new Error(\"missing patch for \" + dep + \": \" + rel);
                 }
               }
             "
@@ -337,7 +337,7 @@ jobs:
               for (const [dep, rel] of Object.entries(workspace.patchedDependencies ?? {})) {
                 const absolute = path.join(\"/app\", rel);
                 if (!fs.existsSync(absolute)) {
-                  throw new Error(`missing patch for ${dep}: ${rel}`);
+                  throw new Error(\"missing patch for \" + dep + \": \" + rel);
                 }
               }
             "

.github/workflows/macos-release.yml

@@ -93,8 +93,8 @@ jobs:
             echo "It does not sign, notarize, or upload macOS assets."
             echo
             echo "Next step:"
-            echo "- Run \`openclaw/releases-private/.github/workflows/openclaw-macos-validate.yml\` with tag \`${RELEASE_TAG}\` and wait for the private mac validation lane to pass."
-            echo "- Run \`openclaw/releases-private/.github/workflows/openclaw-macos-publish.yml\` with tag \`${RELEASE_TAG}\` and \`preflight_only=true\` for the full private mac preflight."
-            echo "- For the real publish path, run the same private mac publish workflow from \`main\` with the successful private preflight \`preflight_run_id\` so it promotes the prepared artifacts instead of rebuilding them."
-            echo "- For stable releases, the private publish workflow also publishes the signed \`appcast.xml\` to public \`main\`, or opens an appcast PR if direct push is blocked."
+            echo "- Run \`openclaw/releases/.github/workflows/openclaw-macos-validate.yml\` with tag \`${RELEASE_TAG}\` and wait for the macOS validation lane to pass."
+            echo "- Run \`openclaw/releases/.github/workflows/openclaw-macos-publish.yml\` with tag \`${RELEASE_TAG}\` and \`preflight_only=true\` for the full macOS preflight."
+            echo "- For the real publish path, run the same macOS publish workflow from \`main\` with the successful preflight \`preflight_run_id\` so it promotes the prepared artifacts instead of rebuilding them."
+            echo "- For stable releases, the publish workflow also publishes the signed \`appcast.xml\` to public \`main\`, or opens an appcast PR if direct push is blocked."
           } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/mantis-telegram-desktop-proof.yml

@@ -48,7 +48,8 @@ env:
   OPENCLAW_BUILD_PRIVATE_QA: "1"
   OPENCLAW_ENABLE_PRIVATE_QA_CLI: "1"
   CRABBOX_REF: main
-  CRABBOX_CAPACITY_REGIONS: eu-west-1,eu-west-2,eu-central-1,us-east-1,us-west-2
+  CRABBOX_AWS_REGION: us-east-1
+  CRABBOX_CAPACITY_REGIONS: us-east-1
   MANTIS_OUTPUT_DIR: .artifacts/qa-e2e/mantis/telegram-desktop-proof
 
 jobs:
@@ -224,6 +225,7 @@ jobs:
       - name: Checkout harness ref
         uses: actions/checkout@v6
         with:
+          ref: main
           persist-credentials: false
           fetch-depth: 0
 
@@ -239,9 +241,6 @@ jobs:
           set -euo pipefail
 
           git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main
-          if [[ -n "${PR_NUMBER:-}" ]]; then
-            git fetch --no-tags origin "+refs/pull/${PR_NUMBER}/head:refs/remotes/origin/pr/${PR_NUMBER}" || true
-          fi
 
           resolve_commit() {
             local input_ref="$2"
@@ -255,7 +254,6 @@ jobs:
           }
 
           baseline_revision="$(resolve_commit baseline "$BASELINE_REF")"
-          candidate_revision="$(resolve_commit candidate "$CANDIDATE_REF")"
           if ! git merge-base --is-ancestor "$baseline_revision" refs/remotes/origin/main; then
             echo "baseline ref '${BASELINE_REF}' resolved to ${baseline_revision}, which is not on main." >&2
             exit 1
@@ -269,6 +267,11 @@ jobs:
           pr_state="$(jq -r '.state' <<<"$pr_head")"
           pr_head_sha="$(jq -r '.head_sha' <<<"$pr_head")"
           pr_head_repo="$(jq -r '.head_repo' <<<"$pr_head")"
+          candidate_revision="$CANDIDATE_REF"
+          if [[ ! "$candidate_revision" =~ ^[0-9a-f]{40}$ ]]; then
+            echo "candidate ref '${CANDIDATE_REF}' is not an immutable commit SHA." >&2
+            exit 1
+          fi
           if [[ "$pr_state" != "open" || "$candidate_revision" != "$pr_head_sha" ]]; then
             echo "candidate ref '${CANDIDATE_REF}' resolved to ${candidate_revision}, which is not the open PR head." >&2
             exit 1
@@ -423,7 +426,7 @@ jobs:
           {
             printf '%s\n' 'Defaults env_keep += "CODEX_HOME CODEX_INTERNAL_ORIGINATOR_OVERRIDE"'
             printf '%s\n' 'Defaults env_keep += "BASELINE_REF BASELINE_SHA CANDIDATE_REF CANDIDATE_SHA"'
-            printf '%s\n' 'Defaults env_keep += "CRABBOX_ACCESS_CLIENT_ID CRABBOX_ACCESS_CLIENT_SECRET CRABBOX_COORDINATOR CRABBOX_COORDINATOR_TOKEN CRABBOX_LEASE_ID CRABBOX_PROVIDER CRABBOX_CAPACITY_REGIONS"'
+            printf '%s\n' 'Defaults env_keep += "CRABBOX_ACCESS_CLIENT_ID CRABBOX_ACCESS_CLIENT_SECRET CRABBOX_COORDINATOR CRABBOX_COORDINATOR_TOKEN CRABBOX_AWS_REGION CRABBOX_CAPACITY_REGIONS CRABBOX_LEASE_ID CRABBOX_PROVIDER"'
             printf '%s\n' 'Defaults env_keep += "GH_TOKEN MANTIS_CANDIDATE_TRUST MANTIS_INSTRUCTIONS MANTIS_OUTPUT_DIR MANTIS_PR_NUMBER"'
             printf '%s\n' 'Defaults env_keep += "OPENCLAW_BUILD_PRIVATE_QA OPENCLAW_ENABLE_PRIVATE_QA_CLI OPENCLAW_QA_CONVEX_SECRET_CI OPENCLAW_QA_CONVEX_SITE_URL OPENCLAW_QA_CREDENTIAL_OWNER_ID OPENCLAW_QA_MANTIS_CRABBOX_COORDINATOR OPENCLAW_QA_MANTIS_CRABBOX_COORDINATOR_TOKEN"'
             printf '%s\n' 'Defaults env_keep += "OPENCLAW_TELEGRAM_USER_CRABBOX_BIN OPENCLAW_TELEGRAM_USER_CRABBOX_PROVIDER OPENCLAW_TELEGRAM_USER_DRIVER_SCRIPT OPENCLAW_TELEGRAM_USER_PROOF_CMD"'
@@ -452,6 +455,7 @@ jobs:
           CRABBOX_ACCESS_CLIENT_SECRET: ${{ secrets.CRABBOX_ACCESS_CLIENT_SECRET }}
           CRABBOX_COORDINATOR: ${{ secrets.CRABBOX_COORDINATOR || secrets.OPENCLAW_QA_MANTIS_CRABBOX_COORDINATOR }}
           CRABBOX_COORDINATOR_TOKEN: ${{ secrets.CRABBOX_COORDINATOR_TOKEN || secrets.OPENCLAW_QA_MANTIS_CRABBOX_COORDINATOR_TOKEN }}
+          CRABBOX_AWS_REGION: ${{ env.CRABBOX_AWS_REGION }}
           CRABBOX_CAPACITY_REGIONS: ${{ env.CRABBOX_CAPACITY_REGIONS }}
           CRABBOX_LEASE_ID: ${{ needs.resolve_request.outputs.lease_id }}
           CRABBOX_PROVIDER: ${{ needs.resolve_request.outputs.crabbox_provider }}

.github/workflows/mantis-telegram-live.yml

@@ -44,6 +44,8 @@ env:
   OPENCLAW_BUILD_PRIVATE_QA: "1"
   OPENCLAW_ENABLE_PRIVATE_QA_CLI: "1"
   CRABBOX_REF: main
+  CRABBOX_AWS_REGION: us-east-1
+  CRABBOX_CAPACITY_REGIONS: us-east-1
 
 jobs:
   authorize_actor:
@@ -375,6 +377,7 @@ jobs:
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
           OPENCLAW_QA_CONVEX_SITE_URL: ${{ secrets.OPENCLAW_QA_CONVEX_SITE_URL }}
           OPENCLAW_QA_CONVEX_SECRET_CI: ${{ secrets.OPENCLAW_QA_CONVEX_SECRET_CI }}
+          OPENCLAW_QA_CREDENTIAL_ACQUIRE_TIMEOUT_MS: "1800000"
           OPENCLAW_QA_REDACT_PUBLIC_METADATA: "1"
           OPENCLAW_QA_TELEGRAM_CAPTURE_CONTENT: "1"
           CRABBOX_COORDINATOR: ${{ secrets.CRABBOX_COORDINATOR }}
@@ -383,6 +386,8 @@ jobs:
           OPENCLAW_QA_MANTIS_CRABBOX_COORDINATOR_TOKEN: ${{ secrets.OPENCLAW_QA_MANTIS_CRABBOX_COORDINATOR_TOKEN }}
           CRABBOX_ACCESS_CLIENT_ID: ${{ secrets.CRABBOX_ACCESS_CLIENT_ID }}
           CRABBOX_ACCESS_CLIENT_SECRET: ${{ secrets.CRABBOX_ACCESS_CLIENT_SECRET }}
+          CRABBOX_AWS_REGION: ${{ env.CRABBOX_AWS_REGION }}
+          CRABBOX_CAPACITY_REGIONS: ${{ env.CRABBOX_CAPACITY_REGIONS }}
           CRABBOX_LEASE_ID: ${{ needs.resolve_request.outputs.lease_id }}
           CRABBOX_PROVIDER: ${{ needs.resolve_request.outputs.crabbox_provider }}
           SCENARIO_INPUT: ${{ needs.resolve_request.outputs.scenario }}

.github/workflows/npm-telegram-beta-e2e.yml

@@ -218,6 +218,7 @@ jobs:
           OPENCLAW_NPM_TELEGRAM_CREDENTIAL_ROLE: ci
           OPENCLAW_QA_CONVEX_SITE_URL: ${{ secrets.OPENCLAW_QA_CONVEX_SITE_URL }}
           OPENCLAW_QA_CONVEX_SECRET_CI: ${{ secrets.OPENCLAW_QA_CONVEX_SECRET_CI }}
+          OPENCLAW_QA_CREDENTIAL_ACQUIRE_TIMEOUT_MS: "1800000"
           OPENCLAW_QA_REDACT_PUBLIC_METADATA: "1"
           OPENCLAW_QA_TELEGRAM_CAPTURE_CONTENT: "1"
           INPUT_SCENARIO: ${{ inputs.scenario }}

.github/workflows/openclaw-cross-os-release-checks-reusable.yml

@@ -451,7 +451,7 @@ jobs:
           OUTPUT_DIR: ${{ runner.temp }}/openclaw-cross-os-release-checks/prepare/baseline
         run: |
           mkdir -p "${OUTPUT_DIR}"
-          npm pack --ignore-scripts --json "${BASELINE_SPEC}" --pack-destination "${OUTPUT_DIR}" > "${OUTPUT_DIR}/pack.json"
+          timeout --preserve-status 300s npm pack --ignore-scripts --json "${BASELINE_SPEC}" --pack-destination "${OUTPUT_DIR}" > "${OUTPUT_DIR}/pack.json"
 
       - name: Capture candidate metadata
         id: candidate_metadata

.github/workflows/openclaw-live-and-e2e-checks-reusable.yml

@@ -480,6 +480,35 @@ jobs:
           fi
           exit 1
 
+  plan_release_workflow_matrices:
+    needs: validate_selected_ref
+    runs-on: ubuntu-24.04
+    outputs:
+      docker_e2e_count: ${{ steps.plan.outputs.docker_e2e_count }}
+      docker_e2e_matrix: ${{ steps.plan.outputs.docker_e2e_matrix }}
+      docker_e2e_omitted_json: ${{ steps.plan.outputs.docker_e2e_omitted_json }}
+      live_models_count: ${{ steps.plan.outputs.live_models_count }}
+      live_models_matrix: ${{ steps.plan.outputs.live_models_matrix }}
+      live_models_omitted_json: ${{ steps.plan.outputs.live_models_omitted_json }}
+    steps:
+      - name: Checkout trusted release harness
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+          ref: ${{ github.sha }}
+          fetch-depth: 1
+
+      - name: Plan release workflow matrices
+        id: plan
+        env:
+          DOCKER_LANES: ${{ inputs.docker_lanes }}
+          INCLUDE_LIVE_SUITES: ${{ inputs.include_live_suites }}
+          INCLUDE_RELEASE_PATH_SUITES: ${{ inputs.include_release_path_suites }}
+          LIVE_MODEL_PROVIDERS: ${{ inputs.live_model_providers }}
+          LIVE_SUITE_FILTER: ${{ inputs.live_suite_filter }}
+          RELEASE_TEST_PROFILE: ${{ inputs.release_test_profile }}
+        run: node scripts/plan-release-workflow-matrix.mjs >> "$GITHUB_OUTPUT"
+
   validate_release_live_cache:
     needs: validate_selected_ref
     if: inputs.include_live_suites && !inputs.live_models_only && (inputs.live_suite_filter == '' || inputs.live_suite_filter == 'live-cache')
@@ -636,72 +665,15 @@ jobs:
         run: ${{ matrix.command }}
 
   validate_docker_e2e:
-    needs: [validate_selected_ref, prepare_docker_e2e_image]
-    if: inputs.include_release_path_suites && inputs.docker_lanes == ''
+    needs: [validate_selected_ref, prepare_docker_e2e_image, plan_release_workflow_matrices]
+    if: inputs.include_release_path_suites && inputs.docker_lanes == '' && needs.plan_release_workflow_matrices.outputs.docker_e2e_count != '0'
     name: Docker E2E (${{ matrix.label }})
     continue-on-error: ${{ inputs.advisory }}
     runs-on: ${{ inputs.use_github_hosted_runners && 'ubuntu-24.04' || 'blacksmith-32vcpu-ubuntu-2404' }}
     timeout-minutes: ${{ matrix.timeout_minutes }}
     strategy:
       fail-fast: false
-      matrix:
-        include:
-          - chunk_id: core
-            label: core
-            timeout_minutes: 60
-            profiles: stable full
-          - chunk_id: package-update-openai
-            label: package/update OpenAI install
-            timeout_minutes: 45
-            profiles: beta minimum stable full
-          - chunk_id: package-update-anthropic
-            label: package/update Anthropic install
-            timeout_minutes: 60
-            profiles: beta minimum stable full
-          - chunk_id: package-update-core
-            label: package/update core
-            timeout_minutes: 60
-            profiles: beta minimum stable full
-          - chunk_id: plugins-runtime-plugins
-            label: plugins/runtime plugins
-            timeout_minutes: 60
-            profiles: stable full
-          - chunk_id: plugins-runtime-services
-            label: plugins/runtime services
-            timeout_minutes: 60
-            profiles: stable full
-          - chunk_id: plugins-runtime-install-a
-            label: plugins/runtime install A
-            timeout_minutes: 60
-            profiles: stable full
-          - chunk_id: plugins-runtime-install-b
-            label: plugins/runtime install B
-            timeout_minutes: 60
-            profiles: stable full
-          - chunk_id: plugins-runtime-install-c
-            label: plugins/runtime install C
-            timeout_minutes: 60
-            profiles: stable full
-          - chunk_id: plugins-runtime-install-d
-            label: plugins/runtime install D
-            timeout_minutes: 60
-            profiles: stable full
-          - chunk_id: plugins-runtime-install-e
-            label: plugins/runtime install E
-            timeout_minutes: 60
-            profiles: stable full
-          - chunk_id: plugins-runtime-install-f
-            label: plugins/runtime install F
-            timeout_minutes: 60
-            profiles: stable full
-          - chunk_id: plugins-runtime-install-g
-            label: plugins/runtime install G
-            timeout_minutes: 60
-            profiles: stable full
-          - chunk_id: plugins-runtime-install-h
-            label: plugins/runtime install H
-            timeout_minutes: 60
-            profiles: stable full
+      matrix: ${{ fromJson(needs.plan_release_workflow_matrices.outputs.docker_e2e_matrix) }}
     env:
       OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
       OPENAI_BASE_URL: ${{ secrets.OPENAI_BASE_URL }}
@@ -1631,42 +1603,14 @@ jobs:
 
   validate_live_models_docker:
     name: Docker live models (${{ matrix.provider_label }})
-    needs: [validate_selected_ref, prepare_live_test_image]
-    if: inputs.include_live_suites && inputs.live_model_providers == '' && (inputs.live_suite_filter == '' || inputs.live_suite_filter == 'docker-live-models')
+    needs: [validate_selected_ref, prepare_live_test_image, plan_release_workflow_matrices]
+    if: inputs.include_live_suites && inputs.live_model_providers == '' && (inputs.live_suite_filter == '' || inputs.live_suite_filter == 'docker-live-models') && needs.plan_release_workflow_matrices.outputs.live_models_count != '0'
     continue-on-error: ${{ inputs.advisory }}
     runs-on: ${{ inputs.use_github_hosted_runners && 'ubuntu-24.04' || 'blacksmith-32vcpu-ubuntu-2404' }}
     timeout-minutes: 45
     strategy:
       fail-fast: false
-      matrix:
-        include:
-          - provider_label: Anthropic
-            providers: anthropic
-            profiles: stable full
-          - provider_label: Google
-            providers: google
-            profiles: stable full
-          - provider_label: MiniMax
-            providers: minimax
-            profiles: stable full
-          - provider_label: OpenAI
-            providers: openai
-            profiles: beta minimum stable full
-          - provider_label: OpenCode
-            providers: opencode-go
-            profiles: full
-          - provider_label: OpenRouter
-            providers: openrouter
-            profiles: full
-          - provider_label: xAI
-            providers: xai
-            profiles: full
-          - provider_label: Z.ai
-            providers: zai
-            profiles: full
-          - provider_label: Fireworks
-            providers: fireworks
-            profiles: full
+      matrix: ${{ fromJson(needs.plan_release_workflow_matrices.outputs.live_models_matrix) }}
     env:
       OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
       OPENAI_BASE_URL: ${{ secrets.OPENAI_BASE_URL }}
@@ -1744,6 +1688,8 @@ jobs:
       - name: Validate provider credential
         if: contains(matrix.profiles, inputs.release_test_profile)
         shell: bash
+        env:
+          LIVE_MODEL_PROVIDERS: ${{ matrix.providers }}
         run: |
           set -euo pipefail
 
@@ -1760,7 +1706,7 @@ jobs:
             exit 1
           }
 
-          case "${{ matrix.providers }}" in
+          case "${LIVE_MODEL_PROVIDERS}" in
             anthropic) require_any Anthropic ANTHROPIC_API_KEY ANTHROPIC_API_KEY_OLD ANTHROPIC_API_TOKEN ;;
             google) require_any Google GEMINI_API_KEY GOOGLE_API_KEY ;;
             minimax) require_any MiniMax MINIMAX_API_KEY ;;
@@ -1771,7 +1717,7 @@ jobs:
             zai) require_any Z.ai ZAI_API_KEY Z_AI_API_KEY ;;
             fireworks) require_any Fireworks FIREWORKS_API_KEY ;;
             *)
-              echo "Unhandled live model provider shard: ${{ matrix.providers }}" >&2
+              echo "Unhandled live model provider shard: ${LIVE_MODEL_PROVIDERS}" >&2
               exit 1
               ;;
           esac
@@ -1857,7 +1803,6 @@ jobs:
           normalize_provider() {
             local value="${1,,}"
             case "$value" in
-              z.ai|z-ai) echo "zai" ;;
               opencode|opencode-go) echo "opencode-go" ;;
               open-router|openrouter) echo "openrouter" ;;
               *) echo "$value" ;;
@@ -1987,7 +1932,7 @@ jobs:
           - suite_id: native-live-src-gateway-profiles-anthropic-opus
             suite_group: native-live-src-gateway-profiles-anthropic
             label: Native live gateway profiles Anthropic Opus
-            command: OPENCLAW_LIVE_GATEWAY_PROVIDERS=anthropic OPENCLAW_LIVE_GATEWAY_MODELS=anthropic/claude-opus-4-7 node .release-harness/scripts/test-live-shard.mjs native-live-src-gateway-profiles
+            command: OPENCLAW_LIVE_GATEWAY_THINKING=low OPENCLAW_LIVE_GATEWAY_PROVIDERS=anthropic OPENCLAW_LIVE_GATEWAY_MODELS=anthropic/claude-opus-4-7 node .release-harness/scripts/test-live-shard.mjs native-live-src-gateway-profiles
             timeout_minutes: 30
             profile_env_only: false
             advisory: true
@@ -1995,7 +1940,7 @@ jobs:
           - suite_id: native-live-src-gateway-profiles-anthropic-sonnet-haiku
             suite_group: native-live-src-gateway-profiles-anthropic
             label: Native live gateway profiles Anthropic Sonnet/Haiku
-            command: OPENCLAW_LIVE_GATEWAY_PROVIDERS=anthropic OPENCLAW_LIVE_GATEWAY_MODELS=anthropic/claude-sonnet-4-6,anthropic/claude-haiku-4-5 node .release-harness/scripts/test-live-shard.mjs native-live-src-gateway-profiles
+            command: OPENCLAW_LIVE_GATEWAY_THINKING=low OPENCLAW_LIVE_GATEWAY_PROVIDERS=anthropic OPENCLAW_LIVE_GATEWAY_MODELS=anthropic/claude-sonnet-4-6,anthropic/claude-haiku-4-5 node .release-harness/scripts/test-live-shard.mjs native-live-src-gateway-profiles
             timeout_minutes: 30
             profile_env_only: false
             advisory: true
@@ -2014,7 +1959,7 @@ jobs:
             profiles: stable full
           - suite_id: native-live-src-gateway-profiles-openai
             label: Native live gateway profiles OpenAI
-            command: OPENCLAW_LIVE_GATEWAY_PROVIDERS=openai OPENCLAW_LIVE_GATEWAY_MODELS=openai/gpt-5.5 node .release-harness/scripts/test-live-shard.mjs native-live-src-gateway-profiles
+            command: OPENCLAW_LIVE_GATEWAY_PROVIDERS=openai OPENCLAW_LIVE_GATEWAY_MODELS=openai/gpt-5.5 OPENCLAW_LIVE_GATEWAY_STEP_TIMEOUT_MS=180000 OPENCLAW_LIVE_GATEWAY_MODEL_TIMEOUT_MS=600000 node .release-harness/scripts/test-live-shard.mjs native-live-src-gateway-profiles
             timeout_minutes: 60
             profile_env_only: false
             profiles: beta minimum stable full
@@ -2295,7 +2240,7 @@ jobs:
             profiles: beta minimum stable full
           - suite_id: live-gateway-anthropic-docker
             label: Docker live gateway Anthropic
-            command: OPENCLAW_LIVE_GATEWAY_PROVIDERS=anthropic OPENCLAW_LIVE_GATEWAY_MODELS=anthropic/claude-sonnet-4-6 OPENCLAW_LIVE_GATEWAY_MAX_MODELS=1 OPENCLAW_LIVE_GATEWAY_STEP_TIMEOUT_MS=90000 OPENCLAW_LIVE_GATEWAY_MODEL_TIMEOUT_MS=180000 OPENCLAW_LIVE_DOCKER_REPO_ROOT="$GITHUB_WORKSPACE" timeout --foreground --kill-after=30s 35m bash .release-harness/scripts/test-live-gateway-models-docker.sh
+            command: OPENCLAW_LIVE_GATEWAY_THINKING=low OPENCLAW_LIVE_GATEWAY_PROVIDERS=anthropic OPENCLAW_LIVE_GATEWAY_MODELS=anthropic/claude-sonnet-4-6,anthropic/claude-haiku-4-5 OPENCLAW_LIVE_GATEWAY_MAX_MODELS=2 OPENCLAW_LIVE_GATEWAY_STEP_TIMEOUT_MS=90000 OPENCLAW_LIVE_GATEWAY_MODEL_TIMEOUT_MS=600000 OPENCLAW_LIVE_DOCKER_REPO_ROOT="$GITHUB_WORKSPACE" timeout --foreground --kill-after=30s 35m bash .release-harness/scripts/test-live-gateway-models-docker.sh
             timeout_minutes: 40
             profile_env_only: false
             profiles: stable full

.github/workflows/openclaw-npm-release.yml

@@ -47,8 +47,8 @@ jobs:
   # KEEP THIS WORKFLOW SHORT AND DETERMINISTIC OR IT CAN GET STUCK AND JEOPARDIZE THE RELEASE.
   # RELEASE-TIME LIVE OR END-TO-END VALIDATION BELONGS IN openclaw-release-checks.yml.
   # SECURITY NOTE: TOKEN-BASED npm dist-tag mutation moved to
-  # openclaw/releases-private/.github/workflows/openclaw-npm-dist-tags.yml
-  # so this public workflow can stay focused on OIDC publish only.
+  # openclaw/releases/.github/workflows/openclaw-npm-dist-tags.yml
+  # so this source workflow can stay focused on OIDC publish only.
   preflight_openclaw_npm:
     if: ${{ inputs.preflight_only }}
     runs-on: ubuntu-latest

.github/workflows/openclaw-performance.yml

@@ -551,25 +551,31 @@ jobs:
           retention-days: ${{ matrix.deep_profile == 'true' && 14 || 30 }}
 
       - name: Prepare clawgrit reports checkout
+        id: clawgrit_reports
         if: ${{ steps.kova.outputs.report_json != '' && steps.clawgrit.outputs.present == 'true' }}
         env:
           CLAWGRIT_REPORTS_TOKEN: ${{ secrets.CLAWGRIT_REPORTS_TOKEN }}
         shell: bash
         run: |
           set -euo pipefail
+          echo "ready=false" >> "$GITHUB_OUTPUT"
           reports_root=".artifacts/clawgrit-reports"
           mkdir -p "$reports_root"
           git -C "$reports_root" init -b main
           git -C "$reports_root" remote add origin "https://x-access-token:${CLAWGRIT_REPORTS_TOKEN}@github.com/openclaw/clawgrit-reports.git"
-          if git -C "$reports_root" ls-remote --exit-code --heads origin main >/dev/null 2>&1; then
-            git -C "$reports_root" fetch --depth=1 origin main
+          if timeout 60s git -C "$reports_root" ls-remote --exit-code --heads origin main >/dev/null 2>&1; then
+            if ! timeout 120s git -C "$reports_root" fetch --depth=1 origin main; then
+              echo "::warning::Skipping optional clawgrit report publish because the reports checkout fetch timed out or failed."
+              exit 0
+            fi
             git -C "$reports_root" checkout -B main FETCH_HEAD
           else
             git -C "$reports_root" checkout -B main
           fi
+          echo "ready=true" >> "$GITHUB_OUTPUT"
 
       - name: Publish to clawgrit reports
-        if: ${{ steps.kova.outputs.report_json != '' && steps.clawgrit.outputs.present == 'true' }}
+        if: ${{ steps.kova.outputs.report_json != '' && steps.clawgrit.outputs.present == 'true' && steps.clawgrit_reports.outputs.ready == 'true' }}
         env:
           CLAWGRIT_REPORTS_TOKEN: ${{ secrets.CLAWGRIT_REPORTS_TOKEN }}
         shell: bash
@@ -642,6 +648,9 @@ jobs:
               exit 0
             fi
             sleep $((attempt * 2))
-            git -C "$reports_root" fetch --depth=1 origin main
+            timeout 120s git -C "$reports_root" fetch --depth=1 origin main || {
+              echo "::warning::Skipping optional clawgrit report rebase because the reports fetch timed out or failed."
+              exit 0
+            }
             git -C "$reports_root" rebase FETCH_HEAD
           done

.github/workflows/openclaw-release-checks.yml

@@ -946,7 +946,7 @@ jobs:
             --concurrency "${QA_PARITY_CONCURRENCY}" \
             --model "${OPENCLAW_CI_OPENAI_MODEL}" \
             --alt-model "openai/gpt-5.5-alt" \
-            --runtime-pair pi,codex \
+            --runtime-pair openclaw,codex \
             --output-dir ".artifacts/qa-e2e/runtime-parity"
 
       - name: Run standard runtime parity tier
@@ -959,7 +959,7 @@ jobs:
             --concurrency "${QA_PARITY_CONCURRENCY}" \
             --model "${OPENCLAW_CI_OPENAI_MODEL}" \
             --alt-model "openai/gpt-5.5-alt" \
-            --runtime-pair pi,codex \
+            --runtime-pair openclaw,codex \
             --output-dir ".artifacts/qa-e2e/runtime-parity-standard"
 
       - name: Run soak runtime parity tier
@@ -973,7 +973,7 @@ jobs:
             --concurrency "${QA_PARITY_CONCURRENCY}" \
             --model "${OPENCLAW_CI_OPENAI_MODEL}" \
             --alt-model "openai/gpt-5.5-alt" \
-            --runtime-pair pi,codex \
+            --runtime-pair openclaw,codex \
             --output-dir ".artifacts/qa-e2e/runtime-parity-soak"
 
       - name: Generate runtime parity report
@@ -1207,6 +1207,7 @@ jobs:
         env:
           OPENCLAW_QA_CONVEX_SITE_URL: ${{ secrets.OPENCLAW_QA_CONVEX_SITE_URL }}
           OPENCLAW_QA_CONVEX_SECRET_CI: ${{ secrets.OPENCLAW_QA_CONVEX_SECRET_CI }}
+          OPENCLAW_QA_CREDENTIAL_ACQUIRE_TIMEOUT_MS: "1800000"
           OPENCLAW_QA_REDACT_PUBLIC_METADATA: "1"
           OPENCLAW_QA_TELEGRAM_CAPTURE_CONTENT: "1"
         run: |

.github/workflows/openclaw-release-publish.yml

@@ -265,7 +265,7 @@ jobs:
         run: |
           set -euo pipefail
           RUN_JSON="$(gh run view "$FULL_RELEASE_VALIDATION_RUN_ID" --repo "$GITHUB_REPOSITORY" --json workflowName,headBranch,event,status,conclusion,url)"
-          printf '%s' "$RUN_JSON" | node -e 'const fs = require("node:fs"); const run = JSON.parse(fs.readFileSync(0, "utf8")); const checks = [["workflowName", "Full Release Validation"], ["headBranch", process.env.EXPECTED_WORKFLOW_BRANCH], ["event", "workflow_dispatch"], ["status", "completed"], ["conclusion", "success"]]; for (const [key, expected] of checks) { if (run[key] !== expected) { console.error(`Referenced full release validation run ${process.env.FULL_RELEASE_VALIDATION_RUN_ID} must have ${key}=${expected}, got ${run[key] ?? "<missing>"}.`); process.exit(1); } } console.log(`Using full release validation run ${process.env.FULL_RELEASE_VALIDATION_RUN_ID}: ${run.url}`);'
+          printf '%s' "$RUN_JSON" | node -e 'const fs = require("node:fs"); const run = JSON.parse(fs.readFileSync(0, "utf8")); const checks = [["workflowName", "Full Release Validation"], ["event", "workflow_dispatch"], ["status", "completed"], ["conclusion", "success"]]; for (const [key, expected] of checks) { if (run[key] !== expected) { console.error(`Referenced full release validation run ${process.env.FULL_RELEASE_VALIDATION_RUN_ID} must have ${key}=${expected}, got ${run[key] ?? "<missing>"}.`); process.exit(1); } } const allowedBranches = new Set(["main", process.env.EXPECTED_WORKFLOW_BRANCH].filter(Boolean)); if (!allowedBranches.has(run.headBranch)) { console.error(`Referenced full release validation run ${process.env.FULL_RELEASE_VALIDATION_RUN_ID} must have headBranch in ${[...allowedBranches].join(", ")}, got ${run.headBranch ?? "<missing>"}.`); process.exit(1); } console.log(`Using full release validation run ${process.env.FULL_RELEASE_VALIDATION_RUN_ID}: ${run.url}`);'
 
           manifest="${RUNNER_TEMP}/full-release-validation-manifest/full-release-validation-manifest.json"
           if [[ ! -f "$manifest" ]]; then
@@ -810,7 +810,7 @@ jobs:
             `- npm package: https://www.npmjs.com/package/openclaw/v/${process.env.RELEASE_VERSION}`,
             `- registry tarball: ${process.env.RELEASE_TARBALL}`,
             `- integrity: \`${process.env.RELEASE_INTEGRITY}\``,
-            `- full release CI report: https://github.com/openclaw/releases-private/blob/main/evidence/${process.env.RELEASE_VERSION}/release-evidence.md`,
+            `- full release CI report: https://github.com/openclaw/releases/blob/main/evidence/${process.env.RELEASE_VERSION}/release-evidence.md`,
             `- release publish: https://github.com/${process.env.RELEASE_REPO}/actions/runs/${process.env.RELEASE_PUBLISH_RUN_ID}`,
             `- npm preflight: https://github.com/${process.env.RELEASE_REPO}/actions/runs/${process.env.PREFLIGHT_RUN_ID}`,
             `- full release validation: https://github.com/${process.env.RELEASE_REPO}/actions/runs/${process.env.FULL_RELEASE_VALIDATION_RUN_ID}`,

.github/workflows/opengrep-precise-full.yml

@@ -32,11 +32,11 @@ jobs:
       - name: Install opengrep
         env:
           # Pin both the install script (by commit SHA) and the binary version.
-          # The script SHA must match the v1.19.0 release tag in opengrep/opengrep
+          # The script SHA must match the v1.22.0 release tag in opengrep/opengrep
           # so a compromised or force-pushed `main` cannot RCE in our CI runner.
           # Bump both together when upgrading.
-          OPENGREP_VERSION: v1.19.0
-          OPENGREP_INSTALL_SHA: 9a4c0a68220618441608cd2bad4ff2eddccf8113
+          OPENGREP_VERSION: v1.22.0
+          OPENGREP_INSTALL_SHA: f458d7f0d52cc58eae1ca3cf3d5caf101e637519
         run: |
           curl -fsSL "https://raw.githubusercontent.com/opengrep/opengrep/${OPENGREP_INSTALL_SHA}/install.sh" \
             | bash -s -- -v "$OPENGREP_VERSION"

.github/workflows/opengrep-precise.yml

@@ -44,7 +44,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ github.sha }}
-          fetch-depth: 0
+          fetch-depth: 1
           fetch-tags: false
           persist-credentials: false
           submodules: false
@@ -58,11 +58,11 @@ jobs:
       - name: Install opengrep
         env:
           # Pin both the install script (by commit SHA) and the binary version.
-          # The script SHA must match the v1.19.0 release tag in opengrep/opengrep
+          # The script SHA must match the v1.22.0 release tag in opengrep/opengrep
           # so a compromised or force-pushed `main` cannot RCE in our CI runner.
           # Bump both together when upgrading.
-          OPENGREP_VERSION: v1.19.0
-          OPENGREP_INSTALL_SHA: 9a4c0a68220618441608cd2bad4ff2eddccf8113
+          OPENGREP_VERSION: v1.22.0
+          OPENGREP_INSTALL_SHA: f458d7f0d52cc58eae1ca3cf3d5caf101e637519
         run: |
           curl -fsSL "https://raw.githubusercontent.com/opengrep/opengrep/${OPENGREP_INSTALL_SHA}/install.sh" \
             | bash -s -- -v "$OPENGREP_VERSION"

.github/workflows/qa-live-transports-convex.yml

@@ -52,6 +52,7 @@ env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
   NODE_VERSION: "24.x"
   OPENCLAW_CI_OPENAI_MODEL: ${{ vars.OPENCLAW_CI_OPENAI_MODEL || 'openai/gpt-5.5' }}
+  OPENCLAW_CI_OPENAI_FALLBACK_MODEL: ${{ vars.OPENCLAW_CI_OPENAI_FALLBACK_MODEL || 'openai/gpt-5.4' }}
   OPENCLAW_BUILD_PRIVATE_QA: "1"
   OPENCLAW_ENABLE_PRIVATE_QA_CLI: "1"
 
@@ -288,8 +289,8 @@ jobs:
             --runtime-parity-tier live-only \
             --concurrency "${QA_PARITY_CONCURRENCY}" \
             --model "${OPENCLAW_CI_OPENAI_MODEL}" \
-            --alt-model "${OPENCLAW_CI_OPENAI_MODEL}" \
-            --runtime-pair pi,codex \
+            --alt-model "${OPENCLAW_CI_OPENAI_FALLBACK_MODEL}" \
+            --runtime-pair openclaw,codex \
             --fast \
             --allow-failures \
             --output-dir "${output_dir}/runtime-suite"
@@ -373,7 +374,7 @@ jobs:
             --output-dir "${output_dir}" \
             --provider-mode live-frontier \
             --model "${OPENCLAW_CI_OPENAI_MODEL}" \
-            --alt-model "${OPENCLAW_CI_OPENAI_MODEL}" \
+            --alt-model "${OPENCLAW_CI_OPENAI_FALLBACK_MODEL}" \
             --profile "${INPUT_MATRIX_PROFILE}" \
             --fast
           )
@@ -457,7 +458,7 @@ jobs:
             --output-dir "${output_dir}" \
             --provider-mode live-frontier \
             --model "${OPENCLAW_CI_OPENAI_MODEL}" \
-            --alt-model "${OPENCLAW_CI_OPENAI_MODEL}" \
+            --alt-model "${OPENCLAW_CI_OPENAI_FALLBACK_MODEL}" \
             --profile "${{ matrix.profile }}" \
             --fast
           )
@@ -529,6 +530,7 @@ jobs:
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
           OPENCLAW_QA_CONVEX_SITE_URL: ${{ secrets.OPENCLAW_QA_CONVEX_SITE_URL }}
           OPENCLAW_QA_CONVEX_SECRET_CI: ${{ secrets.OPENCLAW_QA_CONVEX_SECRET_CI }}
+          OPENCLAW_QA_CREDENTIAL_ACQUIRE_TIMEOUT_MS: "1800000"
           OPENCLAW_QA_REDACT_PUBLIC_METADATA: "1"
           OPENCLAW_QA_TELEGRAM_CAPTURE_CONTENT: "1"
           INPUT_SCENARIO: ${{ github.event_name == 'workflow_dispatch' && inputs.scenario || '' }}
@@ -555,7 +557,7 @@ jobs:
             --output-dir "${output_dir}" \
             --provider-mode live-frontier \
             --model "${OPENCLAW_CI_OPENAI_MODEL}" \
-            --alt-model "${OPENCLAW_CI_OPENAI_MODEL}" \
+            --alt-model "${OPENCLAW_CI_OPENAI_FALLBACK_MODEL}" \
             --fast \
             --credential-source convex \
             --credential-role ci \
@@ -649,7 +651,7 @@ jobs:
             --output-dir "${output_dir}" \
             --provider-mode live-frontier \
             --model openai/gpt-5.5 \
-            --alt-model openai/gpt-5.5 \
+            --alt-model "${OPENCLAW_CI_OPENAI_FALLBACK_MODEL}" \
             --fast \
             --credential-source convex \
             --credential-role ci \
@@ -746,7 +748,7 @@ jobs:
             --output-dir "${output_dir}" \
             --provider-mode live-frontier \
             --model "${OPENCLAW_CI_OPENAI_MODEL}" \
-            --alt-model "${OPENCLAW_CI_OPENAI_MODEL}" \
+            --alt-model "${OPENCLAW_CI_OPENAI_FALLBACK_MODEL}" \
             --fast \
             --credential-source convex \
             --credential-role ci \
@@ -840,7 +842,7 @@ jobs:
             --output-dir "${output_dir}" \
             --provider-mode live-frontier \
             --model "${OPENCLAW_CI_OPENAI_MODEL}" \
-            --alt-model "${OPENCLAW_CI_OPENAI_MODEL}" \
+            --alt-model "${OPENCLAW_CI_OPENAI_FALLBACK_MODEL}" \
             --fast \
             --credential-source convex \
             --credential-role ci \

.github/workflows/website-installer-sync.yml

@@ -90,7 +90,7 @@ jobs:
             bash -lc 'apt-get update -y && apt-get install -y curl && bash /tmp/install-cli.sh --prefix /tmp/openclaw --no-onboard --version latest && /tmp/openclaw/bin/openclaw --version'
 
   macos-installer:
-    runs-on: macos-latest
+    runs-on: macos-15
     steps:
       - name: Checkout
         uses: actions/checkout@v6

.gitignore

@@ -249,6 +249,8 @@ extensions/qa-lab/web/dist/
 # Generated bundled plugin runtime dependency manifests
 extensions/**/.openclaw-runtime-deps.json
 extensions/**/.openclaw-runtime-deps-stamp.json
+extensions/diffs/assets/viewer-runtime.js
+extensions/diffs-language-pack/assets/viewer-runtime.js
 
 # Output dir for scripts/run-opengrep.sh (local opengrep scans)
 /.opengrep-out/

.oxfmtrc.jsonc

@@ -30,6 +30,7 @@
     "docker-compose.yml",
     "dist/",
     "docs/_layouts/",
+    "extensions/diffs/assets/viewer-runtime.js",
     "**/*.json",
     "node_modules/",
     "patches/",

.oxlintrc.json

@@ -182,6 +182,7 @@
     "dist-runtime/",
     "docs/_layouts/",
     "extensions/diffs/assets/viewer-runtime.js",
+    "extensions/diffs-language-pack/assets/viewer-runtime.js",
     "node_modules/",
     "patches/",
     "pnpm-lock.yaml",

AGENTS.md

@@ -57,6 +57,7 @@ Skills own workflows; root owns hard policy and routing.
 - External official plugins own package/deps and are excluded from core dist; core uses registry-aware `facade-runtime` or generic contracts.
 - Externalizing a bundled plugin: update package excludes, official catalogs, docs, tests, and prove core runtime paths resolve installed plugin roots before root-dep removal.
 - Runtime reads canonical config only. No silent compat for old/malformed config keys. If a config change invalidates existing files, add a matching `openclaw doctor --fix` migration. Core/auth config repairs live in core doctor; plugin-owned config repairs live in that plugin's doctor contract (`legacyConfigRules` / `normalizeCompatibilityConfig`).
+- CLI setup flows are public API when external docs, installers, or integrations can copy them. Changes to `openclaw onboard`, `openclaw configure`, their documented flags, non-interactive behavior, or generated config shape are compatibility-sensitive API contract changes; prefer additive flags/aliases, deprecation windows, and backward-preserving migrations over breaking existing snippets.
 - Fix shape: default to clean bounded refactor, not smallest patch. Move ownership to right boundary; delete stale abstractions, duplicate policy, dead branches, wrappers, fallback stacks.
 - Fix observed local failures with generic product rules; do not hardcode names, ids, log phrases, or user examples in prod code unless they are an explicit contract.
 - Tests may use observed examples, but prod literals need a short contract reason.
@@ -211,6 +212,7 @@ Skills own workflows; root owns hard policy and routing.
 - Lockfiles/shrinkwrap are security surface: review `pnpm-lock.yaml`, `npm-shrinkwrap.json`, `package-lock.json`; root/plugin npm packages ship shrinkwrap, not package-lock.
 - Carbon pins owner-only: do not change `@buape/carbon` unless Shadow (`@thewilloftheshadow`, verified by `gh`) asks.
 - Releases/publish/version bumps need explicit approval. Use `$release-openclaw-maintainer`.
+- Backport means apply to newest open `release/` branch unless user names another target.
 - GHSA/advisories: `$openclaw-ghsa-maintainer` / `$security-triage`. Secret scanning: `$openclaw-secret-scanning-maintainer`.
 - Beta tag/version match: `vYYYY.M.D-beta.N` -> npm `YYYY.M.D-beta.N --tag beta`.
 

CHANGELOG.md

@@ -2,6 +2,71 @@
 
 Docs: https://docs.openclaw.ai
 
+## 2026.5.28
+
+### Highlights
+
+- Agent and Codex runtime recovery is steadier: subagents keep cwd/workspace separation, hook context stays prompt-local, session locks release on timeout abort, stale restart continuations are avoided, and Codex app-server/helper failures no longer tear down shared runtime state. (#87218, #86875, #87409, #87399, #87375)
+- Channel delivery and session identity got safer across outbound plugin hooks, Matrix room ids, iMessage reactions/approvals, Slack final replies, Discord recovered tool warnings, and Microsoft Teams service URL trust checks. (#73706, #75670, #87366, #87451, #87334)
+- Mobile and chat surfaces got a broader refresh: the iOS Pro UI, Gateway chat transport, onboarding, Talk permissions, WebChat reconnect delivery, and session picker behavior now preserve more state across reconnects and empty searches. (#87367, #87531, #87682)
+- CLI, auth, doctor, and provider paths fail faster and recover more clearly: malformed numeric/version options are rejected, OAuth and local service startup requests are bounded, legacy `api_key` auth profiles migrate to canonical form, and restart guidance is actionable. (#87398, #86281, #87361)
+- Plugin and Gateway hot paths do less repeated work while preserving cache correctness for install records, config JSON parsing, tool search catalogs, session stores, manifest model rows, auto-enabled plugin config, browser tokens, and viewer assets. (#86699)
+- Release, QA, and E2E validation now bound more log, artifact, harness, and cross-OS waits so failing lanes produce proof instead of hanging or false-greening.
+
+### Changes
+
+- Status: show active subagent details in status output.
+- Diffs: split the default language pack and expand default Diffs language coverage while keeping the host floor aligned. (#87370, #87372) Thanks @RomneyDa.
+- ClawHub: add plugin display names plus skill verification and trust surfaces. (#87354, #86699) Thanks @thewilloftheshadow and @Patrick-Erichsen.
+- iOS: refresh the dev app with Pro Command, Chat, Agents, and Settings tabs wired to gateway sessions, diagnostics, chat, and realtime Talk. (#87367) Thanks @Solvely-Colin.
+- Docs: clarify Codex computer-use setup, paste-token stdin auth setup, macOS gateway sleep troubleshooting, native Codex hook relay recovery, container model auth, install deployment cards, device-token admin gating, and backport targets. (#87313, #63050) Thanks @bdjben, @liaoandi, and @thewilloftheshadow.
+- PDF/tools: use ClawPDF for PDF extraction and surface MCP structured content in agent tool results. (#87670)
+
+### Fixes
+
+- Agents: fall back to local config pruning when the optional `agents delete` Gateway probe cannot authenticate, so offline installs can still delete agents without removing shared workspaces.
+- Tighten phone-control mutation authorization [AI]. (#87150) Thanks @pgondhi987.
+- Clarify directive persistence authorization policy [AI]. (#86369) Thanks @pgondhi987.
+- Agents/Codex: keep spawned agent cwd/workspace state separated, keep hook context prompt-local, release session locks on timeout abort, avoid session event queue self-wait, preserve shared app-server state across startup or helper failures, keep native hook relay alive across restarts, route workspace memory through tools, resolve Codex runtime models first, report quarantined dynamic tools, format `skills` command output, and bound compaction/steering retries. (#87218, #86875, #86123, #87399, #87375, #87383, #87400) Thanks @mbelinky, @Alix-007, @luoyanglang, @yetval, and @sjf.
+- Channels: thread canonical session keys into outbound hooks, preserve Matrix room-id case, keep fallback tool warnings mention-inert, retain delivered Slack final replies during late cleanup, continue iMessage polling after denied reactions, suppress duplicate native exec approvals, preserve Telegram SecretRef prompt config, suppress Discord recovered tool warnings, and block untrusted Teams service URLs. (#73706, #75670, #87366, #87451, #87334) Thanks @zeroaltitude, @lukeboyett, @xiaotian, and @eleqtrizit.
+- CLI/auth/doctor/providers: reject malformed numeric/timeout/subcommand-version inputs, wait for respawn child shutdown, bound Codex and GitHub Copilot OAuth/token requests, warm provider auth off the main thread, honor Codex response timeouts, bound local service startup, resolve GPT-5.5 without cached catalog, migrate legacy memory auto-provider config, rewrite non-canonical `api_key` auth profiles, and make doctor restart follow-ups actionable. (#87398, #86281, #87361) Thanks @Patrick-Erichsen, @samzong, @giodl73-repo, and @alkor2000.
+- Gateway/security/session state: expire browser tokens after auth rotation, scope assistant idempotency dedupe, drain probe client closes, avoid stale restart continuation reuse, preserve retry-after fallbacks, bound webchat image and artifact transcript scans, include seconds in inbound metadata timestamps, and evict current plugin-state namespaces at row caps.
+- Config/parsing/network: reject partial numeric parsing, parse provider/Discord retry headers and dates strictly, honor IPv6 and bare IPv6 `no_proxy` entries, canonicalize secret target array indexes, and reject malformed media content lengths, inspected TCP ports, marketplace content lengths, cron epochs, and sandbox stat fields.
+- Providers/agents: preserve seeded Anthropic signatures, concatenate signature-delta chunks, preserve DeepSeek `reasoning_content` replay across tier suffixes, apply OpenRouter strict9 ids to Mistral routes, promote Ollama plain-text tool calls, and recover empty preflight compaction. (#87593)
+- File transfer: handle late tar stdin pipe errors after archive validation or unpacking has already settled.
+- Performance: trust install-record caches between reloads, prefer native JSON parsing, reuse unchanged tool-search catalogs, skip unchanged store serialization, add precomputed session patch writers, reduce store clone allocations, cache manifest model catalog rows and auto-enabled plugin config, and slim current metadata identity caches.
+- Docker/release/QA: package runtime workspace templates, stream cross-OS served artifacts, preserve sparse Crabbox run artifacts, bound OpenClaw instance logs, plugin gauntlet relay logs, MCP channel buffers, kitchen-sink scans, agent-turn assertions, and release scenario logs, and keep release/google live guards current.
+
+## 2026.5.27
+
+### Highlights
+
+- Safer local/runtime boundaries: OpenClaw now rejects unsafe command wrappers, malformed CLI numeric options, unsafe Node runtime env overrides, no-auth Tailscale exposure, and non-admin device-role pairing approvals before they can affect live runs. (#87308, #87305, #87292, #87146)
+- Matrix and auto-reply delivery are steadier: mention previews stay inert, final mention replies deliver normally, shared-DM notices are awaited, MXID parsing ignores filenames, and reasoning-prefixed `NO_REPLY` responses stay suppressed.
+- Provider and agent reliability improved across OpenAI-compatible embeddings, cached token usage, Anthropic/Codex/Claude runtime state, unsupported tool-schema quarantine, heartbeat templates, and session fallback errors. (#85269, #82062, #85416, #86855)
+- Plugin and package release paths got tighter: Pixverse ships as an external video plugin with region selection, package exclusions and shrinkwrap inventory match the published npm shape, and release/package smoke commands fail bounded instead of hanging.
+- Gateway hot paths do less rediscovery by reusing current plugin metadata fingerprints, stable plugin index fingerprints, read-only session metadata, active working stores, status fast paths, and auth/env snapshots. (#86439)
+
+### Changes
+
+- Memory: add a core OpenAI-compatible embedding provider for local and hosted OpenAI-style endpoints, with config, doctor, and docs support. (#85269) Thanks @dutifulbob.
+- Plugin SDK: mark memory-specific embedding provider registration as deprecated compatibility and surface non-bundled usage in plugin compatibility diagnostics. (#85072) Thanks @mbelinky.
+- Pixverse: add video generation provider support, API region selection, and external plugin publishing.
+- Plugins: expose approval action metadata for plugin-driven approval surfaces.
+
+### Fixes
+
+- Security/CLI/runtime: harden hostname normalization for repeated trailing dots, block side-effecting command wrappers, reject unsafe Node runtime env overrides, reject loose numeric CLI and gateway options, require admin approval for node device-role pairing, and reject no-auth Tailscale exposure. (#87305, #87292, #87308, #87146) Thanks @pgondhi987.
+- Doctor: validate runtime tool schemas for every configured embedded agent while skipping ACP-only profiles, so bad non-default plugin or MCP tools are reported before assistant turns.
+- Telegram: route `sendMessage` action replies through durable outbound delivery so completed agent responses remain retryable when the gateway send path times out. (#87261) Thanks @mbelinky.
+- Matrix/auto-reply: keep draft previews mention-inert, preserve final mention delivery, send mention finals normally, await shared DM notices, ignore filename-embedded MXIDs, and suppress reasoning-prefixed `NO_REPLY` responses.
+- Agents/providers: add OpenAI-compatible cache retention, forward cached token usage in chat completions, preserve runtime context before active user turns, strip stale Anthropic thinking, load Claude CLI OAuth for Pi auth profiles, avoid false Codex runtime live switches, and quarantine unsupported tool schemas. (#82062, #87167, #86855)
+- Gateway/performance: cache plugin metadata fingerprints and stable plugin index fingerprints, borrow read-only session metadata safely, keep the active session working store hot, keep status on a bounded fast path, and preserve model auth profile suffixes. (#86439)
+- Package/install/release: align npm package exclusions and inventory, omit unpacked test helpers, skip Homebrew until macOS packages need it, cap tsdown heap in containers, bound install/release smoke waits, and harden post-publish verification.
+- Codex/Auth: bound ChatGPT OAuth token exchange and refresh requests, and honor cancellation across Codex and Anthropic OAuth login flows.
+- QA/E2E/CI: bound Telegram, kitchen-sink, Open WebUI, ClawHub, MCP, Discord, realtime, labeler, and GitHub API waits; fail empty explicit test, live-media, gateway CPU, startup benchmark, plugin gauntlet, and beta-smoke runs instead of false-greening.
+- Agents/Codex: keep spawned agent bootstrap files rooted in the agent workspace while running task commands, transcripts, and compaction from the requested cwd. (#87218) Thanks @mbelinky.
+
 ## 2026.5.26
 
 ### Highlights
@@ -12,7 +77,7 @@ Docs: https://docs.openclaw.ai
 - Better voice and Talk: realtime Talk runs can be inspected, steered, cancelled, or followed up from Web UI and Discord voice; wake-name handling is more tolerant without letting ambient speech trigger agents.
 - Safer content boundaries: Browser snapshot reads honor SSRF policy, system-event text cannot spoof nested prompt markers, fetched file text is wrapped as external content, ClickClack inbound sender allowlists run before agent dispatch, stale device tokens are rejected, and serialized tool-call text is scrubbed from replies.
 - Providers, Codex, and local models are steadier: named auth profiles, OpenAI sampling params, Codex app-server resume/timeout/usage-limit recovery, dynamic tool-schema guards, xAI usage-limit surfacing, Ollama top-p normalization, and local approval resolution reduce provider-specific dead ends.
-- More reliable install/update/release paths: Alpine installs, trusted runtime fallback roots, stable update channels, Docker/package timeouts, Windows/macOS proof lanes, Testbox/Crabbox delegation, plugin publish checks, and macOS runner bootstraps all got hardened.
+- More reliable install/update/release paths: Alpine installs, trusted runtime fallback roots, stable update channels, Docker/package timeouts, Windows Scheduled Tasks, Windows/macOS proof lanes, Testbox/Crabbox delegation, plugin publish checks, and macOS runner bootstraps all got hardened.
 - Better observability: Activity tab, gateway secret-prep traces, tool/model stream progress, explicit fast-mode status, systemd Gateway hygiene, OpenTelemetry LLM spans, release performance evidence, and richer telemetry signals make failures easier to inspect.
 
 ### Changes
@@ -34,7 +99,7 @@ Docs: https://docs.openclaw.ai
 - Voice: share activation-name matching and consult-transcript screening through the realtime voice SDK so Discord, browser voice, and meeting surfaces can reuse one implementation.
 - Cron: default `cron.maxConcurrentRuns` to 8 so scheduled automations and their isolated agent turns can make progress in parallel without explicit configuration.
 - QA-Lab: add `qa coverage --match <query>` so focused proof selection can discover matching scenarios from existing metadata before running live or remote lanes.
-- Discord/model picker: surface an alpha-bucket select (e.g. `A–G (12) · H–N (18) · O–Z (5)`) when the provider list or a provider's model list exceeds 25 items, so configs with `provider/*` wildcards stay one click from the right page instead of paginating through prev/next; falls back to numeric chunks when every item shares the same first letter.
+- Discord/model picker: surface an alpha-bucket select (e.g. `A–G (12) · H–N (18) · O–Z (5)`) when the provider list or a provider's model list exceeds 25 items, so configs with `provider/*` wildcards stay one click from the right page instead of paginating through prev/next; falls back to numeric chunks when every item shares the same first letter. (#86181) Thanks @rendrag-git.
 - Control UI: add an ephemeral Activity tab for sanitized live tool activity summaries without persisting raw telemetry. Fixes #12831. Thanks @BunsDev.
 - Build: include `ui:build` in the `full` and `ciArtifacts` profiles of `scripts/build-all.mjs` so `pnpm build` always rebuilds `dist/control-ui` after `tsdown` cleans `dist`, removing the second-command requirement and the missing-asset failure mode for source/runtime installs and CI artifact uploads. (#85206)
 - iOS: improve Talk mode with direct realtime voice sessions, compact toolbar status, and responsive voice waveform feedback. (#86355) Thanks @ngutman.
@@ -44,21 +109,27 @@ Docs: https://docs.openclaw.ai
 ### Fixes
 
 - Memory/security: reject prompt-like text submitted through the explicit `memory_store` tool before embedding or storage, matching the existing auto-capture prompt-injection filter. (#87142)
+- Gateway/security: enable the default auth rate limiter for remote non-browser and HTTP gateway auth failures when `gateway.auth.rateLimit` is unset, while preserving the loopback exemption. (#87148)
+- Prompt hardening: route untrusted group prompt metadata through sanitized untrusted structured context while preserving trusted operator-configured group system prompts and aligning the plugin SDK docs/test helpers. (#87144)
 - Security/content boundaries: validate Browser snapshot tab URLs against SSRF policy before ChromeMCP or direct CDP reads, sanitize queued system-event text so untrusted plugin/channel labels cannot spoof nested prompt markers, wrap fetched file text and metadata as external content, apply ClickClack `allowFrom` sender allowlists before agent dispatch, reject RPCs from invalidated device-token clients during rotation, require staged sandbox media refs, and scrub serialized tool-call text from replies. (#78526, #87094, #87062, #83741, #70707, #86924) Thanks @zsxsoft, @ttzero25, and @mmaps.
 - Transcripts/user turns: persist CLI, WebChat, media, follow-up, hook, and Codex-mirror user turns to the admitted session target; keep cleaned transcript text, inline image routing, provenance metadata, replay hooks, and fallback paths idempotent when runtimes fail or restart.
 - TUI/status/onboarding/UI: queue busy TUI prompts instead of dropping them, preserve the configured default model during onboarding, show failed tool results as errors, show config-open failures in Control UI, keep status JSON plugin scans healthy, preserve xAI usage-limit errors locally, and expose explicit fast-mode/systemd state. (#86722, #87000, #85786, #87108, #87001, #86614, #87115, #86976)
-- Plugin commands/SDK: preserve plugin LLM command auth, keep `onDiagnosticEvent` exports discoverable through `Function.name`, stabilize diagnostic event root aliases, correlate pathless read diagnostics, suppress transient runner failures in channel command paths, and repair local approval resolution. (#85936, #87084, #86977, #87069, #86771)
+- Plugin commands/SDK: preserve plugin LLM command auth, bind native plugin command dispatch to the host agent's LLM auth, keep `onDiagnosticEvent` exports discoverable through `Function.name`, stabilize diagnostic event root aliases, correlate pathless read diagnostics, suppress transient runner failures in channel command paths, and repair local approval resolution. (#85936, #87084, #86977, #87069, #86771)
 - Codex/providers: keep WebChat delivery hints out of user prompts, avoid false queued-terminal idle timeouts, share the native hook relay registry, quarantine unsupported dynamic tool schemas, preserve Claude resumed-session system prompts, normalize greedy Ollama `top_p`, preserve per-agent thinking defaults for ingress runs, and avoid native compaction takeover on budget-triggered Codex turns. (#87096, #73950, #87049, #86689, #86772)
-- Gateway/perf/release: reuse startup-warning metadata and prepared auth stores, defer warning and scheduled-service fallback imports, trim Gateway session/startup/runtime CPU churn, skip duplicate turn session touches, stop chat timeout fallback cascades, drop stale subagent announce history, bound benchmark/watch/kitchen-sink teardown waits, bound macOS/package/onboarding/plugin smoke commands, bound install finalization probes, resolve Parallels npm-update commands from guest `PATH`, and bootstrap raw AWS macOS Node/pnpm commands through `/usr/bin/env`. (#86997)
+- Gateway/perf/release: reuse startup-warning metadata and prepared auth stores, avoid cloning live-switch and lifecycle session caches on read paths, defer warning and scheduled-service fallback imports, trim Gateway session/startup/runtime CPU churn, skip duplicate turn session touches, stop chat timeout fallback cascades, drop stale subagent announce history, bound benchmark/watch/kitchen-sink teardown waits, bound macOS/package/onboarding/plugin smoke commands, bound install finalization probes, resolve Parallels npm-update commands from guest `PATH`, and bootstrap raw AWS macOS Node/pnpm commands through `/usr/bin/env`. (#86997)
 - Reply/perf: reduce visible reply delivery latency by preserving Telegram typing/progress context, lazy-loading slash-command startup metadata, avoiding hot-path model hydration, flag-gating Codex profiler timing, deferring context compaction maintenance, and tracking delivery timing. (#86989, #86990, #86991, #86992, #86993, #86994) Thanks @keshavbotagent.
 - Reply/source delivery: keep TUI, Control UI, media, TTS, transcript, and Codex source-reply finals live without duplicate terminal events or stale replay artifacts.
 - Agents/replay: repair legacy tool results before replay, preserve `sessions_spawn` transcript payloads, restore current guard checks, stage sandboxed workspace media, and keep duplicate transcripts tool display metadata from reappearing. (#82203, #86934, #87025) Thanks @martingarramon, @vincentkoc, and @joshavant.
+- Agents/sessions: handle active-fallback failures in `sessions_send` so fallback routing reports the real failure and does not leave callers with an ambiguous dropped send. (#86638)
 - Agents/hooks/subagents: enforce default hook agent allowlists, recover failed subagent lifecycle completions, and keep node task lifecycle cleanup from closing the Gateway listener. (#86101)
 - Codex: project newer OpenClaw chat history into resumed app-server threads and keep Codex turn timeouts inside the Codex runtime boundary so timeouts do not poison shared app-server clients or fall through to unrelated provider fallback. (#86677, #86476) Thanks @TurboTheTurtle and @pashpashpash.
 - Config/doctor/update: narrow profiled tool-section doctor repair, keep runtime-injected legacy web-search provider config out of user-authored config validation, and keep prerelease tags excluded from stable updater resolution. (#87030, #86818, #86559) Thanks @joshavant, @luoyanglang, and @stevenepalmer.
+- Doctor/runtime: validate active bundled MCP tool schemas through the same runtime projection path so unsupported MCP input schemas are reported and quarantined instead of poisoning assistant startup.
 - CLI/Windows: add a Windows-only stack-size respawn for stack-heavy startup paths, default CLI logs to local timestamps, and validate timeout/banner TTY state more strictly. (#87031, #85387) Thanks @giodl73-repo and @vincentkoc.
 - Locking/security: require owner identity proof before stale plugin lock removal, memoize session lock owner arguments, and avoid writing default exec approval stores unless policy state actually changed. (#86814, #86964) Thanks @Alix-007 and @vincentkoc.
 - Install/release: bound Docker package build, inventory, pack, and tarball preparation with process-group timeouts; pin shrinkwrap patch drift to the pnpm lock; harden macOS restart and dSYM packaging; and run release Docker/live timeout wrappers in the foreground so child processes cannot wedge gates.
+- QA/Telegram: bound Telegram user credential tar and broker calls so live proof setup fails with a timeout instead of waiting for the outer Crabbox job deadline.
+- QA/Tool Search: bound gateway E2E HTTP probes, run only the fixture plugin, and clean up temporary fixture trees after the compact tool-catalog proof completes.
 - Telegram/network: treat `ENETDOWN` as a transient pre-connect network failure so Telegram sends, gateway unhandled-rejection handling, and cron network retries follow the same recovery path as sibling network outages. (#86762) Thanks @TurboTheTurtle.
 - Telegram: preserve inbound text entities, overlapping DM replies, account topic cache sidecars, outbound reply context, targeted bot-command mentions, durable group retry targets, forum topic names, and native progress callbacks. (#83873, #85361, #85555, #85656, #85709, #86299, #86553) Thanks @SebTardif, @luoyanglang, and @neeravmakwana.
 - iMessage: read image attachments from local Messages attachment roots, dedupe duplicate local Messages-source accounts, seed direct DM history, fix image/group media attachment commands, advance catchup cursors after live handling, and keep slash-command acknowledgements in the source conversation. (#82642, #85475, #86569, #86705, #86706, #86770) Thanks @homer-byte, @TurboTheTurtle, @swang430, and @OmarShahine.
@@ -67,7 +138,8 @@ Docs: https://docs.openclaw.ai
 - Codex: preserve native web-search metadata, keep oversized native thread reuse, bridge CLI API-key auth into the app server, preserve sandbox bootstrap path style, recover context-window prompt errors, honor yolo approval policy, disable native thread personality, and route compaction through Codex auth. (#85378, #85542, #85891, #85909, #86408)
 - Agents/runtime: enforce session lock max-hold reclaim, release embedded-attempt locks on all exits, treat aborted subagent runs as terminal, avoid runtime model hydration on hot paths, disclose scoped session list counts, derive overflow budgets from provider errors, and keep fallback errors scoped to the active model candidate. (#70473, #85764, #86014, #86134, #86427, #86944) Thanks @openperf, @fuller-stack-dev, @zhangguiping-xydt, and @ferminquant.
 - Config/update/doctor: retry config recovery after failed backup restore, skip shell env fallback on Windows, exclude prerelease tags from the stable git channel, support deep config edits, warn instead of aborting on unreadable cron stores, prune stale bundled plugin paths, and avoid duplicate restart prompts when the Gateway is already healthy. (#85739, #85787, #86060, #86260, #86384, #86533) Thanks @liaoyl830.
-- Install/release: support Alpine CLI installs and runtime floors, prefer trusted startup argv runtime fallback roots, reject stale CLI node runtimes, avoid npm `min-release-age` installer failures, bound npm/package/Docker install phases, restore config parent ownership in Docker, seed Docker lockfile package tarballs before prune, and make release/plugin prerelease checks fail closed instead of hanging or false-greening. (#85491)
+- Install/release: support Alpine CLI installs and runtime floors, prefer trusted startup argv runtime fallback roots, reject stale CLI node runtimes, avoid npm `min-release-age` installer failures, bound npm/package/Docker install phases, restore config parent ownership in Docker, seed Docker lockfile package tarballs before prune, make release/plugin prerelease checks fail closed instead of hanging or false-greening, and use host-visible Crabbox local work roots for Docker-backed proof. (#85491)
+- Windows daemon: keep Scheduled Task gateway launches running on battery power and avoid workgroup-machine prompts for a domain user during task installation. (#59299)
 - Security: avoid printing Gateway tokens in Docker, validate plugin model-pattern regexes safely, escape transcript metadata field names, harden session allowlist glob matching, audit Claude permission overrides under YOLO, and require explicit allow for ACP auto approvals. (#85849, #85934, #86046, #86557)
 - Media/images: replace Sharp with Rastermill, keep EXIF normalization best-effort, normalize HEIC/HEIF before image descriptions, route Codex image API keys through OpenAI, preserve image compression metadata, and auto-scale live tool result caps. (#85776, #86037, #86437, #86857, #86923)
 - Memory: prevent semantic vector indexes from silently degrading when embeddings are unavailable, stop doctor OOMs on large session stores, preserve sidecar hooks/artifacts, write fallback dream diaries, use CJK-aware dreaming dedupe, and avoid per-file watcher FD fan-out. (#80613, #82928, #85060, #85704, #85967, #86701) Thanks @brokemac79, @openperf, and @yaaboo-gif.
@@ -76,6 +148,10 @@ Docs: https://docs.openclaw.ai
 - Agents/BTW: route fallback side-question streams through the embedded stream resolver so Anthropic-compatible MiniMax requests use the same capped transport as normal chat. (#86312) Thanks @neeravmakwana.
 - Telegram: treat `/command@TargetBot` bot-command entities as explicit mentions for the addressed bot so `requireMention` groups no longer drop targeted commands or captions. Fixes #84462. (#86553) Thanks @luoyanglang.
 - CI: bound Docker/Bash E2E tarball npm installs with `OPENCLAW_E2E_NPM_INSTALL_TIMEOUT` so package, onboarding, plugin, and upgrade lanes fail instead of hanging on a stuck npm install.
+- CI: fail Parallels npm-update smoke jobs after the guest command timeout and cleanup backstop instead of only logging a timeout line.
+- CI: bound kitchen-sink RPC HTTP probes so stalled gateway readiness or response bodies fail and retry instead of wedging the walker.
+- CI: bound Telegram user Crabbox proof Bot API calls so stalled Telegram responses fail instead of wedging credential and desktop proof cleanup.
+- CI: bound MCP channel stdio client initialization so Docker channel proof fails and closes the bridge transport instead of waiting for the outer job timeout.
 - CI: keep `OPENCLAW_TESTBOX=1 pnpm check:changed` delegating to Blacksmith Testbox through Crabbox without forwarding local Testbox or worker env into the remote command.
 - CI: send KILL after the TERM grace period for manual checkout fetch timeouts so stuck Testbox and workflow checkout retries cannot hang behind a wedged `git fetch`.
 - CI: send KILL after the TERM grace period for Bun global install smoke command timeouts so trapped `openclaw` child processes cannot wedge the scheduled install smoke.
@@ -223,6 +299,7 @@ Docs: https://docs.openclaw.ai
 - Maintainer skills: add `openclaw-landable-bug-sweep` for producing five small, reviewed, CI-green OpenClaw bugfix PRs from issue/PR sweeps.
 - Control UI/chat: add search and Load More pagination to the chat session picker, keeping initial session loads bounded while making older conversations reachable. (#85237) Thanks @amknight.
 - CLI/onboarding: start classic onboarding when bare `openclaw` runs before an authored config exists, while keeping configured installs on Crestodian. (#72343) Thanks @fuller-stack-dev.
+- Agents/runtime: internalize the former Pi agent runtime into OpenClaw, remove legacy package dependencies, and keep Pi-named SDK aliases only as deprecated plugin compatibility.
 - Discord: allow configuring a bounded `agentComponents.ttlMs` callback registry lifetime for long-running component workflows, with per-account overrides and a 24-hour cap. (#84189) Thanks @100menotu001.
 - xAI/Grok: reuse xAI OAuth auth profiles for Grok `web_search`, thread active-agent auth through web search, add Grok model aliases, and let media providers declare default operation timeouts. (#85182) Thanks @fuller-stack-dev.
 - Plugin SDK: add row-level session workflow helpers and deprecate `loadSessionStore` so plugins can read and patch sessions without depending on the legacy whole-store shape. (#84693) Thanks @efpiva.
@@ -479,6 +556,7 @@ Docs: https://docs.openclaw.ai
 
 ### Fixes
 
+- Agents: validate a forced plugin harness against the candidate provider/model before pinning it, so unsupported fallback-chain candidates fail with a clear harness error instead of producing a late `Model provider X not found` from the underlying harness. Codex harness `supports()` now also accepts the canonical `openai` and `openai-codex` routing ids so documented Codex configs keep working. Thanks @cathrynlavery.
 - Control UI/WebChat: keep selected external-channel sessions live by mirroring Codex prompts at turn start, streaming hidden runs only to exact selected-session subscribers, and deduplicating accumulated stream snapshots around tool cards. Fixes #83528, #82611, refs #83949. Thanks @BunsDev.
 - CLI/tasks: include stale-running task maintenance decisions in `openclaw tasks maintenance --json` so retained and reconcile candidates explain backing-session, cron, CLI, and wedged-subagent state. (#84691) Thanks @efpiva.
 - Codex app-server: keep system-prompt reports working when bootstrap hooks provide workspace files with only a path and content, so hook-supplied SOUL/IDENTITY/TOOLS/USER context still reports injected characters correctly. (#84736) Thanks @JARVIS-Glasses.
@@ -1844,6 +1922,7 @@ Docs: https://docs.openclaw.ai
 - Agents/read tool: treat positive offsets beyond EOF as empty ranges instead of surfacing the upstream read error, so stale pagination cursors no longer crash tool calls while unrelated read failures still fail loud. Fixes #62466. (#75536) Thanks @vyctorbrzezowski.
 - Google/Gemini: normalize retired Gemini 3 Pro Preview refs left in Google API-key onboarding model allowlists and fallbacks, so setup-emitted config keeps testing `google/gemini-3.1-pro-preview` instead of `google/gemini-3-pro-preview`.
 - Telegram/context: bound selected topic context to the active session so messages from before `/new` or `/reset` are not replayed into later turns. (#80848) Thanks @VACInc.
+- Docs/providers/openai: clarify that OpenAI Realtime voice goes through the OpenAI Platform Realtime API and requires Platform credits — Codex/ChatGPT subscription quota does not cover this route. Fixes #76498. Thanks @lonexreb.
 - Google/Gemini: normalize retired nested Gemini 3 Pro Preview ids when resolving exact configured proxy-provider refs, so `kilocode/google/gemini-3-pro-preview` resolves to `kilocode/google/gemini-3.1-pro-preview` for Gemini 3.1 testing.
 - CLI: strip generic OSC terminal escape payloads from sanitized output fields, preventing clipboard/title escape bodies from leaking into commitment tables and other terminal-safe text. Thanks @shakkernerd.
 - Codex app-server: match connector-backed plugin approval elicitations by stable connector id so enabled destructive actions no longer fall through to display-name-only rejection.

Dockerfile

@@ -48,6 +48,7 @@ RUN --mount=type=bind,source=packages,target=/tmp/packages,readonly \
 FROM ${OPENCLAW_BUN_IMAGE} AS bun-binary
 FROM ${OPENCLAW_NODE_BOOKWORM_IMAGE} AS build
 ARG OPENCLAW_BUNDLED_PLUGIN_DIR
+ARG OPENCLAW_EXTENSIONS
 
 # Copy pinned Bun binary from the official image instead of fetching via curl.
 COPY --from=bun-binary /usr/local/bin/bun /usr/local/bin/bun
@@ -77,7 +78,12 @@ RUN --mount=type=cache,id=openclaw-pnpm-store,target=/root/.local/share/pnpm/sto
 # pnpm v10+ may append peer-resolution hashes to virtual-store folder names; do not hardcode `.pnpm/...`
 # paths. Matrix's native downloader can hit transient release CDN errors while
 # still exiting successfully, so retry the package downloader before failing.
+# Skip the entire check when matrix is not a bundled extension (e.g. msteams-only builds).
 RUN set -eux; \
+    if ! printf '%s\n' "$OPENCLAW_EXTENSIONS" | tr ',' ' ' | tr ' ' '\n' | grep -qx 'matrix'; then \
+      echo "==> matrix not bundled, skipping matrix-sdk-crypto check"; \
+      exit 0; \
+    fi; \
     echo "==> Verifying critical native addons..."; \
     for attempt in 1 2 3 4 5; do \
       if find /app/node_modules -name "matrix-sdk-crypto*.node" 2>/dev/null | grep -q .; then \
@@ -178,6 +184,7 @@ COPY --from=runtime-assets --chown=node:node /app/package.json .
 COPY --from=runtime-assets --chown=node:node /app/pnpm-workspace.yaml .
 COPY --from=runtime-assets --chown=node:node /app/patches ./patches
 COPY --from=runtime-assets --chown=node:node /app/openclaw.mjs .
+COPY --from=runtime-assets --chown=node:node /app/src/agents/templates ./src/agents/templates
 COPY --from=runtime-assets --chown=node:node /app/${OPENCLAW_BUNDLED_PLUGIN_DIR} ./${OPENCLAW_BUNDLED_PLUGIN_DIR}
 COPY --from=runtime-assets --chown=node:node /app/skills ./skills
 COPY --from=runtime-assets --chown=node:node /app/docs ./docs

LICENSE

@@ -19,3 +19,6 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
+
+Third-party notices for incorporated or adapted code are recorded in
+THIRD_PARTY_NOTICES.md.

README.md

@@ -25,7 +25,7 @@ If you want a personal, single-user assistant that feels local, fast, and always
 
 Supported channels include: WhatsApp, Telegram, Slack, Discord, Google Chat, Signal, iMessage, IRC, Microsoft Teams, Matrix, Feishu, LINE, Mattermost, Nextcloud Talk, Nostr, Synology Chat, Tlon, Twitch, Zalo, Zalo Personal, WeChat, QQ, WebChat.
 
-[Website](https://openclaw.ai) · [Docs](https://docs.openclaw.ai) · [Vision](VISION.md) · [DeepWiki](https://deepwiki.com/openclaw/openclaw) · [Getting Started](https://docs.openclaw.ai/start/getting-started) · [Updating](https://docs.openclaw.ai/install/updating) · [Showcase](https://docs.openclaw.ai/start/showcase) · [FAQ](https://docs.openclaw.ai/help/faq) · [Onboarding](https://docs.openclaw.ai/start/wizard) · [Nix](https://github.com/openclaw/nix-openclaw) · [Docker](https://docs.openclaw.ai/install/docker) · [Discord](https://discord.gg/clawd)
+[Website](https://openclaw.ai) · [Docs](https://docs.openclaw.ai) · [Vision](VISION.md) · [Third-party notices](THIRD_PARTY_NOTICES.md) · [DeepWiki](https://deepwiki.com/openclaw/openclaw) · [Getting Started](https://docs.openclaw.ai/start/getting-started) · [Updating](https://docs.openclaw.ai/install/updating) · [Showcase](https://docs.openclaw.ai/start/showcase) · [FAQ](https://docs.openclaw.ai/help/faq) · [Onboarding](https://docs.openclaw.ai/start/wizard) · [Nix](https://github.com/openclaw/nix-openclaw) · [Docker](https://docs.openclaw.ai/install/docker) · [Discord](https://discord.gg/clawd)
 
 New install? Start here: [Getting started](https://docs.openclaw.ai/start/getting-started)
 
@@ -306,7 +306,7 @@ See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines, maintainers, and how to s
 AI/vibe-coded PRs welcome! 🤖
 
 Special thanks to [Mario Zechner](https://mariozechner.at/) for his support and for
-[pi-mono](https://github.com/badlogic/pi-mono).
+[pi-mono](https://github.com/earendil-works/pi-mono).
 Special thanks to Adam Doppelt for the lobster.bot domain.
 
 Thanks to all clawtributors:

THIRD_PARTY_NOTICES.md

@@ -0,0 +1,37 @@
+# Third-party notices
+
+This file records third-party notices for code or substantial implementation
+portions incorporated into OpenClaw source, beyond normal package-manager
+dependency metadata.
+
+## Pi / pi-mono
+
+Portions of OpenClaw were adapted from Pi / pi-mono, and OpenClaw also depends
+on `@earendil-works/pi-tui` for terminal UI rendering.
+
+- Upstream: https://github.com/earendil-works/pi-mono
+- Package family: `@earendil-works/pi-*`
+- License: MIT
+- Copyright: Copyright (c) 2025 Mario Zechner
+
+MIT License
+
+Copyright (c) 2025 Mario Zechner
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

appcast.xml

@@ -2,6 +2,262 @@
 <rss xmlns:sparkle="http://www.andymatuschak.org/xml-namespaces/sparkle" version="2.0">
     <channel>
         <title>OpenClaw</title>
+        <item>
+            <title>2026.5.27</title>
+            <pubDate>Thu, 28 May 2026 12:12:19 +0000</pubDate>
+            <link>https://raw.githubusercontent.com/openclaw/openclaw/main/appcast.xml</link>
+            <sparkle:version>2026052790</sparkle:version>
+            <sparkle:shortVersionString>2026.5.27</sparkle:shortVersionString>
+            <sparkle:minimumSystemVersion>15.0</sparkle:minimumSystemVersion>
+            <description><![CDATA[<h2>OpenClaw 2026.5.27</h2>
+<h3>Highlights</h3>
+<ul>
+<li>Stronger security and content boundaries: group prompt text is kept out of the system prompt, repeated-dot hostnames are normalized, side-effecting command wrappers and unsafe Node runtime env overrides are blocked, no-auth Tailscale exposure is rejected, and node/device-role approvals now require admin authority. (#87144, #87305, #87292, #87308, #87146) Thanks @eleqtrizit and @pgondhi987.</li>
+<li>More reliable Codex app-server runs: Codex runtime models resolve first, workspace memory is routed through tools, shared app-server clients survive startup and spawned-helper failures, native hook relay generations survive restarts and rotate on fresh fallbacks, and false runtime live switches are avoided. (#87383, #87403, #87375, #72574, #87428) Thanks @yetval.</li>
+<li>Faster Gateway and reply paths: session reads, plugin metadata fingerprints, auth env snapshots, auto-enabled plugin config, tool-search catalogs, and stable metadata caches do less hot-path rediscovery while visible replies no longer inherit hidden cleanup timeouts. (#86439, #87044) Thanks @keshavbotagent.</li>
+<li>Better provider and model coverage: OpenAI-compatible embedding providers are core, DeepInfra catalog browsing loads the full credential-aware model set, Pixverse adds video generation and API region selection, VLLM thinking params are wired, Claude CLI OAuth overlays load for PI auth profiles, and bare direct Anthropic model ids work. (#85269, #84549, #87167) Thanks @dutifulbob, @ats3v, and @joshavant.</li>
+<li>Channel delivery is steadier: Telegram <code>sendMessage</code> actions use durable outbound delivery, iMessage suppresses duplicate native exec approval prompts and sends, Slack keeps delivered final replies during late cleanup, Matrix mention previews/finals are stricter, QQBot fallback approval buttons honor slash-command auth, Discord guild requester checks are tighter, recovered Discord tool-warning artifacts stay out of successful replies, and Google Chat stops thread sends in DMs. (#87261, #87154) Thanks @mbelinky and @eleqtrizit.</li>
+<li>Release, package, and CI proof paths are harder to wedge: npm/package inventory honors dist exclusions, shrinkwrap override pins merge correctly, Docker runtime workspace templates are packaged and smoked, release postpublish checks are stricter, beta smoke rejects empty runs, and E2E log/probe waits are bounded.</li>
+</ul>
+<h3>Changes</h3>
+<ul>
+<li>Memory: add a core OpenAI-compatible embedding provider for local and hosted OpenAI-style endpoints, with config, doctor, and docs support. (#85269) Thanks @dutifulbob.</li>
+<li>Plugin SDK: mark memory-specific embedding provider registration as deprecated compatibility and surface non-bundled usage in plugin compatibility diagnostics. (#85072) Thanks @mbelinky.</li>
+<li>Providers: add the Pixverse video generation provider, API region selection, docs, and external plugin packaging support.</li>
+<li>DeepInfra: load the full model catalog when users browse models during onboarding, preserve configured API-key catalogs, refresh media/video defaults, and keep pricing/default model metadata aligned. (#84549) Thanks @ats3v.</li>
+<li>Plugin SDK: expose plugin approval action metadata and stop exporting Vitest test helpers from the public SDK surface. (#87120) Thanks @RomneyDa.</li>
+<li>Channel SDK: move channel message compatibility into core, remove old channel turn runtime aliases, and preserve runtime catalog markdown metadata for plugins.</li>
+<li>ClawHub: add plugin display metadata so catalog/package listings use cleaner names. (#87354) Thanks @thewilloftheshadow.</li>
+<li>Agents: split the heartbeat runtime template out of docs assets and add compatibility repair for legacy heartbeat template content. (#85416) Thanks @hxy91819.</li>
+</ul>
+<h3>Fixes</h3>
+<ul>
+<li>Security/content boundaries: route untrusted group prompt metadata outside system prompts, normalize repeated trailing hostname dots, block side-effecting command wrappers, reject unsafe Node runtime env overrides, reject no-auth Tailscale exposure, block untrusted Microsoft Teams service URLs, enforce <code>/allowlist configWrites</code> origin policy, gate QQBot fallback approval buttons, and require admin for node/device-role approvals. (#87144, #87305, #87292, #87308, #87146, #87154, #87334) Thanks @eleqtrizit and @pgondhi987.</li>
+<li>Codex: resolve Codex runtime models before generic routing, route workspace memory through tools, preserve shared app-server clients after startup and spawned-helper failures, preserve native hook relay generations across restarts and fresh fallbacks, keep raw reasoning/source-reply guards intact, report quarantined dynamic tools, keep the attempt watchdog armed for queued terminal turns, and route Codex OAuth compaction through OpenAI-Codex. (#87383, #87403, #87375, #72574, #87428) Thanks @yetval.</li>
+<li>Agents/runtime: avoid session event queue self-waits, bound compaction wake and steering retries, preserve grace for pending error diagnostics, avoid false Codex runtime live switches, avoid stale restart continuation reuse, preserve session fallback errors, suppress duplicate Claude CLI skill prompts, keep runtime context before active user turns, strip stale Anthropic thinking, quarantine unsupported tool schemas, recover completed write timeouts safely, release retained session write locks on timeout abort, and validate forced plugin harness support before pinning. (#86123, #55424, #86855, #74341, #87278) Thanks @luoyanglang, @cathrynlavery, and @openperf.</li>
+<li>Reply/session delivery: keep visible turn admission unbounded, keep visible fallback delivery on latest targets, preserve bridge hook context, classify direct fallback targets by channel grammar, report approval resolutions in bridge mode, and avoid stale source-reply artifacts. (#87044) Thanks @keshavbotagent.</li>
+<li>Channels: make Telegram <code>sendMessage</code> action replies durable and preserve SecretRef prompt config, suppress duplicate iMessage native exec approval prompts and sends, keep iMessage approval polling alive after denied reactions, keep Slack delivered final replies during late cleanup, keep Matrix mention previews/finals mention-inert and normally delivered, ignore filename-embedded Matrix IDs, suppress recovered Discord tool-warning artifacts from successful replies, suppress Google Chat thread sends in DMs, and harden Discord guild requester checks. (#87261, #87452) Thanks @mbelinky.</li>
+<li>Memory: salvage QMD search JSON after nonzero exits and keep workspace memory routing through the Codex tool path where possible. (#87225, #87383, #87403) Thanks @osolmaz.</li>
+<li>Providers/models: forward cached token usage in OpenAI-compatible chat completions, load Claude CLI OAuth overlays for PI auth profiles, send bare direct Anthropic model ids, wire configured VLLM thinking params, honor OpenAI-compatible cache retention, normalize OpenAI Responses replay tool ids, resolve OpenAI <code>gpt-5.5</code> without a cached catalog, preserve <code>retry-after</code> fallback handling, bound GitHub Copilot auth requests, and load DeepInfra custom/live catalogs consistently. (#82062, #87167, #84549) Thanks @caz0075, @joshavant, and @ats3v.</li>
+<li>Gateway/performance: borrow read-only session metadata and active session working stores, cache current/stable plugin metadata fingerprints, cache auto-enabled plugin config, slim metadata identity caches, trust current metadata lifecycle caches, stabilize isolated cron prompt-cache affinity, persist model auth profile suffixes, drain probe client closes, expire browser tokens after auth rotation, and keep default status fast paths bounded. Thanks @ferminquant.</li>
+<li>CLI/help/config: reject loose or malformed numeric options for gateway timeouts, model limits, directory limits, message options, webhooks, and partial values; respect subcommand version options; route generated/root/plugin help targets correctly; keep skills JSON output flushing naturally; and keep plugin descriptor loading quiet in root help. (#87398) Thanks @Patrick-Erichsen.</li>
+<li>Plugin state/tool search: evict the current namespace when plugin rows hit caps, reuse unchanged tool-search catalogs, align the release catalog reuse wrapper, and keep fallback tool warnings mention-inert.</li>
+<li>Install/package/release: match npm globstar exclusions, honor dist package exclusions in inventory, omit unpacked test helpers, skip Homebrew until macOS packages need it, package Docker runtime workspace templates, smoke Docker runtime templates during full validation, merge nested shrinkwrap override pins, preserve forked shrinkwrap pins, pin aged <code>lru-cache</code>, harden postpublish verification, accept main full-validation proof, and reject empty beta smoke runs.</li>
+<li>E2E/QA/Crabbox: bound Telegram, Open WebUI, ClawHub, Matrix, Tool Search, MCP, gateway network, bundled runtime, kitchen-sink, codex media, config reload, and agent-turn assertion waits; prefer Azure for Windows targets; reinitialize invalid changed-gate git dirs; full-sync sparse container runs; and fail empty explicit test requests. (#87186)</li>
+</ul>
+<p><a href="https://github.com/openclaw/openclaw/blob/main/CHANGELOG.md">View full changelog</a></p>
+]]></description>
+            <enclosure url="https://github.com/openclaw/openclaw/releases/download/v2026.5.27/OpenClaw-2026.5.27.zip" length="54488811" type="application/octet-stream" sparkle:edSignature="c5w2T1UO6vpPs70hyYH93cIyWEOd5sl5z2NkhU53E+XQBSd+jAr+xd0qf3KzWbeX2mfXYMQmnx+VMls3L22EDg=="/>
+        </item>
+        <item>
+            <title>2026.5.26</title>
+            <pubDate>Wed, 27 May 2026 12:24:26 +0000</pubDate>
+            <link>https://raw.githubusercontent.com/openclaw/openclaw/main/appcast.xml</link>
+            <sparkle:version>2026052690</sparkle:version>
+            <sparkle:shortVersionString>2026.5.26</sparkle:shortVersionString>
+            <sparkle:minimumSystemVersion>15.0</sparkle:minimumSystemVersion>
+            <description><![CDATA[<h2>OpenClaw 2026.5.26</h2>
+<h3>Highlights</h3>
+<ul>
+<li>Faster Gateway and replies: startup avoids repeated plugin, channel, session, usage-cost, warning, scheduled-service, and filesystem scans; visible replies separate user-facing sends from slower follow-up work; Gateway runtime/session caches churn less under load.</li>
+<li>Transcripts are core: transcript-backed meeting summaries, source-provider chunks, cleaned user turns, media provenance, Codex mirrors, WebChat replies, and CLI/TUI replay now use one more reliable transcript path.</li>
+<li>More channels are production-ready: Telegram keeps typing/progress context and forum topics, iMessage handles attachment roots, remote media staging, and duplicate local Messages sources, WhatsApp restores group/media behavior, Discord improves voice playback and model picking, and Signal/iMessage/WhatsApp get reaction approvals.</li>
+<li>Better voice and Talk: realtime Talk runs can be inspected, steered, cancelled, or followed up from Web UI and Discord voice; wake-name handling is more tolerant without letting ambient speech trigger agents.</li>
+<li>Safer content boundaries: Browser snapshot reads honor SSRF policy, system-event text cannot spoof nested prompt markers, fetched file text is wrapped as external content, ClickClack inbound sender allowlists run before agent dispatch, stale device tokens are rejected, and serialized tool-call text is scrubbed from replies.</li>
+<li>Providers, Codex, and local models are steadier: named auth profiles, OpenAI sampling params, Codex app-server resume/timeout/usage-limit recovery, dynamic tool-schema guards, xAI usage-limit surfacing, Ollama top-p normalization, and local approval resolution reduce provider-specific dead ends.</li>
+<li>More reliable install/update/release paths: Alpine installs, trusted runtime fallback roots, stable update channels, Docker/package timeouts, Windows Scheduled Tasks, Windows/macOS proof lanes, Testbox/Crabbox delegation, plugin publish checks, and macOS runner bootstraps all got hardened.</li>
+<li>Better observability: Activity tab, gateway secret-prep traces, tool/model stream progress, explicit fast-mode status, systemd Gateway hygiene, OpenTelemetry LLM spans, release performance evidence, and richer telemetry signals make failures easier to inspect.</li>
+</ul>
+<h3>Changes</h3>
+<ul>
+<li>Transcripts: add core transcript capture and source-provider support for transcript-backed meeting summaries, including the renamed Transcripts docs, CLI surface, source-provider chunks, and cleaned user-turn persistence.</li>
+<li>Auth: add named model login profiles and supported credential migration for Hermes, OpenCode, and Codex auth profiles, with explicit opt-out and non-interactive controls. (#85667) Thanks @fuller-stack-dev.</li>
+<li>Diagnostics: trace gateway secret preparation, classify skill/tool usage, surface model stream progress, add OpenTelemetry LLM content spans, and expose alertable telemetry for blocked tools, failover, stale sessions, liveness, oversized payloads, and webhook ingress. (#83019, #80370, #86191)</li>
+<li>Channels: add Signal reaction approvals, iMessage thumb approval reactions, and WhatsApp thumb approval reaction support so mobile approval flows work without textual <code>/approve</code> commands. (#85894, #85952, #85477)</li>
+<li>Agents/API: forward OpenAI sampling params through the Gateway and expose estimated context-budget status for active agent runs. (#84094)</li>
+<li>TUI/status: queue prompts submitted while an agent is busy and show explicit fast-mode state plus richer systemd Gateway hygiene in status output. (#86722, #87115, #86976)</li>
+<li>Exec approvals: hide durable approval actions that are unavailable for the current prompt and keep approval runtime tokens local-only so stale prompts cannot offer misleading controls. (#86270, #86359)</li>
+<li>Plugin SDK: add reaction approval helpers and keep diagnostic event root exports discoverable across function-name and alias-bound module graphs. (#86735, #87084)</li>
+<li>Android/iOS: add the Android pair-new-gateway action and improve mobile Talk mode surfaces, including iOS realtime Talk mode and Android offline voice/gateway recovery. (#86798, #86355) Thanks @ngutman.</li>
+<li>Performance: cache plugin metadata snapshots, package realpaths, stable gateway metadata, model cost indexes, channel resolution, usage-cost indexes, and session/auth hot-path facts so common Gateway and reply paths do less rediscovery. (#84649, #85843, #86517, #86678)</li>
+<li>Voice: expose shared realtime turn-context tracking through the realtime voice SDK and reuse it for Discord speaker attribution and wake-name context recovery.</li>
+<li>Voice: reuse shared realtime output activity tracking in Google Meet command and node audio bridges, including recent-output checks for local barge-in detection.</li>
+<li>Voice: expose shared realtime output activity tracking through the realtime voice SDK and reuse it for Discord playback activity and barge-in decisions.</li>
+<li>Voice: expose shared realtime consult question matching, speakable-result extraction, and alias-aware forced-consult coordination through the realtime voice SDK, then reuse it in Gateway Talk, Voice Call, and Discord voice paths.</li>
+<li>Voice: share activation-name matching and consult-transcript screening through the realtime voice SDK so Discord, browser voice, and meeting surfaces can reuse one implementation.</li>
+<li>Cron: default <code>cron.maxConcurrentRuns</code> to 8 so scheduled automations and their isolated agent turns can make progress in parallel without explicit configuration.</li>
+<li>QA-Lab: add <code>qa coverage --match <query></code> so focused proof selection can discover matching scenarios from existing metadata before running live or remote lanes.</li>
+<li>Discord/model picker: surface an alpha-bucket select (e.g. <code>A–G (12) · H–N (18) · O–Z (5)</code>) when the provider list or a provider's model list exceeds 25 items, so configs with <code>provider/*</code> wildcards stay one click from the right page instead of paginating through prev/next; falls back to numeric chunks when every item shares the same first letter.</li>
+<li>Control UI: add an ephemeral Activity tab for sanitized live tool activity summaries without persisting raw telemetry. Fixes #12831. Thanks @BunsDev.</li>
+<li>Build: include <code>ui:build</code> in the <code>full</code> and <code>ciArtifacts</code> profiles of <code>scripts/build-all.mjs</code> so <code>pnpm build</code> always rebuilds <code>dist/control-ui</code> after <code>tsdown</code> cleans <code>dist</code>, removing the second-command requirement and the missing-asset failure mode for source/runtime installs and CI artifact uploads. (#85206)</li>
+<li>iOS: improve Talk mode with direct realtime voice sessions, compact toolbar status, and responsive voice waveform feedback. (#86355) Thanks @ngutman.</li>
+<li>Media: replace the Sharp image backend with Rastermill for metadata, resizing, EXIF orientation, and PNG alpha-preserving optimization so OpenClaw no longer installs Sharp or the WhatsApp Jimp fallback for image processing. (#86437)</li>
+<li>Codex: update the bundled Codex CLI to 0.134.0 and keep native compaction disabled for budget-triggered app-server turns so OpenClaw owns the recovery boundary. (#86772)</li>
+</ul>
+<h3>Fixes</h3>
+<ul>
+<li>Memory/security: reject prompt-like text submitted through the explicit <code>memory_store</code> tool before embedding or storage, matching the existing auto-capture prompt-injection filter. (#87142)</li>
+<li>Gateway/security: enable the default auth rate limiter for remote non-browser and HTTP gateway auth failures when <code>gateway.auth.rateLimit</code> is unset, while preserving the loopback exemption. (#87148)</li>
+<li>Security/content boundaries: validate Browser snapshot tab URLs against SSRF policy before ChromeMCP or direct CDP reads, sanitize queued system-event text so untrusted plugin/channel labels cannot spoof nested prompt markers, wrap fetched file text and metadata as external content, apply ClickClack <code>allowFrom</code> sender allowlists before agent dispatch, reject RPCs from invalidated device-token clients during rotation, require staged sandbox media refs, and scrub serialized tool-call text from replies. (#78526, #87094, #87062, #83741, #70707, #86924) Thanks @zsxsoft, @ttzero25, and @mmaps.</li>
+<li>Transcripts/user turns: persist CLI, WebChat, media, follow-up, hook, and Codex-mirror user turns to the admitted session target; keep cleaned transcript text, inline image routing, provenance metadata, replay hooks, and fallback paths idempotent when runtimes fail or restart.</li>
+<li>TUI/status/onboarding/UI: queue busy TUI prompts instead of dropping them, preserve the configured default model during onboarding, show failed tool results as errors, show config-open failures in Control UI, keep status JSON plugin scans healthy, preserve xAI usage-limit errors locally, and expose explicit fast-mode/systemd state. (#86722, #87000, #85786, #87108, #87001, #86614, #87115, #86976)</li>
+<li>Plugin commands/SDK: preserve plugin LLM command auth, bind native plugin command dispatch to the host agent's LLM auth, keep <code>onDiagnosticEvent</code> exports discoverable through <code>Function.name</code>, stabilize diagnostic event root aliases, correlate pathless read diagnostics, suppress transient runner failures in channel command paths, and repair local approval resolution. (#85936, #87084, #86977, #87069, #86771)</li>
+<li>Codex/providers: keep WebChat delivery hints out of user prompts, avoid false queued-terminal idle timeouts, share the native hook relay registry, quarantine unsupported dynamic tool schemas, preserve Claude resumed-session system prompts, normalize greedy Ollama <code>top_p</code>, preserve per-agent thinking defaults for ingress runs, and avoid native compaction takeover on budget-triggered Codex turns. (#87096, #73950, #87049, #86689, #86772)</li>
+<li>Gateway/perf/release: reuse startup-warning metadata and prepared auth stores, avoid cloning live-switch and lifecycle session caches on read paths, defer warning and scheduled-service fallback imports, trim Gateway session/startup/runtime CPU churn, skip duplicate turn session touches, stop chat timeout fallback cascades, drop stale subagent announce history, bound benchmark/watch/kitchen-sink teardown waits, bound macOS/package/onboarding/plugin smoke commands, bound install finalization probes, resolve Parallels npm-update commands from guest <code>PATH</code>, and bootstrap raw AWS macOS Node/pnpm commands through <code>/usr/bin/env</code>. (#86997)</li>
+<li>Reply/perf: reduce visible reply delivery latency by preserving Telegram typing/progress context, lazy-loading slash-command startup metadata, avoiding hot-path model hydration, flag-gating Codex profiler timing, deferring context compaction maintenance, and tracking delivery timing. (#86989, #86990, #86991, #86992, #86993, #86994) Thanks @keshavbotagent.</li>
+<li>Reply/source delivery: keep TUI, Control UI, media, TTS, transcript, and Codex source-reply finals live without duplicate terminal events or stale replay artifacts.</li>
+<li>Agents/replay: repair legacy tool results before replay, preserve <code>sessions_spawn</code> transcript payloads, restore current guard checks, stage sandboxed workspace media, and keep duplicate transcripts tool display metadata from reappearing. (#82203, #86934, #87025) Thanks @martingarramon, @vincentkoc, and @joshavant.</li>
+<li>Agents/sessions: handle active-fallback failures in <code>sessions_send</code> so fallback routing reports the real failure and does not leave callers with an ambiguous dropped send. (#86638)</li>
+<li>Agents/hooks/subagents: enforce default hook agent allowlists, recover failed subagent lifecycle completions, and keep node task lifecycle cleanup from closing the Gateway listener. (#86101)</li>
+<li>Codex: project newer OpenClaw chat history into resumed app-server threads and keep Codex turn timeouts inside the Codex runtime boundary so timeouts do not poison shared app-server clients or fall through to unrelated provider fallback. (#86677, #86476) Thanks @TurboTheTurtle and @pashpashpash.</li>
+<li>Config/doctor/update: narrow profiled tool-section doctor repair, keep runtime-injected legacy web-search provider config out of user-authored config validation, and keep prerelease tags excluded from stable updater resolution. (#87030, #86818, #86559) Thanks @joshavant, @luoyanglang, and @stevenepalmer.</li>
+<li>CLI/Windows: add a Windows-only stack-size respawn for stack-heavy startup paths, default CLI logs to local timestamps, and validate timeout/banner TTY state more strictly. (#87031, #85387) Thanks @giodl73-repo and @vincentkoc.</li>
+<li>Locking/security: require owner identity proof before stale plugin lock removal, memoize session lock owner arguments, and avoid writing default exec approval stores unless policy state actually changed. (#86814, #86964) Thanks @Alix-007 and @vincentkoc.</li>
+<li>Install/release: bound Docker package build, inventory, pack, and tarball preparation with process-group timeouts; pin shrinkwrap patch drift to the pnpm lock; harden macOS restart and dSYM packaging; and run release Docker/live timeout wrappers in the foreground so child processes cannot wedge gates.</li>
+<li>Telegram/network: treat <code>ENETDOWN</code> as a transient pre-connect network failure so Telegram sends, gateway unhandled-rejection handling, and cron network retries follow the same recovery path as sibling network outages. (#86762) Thanks @TurboTheTurtle.</li>
+<li>Telegram: preserve inbound text entities, overlapping DM replies, account topic cache sidecars, outbound reply context, targeted bot-command mentions, durable group retry targets, forum topic names, and native progress callbacks. (#83873, #85361, #85555, #85656, #85709, #86299, #86553) Thanks @SebTardif, @luoyanglang, and @neeravmakwana.</li>
+<li>iMessage: read image attachments from local Messages attachment roots, dedupe duplicate local Messages-source accounts, seed direct DM history, fix image/group media attachment commands, advance catchup cursors after live handling, and keep slash-command acknowledgements in the source conversation. (#82642, #85475, #86569, #86705, #86706, #86770) Thanks @homer-byte, @TurboTheTurtle, @swang430, and @OmarShahine.</li>
+<li>WhatsApp/QQ/Twitch/IRC/Slack: restore WhatsApp ack identity and group-drop warnings, make QQ Bot media respect <code>OPENCLAW_HOME</code>, serialize Twitch auth disconnects, store IRC channel routes canonically, and keep Slack downloaded files out of reply media. (#83833, #85309, #85777, #85794, #85906, #86318, #86697) Thanks @sliverp, @neeravmakwana, and @Kailigithub.</li>
+<li>Discord/voice: improve voice playback and wake replies, bucket large model picker menus, merge media captions into one message, route metadata through configured proxies, restore numeric channel sends, suppress self-reply echoes, and tighten wake matching without breaking fuzzy wake phrases. (#80227, #86238, #86487, #86571, #86595, #86601)</li>
+<li>Codex: preserve native web-search metadata, keep oversized native thread reuse, bridge CLI API-key auth into the app server, preserve sandbox bootstrap path style, recover context-window prompt errors, honor yolo approval policy, disable native thread personality, and route compaction through Codex auth. (#85378, #85542, #85891, #85909, #86408)</li>
+<li>Agents/runtime: enforce session lock max-hold reclaim, release embedded-attempt locks on all exits, treat aborted subagent runs as terminal, avoid runtime model hydration on hot paths, disclose scoped session list counts, derive overflow budgets from provider errors, and keep fallback errors scoped to the active model candidate. (#70473, #85764, #86014, #86134, #86427, #86944) Thanks @openperf, @fuller-stack-dev, @zhangguiping-xydt, and @ferminquant.</li>
+<li>Config/update/doctor: retry config recovery after failed backup restore, skip shell env fallback on Windows, exclude prerelease tags from the stable git channel, support deep config edits, warn instead of aborting on unreadable cron stores, prune stale bundled plugin paths, and avoid duplicate restart prompts when the Gateway is already healthy. (#85739, #85787, #86060, #86260, #86384, #86533) Thanks @liaoyl830.</li>
+<li>Install/release: support Alpine CLI installs and runtime floors, prefer trusted startup argv runtime fallback roots, reject stale CLI node runtimes, avoid npm <code>min-release-age</code> installer failures, bound npm/package/Docker install phases, restore config parent ownership in Docker, seed Docker lockfile package tarballs before prune, make release/plugin prerelease checks fail closed instead of hanging or false-greening, and use host-visible Crabbox local work roots for Docker-backed proof. (#85491)</li>
+<li>Windows daemon: keep Scheduled Task gateway launches running on battery power and avoid workgroup-machine prompts for a domain user during task installation. (#59299)</li>
+<li>Security: avoid printing Gateway tokens in Docker, validate plugin model-pattern regexes safely, escape transcript metadata field names, harden session allowlist glob matching, audit Claude permission overrides under YOLO, and require explicit allow for ACP auto approvals. (#85849, #85934, #86046, #86557)</li>
+<li>Media/images: replace Sharp with Rastermill, keep EXIF normalization best-effort, normalize HEIC/HEIF before image descriptions, route Codex image API keys through OpenAI, preserve image compression metadata, and auto-scale live tool result caps. (#85776, #86037, #86437, #86857, #86923)</li>
+<li>Memory: prevent semantic vector indexes from silently degrading when embeddings are unavailable, stop doctor OOMs on large session stores, preserve sidecar hooks/artifacts, write fallback dream diaries, use CJK-aware dreaming dedupe, and avoid per-file watcher FD fan-out. (#80613, #82928, #85060, #85704, #85967, #86701) Thanks @brokemac79, @openperf, and @yaaboo-gif.</li>
+<li>Agents/sessions: include visibility metadata on restricted <code>sessions_list</code> results so scoped counts are clearly reported without widening access or exposing hidden-session counts. (#86944) Thanks @ferminquant.</li>
+<li>Gateway/DNS: validate wide-area discovery domains before deriving zone paths or writing zone files, so invalid <code>discovery.wideArea.domain</code> and <code>dns setup --domain</code> values fail with a DNS-name diagnostic instead of falling through to unrelated configuration errors. Thanks @mmaps.</li>
+<li>Agents/BTW: route fallback side-question streams through the embedded stream resolver so Anthropic-compatible MiniMax requests use the same capped transport as normal chat. (#86312) Thanks @neeravmakwana.</li>
+<li>Telegram: treat <code>/command@TargetBot</code> bot-command entities as explicit mentions for the addressed bot so <code>requireMention</code> groups no longer drop targeted commands or captions. Fixes #84462. (#86553) Thanks @luoyanglang.</li>
+<li>CI: bound Docker/Bash E2E tarball npm installs with <code>OPENCLAW_E2E_NPM_INSTALL_TIMEOUT</code> so package, onboarding, plugin, and upgrade lanes fail instead of hanging on a stuck npm install.</li>
+<li>CI: fail Parallels npm-update smoke jobs after the guest command timeout and cleanup backstop instead of only logging a timeout line.</li>
+<li>CI: bound kitchen-sink RPC HTTP probes so stalled gateway readiness or response bodies fail and retry instead of wedging the walker.</li>
+<li>CI: keep <code>OPENCLAW_TESTBOX=1 pnpm check:changed</code> delegating to Blacksmith Testbox through Crabbox without forwarding local Testbox or worker env into the remote command.</li>
+<li>CI: send KILL after the TERM grace period for manual checkout fetch timeouts so stuck Testbox and workflow checkout retries cannot hang behind a wedged <code>git fetch</code>.</li>
+<li>CI: send KILL after the TERM grace period for Bun global install smoke command timeouts so trapped <code>openclaw</code> child processes cannot wedge the scheduled install smoke.</li>
+<li>iMessage: thread current channel/account inbound attachment roots into the image tool so iMessage-saved attachments under <code>~/Library/Messages/Attachments</code> (including the wildcard <code>/Users/*/Library/Messages/Attachments</code> root) are read through the existing inbound path policy instead of being rejected as <code>path-not-allowed</code>. Literal <code>localRoots</code> stays workspace-scoped. Fixes #30170. (#86569)</li>
+<li>QQ Bot: respect <code>OPENCLAW_HOME</code> for outbound media path resolution so <code><qqmedia></code> sends no longer silently fail when <code>HOME</code> and <code>OPENCLAW_HOME</code> differ (Docker / multi-user hosts). Persisted QQ Bot data (sessions, known users, refs) stays anchored on the OS home for upgrade compatibility. Fixes #83562. Thanks @sliverp.</li>
+<li>Update: report the primary malformed <code>openclaw.extensions</code> payload error without adding a duplicate missing-main diagnostic. (#86596) Thanks @ferminquant.</li>
+<li>Control UI: keep host-local Markdown file paths inert while preserving app-relative links. (#86620) Thanks @BryanTegomoh.</li>
+<li>Gateway: dampen repeated unauthenticated device-required probes per URL while preserving explicit-auth and paired recovery paths. (#86575) Thanks @ferminquant.</li>
+<li>IRC: store inbound channel routes with the canonical <code>channel:#name</code> target and join transient channel sends before writing. (#85906) Thanks @Kailigithub.</li>
+<li>Usage: surface unknown all-zero model pricing as missing cost entries instead of a confident <code>$0</code> total. (#85882) Thanks @MichaelZelbel.</li>
+<li>Agents/Codex: honor yolo app-server approval policy only for the full <code>never</code> plus <code>danger-full-access</code> case. (#85909) Thanks @earlvanze.</li>
+<li>Gateway/Gmail: clear Gmail watcher renewal intervals on re-entry so hot reloads do not leak lifecycle timers. (#82947) Thanks @SebTardif.</li>
+<li>Logging: exit cleanly on broken stdout/stderr pipes without masking existing failure exit codes. (#80059) Thanks @pavelzak.</li>
+<li>Gateway/security: escape transcript metadata field names while extracting oversized session line prefixes. (#85934) Thanks @SebTardif.</li>
+<li>Plugins/security: validate manifest model pattern regexes with the safe-regex compiler so unsafe patterns are ignored before matching. (#86046) Thanks @SebTardif.</li>
+<li>Discord: route gateway metadata REST lookups through the configured Discord proxy so proxied accounts do not fall back to direct <code>discord.com</code> connections before opening the WebSocket. Fixes #80227. Thanks @Clivilwalker.</li>
+<li>Agents/media: hydrate current-turn image attachments from filename-derived MIME types so active vision can see generated or forwarded images whose source omitted an image content type. (#84812) Thanks @marchpure.</li>
+<li>Agents/fs: point workspace-only scratch-path guidance at in-workspace temp directories while keeping host-root writes rejected by the tool guard. (#86501) Thanks @tianxiaochannel-oss88.</li>
+<li>Agents/media: keep async cron media completions scoped to their run session while preserving direct delivery for stale generated-media success and failure notifications. (#86529) Thanks @ai-hpc.</li>
+<li>Gateway: emit plugin <code>session_end</code>/<code>session_start</code> hooks when <code>agent.send</code> rotates or replaces a session id, keeping hook lifecycle state aligned with <code>sessions.changed</code> notifications. Fixes #83507. (#85875) Thanks @brokemac79.</li>
+<li>OpenShell/SSH: reject malformed generated exec commands before sandbox/session setup so unresolved workflow placeholders fail fast instead of reaching the remote shell. Fixes #72373. Thanks @brokemac79.</li>
+<li>Google: stop normalizing <code>gemini-3.1-flash-lite</code> to the retired preview endpoint and update Flash Lite alias guidance to the GA model id. Fixes #86151. (#86240) Thanks @SebTardif.</li>
+<li>Installer: make Alpine apk installs cover Git, verify the Node runtime floor, try <code>nodejs-current</code>, and report Alpine version guidance when repositories only provide older Node packages.</li>
+<li>Agents/status: prefer the active Claude CLI OAuth auth label over an unused Anthropic env API-key label for equivalent runtime aliases. Fixes #80184. (#86570) Thanks @brokemac79.</li>
+<li>Agents/media: send direct fallback for generated media still missing after an active requester wake fails. (#85489) Thanks @fuller-stack-dev.</li>
+<li>Agents: derive overflow compaction budgets from provider-reported and synthetic over-budget token counts so confirmed context overflows compact before retrying. (#70473) Thanks @fuller-stack-dev.</li>
+<li>Agents/Codex: recover Codex context-window prompt errors through overflow compaction and surface reset guidance when recovery is exhausted. (#85542) Thanks @fuller-stack-dev.</li>
+<li>Agents/Codex: allow Codex app-server runs to bootstrap from <code>CODEX_API_KEY</code> or <code>OPENAI_API_KEY</code> when no Codex auth profile is configured.</li>
+<li>Agents/Codex: keep selected Codex runtime routing on OpenAI-Codex while preserving direct OpenAI API-key compaction fallback. (#86408) Thanks @funmerlin and @VACInc.</li>
+<li>Agent transcript: include OpenClaw agent session logs when finding local transcript candidates.</li>
+<li>Crabbox: bootstrap raw AWS macOS shell commands wrapped in absolute <code>time</code> paths so RSS probes can run Node and pnpm on fresh macOS runners.</li>
+<li>Crabbox: bootstrap raw AWS macOS shell commands even when setup statements precede Node or pnpm usage.</li>
+<li>TUI/local: skip unnecessary secret resolution, gateway model catalog loading, bootstrap, and skill scans in explicit local-model runs so startup reaches the model request faster.</li>
+<li>Sessions/doctor: load large session stores without clone amplification during read-only doctor checks and reclaim stale <code>sessions.json.*.tmp</code> sidecars. Fixes #56827. Thanks @openperf.</li>
+<li>Tests: clean successful plugin gateway gauntlet isolated temp roots while keeping an explicit preservation switch for failed/debug runs.</li>
+<li>Plugins/perf: reuse derived plugin metadata snapshots for the lifetime of the process so reply-time skill setup no longer rescans plugin metadata on every turn.</li>
+<li>Discord/OpenAI voice: keep wake-name master consults using the current speaker context after ignored ambient transcripts and shorten the default capture silence grace.</li>
+<li>Doctor: skip redundant Gateway restart prompts when a recent supervisor restart leaves the Gateway healthy. Fixes #86518. (#86533) Thanks @liaoyl830.</li>
+<li>Cron: restore suspended cron lanes to the configured/default concurrency instead of falling back to one after quota or circuit-breaker auto-resume.</li>
+<li>Gateway: keep session-only Control UI tool-start mirrors flowing during diagnostic queue pressure instead of silently dropping non-terminal tool updates.</li>
+<li>Agents/memory: return optional not-found context for missing date-only daily memory reads instead of logging benign first-run <code>ENOENT</code> failures. Fixes #82928. Thanks @galiniliev.</li>
+<li>Discord: merge streamed text captions into following media block replies so captions and attachments send as one message. (#86487) Thanks @neeravmakwana.</li>
+<li>Gateway: avoid sending duplicate tool-event frames to Control UI connections that are subscribed by both run and session.</li>
+<li>Discord/OpenAI voice: accept broader edge-position fuzzy wake-name transcripts while keeping ambient speech gated.</li>
+<li>Discord/OpenAI voice: accept longer leading wake-name mistranscripts such as "Open Club" for OpenClaw.</li>
+<li>Agents/OpenAI-compatible: stop ModelStudio-compatible chat requests before sending system/tool-only payloads that have no usable user or assistant turn. (#86177) Thanks @TurboTheTurtle.</li>
+<li>Gateway/plugins: reuse plugin package realpath checks while building installed plugin indexes so startup avoids repeated filesystem resolution work.</li>
+<li>Kilo Gateway: send string <code>stop</code> sequences as arrays so Kilo accepts OpenAI-compatible chat completions. (#86461) Thanks @SebTardif.</li>
+<li>Discord/OpenAI voice: accept leading fuzzy wake-name transcripts such as "Monty" or "Moti" for a Molty agent while keeping ambient speech gated.</li>
+<li>Media understanding: convert HEIC and HEIF images to JPEG before image description providers run so iPhone photos work in direct and configured image-description flows. (#86037)</li>
+<li>Agents: release embedded-attempt session locks from outer teardown so post-prompt exceptions cannot wedge later requests behind <code>SessionWriteLockTimeoutError</code>. Fixes #86014. Thanks @openperf.</li>
+<li>Discord/OpenAI voice: rotate Realtime sessions at provider max duration without logging the expected session-expiry event as an error.</li>
+<li>Sessions: skip metadata-only entries during QMD-slugified session lookup so one incomplete row does not block transcript hit resolution. (#86327) Thanks @abnershang.</li>
+<li>Agents/media: derive bundled plugin local-media trust from plugin tool metadata instead of importing the full plugin registry on subscription paths. (#84409) Thanks @samzong.</li>
+<li>Image tool: keep config-backed custom-provider API keys usable for auto-discovered vision models, including deferred image-tool execution without env keys or auth profiles. (#85733)</li>
+<li>Memory/local embeddings: run local GGUF embeddings in an isolated worker sidecar and degrade to configured fallback or keyword search on worker failure so native embedding crashes do not take down the Gateway. (#85348) Thanks @osolmaz.</li>
+<li>Gateway: clear the runtime config snapshot before <code>SIGUSR1</code> in-process restarts so config changes survive the next gateway loop. (#86388) Thanks @XuZehan-iCenter.</li>
+<li>Models: show OAuth delegation markers as configured <code>models.json</code> auth while keeping runtime route usability checks strict. (#86378) Thanks @rohitjavvadi.</li>
+<li>Cron: seed active scheduled and manual cron task rows with a progress summary so status surfaces do not look blank while jobs run. (#86313) Thanks @ferminquant.</li>
+<li>Cron: preserve unsupported persisted cron payload rows during routine store writes while keeping those rows non-runnable. Fixes #84922. (#86415) Thanks @IWhatsskill.</li>
+<li>Updater: exclude prerelease git tags from stable channel resolution so source updates do not check out newer alpha/rc/preview/canary tags. (#86260) Thanks @stevenepalmer.</li>
+<li>Security/Audit: flag webhook <code>hooks.token</code> reuse of active Gateway password auth in <code>openclaw security audit</code> while keeping password-mode startup compatibility. (#84338) Thanks @coygeek.</li>
+<li>QQBot: derive the outbound reply watchdog from configured agent and provider timeouts so slow local model replies are not cut off at five minutes. Fixes #85267. (#85271) Thanks @SymbolStar.</li>
+<li>Agents/heartbeat: stop heartbeat turns after the first valid <code>heartbeat_respond</code> so repeated response loops do not burn tokens. (#86357) Thanks @udaymanish6.</li>
+<li>Tasks: keep retained lost tasks out of default status health counts, explain their cleanup window during maintenance, and prune lost task records after 24 hours instead of the general 7-day terminal retention.</li>
+<li>Memory-core: keep REM dreaming focused on live light-staged memories and mark staged entries as considered so old recall history no longer dominates fresh candidates. (#86302) Thanks @SebTardif.</li>
+<li>Memory: abort sync instead of downgrading an existing semantic vector index to FTS-only when the configured embedding provider is temporarily unavailable. (#85704) Thanks @yaaboo-gif.</li>
+<li>Telegram: propagate forum topic names through the account-scoped topic cache for native command context and topic create/edit actions. (#86299) Thanks @SebTardif.</li>
+<li>Slack: keep downloaded read-only files out of reply media so Slack file reads do not echo files back to the conversation. (#86318) Thanks @neeravmakwana.</li>
+<li>Cron: accept leading-plus relative durations such as <code>+5m</code> for one-shot <code>--at</code> schedules. (#86341) Thanks @mushuiyu886.</li>
+<li>Agents/media: preserve async-started media tool metadata so background generation starts no longer surface generic incomplete-turn warnings while replay stays unsafe. (#85933) Thanks @fuller-stack-dev.</li>
+<li>Docker E2E: dedupe scheduler lane resources so npm/service package lanes are not over-counted and serialized unnecessarily.</li>
+<li>QA/diagnostics: add a collector-backed OpenTelemetry smoke lane, make the OTLP payload leak check scenario-aware, and keep source QA builds from failing on optional dependency imports resolved through pnpm's temp module path.</li>
+<li>Crabbox: bootstrap Git metadata for sparse remote changed gates so raw synced workspaces can run <code>pnpm check:changed</code> from the intended diff.</li>
+<li>xAI/LM Studio: avoid buffering ordinary bracketed or <code>final</code> prose until stream completion while watching for plain-text tool-call fallbacks.</li>
+<li>Doctor: warn and continue when the cron job store exists but cannot be read so later health checks still run. Fixes #86102. (#86384) Thanks @1052326311.</li>
+<li>Discord: suppress a bot's previous reply body and referenced media from prompt context when a user replies to that bot message, while keeping reply metadata for routing. (#86238) Thanks @fuller-stack-dev.</li>
+<li>Discord: restore bare numeric channel IDs for outbound message-tool sends while keeping explicit DM targets unambiguous. (#86571) Thanks @joshavant.</li>
+<li>Docker E2E: avoid rebuilding the Control UI twice while preparing the shared OpenClaw package tarball for package-backed scenario runs.</li>
+<li>Tests: avoid rebuilding the Control UI twice during the installer Docker smoke now that <code>pnpm build</code> includes <code>ui:build</code>.</li>
+<li>Tests: give QA config mutation RPCs enough native Windows budget to finish gateway config writes and restart settle after hot scenario runs.</li>
+<li>Tests: keep the gateway restart-inflight QA scenario focused on restart recovery on native Windows by allowing expected embedded prompt handoff errors and using the Windows-safe timeout budget.</li>
+<li>QA-Lab: make the synthetic OpenAI provider honor generic <code>reply exactly:</code> directives after required kickoff reads so restart-recovery scenarios do not fall through to generic repo-summary prose.</li>
+<li>Gateway: abort active <code>agent</code> RPC runs during forced restart shutdown so stale in-process turns cannot keep writing a session after the Gateway lifecycle restarts.</li>
+<li>Crabbox: sync clean sparse worktrees through a temporary full checkout even when reusing an existing lease so tracked build-time files are not omitted.</li>
+<li>Build: route <code>scripts/ui.js</code> through the shared pnpm runner and keep Control UI chunking helpers in sparse-included source so native Windows Corepack builds can produce <code>dist/control-ui</code>.</li>
+<li>Tests: give the memory fallback QA scenario enough turn budget to exercise native Windows gateway runs instead of failing on the client timeout while the mock agent is still dispatching.</li>
+<li>Tests: collect QA gateway CPU/RSS metrics on native Windows and give the channel baseline enough turn budget to report slow gateway runs instead of timing out before proof.</li>
+<li>Install/update: bypass npm <code>min-release-age</code> policies with <code>--min-release-age=0</code> instead of <code>--before</code> so hosted installers keep working on npm versions that reject the combined config. (#84749) Thanks @TeodoroRodrigo.</li>
+<li>Diagnostics: reclaim wedged session lanes when stale active-run bookkeeping blocks queued work despite no forward progress. Fixes #85639. Thanks @openperf.</li>
+<li>WebChat: keep message-tool replies visible in the chat while still summarizing internal tool results for the model. Fixes #86347. Thanks @shakkernerd.</li>
+<li>Gateway/perf: fail startup benchmark samples when the Gateway process exits before benchmark teardown, including signal deaths after readiness probes.</li>
+<li>Gateway/perf: fail restart benchmark samples when the Gateway exits before benchmark teardown, including clean exits and signal deaths after successful restart probes.</li>
+<li>Agents/tests: keep model catalog visibility on static selection helpers so catalog visibility checks avoid the broad model-selection barrel import.</li>
+<li>Agents/commitments: serialize commitment store load-modify-save writes so concurrent heartbeat and CLI updates no longer lose dismissal, sent, or attempt state. (#81153) Thanks @ai-hpc.</li>
+<li>xAI/LM Studio: promote plain-text tool-call fallbacks into structured tool calls and strip leaked internal tool syntax before user-facing delivery. (#86222) Thanks @fuller-stack-dev.</li>
+<li>CLI: suppress benign self-update version-skew warnings during package post-update finalization.</li>
+<li>Gateway/perf: tighten restart and startup benchmark failure handling so long profiling runs, failed probes, and fresh Linux runners no longer produce false passing or <code>n/a</code> results.</li>
+<li>Checks: keep intentional Knip unused-file findings optional so full CI and sparse proof workspaces stay aligned.</li>
+<li>Docker: restore writable <code>~/.config</code> in runtime images. Fixes #85968. Thanks @hkoessler and @Bartok9.</li>
+<li>Plugin SDK: keep legacy root diagnostic subscriptions connected when built plugin SDK aliases resolve diagnostic helpers through a separate module graph.</li>
+<li>Diagnostics: export alertable OTel and Prometheus signals for blocked tools, model failover, stale sessions, liveness warnings, oversized payloads, and webhook ingress while fixing shared OTLP endpoints with query strings.</li>
+<li>Tests: normalize macOS canonical temp paths in exec allowlists, fs-safe trash assertions, installed plugin matching, Telegram topic-name stores, and built ACPX MCP server expectations so native macOS proof runners cover the intended behavior.</li>
+<li>Codex/app-server: preserve message-tool-only source reply delivery mode on active runs so sub-agent completion wakeups can steer the active Codex turn instead of being rejected. (#86287) Thanks @ferminquant.</li>
+<li>Tests: sample the Windows kitchen-sink RPC gateway directly and serialize RSS probes so native runs keep the memory guard active.</li>
+<li>Tests: normalize bundled plugin lifecycle probe paths and state-root lookup so native Windows release sweeps accept valid packaged plugin installs.</li>
+<li>Agents/Claude CLI: route live native Bash permission requests through OpenClaw exec policy so Claude turns no longer stall on <code>control_request</code>, and document that OpenClaw exec policy is authoritative. Fixes #80819. (#86330, from #81971) Thanks @guthirry and @sallyom.</li>
+<li>Security audit: warn when YOLO OpenClaw exec policy overrides a restrictive raw Claude <code>--permission-mode</code> for managed live sessions. (#86557) Thanks @sallyom.</li>
+<li>Config: keep benign legacy metadata write anomalies out of default doctor and config command output while preserving explicit anomaly logging for diagnostics.</li>
+<li>Codex: log when implicit app-server <code>never</code> approvals are promoted for OpenClaw tool policy, including whether the trigger was a <code>before_tool_call</code> hook or trusted tool policy.</li>
+<li>Codex harness: make subscription usage-limit errors without reset times explain that OpenClaw cannot determine the reset and point users to wait until Codex is available, use another Codex account, or switch to another configured model/provider. Thanks @amknight.</li>
+<li>Google Vertex: support production ADC modes such as Workload Identity Federation, service-account credentials, and metadata-server ADC for the native Vertex transport. (#83971) Thanks @damianFelixPago.</li>
+<li>Telegram: route normal <code>[telegram][diag]</code> polling diagnostics through <code>runtime.log</code> while keeping non-diag warnings and persistence failures on <code>runtime.error</code>, so healthy polling startup no longer looks like an error. Fixes #82957. (#82958) Thanks @galiniliev.</li>
+<li>Providers/Ollama: strip inline Kimi cloud reasoning prefixes from streamed and final visible replies while keeping ordinary Kimi answers append-only. (#86286) Thanks @jason-allen-oneal.</li>
+</ul>
+<ul>
+<li>Gateway: require Talk secret authority before setup-code handoff can include Talk secrets. (#85690) Thanks @ngutman.</li>
+<li>Agents: keep fallback error reporting scoped to the active model candidate so stale prior-provider quota/auth text is not reported for later fallback attempts. (#86134) Thanks @zhangguiping-xydt.</li>
+<li>iMessage: dedupe watcher startup when <code>channels.imessage.accounts</code> lists both <code>default</code> and a named account that point at the same local Messages source, so the gateway no longer spawns two <code>imsg rpc</code> processes or doubles inbound replies; the dedupe is scoped to watcher startup, leaving duplicate accounts addressable for outbound sends, status, and capability listings, and <code>openclaw doctor</code> flags the redundant account with a rebinding hint. Fixes #65141. (#86705) Thanks @swang430.</li>
+</ul>
+<p><a href="https://github.com/openclaw/openclaw/blob/main/CHANGELOG.md">View full changelog</a></p>
+]]></description>
+            <enclosure url="https://github.com/openclaw/openclaw/releases/download/v2026.5.26/OpenClaw-2026.5.26.zip" length="54484748" type="application/octet-stream" sparkle:edSignature="y4WXG7JT8ktJ+K7YDgllY7u5Z9BSKR/SwGiwEh0gikOJ/SWqwcQd+z2tWa2zgwvCJKWsAUFwJs1ATor880SUBg=="/>
+        </item>
         <item>
             <title>2026.5.22</title>
             <pubDate>Sun, 24 May 2026 01:41:27 +0000</pubDate>
@@ -281,397 +537,5 @@
 ]]></description>
             <enclosure url="https://github.com/openclaw/openclaw/releases/download/v2026.5.22/OpenClaw-2026.5.22.zip" length="54409357" type="application/octet-stream" sparkle:edSignature="am1mwLOmUHor9QuQWtxSsKoBOCySUBo4fB+0Qdcrz0E3wf6ESIMTfOC0k+dKJSh9gtLZw5jzpWVqTBzEdU36Aw=="/>
         </item>
-        <item>
-            <title>2026.5.20</title>
-            <pubDate>Thu, 21 May 2026 21:19:52 +0000</pubDate>
-            <link>https://raw.githubusercontent.com/openclaw/openclaw/main/appcast.xml</link>
-            <sparkle:version>2026052090</sparkle:version>
-            <sparkle:shortVersionString>2026.5.20</sparkle:shortVersionString>
-            <sparkle:minimumSystemVersion>15.0</sparkle:minimumSystemVersion>
-            <description><![CDATA[<h2>OpenClaw 2026.5.20</h2>
-<h3>Changes</h3>
-<ul>
-<li>Exec approvals: remove the old <code>cat SKILL.md && printf ... && <skill-wrapper></code> allowlist compatibility path so skill files must be loaded with the read tool and only the real skill executable is auto-allowed.</li>
-<li>Discord: let voice sessions follow configured Discord users into voice channels, with allowed-channel checks, multi-user handoff, bounded reconciliation, and DAVE recovery preservation. (#84264) Thanks @fuller-stack-dev.</li>
-<li>Discord/voice: include bounded <code>IDENTITY.md</code>, <code>USER.md</code>, and <code>SOUL.md</code> profile context in realtime voice session instructions by default, with <code>voice.realtime.bootstrapContextFiles: []</code> available to disable it. (#84499) Thanks @fuller-stack-dev.</li>
-<li>Dependencies: bump the bundled Codex harness to <code>@openai/codex</code> <code>0.132.0</code> and refresh the app-server model-list docs for the new catalog.</li>
-<li>CLI/policy: add the bundled Policy plugin for policy-backed channel conformance checks, doctor lint findings, and opt-in workspace repair. (#80407) Thanks @giodl73-repo.</li>
-<li>Agents/config: allow <code>agents.list[].experimental.localModelLean</code> so lean local-model mode can be enabled for one configured agent instead of globally.</li>
-<li>Providers/xAI: add device-code OAuth login so remote and headless setups can authorize xAI without a localhost browser callback. (#84005) Thanks @fuller-stack-dev.</li>
-<li>Providers/OpenRouter: honor provider-level <code>params.provider</code> routing policy for OpenRouter requests, with model and agent params overriding the defaults. Thanks @amknight.</li>
-</ul>
-<h3>Fixes</h3>
-<ul>
-<li>CLI/tasks: include stale-running task maintenance decisions in <code>openclaw tasks maintenance --json</code> so retained and reconcile candidates explain backing-session, cron, CLI, and wedged-subagent state. (#84691) Thanks @efpiva.</li>
-<li>Codex app-server: keep system-prompt reports working when bootstrap hooks provide workspace files with only a path and content, so hook-supplied SOUL/IDENTITY/TOOLS/USER context still reports injected characters correctly. (#84736) Thanks @JARVIS-Glasses.</li>
-<li>Providers/MiniMax music: stop advertising <code>durationSeconds</code> control and remove prompt-injected duration hints, so <code>music_generate</code> reports MiniMax duration as an unsupported override instead of suggesting MiniMax can enforce track length. Fixes #84508. Thanks @neeravmakwana.</li>
-<li>Doctor: warn when sandbox tool policy hides configured MCP server tools before provider requests. (#84699) Thanks @nxmxbbd.</li>
-<li>WhatsApp: update Baileys to <code>7.0.0-rc12</code>.</li>
-<li>Build: suppress per-locale <code>rolldown-plugin-dts:fake-js</code> CommonJS dts warnings emitted while bundling the intentionally-inlined <code>zod/v4/locales/*.d.cts</code> files, so <code>pnpm build</code> output stays readable after the 0.25.1 plugin bump. Thanks @romneyda.</li>
-<li>CLI/nodes: route lazy plugin-registration logs to stderr for JSON-mode <code>openclaw nodes</code> commands so stdout stays parseable. (#84684) Thanks @TurboTheTurtle.</li>
-<li>Approvals: route manual <code>/approve</code> decisions through the trusted approval runtime so active exec and plugin approvals no longer look unknown or expired.</li>
-<li>Mac app: update the About settings copyright year to 2026. (#84385) Thanks @pejmanjohn.</li>
-<li>Dependencies: update <code>@openclaw/fs-safe</code> to <code>0.2.7</code> so OpenClaw's default Python-helper-off policy keeps best-effort Node write fallbacks for private stores, secret writes, run logs, and media attachments on Linux/macOS.</li>
-<li>Infra/secrets: restore the fail-closed contract for <code>tryReadSecretFileSync</code> so credential loaders that pass <code>rejectSymlink: true</code> (Telegram, LINE, Zalo, IRC, Nextcloud Talk tokens) refuse symlinked credential files instead of silently accepting them, and the infra-state CI shard's secret-file symlink test passes again. Thanks @romneyda.</li>
-<li>Browser: honor the configured image sanitization limit for screenshots and labeled snapshots so browser-captured images follow the same resize policy as other image results. (#84595)</li>
-<li>Doctor: remove unrecognized <code>models.providers.*.models[*].compat.thinkingFormat</code> values during <code>doctor --fix</code> so stale provider model config can validate after upgrade. Fixes #77803.</li>
-<li>Doctor: warn when <code>openclaw.json</code> stores plaintext secret-bearing config fields, including model provider API keys and sensitive provider headers. (#84718) Thanks @lukaIvanic.</li>
-<li>Status: show the configured default, session-selected model, reason, clear hint, and docs link when a session remains pinned to a model that differs from <code>agents.defaults.model.primary</code>.</li>
-<li>WebChat: clear stale typing indicators when session change events mark the active chat run complete.</li>
-<li>Mac app: keep local packaging signed with a stable app identity for permission testing and fix Control UI production builds under current Vite/Highlight.js exports.</li>
-<li>macOS app: update the embedded Peekaboo bridge to 3.2.1 so OpenClaw-hosted UI automation works with current Peekaboo CLI capture flows.</li>
-<li>Cron: deliver preferred final assistant output for successful scheduled runs when trailing plain tool warnings remain in diagnostics instead of marking the run failed.</li>
-<li>fix(mattermost): fail closed on missing channel type [AI]. (#84091) Thanks @pgondhi987.</li>
-<li>Recheck rebuilt system.run argv [AI]. (#84090) Thanks @pgondhi987.</li>
-<li>CLI: keep the private QA subcommand out of exported command descriptors unless <code>OPENCLAW_ENABLE_PRIVATE_QA_CLI=1</code>, so root help and subcommand markers match runtime registration. (#84519)</li>
-<li>CLI/cron: bound <code>openclaw cron show</code> job lookup pagination so non-advancing or unbounded <code>cron.list</code> responses fail instead of hanging the command. Fixes #83856. (#83989)</li>
-<li>Agents/messages: stop message-tool-only turns after a successful source-channel <code>message</code> send while keeping transcript mirrors under the session write lock. (#84289)</li>
-<li>Agents: filter silent heartbeat response-tool transcript artifacts out of embedded context snapshots so later user turns are not polluted by heartbeat no-op messages. (#83477) Thanks @fuller-stack-dev.</li>
-<li>Agents/OpenAI: log repeated strict tool-schema downgrade diagnostics once per provider/model/tool signature, reducing duplicate debug noise while preserving <code>strict=false</code> fallback behavior. Fixes #82930. (#82933) Thanks @galiniliev.</li>
-<li>Agents/code mode: spell out the <code>exec</code> tool's JavaScript/TypeScript, no Node module, and catalog-bridge constraints in model-visible schema text so agents can use enabled tools without trial-and-error. (#84269) Thanks @Kaspre.</li>
-<li>Codex: give <code>image_generate</code> dynamic-tool calls a 120s default watchdog when no per-call or configured image timeout is set, so image generation no longer falls back to the generic 30s bridge timeout. (#84254) Thanks @moritzmmayerhofer.</li>
-<li>Codex: avoid duplicate dynamic tool terminal diagnostics while large diagnostic backlogs drain without blocking tool responses. (#82937) Thanks @galiniliev.</li>
-<li>CLI/message: include a stable top-level <code>messageId</code> in <code>openclaw message --json</code> output when channel sends return one. (#84191) Thanks @100menotu001.</li>
-<li>Cron: preserve legacy top-level array <code>jobs.json</code> stores when loading or adding scheduled jobs so old cron jobs are no longer treated as an empty store during upgrade. Fixes #60799. (#84433) Thanks @IWhatsskill.</li>
-<li>Gateway/agents: use an agent's <code>identity.name</code> in Gateway agent summaries when <code>agents.list[].name</code> is unset, so configured agent labels remain visible in clients. (#84355; refs #57835) Thanks @luoyanglang.</li>
-<li>Channels/replies: keep normal <code>/verbose</code> failed-tool progress compact in message-tool replies and prevent late text-only tool output from appearing after the final answer. (#84303) Thanks @VACInc.</li>
-<li>Plugins/hooks: apply a default 30-second timeout to <code>before_compaction</code> and <code>after_compaction</code> hooks so a hung plugin handler no longer blocks compaction completion. (#84153)</li>
-<li>Discord: preserve disabled presentation buttons when adapting and rendering Discord message controls. (#84188) Thanks @100menotu001.</li>
-<li>Twitch: add a test-only client-manager registry reset helper so non-isolated Twitch tests can clear cached managers between cases. Fixes #83887. (#84244) Thanks @hclsys.</li>
-<li>Cron: run main-session scheduled work on a cron-owned wake lane while preserving reply delivery context, so background cron turns no longer block human main-session chat. Fixes #82766. (#82767) Thanks @galiniliev.</li>
-<li>Cron: use structured embedded-run denial metadata for isolated scheduled tasks so blocked exec requests fail the job without treating ordinary assistant prose as a denial. (#84067) Thanks @abnershang.</li>
-<li>Cron: keep recovered tool warnings diagnostic for successful scheduled runs so final cron output is delivered instead of being replaced by a post-processing warning. (#84045) Thanks @abnershang.</li>
-<li>Plugins/perf: thread explicit plugin discovery results through <code>loadBundledCapabilityRuntimeRegistry</code>, <code>resolveBundledPluginSources</code>, and <code>listChannelCatalogEntries</code> so callers that already hold a discovery result skip redundant filesystem walks. Thanks @SebTardif.</li>
-<li>harden update restart script creation [AI]. (#84088) Thanks @pgondhi987.</li>
-<li>Docker: keep the bundled Codex plugin in official release image keep lists so the default OpenAI agent harness remains available after Docker pruning. Fixes #83613. (#83626) Thanks @YuanHanzhong.</li>
-<li>CLI/channels: preserve the first line of <code>openclaw channels logs</code> output when the rolling tail window starts exactly on a line boundary, mirroring the already-fixed <code>readLogSlice</code> behavior in <code>src/logging/log-tail.ts</code>.</li>
-<li>Control UI: treat terminal session status as authoritative over stale active-run flags so completed terminal runs stop showing abort/live UI. (#84057)</li>
-<li>CLI: preserve embedded equals signs in inline root option values instead of truncating after the second separator. (#83995) Thanks @ThiagoCAltoe.</li>
-<li>Matrix/config: accept <code>messages.queue.byChannel.matrix</code> queue overrides and keep queue provider schema/type keys aligned for Matrix, Google Chat, and Mattermost. Thanks @bdjben.</li>
-<li>CLI: format <code>openclaw acp client</code> failures through the shared error formatter so object-shaped errors stay readable instead of printing <code>[object Object]</code>. Fixes #83904. (#84080)</li>
-<li>Providers/Ollama: default unknown-capabilities models to tool-capable so discovered native Ollama models can use tools when <code>/api/show</code> omits capabilities. (#84055) Thanks @dutifulbob.</li>
-<li>Installer/Windows: launch <code>install.ps1</code> onboarding as an attached child process so fresh native Windows installs do not freeze visibly at <code>Starting setup...</code> or corrupt the wizard's terminal rendering.</li>
-<li>CLI/update: keep restart health checks working across one-version CLI/Gateway protocol skew and use the managed Gateway service Node for all follow-up commands even when the package root is unchanged, so <code>openclaw update</code> no longer silently switches the gateway to a different Node binary when multiple Node installations are present. Thanks @amknight.</li>
-<li>CLI/gateway: include the running Gateway version in <code>gateway status</code> JSON output, preserving existing server metadata while falling back to status RPC data for read probes. Fixes #56222. Thanks @galiniliev.</li>
-<li>Memory/search: close local embedding providers when active-memory searches time out so pending local model loads and embedding contexts are aborted and released. (#83858) Thanks @brokemac79.</li>
-<li>CLI/nodes: request pending node surface approval scopes before <code>openclaw nodes approve</code> so exec-capable node approval can use admin-scoped Gateway credentials instead of failing with <code>missing scope: operator.admin</code>. (#84392) Thanks @joshavant.</li>
-<li>Gateway: reject slow node event sends before outbound buffers grow unbounded and log the rejected payload diagnostic. (#84387) Thanks @samzong.</li>
-<li>Agents: include bounded trajectory queued-writer diagnostics in <code>pi-trajectory-flush</code> timeout warnings so flush stalls show pending writes, queued bytes, and append state. Fixes #82961. (#82962) Thanks @galiniliev.</li>
-<li>Agents/subagents: recover stale completion announces by retrying unsupported transcript-wait wakes without transcript waiting and forcing a message-tool handoff when the requester run is already stale. Fixes #83699. (#83700) Thanks @galiniliev.</li>
-<li>Agents/subagents: constrain wildcard subagent target allowlists to configured agents while preserving explicitly listed compatibility targets. Fixes #84040. (#84357) Thanks @joshavant.</li>
-<li>Providers/Anthropic: route Anthropic model refs selected with Claude CLI auth through the Claude CLI runtime so shorthand refs such as <code>anthropic/opus-4.7</code> no longer fall back to embedded Anthropic billing. Fixes #84222. (#84374) Thanks @joshavant.</li>
-<li>Agents: honor explicit <code>models.providers.<id>.timeoutSeconds</code> values above the default idle watchdog for cloud and self-hosted providers, so long first-token waits no longer fall back at ~120s when the provider timeout is higher. (#83979) Thanks @yujiawei.</li>
-<li>Agents/Codex: keep encrypted Responses reasoning replay provenance-bound so stale mirrored Codex transcripts drop invalid encrypted content before request assembly while preserving matching same-session replay. Fixes #83836. (#84367) Thanks @joshavant.</li>
-<li>Agents/subagents: skip stale embedded-run wake probes for dormant completion requesters, so late subagent completions go straight to requester-agent/direct handoff instead of producing <code>reason=no_active_run</code> queue noise. (#82964) Thanks @galiniliev.</li>
-<li>CLI: retry config snapshot reads after a transient failure so one rejected read no longer poisons later commands in the same process. (#83931) Thanks @honor2030.</li>
-<li>Media: decode URL path basenames before using them as remote media fallback filenames, so files like <code>My%20Report.pdf</code> are surfaced as <code>My Report.pdf</code>. Fixes #84050. (#84052) Thanks @jbetala7.</li>
-<li>WhatsApp: clarify inbound group diagnostics so observed but unregistered groups point to <code>channels.whatsapp.groups</code> without changing routing or sender authorization. (#83846) Thanks @neeravmakwana.</li>
-<li>WhatsApp: drain pending outbound deliveries on a 30s periodic timer in addition to the reconnect handler, so messages enqueued while the provider is already connected no longer wait for the next reconnect to send. (#79083) Thanks @Oviemudiaga.</li>
-<li>CLI/TUI: include gateway plugin slash commands in TUI autocomplete, so connected sessions can suggest plugin-owned commands exposed by the running Gateway. (#83640) Thanks @se7en-agent.</li>
-<li>Gateway/mobile: restore QR setup-code handoff of bounded operator tokens for iOS and Android onboarding while keeping admin and pairing scopes out of bootstrap. (#83684) Thanks @ngutman.</li>
-<li>iOS: repair Release archive compilation for the TestFlight build. (#84255) Thanks @ngutman.</li>
-<li>Agents/compaction: bound plugin-owned CLI transcript compaction with the host safety timeout so a hung context engine can no longer stall post-turn cleanup. (#84083) Thanks @100yenadmin.</li>
-<li>Control UI/usage: truncate long context skill, tool, and file names in the usage panel while keeping the full name available on hover. (#42197) Thanks @Rain120.</li>
-<li>Codex: respect explicit <code>models auth order set</code> and <code>config.auth.order</code> precedence over stale <code>lastGood</code> in <code>/codex account</code>, and show <code>no working credential</code> when every explicit-order profile is ineligible instead of marking a lower-ranked profile as active. Fixes #84386. (#84412) Thanks @openperf.</li>
-<li>Agents: honor <code>messages.suppressToolErrors</code> for mutating tool failures so configured chat surfaces do not receive separate warning payloads. (#81561) Thanks @moeedahmed.</li>
-<li>Agents/fallback: surface billing guidance for mixed rate-limit plus billing fallback exhaustion instead of generic failure copy. Fixes #79396. (#79489) Thanks @aayushprsingh.</li>
-</ul>
-<p><a href="https://github.com/openclaw/openclaw/blob/main/CHANGELOG.md">View full changelog</a></p>
-]]></description>
-            <enclosure url="https://github.com/openclaw/openclaw/releases/download/v2026.5.20/OpenClaw-2026.5.20.zip" length="54396392" type="application/octet-stream" sparkle:edSignature="Ufz+twYjgj5NDg29tG3Ttx/JNyT3/a3EKLciBGvsa38C6Dwqp4yFYC5jSBiSlubwBXhrq8OQDMgavMKtSsclBQ=="/>
-        </item>
-        <item>
-            <title>2026.5.19</title>
-            <pubDate>Wed, 20 May 2026 21:27:21 +0000</pubDate>
-            <link>https://raw.githubusercontent.com/openclaw/openclaw/main/appcast.xml</link>
-            <sparkle:version>2026051990</sparkle:version>
-            <sparkle:shortVersionString>2026.5.19</sparkle:shortVersionString>
-            <sparkle:minimumSystemVersion>15.0</sparkle:minimumSystemVersion>
-            <description><![CDATA[<h2>OpenClaw 2026.5.19</h2>
-<h3>Changes</h3>
-<ul>
-<li>Agents: clarify that fixes should default to clean bounded refactors, lean internals, and explicit plugin SDK/API deprecation paths.</li>
-<li>Dependencies: update <code>@openclaw/proxyline</code> to 0.3.3.</li>
-<li>Dependencies: update Pi packages to 0.75.1 and raise the minimum supported Node.js 22 line to 22.19.</li>
-<li>Docker/Podman: add <code>OPENCLAW_IMAGE_APT_PACKAGES</code> as the runtime-neutral image build arg for extra apt packages while keeping <code>OPENCLAW_DOCKER_APT_PACKAGES</code> as a legacy fallback. (#62431) Thanks @urtabajev.</li>
-<li>Gateway/ACPX: attribute startup probe, config, runtime, and resource-count costs in restart traces without changing readiness behavior. (#83300) Thanks @samzong.</li>
-<li>Gateway: overlap startup logging and plugin-service startup with channel sidecars to reduce restart ready latency while preserving <code>/readyz</code> sidecar gating. (#83301) Thanks @samzong.</li>
-<li>Plugins/admin-http-rpc: allow trusted admin HTTP RPC clients to start and wait for web QR login flows. (#83259) Thanks @liorb-mountapps.</li>
-<li>Mac app: redesign Settings pages with consistent card layouts, cached navigation, cleaner permissions/voice/skills/cron/exec/debug panes, and steadier spacing around the native sidebar.</li>
-<li>Mac app: refine Voice & Talk recognition-language and wake-phrase settings so they use the same compact card rows as the rest of Settings.</li>
-<li>Skills: rename the repo-local Codex closeout review skill and helper to <code>autoreview</code> while preserving the Codex-first fallback behavior.</li>
-<li>Skills: add a meme-maker skill for curated template search, local SVG/PNG rendering, Imgflip hosted rendering, and Know Your Meme provenance links.</li>
-<li>Skills CLI: allow <code>openclaw skills install</code> and <code>openclaw skills update</code> to target shared managed skills with <code>--global</code>. (#74466) Thanks @Marvae.</li>
-<li>Browser: surface pending and recently handled modal dialogs in snapshots, return <code>blockedByDialog</code> when an action opens a modal, and allow <code>browser dialog --dialog-id</code> to answer pending dialogs.</li>
-<li>Browser CLI: add <code>openclaw browser evaluate --timeout-ms</code> so long-running page functions can extend both the evaluate action and request timeout budgets. (#83447) Thanks @eefreenyc.</li>
-<li>Codex app-server: scope OpenClaw prompt guidance by runtime surface so native Codex keeps Codex-owned base/personality instructions while OpenClaw contributes only runtime context, delivery guidance, and explicitly scoped command hints. (#83454) Thanks @100yenadmin.</li>
-<li>Docker/Podman: add <code>OPENCLAW_IMAGE_PIP_PACKAGES</code> for opt-in Python package installation in local image builds. (#83771) Thanks @stephenredmond-straiteis.</li>
-<li>Agents/tools: shorten built-in tool descriptions and schema hints across media, messaging, sessions, cron, Gateway, web, image/PDF, TTS, nodes, and plan tools while preserving routing guardrails.</li>
-<li>Skills: add node inspector debugging, fused diagram generation, and throwaway spike workflow skills.</li>
-<li>CLI/plugins: add <code>defineToolPlugin</code> plus <code>openclaw plugins build</code>, <code>validate</code>, and <code>init</code> for typed simple tool plugins with generated manifest metadata, optional tool declarations, and context factories.</li>
-<li>Agents/skills: tighten bundled skill prompts and metadata, quote skill descriptions, refresh current CLI/API guidance, and update embedded sherpa-onnx runtime downloads.</li>
-<li>Skills: update the Obsidian skill to target the official <code>obsidian</code> CLI and require its registered binary instead of the third-party <code>obsidian-cli</code>.</li>
-<li>Skills: add a Python debugging skill for pdb, breakpoint(), post-mortem inspection, and debugpy remote attach.</li>
-<li>Codex: add <code>/codex plugins list</code>, <code>enable</code>, and <code>disable</code> for managing configured native Codex plugins from chat without editing config by hand.</li>
-<li>Plugins/messages: add presentation capability limits for channel renderers, adapt rich message controls before native rendering, and mark legacy <code>interactive</code>/Slack directive producer APIs as deprecated.</li>
-<li>Plugins/subagents: store channel delivery routes as canonical session metadata and deprecate ad hoc subagent hook delivery-origin fields in favor of core route projection.</li>
-<li>Proxy: support HTTPS managed forward-proxy endpoints and scoped <code>proxy.tls.caFile</code> CA trust for proxy endpoint TLS. (#79171) Thanks @jesse-merhi.</li>
-<li>QA-Lab: add first-hour 20-turn and optional 100-turn runtime parity scenarios, with tier metadata for standard and soak QA gates. Fixes #80338; refs #80337. Thanks @100yenadmin.</li>
-<li>QA-Lab: add <code>openclaw qa suite --runtime-parity-tier</code> and wire the standard Codex-vs-Pi tier into release checks separately from optional/live-only/soak lanes. Fixes #80337. Thanks @100yenadmin.</li>
-<li>QA-Lab: add a live-only Codex Pi-shaped Read vocabulary canary so runtime parity catches native workspace-read prompt compatibility drift. (#80323) Thanks @100yenadmin.</li>
-<li>QA-Lab: add live-only harness self-health scenarios for plugin hook crashes, manifest contract errors, and WebChat direct-reply self-message routing. (#80323) Thanks @100yenadmin.</li>
-<li>QA-Lab: add runtime tool fixture scenarios and coverage reporting for Codex-native workspace tools, OpenClaw dynamic tools, and optional plugin-backed tools. Fixes #80173. Thanks @100yenadmin.</li>
-<li>QA-Lab: expose runtime tool fixture coverage through <code>openclaw qa coverage --tools</code>, with optional suite-summary evaluation for parity gate artifacts. Thanks @100yenadmin.</li>
-<li>QA-Lab: schedule a live-frontier Codex-vs-Pi runtime token-efficiency artifact lane in the all-lanes QA workflow. Fixes #80175. Thanks @100yenadmin.</li>
-<li>QA-Lab: hard-gate required OpenClaw dynamic runtime-tool drift in the standard Codex-vs-Pi tier with a blocking release-check verifier and publish the tool coverage report artifact. Fixes #80339; refs #80319. Thanks @100yenadmin.</li>
-<li>QA-Lab: add the personal-agent approval-denial scenario so the benchmark pack verifies denied local reads stop cleanly without tool progress or fixture leaks. (#83150) Thanks @iFiras-Max1.</li>
-<li>QA-Lab: extend the personal-agent benchmark pack with a local task followthrough scenario for proof-backed pending, blocked, and done status reporting. Thanks @iFiras-Max1.</li>
-<li>QA-Lab: add a report-only dreaming shadow-trial scenario so candidate memory promotion can be evaluated without mutating <code>MEMORY.md</code>. Thanks @iFiras-Max1.</li>
-<li>Gateway/performance: add <code>pnpm test:restart:gateway</code> benchmark tooling for repeated restart readiness, downtime, trace, and resource-slope evidence. (#83299) Thanks @samzong.</li>
-<li>Android: switch Talk Mode to realtime Gateway relay voice sessions with streaming mic input, realtime audio playback, tool-result bridging, and on-screen transcripts. (#83130) Thanks @sliekens.</li>
-<li>Gateway/config: expose config lookup reload metadata so tools can distinguish restart-required, hot-reloadable, and no-op fields before applying config edits. Fixes #81409. (#81612) Thanks @LLagoon3.</li>
-<li>Telegram: add allowlisted native DM draft previews for transient tool progress while keeping final answers on the normal persistent delivery path. (#83622) Thanks @akrimm702.</li>
-<li>QA-Lab: add a personal-agent share-safe diagnostics artifact scenario so support handoffs keep useful status while omitting raw personal content. Thanks @iFiras-Max1.</li>
-<li>QA-Lab: add a personal-agent no-fake-progress scenario so completion claims stay tied to local evidence instead of unsupported external progress. (#83824) Thanks @iFiras-Max1.</li>
-</ul>
-<h3>Fixes</h3>
-<ul>
-<li>CLI: reject explicit port numbers above 65535 before they reach Gateway or Node bind paths. Fixes #83900. (#84008) Thanks @hclsys.</li>
-<li>Codex app-server: preserve plugin tool auth profiles when Codex owns model transport so OpenClaw dynamic tools can resolve their provider credentials. (#83603) Thanks @rubencu.</li>
-<li>Memory/search: scan the JS-side fallback vector path (used when the sqlite-vec index is unavailable or has a mismatched dimension) in bounded rowid batches and yield to the event loop between batches so large chunk tables can no longer pin the Node.js main thread for multi-second windows. Also keeps the SQL prepared statement rooted in a local so node:sqlite cannot finalize it mid-scan under heap pressure. Fixes #81172. Thanks @dev23xyz-oss.</li>
-<li>Memory Wiki: preserve fs-safe diagnostics when bridge source page writes fail for non-symlink filesystem safety reasons, so directory collisions are reported with the underlying error code. (#83776) Thanks @TurboTheTurtle.</li>
-<li>Telegram: keep forum topics from blocking sibling topic traffic by routing inbound serialization, media/text buffers, and account API queues on topic-aware lanes. (#83829)</li>
-<li>Telegram: keep queued forum-topic follow-up messages from inheriting superseded source abort signals, so later same-topic user turns can still run and reply after an active turn is replaced. (#83827) Thanks @VACInc.</li>
-<li>CLI/update: bypass npm freshness filters consistently during managed package and plugin installs so freshly published release plugins remain installable. Thanks @jalehman.</li>
-<li>CLI/update: guide root-owned npm install EACCES recovery by stopping the managed Gateway before manual package replacement, then reinstalling and restarting the service. Fixes #83747. (#83757) Thanks @brokemac79.</li>
-<li>Twitch: register refreshing chat tokens with Twurple's chat intent so automatic token refresh keeps chat access available. (#83750) Thanks @TurboTheTurtle.</li>
-<li>Agents/subagents: keep collect-mode announce queues batching unresolved-origin items with compatible same-route messages and resume collection after a true cross-channel drain when a later compatible batch remains. Fixes #83577.</li>
-<li>Skills: refresh existing session skill snapshots when watched skill roots change, so changed extra skill directories take effect without starting a new session. Fixes #83782. (#83800) Thanks @hclsys.</li>
-<li>Providers/Anthropic: preserve native image input for current Claude model rows when stale local catalog data marks them text-only. (#83756) Thanks @TurboTheTurtle.</li>
-<li>Providers/Anthropic: preserve Claude 4 image capability when configured model refs resolve through a stale local catalog row. (#83756) Thanks @TurboTheTurtle.</li>
-<li>Providers/DeepSeek: normalize MCP tool schemas with <code>anyOf</code>/<code>oneOf</code> unions before normal and compaction requests reach DeepSeek, preventing union-shaped parameters from being rejected. (#83766) Thanks @TurboTheTurtle.</li>
-<li>Control UI: render live tool progress from session-scoped <code>session.tool</code> Gateway events so externally started runs show their tool cards in the active session. (#83734) Thanks @TurboTheTurtle.</li>
-<li>Outbound: resolve send-capable channel plugins from the active runtime registry when the pinned startup registry only has setup metadata. (#83733) Thanks @TurboTheTurtle.</li>
-<li>Discord: preserve streamed reply previews when recovered tool-warning finals are delivered before or after the assistant's final reply. (#84169) Thanks @neeravmakwana.</li>
-<li>Control UI: keep the chat delete confirmation popover clamped inside the visible viewport on small screens. (#83804) Thanks @ThiagoCAltoe.</li>
-<li>Browser: enforce current-tab URL allowlist checks for <code>/act</code> evaluate/batch actions and <code>/highlight</code> routes while leaving tab-management actions unblocked. (#78523)</li>
-<li>CI: require real-behavior-proof verdict markers to come from the ClawSweeper GitHub App before accepting exact-head proof. (#83692)</li>
-<li>Models: show the effective OpenAI/Codex auth profile in <code>/models</code> provider headers instead of falling back to the OpenAI env-key label. (#83697) Thanks @yu-xin-c.</li>
-<li>CLI: include active bundled loopback MCP tools in CLI system prompts and reset provider-side CLI sessions when that prompt-visible tool surface changes. (#83785) Thanks @TurboTheTurtle.</li>
-<li>Browser: keep a profile <code>cdpPort</code> when its <code>cdpUrl</code> omits a port, while still letting explicitly written URL ports win. (#82166) Thanks @Marvae.</li>
-<li>Agents/image generation: allow distinct <code>image_generate</code> prompts to start separate session-backed background tasks while same-prompt retries still return the active task status. (#83614) Thanks @Elarwei001.</li>
-<li>Gateway/WebChat: honor configured <code>channels.webchat.textChunkLimit</code> and <code>chunkMode</code> overrides when chunking WebChat replies. (#83713)</li>
-<li>Control UI: stop the chat reading indicator from sticking after an assistant response finishes. (#83515) Thanks @njuboy11.</li>
-<li>Skills: reject empty or whitespace-only skill names and descriptions during quick validation. (#27061)</li>
-<li>Sessions: skip trailing custom transcript entries when checking tail assistant replies so embedded CLI gap-fill does not duplicate canonical assistant output. (#83635) Thanks @yaoyi1222.</li>
-<li>Memory Wiki: keep <code>wiki_lint</code> tool output path-safe by reporting vault-internal lint reports as relative paths in tool text and details while preserving absolute report paths for CLI/file callers. (#83439) Thanks @LLagoon3.</li>
-<li>Telegram: keep verbose tool progress visible without mirroring non-final progress into active session transcripts, preventing embedded provider replies from aborting mid-run. (#83631) Thanks @kurplunkin.</li>
-<li>Telegram: log successful outbound text and media deliveries with account, chat, message, operation, thread, reply, silent, and chunk metadata while keeping message bodies out of logs. Fixes #83196. (#83247) Thanks @jrwrest.</li>
-<li>Cron: link isolated scheduled task runs to their stable cron session so task status and cleanup can follow the backing agent run. (#83606) Thanks @jai.</li>
-<li>Codex app-server: mark Codex-native subagent task mirrors terminal when blocked or failed spawn-agent calls arrive with stale initializing child state, preventing task registry entries from staying running. Fixes #83852. (#83945) Thanks @joshavant.</li>
-<li>CLI: enforce the documented Node.js 22.19 runtime floor in the source launcher.</li>
-<li>Release stability: repair broad-gate regressions in requester-agent completion handoff, QA-Lab mock spawn attribution, Slack monitor test isolation, plugin uninstall peer fixtures, and Node-floor launcher contract coverage.</li>
-<li>Agents/replies: persist queued follow-up user messages and assistant error stubs only once across model-fallback retries, preventing repeated provider rejections from corrupted same-role session transcripts. Fixes #83404. (#83417) Thanks @yetval.</li>
-<li>Telegram: preserve reply-target context for bare mention replies on runtime-only turns so the model sees the replied-to message body. Fixes #83767. (#83953) Thanks @joshavant.</li>
-<li>ClawHub: preserve configured base URL path prefixes when building API request URLs, so self-hosted ClawHub instances mounted under a subpath keep routing correctly. (#83982) Thanks @ThiagoCAltoe.</li>
-<li>Slack: persist delivered inbound message IDs and fail closed when same-channel thread replies lose their thread context, preventing delayed duplicate replies and accidental channel-root posts. Fixes #83521. Thanks @shannon0430.</li>
-<li>Codex app-server: complete OpenClaw dynamic tool diagnostics at the request boundary so successful, failed, timed out, aborted, and blocked tool calls do not leave active tool state behind. Fixes #83474. Thanks @rozmiarD.</li>
-<li>Gateway/config: keep config writes from failing on unrelated unresolved auth-profile SecretRefs while preserving live auth-profile runtime snapshots.</li>
-<li>Gateway/sessions: clear stored CLI provider resume bindings on non-subagent <code>/reset</code> so the next turn starts a fresh provider-side CLI conversation instead of resuming old context. (#83448) Thanks @jasonyliu.</li>
-<li>Doctor: preserve legacy whole-agent Claude CLI intent by moving matching Anthropic model selections to model-scoped runtime policy before removing stale runtime pins. Fixes #83491. Thanks @danielcrick.</li>
-<li>Discord/OpenAI: keep realtime Discord voice sessions hearing follow-up turns with OpenAI realtime and prebuffer assistant playback to avoid choppy starts. (#80505) Thanks @Solvely-Colin.</li>
-<li>LM Studio: resolve env-template API keys like <code>${LMSTUDIO_API_KEY}</code> through the standard SecretInput path instead of sending the raw template as the bearer token, and preserve header-auth and discovery-key precedence when the template is unset. Fixes #80495. (#80568) Thanks @MonkeyLeeT.</li>
-<li>Discord/subagents: route the initial reply from thread-bound delegated sessions into the bound Discord thread instead of the parent channel. Fixes #83170. (#83172) Thanks @100menotu001.</li>
-<li>Gateway/sessions: rotate failed agent sessions when their transcript file is missing instead of wedging per-channel lanes. Fixes #83488. (#83553) Thanks @LLagoon3.</li>
-<li>Agents: refresh final-delivery routing from fresh session state before declaring a no-send failure, keeping recovered runs on the normal durable delivery path. (#83835) Thanks @joshavant.</li>
-<li>Agents: guard final-delivery fresh session routing against mismatched logical sessions before reusing recovered delivery context. (#83928) Thanks @joshavant.</li>
-<li>Media: prevent image metadata probing from invoking external decoder delegates on unrecognized image bytes, and stop fallback chaining after real processing errors.</li>
-<li>Media: install Sharp with the root package and fall back to sips, Windows native imaging, ImageMagick, GraphicsMagick, or ffmpeg for image resizing/conversion when Sharp is unavailable. Fixes #83401. Thanks @scotthuang.</li>
-<li>Telegram: deliver generated media completions back into forum topics by preserving topic IDs across requester-agent handoff. (#83556) Thanks @fuller-stack-dev.</li>
-<li>Gateway: defer update-check startup until after readiness so package update checks no longer block sidecar-ready startup, while preserving update broadcasts and shutdown cleanup. (#83520) Thanks @samzong.</li>
-<li>Telegram: keep <code>/btw</code> and read-only status commands from aborting active runs, and avoid retaining raw update payloads in timed-out spool tombstones. Refs #83272.</li>
-<li>Agents: log strict-agentic execution contract diagnostics only when the planning-only retry path actually triggers.</li>
-<li>Agents: stop embedded session takeover and session write-lock errors from consuming model fallbacks while preserving provider fallback metadata. Fixes #83510. Thanks @luyao618.</li>
-<li>Agents/video: hide <code>video_generate</code> reference-audio parameters unless a registered video provider supports audio inputs.</li>
-<li>Plugins: fall back to npm for official ClawHub updates when artifact downloads are unavailable, including beta-to-default fallback and dry-run version reporting.</li>
-<li>Plugins/xAI: echo PKCE challenge fields during OAuth authorization-code token exchange for xAI token-endpoint compatibility. (#83499) Thanks @fuller-stack-dev.</li>
-<li>Codex app-server: hydrate current inbound image attachments before queued runs so Responses-backed agents receive Discord and other channel images as native vision input. Fixes #83466. Thanks @iannwu.</li>
-<li>Codex app-server: keep native code mode available without forcing code-mode-only so OpenClaw dynamic tool turns complete through the app-server tool bridge. Fixes #83109. Thanks @daswass.</li>
-<li>Codex app-server: expose OpenClaw's sandbox-routed shell as <code>sandbox_exec</code>/<code>sandbox_process</code> for non-Docker sandbox backends so SSH sandbox agents keep a correctly routed shell path without shadowing Codex native shell. Fixes #80322. Thanks @keramblock.</li>
-<li>Release stability: recover stale session diagnostics and Codex OAuth fallback state so stuck runs and reused refresh tokens clear without blocking follow-up work. (#83503) Thanks @100yenadmin.</li>
-<li>Messages/TTS: apply TTS directives before message-tool sends reach core, gateway, or plugin delivery so opt-in message-tool rooms and proactive sends attach voice notes instead of leaking raw tags. Fixes #81598. Thanks @CG-Intelligence-Agent-Jack and @CoronovirusG10.</li>
-<li>Messages/Codex: keep Codex direct/source chats on message-tool visible delivery by default while documenting and testing <code>messages.visibleReplies: "automatic"</code> as the old-mode opt-out; channel wildcard model overrides now apply to direct chats before harness delivery defaults.</li>
-<li>Memory/QMD: keep archived session transcript hits visible after QMD export while preserving normal <code>.md</code> session ids that only resemble archive names. (#83518; fixes #83506) Thanks @tanshanshan.</li>
-<li>Codex app-server: preserve network access for sandboxed Codex code-mode turns when the OpenClaw sandbox allows outbound egress. Fixes #83347. Thanks @YusukeIt0.</li>
-<li>Codex app-server: honor writable Docker bind mounts for sandboxed workspace-write turns while disabling native Code Mode when container-path aliases or read-only bind shadows cannot be represented safely host-side. Fixes #83737. (#83849) Thanks @joshavant.</li>
-<li>QA-Lab: keep the OTLP smoke decoder independent of removed OpenTelemetry generated-root internals.</li>
-<li>Messages: default group/channel visible replies to automatic final delivery again, keeping <code>message_tool</code> opt-in for ambient/shared rooms and tool-reliable models.</li>
-<li>CLI/TUI: force standalone <code>/exit</code> runs to terminate after <code>runTui</code> returns so onboarding-launched TUI children do not stay alive invisibly. (#83501) Thanks @fuller-stack-dev.</li>
-<li>Agents/code mode: honor per-agent code-mode config in schema, runtime catalog activation, and model payload filtering. Fixes #83388. Thanks @Kaspre.</li>
-<li>Agents/code mode: preserve agent, session, run, and channel context in <code>before_tool_call</code> hooks for top-level <code>exec</code>/<code>wait</code> dispatches. Fixes #83387.</li>
-<li>QQBot: shorten C2C typing indicators to a 10-second window renewed every 5 seconds, capped to keep a final passive-reply slot available. (#83469)</li>
-<li>Replies: keep final payload delivery after live preview updates so channels can finalize or send the completed answer instead of losing preview-only drafts. (#83468)</li>
-<li>Discord: deliver final replies in progress-mode preview streams instead of deduplicating the final visible message. (#83443) Thanks @compoodment.</li>
-<li>Providers/Xiaomi: replay MiMo Anthropic-compatible <code>reasoning_content</code> as provider-required thinking blocks even when OpenClaw thinking is disabled, fixing follow-up tool turns for <code>mimo-v2-flash</code>. Fixes #83407. Thanks @Xgenious7.</li>
-<li>Agents/exec approvals: forward approval-runtime credentials on agent-owned Gateway approval calls so approved async commands complete through the existing runtime path instead of stalling on unauthenticated follow-up calls. Thanks @IWhatsskill, @Patrick-Erichsen, and @jesse-merhi.</li>
-<li>Gateway/skills: preflight remote macOS skill-bin refreshes with a WebSocket connectivity check so stale node sessions skip quickly instead of logging slow <code>system.which</code> timeout warnings.</li>
-<li>CLI/config: keep broken discovered plugins that are not referenced by active config from failing <code>openclaw config validate</code>, while preserving fatal errors for explicitly configured plugin entries.</li>
-<li>GitHub Copilot: drop unsafe native Responses reasoning replay items with non-replayable IDs before dispatch, preventing affected Copilot sessions from failing with <code>invalid_request_body</code>. Fixes #83220. Thanks @galiniliev.</li>
-<li>Agents/Codex: fail closed when an explicitly requested Codex harness is not registered instead of silently trying configured model fallbacks. Fixes #83349. Thanks @r2-vibes.</li>
-<li>QA-Lab: make runtime tool coverage fail on missing required tool exercise instead of treating pass/pass parity envelope drift as missing coverage.</li>
-<li>Core/plugins: harden clawpatch-reported edge cases across gateway auth cleanup, Claude session id paths, plugin activation policy, apply-patch hunk handling, diagnostic redaction, and plugin metadata validation.</li>
-<li>UI: show reasoning choices as plain labels instead of leaking internal override wording in session and chat pickers.</li>
-<li>Mac app: avoid repeating the Configuration heading inside channel quick settings.</li>
-<li>Mac app: keep the Settings sidebar always visible and remove the redundant titlebar hide/show control.</li>
-<li>Mac app: normalize Settings pane content margins so pages share the same left and right rail.</li>
-<li>Mac app: prefer explicit private/Tailscale/LAN Gateway endpoints over SSH tunnels, preserve legacy loopback tunnel configs, persist transport choices, and show captured SSH stderr when tunneling really fails.</li>
-<li>Gateway/sessions: keep ACP/acpx and runtime child sessions visible in configured-only session lists when their owner or parent session belongs to a configured agent.</li>
-<li>Mac app: keep app-level menu commands and Dashboard failure states reachable when the remote Gateway is disconnected.</li>
-<li>Mac app: allow longer Gateway and Context errors to wrap in the menu instead of truncating the useful failure detail.</li>
-<li>Mac app: tighten remote Gateway fields in Settings so the Connection pane keeps readable labels and full action button text.</li>
-<li>Mac app: keep custom Settings card rows left-aligned and full-width so Discovery and status sections no longer appear centered or detached.</li>
-<li>Mac app: align Location permission controls to the same trailing column as the rest of Settings.</li>
-<li>Mac app: add Dashboard, Chat, Canvas, and Settings shortcuts to the Dock icon menu.</li>
-<li>Mac app: replace the Settings window's native split-view sidebar with an explicit layout so page content keeps its leading gutter when the sidebar is shown or hidden.</li>
-<li>Mac app: render channel quick config as aligned Settings rows and hide schema-only variants that cannot be edited safely from the quick pane.</li>
-<li>Gateway/webchat: hide internal runtime-context and other <code>display: false</code> transcript messages from Chat history and live message events. Fixes #83216. Thanks @EmpireCreator.</li>
-<li>CLI/help: keep <code>gateway</code>, <code>doctor</code>, <code>status</code>, and <code>health</code> help registration out of action/runtime imports so subcommand <code>--help</code> stays lightweight in constrained terminals. Fixes #83228. Thanks @dfguerrerom.</li>
-<li>CLI/help: show plugin-owned command help based on the active memory slot so LanceDB memory users see <code>ltm</code> instead of unavailable <code>memory</code> commands. Fixes #83745. (#83841) Thanks @joshavant.</li>
-<li>Cron/Discord: keep explicit announce runs in message-tool-only source-reply mode so scheduled agent turns post once instead of also echoing through automatic visible replies. Fixes #83261. Thanks @Theralley.</li>
-<li>Telegram: preserve forum-topic origin targets in inbound, audio-preflight, and skipped-message hook contexts so follow-up delivery stays bound to the originating topic. Fixes #83302. Thanks @M00zyx.</li>
-<li>Telegram: retry HTTP 421 Misdirected Request send failures on a fresh fallback transport so transient edge-node routing errors no longer drop outbound replies. Fixes #48892. (#48908) Thanks @MarsDoge.</li>
-<li>Telegram: fail topic sends closed when Telegram reports <code>message thread not found</code> instead of retrying without <code>message_thread_id</code> into the base chat. Refs #83302.</li>
-<li>Config/subagents: remove ignored agent-model <code>timeoutMs</code> keys, keep subagent model config to primary/fallback selection, and clean shipped stale config through doctor. Fixes #83291. Thanks @giodl73-repo.</li>
-<li>Mac app: align the Sessions settings pane with the standard Settings page gutter and row spacing.</li>
-<li>OpenAI/Codex: stop rejecting available <code>openai-codex</code> GPT-5.1, GPT-5.2, and GPT-5.3 model refs during config validation, while keeping removed Spark aliases suppressed. Fixes #83303.</li>
-<li>Plugins/xAI: complete OAuth-backed xAI login and sidecar auth fixes, including guarded loopback callback CORS handling, video generation polling/defaults, and native-host User-Agent attribution. (#83322) Thanks @Jaaneek.</li>
-<li>Codex app-server: preserve streamed native command output in mirrored transcripts and trajectory exports when final snapshots omit aggregated output. (#83200) Thanks @rozmiarD.</li>
-<li>Codex app-server: fail closed when chat or sender policy denies tools, disabling native code, app, environment, and user MCP surfaces for restricted turns. (#82374) Thanks @VACInc.</li>
-<li>Codex app-server: keep recent context-engine messages when oversized projected history is truncated, so short follow-ups in long channel sessions do not fall back to stale earlier turns. (#83127) Thanks @VACInc.</li>
-<li>Codex app-server: keep OpenClaw session spawning searchable while steering Codex-native delegation through native subagents, avoiding duplicate direct subagent surfaces. (#83329) Thanks @fuller-stack-dev.</li>
-<li>Codex app-server: recover stale childless Codex-native subagent task mirrors during maintenance and allow their registry rows to be cancelled without an OpenClaw child session. (#82836) Thanks @yshimadahrs-ship-it and @joshavant.</li>
-<li>Feishu: return bound subagent delivery origins from session thread setup so Feishu subagent completions route back to the same DM or topic. (#83190) Thanks @100menotu001.</li>
-<li>CLI/update: tailor post-update Gateway recovery hints by platform, showing systemd, LaunchAgent, Scheduled Task, or generic service-manager guidance instead of macOS-only recovery text. (#83096) Thanks @rubencu.</li>
-<li>Plugins: apply a default 15-second timeout to legacy <code>before_agent_start</code> hooks so hung plugin handlers no longer block agent startup. Fixes #48534. (#83136) Thanks @therahul-yo.</li>
-<li>Feishu: refresh inbound session delivery context for DM, group, and broadcast turns so later replies do not inherit stale WebChat routing. Fixes #78274.</li>
-<li>Agents/subagents: require the initial subagent registry save before reporting spawn accepted, returning a spawn error instead of losing an untracked run when the registry write fails. (#83146) Thanks @yetval.</li>
-<li>QA-Lab/qa-channel: attach redacted agent tool-start traces to outbound <code>QaBusMessage</code> records so scenarios can assert actual tool use instead of relying only on reply text. Fixes #67637. Thanks @100yenadmin.</li>
-<li>QA-Lab: fail live runtime parity reports when assistant-message usage is missing, preventing <code>0 vs 0</code> live token rows from being reported as passing proof. Fixes #80411. Thanks @100yenadmin.</li>
-<li>QA-Lab: add a runtime token-efficiency sidecar report that classifies Codex savings separately from regressions and fails only positive Codex-over-Pi live token deltas above threshold. Fixes #81093. Thanks @100yenadmin.</li>
-<li>QA-Lab: fail Codex-backed OpenAI live runtime-pair runs before launching isolated workers when no portable Codex auth is available, while staging API-key fallbacks and configured Codex keys for isolated QA agents. Fixes #80412. Thanks @100yenadmin.</li>
-<li>QA-Lab: refresh parity gates, mock frontier fixtures, model scenarios, and workflow artifact lanes to compare GPT-5.5 against Claude Opus 4.7. Fixes #74262. Thanks @100yenadmin.</li>
-<li>QA-Lab: make mock parity dispatch provider-aware for source discovery and subagent scenarios so OpenAI and Anthropic lanes no longer share identical canned plans. Fixes #64879. Thanks @100yenadmin.</li>
-<li>QA-Lab: stop returning Control UI bearer tokens from unauthenticated bootstrap payloads and bind Docker harness ports to loopback-only host addresses. (#66355) Thanks @pgondhi987.</li>
-<li>Mac app: avoid a SwiftUI metadata crash when rendering the Cron Jobs settings pane.</li>
-<li>Agents/subagents: preserve run-mode keep subagent registry entries past the session sweep TTL, so kept subagent runs remain visible after cleanup completes. Fixes #83132. (#83168) Thanks @yetval.</li>
-<li>Agents/OpenAI streams: yield via <code>setTimeout(0)</code> instead of <code>setImmediate</code> between bursty Responses chunks so abort timers can fire during the yield, keeping cancel-on-timeout responsive on hot streams. Refs #82462.</li>
-<li>Agents/Codex: keep legacy <code>oauthRef</code>-backed OAuth profiles usable while <code>openclaw doctor --fix</code> migrates them back to inline credentials, without creating new sidecar credentials. (#83312) Thanks @joshavant.</li>
-<li>Agents/Codex: load the selected provider owner alongside the Codex harness runtime so <code>openai-codex</code> models resolve when plugin allowlists scope runtime loading. Fixes #83380. (#83519) Thanks @joshavant.</li>
-<li>Telegram: fail stalled isolated-ingress handlers into tombstones and abort same-lane reply work before restarting, so later same-chat updates drain after a hung turn. Fixes #83272. (#83505) Thanks @joshavant.</li>
-<li>CLI/config: send SecretRef diagnostics to stderr so JSON command stdout remains parseable.</li>
-<li>CLI/doctor: seed Control UI allowed origins when migrating legacy non-loopback gateway bind host aliases like <code>0.0.0.0</code>. Fixes #83286. Thanks @giodl73-repo.</li>
-<li>CLI/plugins: ship the bundled memory CLI as a package entry so package-installed <code>openclaw memory</code> commands register correctly.</li>
-<li>CLI/update: defer doctor-time plugin package installs during package swaps and seed post-core repair from the updated install registry, preventing duplicate reinstall failures.</li>
-<li>CLI/update: preserve old-parent-readable config metadata during legacy package handoffs, fall back only to official <code>@openclaw/*</code> npm plugin packages when ClawHub plugin artifacts are unavailable, and keep managed service package roots authoritative during updates.</li>
-<li>Feishu: detect SecretRef top-level credentials as a configured default account instead of treating object-backed app secrets as missing.</li>
-<li>Gateway/restart: keep ordinary unmanaged SIGUSR1/config restarts in-process instead of detach-spawning an orphaned child, preserving custom supervisor PID tracking while leaving update restarts on the fresh-process path. Fixes #65668.</li>
-<li>CLI/completion: resolve concrete PowerShell profile paths and reload commands during setup and doctor completion installation. Fixes #44296. (#83059) Thanks @yu-xin-c.</li>
-<li>Telegram: keep isolated long polling below the hard <code>getUpdates</code> request guard so idle bot accounts with high <code>timeoutSeconds</code> do not false-disconnect and restart-loop. Fixes #83264. Thanks @riccodecarvalho.</li>
-<li>Providers/Google: preserve and recover Gemini 3 tool-call thought signatures during native replay so function-calling turns no longer fail with missing <code>thought_signature</code> 400s. Fixes #72879. (#80358) Thanks @abnershang.</li>
-<li>Telegram: skip transcript-only delivery mirrors and gateway-injected rows when resolving latest assistant text, preventing retained previews from replacing final replies with stale fragments. Fixes #83159. (#83362) Thanks @joshavant.</li>
-<li>Memory/QMD: keep lexical search on raw hyphenated queries while normalizing semantic QMD sub-searches, avoiding fallback to the builtin index for dashed identifiers and dates. Fixes #81328.</li>
-<li>Memory-core: distinguish sqlite-vec load failures from missing semantic vector embeddings in degraded <code>memory index</code> warnings, so vector recall diagnostics point at unresolved dimensions instead of blaming sqlite-vec when the store is ready. Fixes #75624. (#83056) Thanks @xuruiray and @Noah3521.</li>
-<li>Agents/subagents: preserve sandbox-peer controller ownership while routing completion announcements back to the originating run session, keeping subagent control and completion delivery scoped correctly. Fixes #80201. (#80242) Thanks @Jerry-Xin.</li>
-<li>Gateway: continue restarting remaining channels when one hot-reload channel restart fails, while still reporting aggregate reload failure and rolling back plugin pre-replace stops. Fixes #83054. Thanks @zqchris.</li>
-<li>Gateway/plugins: bind admin HTTP RPC dispatch to the accepting gateway instance so multi-gateway processes cannot execute plugin HTTP control-plane calls against another live gateway. Fixes #83486. (#83487) Thanks @coygeek.</li>
-<li>Telegram: keep hot-reload restarts from marking polling accounts manually stopped and restart isolated ingress cleanly after worker shutdown, preserving Telegram replies across config reloads. Fixes #83008. (#83410) Thanks @joshavant.</li>
-<li>Telegram/Ollama: pass current Telegram image attachments into native PI/Ollama vision turns so live photo prompts reach Ollama as native images. Fixes #83023. (#83516) Thanks @joshavant.</li>
-<li>Gateway/secrets: split the lightweight secrets runtime state and auth-store cache from the full secrets runtime and take a startup fast path when the gateway startup config has no SecretRef values, speeding up secrets startup while preserving cleanup and refresh semantics.</li>
-<li>Codex app-server: rotate oversized native Codex threads before resume and cap dynamic tool-result text entering native Codex sessions, preventing stale oversized context from surviving OpenClaw compaction. (#82981) Thanks @hansolo949.</li>
-<li>Gateway/restart: drain pending replies and active chat runs during restart shutdown before sockets and channels close, aborting timed-out chat runs through the normal cleanup path. (#69121) Thanks @alexlomt.</li>
-<li>Agents/Codex: use the Codex runtime context window for OpenAI-model preflight compaction and memory flush checks, so GPT-5.5 Codex sessions compact before hitting the smaller native context limit. Fixes #82982. Thanks @vliuyt.</li>
-<li>QA-Lab: clean orphaned gateway temp roots when a suite parent exits and wait on gateway plus transport readiness after config restarts, reducing stale <code>qa-channel</code> noise from interrupted runs. Fixes #65506. Thanks @100yenadmin.</li>
-<li>QA-Lab: wake qa-bus long polls that arrive with stale future cursors after a bus restart, preserving reconnect readiness for harness clients. (#67142) Thanks @hxy91819.</li>
-<li>QA-Lab: stage Multipass transfer scripts under OpenClaw's preferred temp root instead of raw OS temp paths, keeping the VM runner inside temp-path guardrails. (#64098) Thanks @ImLukeF.</li>
-<li>Agents/replies: keep surviving reply media and append a warning when other media references fail, so partial media normalization no longer drops failures silently. Thanks @Jerry-Xin.</li>
-<li>Config/models: accept <code>thinkingFormat: "together"</code> in model compat config so Together routes can opt into the Together-specific thinking response shape.</li>
-<li>Plugins/tokenjuice: bump the bundled tokenjuice runtime to 0.7.1, bringing Codex hook approval compatibility, pre-tool command wrapping fixes, and Rolldown/Vitest output compaction improvements into the OpenClaw plugin.</li>
-<li>Agents/OpenAI: stop post-processing GPT-5 final replies with hardcoded brevity caps, preserving full channel responses instead of appending synthetic ellipses, and log when strict-agentic GPT-5 execution activates. Fixes #82910.</li>
-<li>Mac app: refine the Settings General and Connection panes with cleaner status panels, card rows, and a single native titlebar sidebar toggle.</li>
-<li>Agents/media: deliver failed async image, music, and video generation completions directly when requester-session completion handoff fails, so channel users see provider errors instead of silent fallback stalls.</li>
-<li>Browser/CDP: keep loopback proxy bypass active across both <code>NO_PROXY</code> casings and redact home-relative Chrome MCP profile paths in attach-failure diagnostics.</li>
-<li>Agents/music: steer song, jingle, beat, anthem, and instrumental requests toward <code>music_generate</code> audio creation instead of lyric-only replies, and reserve <code>lyrics</code> for exact sung words.</li>
-<li>Codex app-server: record native Codex tool calls and results into trajectory artifacts so debug/trajectory exports capture the full Codex-native tool history, not just OpenClaw-bridged turns. Thanks @vyctorbrzezowski.</li>
-<li>Codex/app-server: keep bound conversation sessions on the owning agent runtime so native Codex control and follow-up turns do not fall back to the default agent client. Fixes #82954. (#82993)</li>
-<li>CLI/infer: run gateway model probes in fresh explicit sessions so one-shot provider checks do not inherit default agent transcript state. (#82861) Thanks @Kaspre.</li>
-<li>Providers/Together: send video-generation requests to Together's v2 video API even when shared text-model config still points at the v1 base URL. (#82992)</li>
-<li>Browser CLI: preserve browser-level options on nested commands, skip option values during lazy command registration, and keep long-running wait/download/dialog hooks open for their advertised wait window.</li>
-<li>CLI/sessions: accept <code>openclaw sessions list</code> as an alias for <code>openclaw sessions</code>, matching other list-style commands. Fixes #81139. (#81163) Thanks @YB0y.</li>
-<li>Channels/stream previews: widen compact progress draft lines and cut prose at word boundaries while preserving command/path suffixes, with <code>streaming.progress.maxLineChars</code> for channel-specific tuning.</li>
-<li>CLI/plugins: have <code>openclaw plugins doctor</code> warn when a configured runtime needs a missing owner plugin, sharing the same install mapping as <code>openclaw doctor --fix</code>. Fixes #81326. (#81674) Thanks @Zavianx.</li>
-<li>Agents/Codex: route OpenAI runs that resolve to <code>openai-codex</code> through the Codex provider and bootstrap OpenClaw's stored OAuth profile into the Codex harness when the harness owns transport, so <code>openai/*</code> model refs no longer fail with <code>No API key found for openai-codex</code> despite an existing Codex OAuth profile. (#82864) Thanks @ragesaq.</li>
-<li>Agents/ACP: distinguish prompt-submitted and runtime-active child stalls from true interactive waits, including redacted proxy-env diagnostics for Codex ACP no-output runs. Fixes #44810.</li>
-<li>Agents/memory: explain that memory-triggered compaction exposes only <code>read</code> and append-only <code>write</code> when configured core tools are unavailable in <code>tools.allow</code> warnings. Fixes #82941. Thanks @galiniliev.</li>
-<li>Agents/OpenAI: preserve deterministic tool payload ordering for prompt-cache reuse across OpenAI Responses and chat completions calls. (#82940) Thanks @galiniliev.</li>
-<li>ACP/Codex: honor terminal ACP turn results so failed Codex/acpx runs are not recorded as successful after only progress text. Fixes #79522. Thanks @dudaefj.</li>
-<li>Telegram: warn when a media group drops photos that fail to download, including albums where every photo is skipped. Fixes #55216. (#82987) Thanks @eldar702.</li>
-<li>Agents/diagnostics: treat repeated same-handle embedded-run cleanup as idempotent while preserving true replacement-handle mismatch diagnostics. Fixes #82959. (#82960) Thanks @galiniliev.</li>
-<li>Agents/subagents: preserve high-priority <code>AGENTS.md</code> policy in bootstrap context when oversized files are trimmed, and warn agents to read the full policy file before relying on scoped rules. Fixes #82920. (#82921) Thanks @galiniliev.</li>
-<li>Agents/skills: apply the full effective tool policy pipeline to inline <code>command-dispatch: tool</code> skill dispatch before owner-only filtering, preserving configured allow, deny, sandbox, sender, group, and subagent restrictions. (#78525)</li>
-<li>Codex: avoid spawning native hook relay subprocesses for post-tool/finalize events with no registered hook handlers while preserving pre-tool safety and approval relays. Fixes #76552. (#78004) Thanks @evgyur.</li>
-<li>Channel accounts: keep top-level default channel accounts visible when named accounts are added alongside default credential material, so mixed legacy/new account configs keep resolving <code>default</code> instead of silently dropping it.</li>
-<li>Agents/CLI: reject empty successful CLI subprocess replies as <code>empty_response</code> and keep them out of shared auth-profile health, so blank Claude CLI results no longer become green no-payload turns. Fixes #83231. (#83421) Thanks @joshavant.</li>
-<li>Codex/Telegram: synthesize native Codex tool progress from final turn snapshots so Telegram <code>/verbose</code> stays visible when command events arrive only at completion.</li>
-<li>Codex/Telegram: deliver Codex verbose tool summaries in direct message-tool-only turns while suppressing message-send and activity-log noise. (#83186) Thanks @kurplunkin.</li>
-<li>Mac app: make Channels settings open faster by deferring config-schema work, avoiding startup channel probes, caching decoded channel status rows, and showing only compact quick settings instead of the full generated channel schema.</li>
-<li>Control UI: include the Control UI and Gateway protocol versions in protocol-mismatch errors so stale app/dashboard pairings identify which side needs rebuilding or restarting.</li>
-<li>Gateway/protocol: restore Gateway WS protocol v4 and keep <code>message.action</code> room-event metadata on the existing <code>inboundTurnKind</code> wire field while preserving internal inbound-event classification.</li>
-<li>Agents/tools: prefer non-webchat session-key routes when the message tool has stale webchat context, so message-tool-only replies keep delivering to the originating channel. Fixes #82911. (#83004) Thanks @joshavant.</li>
-<li>Channels: keep direct-message last-route writes on isolated <code>per-channel-peer</code> sessions instead of contaminating the agent main session with channel delivery context. Fixes #36614. Thanks @aspenas.</li>
-<li>Mac app: move the Settings sidebar toggle into the native titlebar and tighten the General pane width.</li>
-<li>Mac app: keep visited Settings panes mounted so switching tabs no longer blanks and reloads their content.</li>
-<li>Mac app: make Config settings open from shallow schema lookups and load selected paths on demand instead of fetching and rendering the full generated config schema up front.</li>
-<li>Codex: sanitize inline image payloads before Codex app-server and OpenAI Responses replay, and clear poisoned Codex thread bindings after invalid image errors. Fixes #82878.</li>
-<li>Providers/GitHub Copilot: request identity-encoded Copilot API responses across token exchange, catalog, model calls, usage, and embeddings so compressed Business-account error payloads no longer reach JSON parsers as gzip bytes. Fixes #82871. Thanks @tonyfe01.</li>
-<li>Telegram: redact nested raw-update identifiers and user metadata before verbose raw update logging, preserving useful update/message ids without exposing chat, user, command, or profile details. (#82945) Thanks @galiniliev and @joshavant.</li>
-<li>Telegram: preserve replied-to bot messages, captions, and media metadata in group reply chains so follow-up replies understand what the user is reacting to. (#82863)</li>
-<li>Providers/Together: update PI runtime packages to 0.74.1 and emit Together-style <code>reasoning.enabled</code>/<code>max_tokens</code> controls for reasoning-capable OpenAI-completions models.</li>
-<li>Agents/diagnostics: split slow embedded-run <code>attempt-dispatch</code> startup summaries into workspace, prompt, runtime-plan, and final dispatch subspans so traces identify the delayed setup phase. Fixes #82782. (#82783) Thanks @galiniliev.</li>
-<li>Agents/Codex: flatten nested tool-result middleware blocks into bounded text so successful message sends are no longer replaced with <code>Tool output unavailable due to post-processing error</code>. Fixes #82912. Thanks @joeykrug.</li>
-<li>CLI/media: accept HTTP(S) URLs in <code>openclaw infer image describe --file</code>, fetching remote images through the guarded media path instead of treating URLs as local files. Fixes #82837. (#82854) Thanks @neeravmakwana.</li>
-<li>Agents/subagents: keep session-backed parent runs active when the child wait call times out before the child session has actually settled, so late subagent completions are reconciled instead of being lost. Fixes #82787. Thanks @ramitrkar-hash.</li>
-<li>Control UI: advertise shared Gateway protocol constants in browser connect frames, fixing protocol mismatch handshakes after protocol constant drift. Fixes #82882. Thanks @galiniliev.</li>
-<li>Gateway: add rollback protocol-mismatch diagnostics, including client protocol ranges in Gateway logs and deep status/doctor hints for stale client processes. Fixes #82841. (#82908)</li>
-<li>Agents/subagents: keep successful keep-mode completion payloads pending after final-delivery retry exhaustion, so requester recovery no longer loses final subagent results. Fixes #82583. (#82999) Thanks @joshavant.</li>
-<li>Gateway/auth: allow same-host trusted-proxy callers to use the documented local direct <code>gateway.auth.password</code> fallback after revisiting the #78684 fail-closed policy, while keeping token fallback rejected and forwarded-header requests on the trusted-proxy path. Fixes #82607. (#82953) Thanks @joshavant.</li>
-<li>Agents/subagents: wait for queued completion handoffs to reach the parent transcript before marking them announced, preventing busy parent runs from cleaning up before observing child results. Fixes #82913. (#83039) Thanks @joshavant.</li>
-<li>Agents/subagents: route group/channel subagent completions through message-tool-only handoffs when required and keep active-requester wake failures from dropping completion delivery. Fixes #82803. Thanks @galiniliev, @yozakura-ava, and @moeedahmed.</li>
-<li>Memory-core: scan persisted memory source sessions on startup, comparing on-disk transcripts against the index and marking only missing/newer/resized files dirty for incremental sync. Fixes #82341. (#82341) Thanks @giodl73-repo.</li>
-<li>Telegram: keep the top-level default account in the account list when named accounts or bindings are added alongside top-level credentials, preserving default polling while still letting named-only configs resolve to a single account. Fixes #82794. (#82794) Thanks @giodl73-repo.</li>
-<li>CLI/models: reuse command-scoped plugin metadata across model listing, provider catalog, auth, and synthetic-auth checks, restoring fast <code>openclaw models</code> runs for plugin-heavy installs. Fixes #82881. (#83033) Thanks @joshavant.</li>
-<li>CLI/channels: show configured official external channels such as Discord in <code>openclaw channels list</code> when their plugin package is missing, including the install and doctor repair command instead of reporting no configured channels. Fixes #82813.</li>
-<li>Signal: preserve mixed-case group IDs through routing and session persistence so group auto-replies keep delivering after updates. Fixes #82827.</li>
-<li>Agents/tools: keep the <code>message</code> tool available in embedded runs when it is explicitly allowed through <code>tools.alsoAllow</code> or runtime tool allowlists, so channel plugins with custom reply delivery can still use configured message sends. Fixes #82833. Thanks @cn1313113.</li>
-<li>WhatsApp: honor forced document delivery for outbound image, GIF, and video media so <code>forceDocument</code>/<code>asDocument</code> sends preserve original media bytes instead of using compressed media payloads. (#79272) Thanks @itsuzef.</li>
-<li>WhatsApp: name outbound document attachments from their MIME type when no filename is provided, so PDF and CSV sends arrive as <code>file.pdf</code> and <code>file.csv</code> instead of an extensionless <code>file</code>. Thanks @mcaxtr.</li>
-<li>Process/diagnostics: report active lane blockers in lane wait warnings so <code>queueAhead=0</code> no longer hides commands waiting behind active work. Fixes #82791. (#82792) Thanks @galiniliev.</li>
-<li>Process/diagnostics: stop counting the active processing turn as queued backlog in liveness warnings so transient max-only event-loop spikes do not surface as gateway warnings.</li>
-<li>Agents/replies: classify provider conversation-state rejections and return a clear message-channel error instead of auto-resetting or falling back to a generic runner failure. (#82616) Thanks @dutifulbob.</li>
-<li>Browser plugin: trust managed Chrome CDP diagnostics when launch HTTP probes race cold-start readiness, avoiding false startup failures. Fixes #82904. (#82986) Thanks @kmanan and @hclsys.</li>
-<li>Android: prompt before replacing a changed Gateway TLS thumbprint, showing the old and new SHA-256 fingerprints so users can accept expected certificate rotations instead of hard failing on pin mismatch. (#83077) Thanks @sliekens.</li>
-<li>CLI/status: render extra gateway-like service diagnostics as warning/info output instead of error output. Fixes #46930. (#82922) thanks @giodl73-repo.</li>
-<li>Agents/failover: classify Moonshot/Kimi exhausted-balance HTTP 429 payloads as billing instead of generic rate limits, preserving billing guidance and fallback behavior. Fixes #43447. (#83079) Thanks @leno23.</li>
-<li>Plugin SDK: bundle <code>openclaw/plugin-sdk/zod</code> into the published package artifact and verify the packed zod subpath stays self-contained, so pnpm global installs can register plugins without a package-local <code>zod</code> symlink. Fixes #78398. (#78515) Thanks @ggzeng.</li>
-<li>Providers/Google: drop compaction-truncated Gemini thought signatures before replay so malformed Base64 no longer aborts the next assistant turn. (#82995) Thanks @wAngByg.</li>
-<li>Gateway/mobile: allow paired iOS and Android clients to refresh same-family OS metadata on authenticated reconnect instead of requiring a new approval. (#83490) Thanks @ngutman.</li>
-<li>WhatsApp: treat <code>upload-file</code> as a supported media send intent by lowering path/URL uploads through the channel's normal send-media transport. (#81883) Thanks @ngutman.</li>
-<li>iOS: end Live Activities when OpenClaw is connected, idle, or disconnected, and show compact attention states for approval-required reconnects. (#83597) Thanks @ngutman.</li>
-<li>Control UI: hide child nav items when collapsing the active sidebar group. Fixes #42167. (#42223) Thanks @Aroool.</li>
-<li>CI/proof: skip the real-behavior-proof gate for private org maintainers by minting a least-privilege (<code>members: read</code>) GitHub App token and checking active membership in the <code>maintainer</code> team, instead of treating <code>author_association=CONTRIBUTOR</code> as definitively external. (#83418) Thanks @romneyda.</li>
-</ul>
-<p><a href="https://github.com/openclaw/openclaw/blob/main/CHANGELOG.md">View full changelog</a></p>
-]]></description>
-            <enclosure url="https://github.com/openclaw/openclaw/releases/download/v2026.5.19/OpenClaw-2026.5.19.zip" length="54062201" type="application/octet-stream" sparkle:edSignature="7bVi6rv+TjhrUfi32V62BW2VgyV17jm7x+H6p10PRClCdXKZjhM7AX6MyvAz2+e7kzXIknj1Y9X7q43/E9fBBw=="/>
-        </item>
     </channel>
 </rss>

apps/android/app/build.gradle.kts

@@ -65,8 +65,8 @@ android {
     applicationId = "ai.openclaw.app"
     minSdk = 31
     targetSdk = 36
-    versionCode = 2026052601
-    versionName = "2026.5.26"
+    versionCode = 2026052801
+    versionName = "2026.5.28"
     ndk {
       // Support all major ABIs — native libs are tiny (~47 KB per ABI)
       abiFilters += listOf("armeabi-v7a", "arm64-v8a", "x86", "x86_64")

apps/android/app/src/main/java/ai/openclaw/app/gateway/GatewayHostSecurity.kt

@@ -44,7 +44,7 @@ internal fun isLoopbackGatewayHost(
   return isMappedIpv4 && address[12] == 127.toByte()
 }
 
-internal fun isPrivateLanGatewayHost(
+internal fun isLocalCleartextGatewayHost(
   rawHost: String?,
   allowEmulatorBridgeAlias: Boolean = isAndroidEmulatorRuntime(),
 ): Boolean {

apps/android/app/src/main/java/ai/openclaw/app/gateway/GatewaySession.kt

@@ -632,7 +632,7 @@ class GatewaySession(
 
     private fun shouldPersistBootstrapHandoffTokens(authSource: GatewayConnectAuthSource): Boolean {
       if (authSource != GatewayConnectAuthSource.BOOTSTRAP_TOKEN) return false
-      if (isLoopbackGatewayHost(endpoint.host)) return true
+      if (isLocalCleartextGatewayHost(endpoint.host)) return true
       return tls != null
     }
 
@@ -1212,9 +1212,7 @@ class GatewaySession(
     endpoint: GatewayEndpoint,
     tls: GatewayTlsParams?,
   ): Boolean {
-    if (isLoopbackGatewayHost(endpoint.host)) {
-      return true
-    }
+    if (isLocalCleartextGatewayHost(endpoint.host)) return true
     return tls?.expectedFingerprint?.trim()?.isNotEmpty() == true
   }
 }

apps/android/app/src/main/java/ai/openclaw/app/node/ConnectionManager.kt

@@ -8,6 +8,7 @@ import ai.openclaw.app.gateway.GatewayClientInfo
 import ai.openclaw.app.gateway.GatewayConnectOptions
 import ai.openclaw.app.gateway.GatewayEndpoint
 import ai.openclaw.app.gateway.GatewayTlsParams
+import ai.openclaw.app.gateway.isLocalCleartextGatewayHost
 import ai.openclaw.app.gateway.isLoopbackGatewayHost
 import android.os.Build
 
@@ -35,7 +36,12 @@ class ConnectionManager(
       val stableId = endpoint.stableId
       val stored = storedFingerprint?.trim().takeIf { !it.isNullOrEmpty() }
       val isManual = stableId.startsWith("manual|")
-      val cleartextAllowedHost = isLoopbackGatewayHost(endpoint.host)
+      val cleartextAllowedHost =
+        if (isManual) {
+          isLocalCleartextGatewayHost(endpoint.host)
+        } else {
+          isLoopbackGatewayHost(endpoint.host)
+        }
 
       if (isManual) {
         if (!manualTlsEnabled && cleartextAllowedHost) return null

apps/android/app/src/main/java/ai/openclaw/app/ui/GatewayConfigResolver.kt

@@ -1,6 +1,6 @@
 package ai.openclaw.app.ui
 
-import ai.openclaw.app.gateway.isLoopbackGatewayHost
+import ai.openclaw.app.gateway.isLocalCleartextGatewayHost
 import kotlinx.serialization.json.Json
 import kotlinx.serialization.json.JsonObject
 import kotlinx.serialization.json.JsonPrimitive
@@ -56,9 +56,9 @@ internal data class GatewayScannedSetupCodeResult(
 
 private val gatewaySetupJson = Json { ignoreUnknownKeys = true }
 private const val remoteGatewaySecurityRule =
-  "Tailscale and public mobile nodes require wss:// or Tailscale Serve. ws:// is allowed only for localhost and the Android emulator."
+  "Public gateways require wss:// or Tailscale Serve. ws:// is allowed for localhost, the Android emulator, and private LAN IPs."
 private const val remoteGatewaySecurityFix =
-  "Use localhost/the Android emulator, or enable Tailscale Serve / expose a wss:// gateway URL."
+  "Use a private LAN IP for local setup, or enable Tailscale Serve / expose a wss:// gateway URL for remote access."
 
 internal fun resolveGatewayConnectConfig(
   useSetupCode: Boolean,
@@ -147,7 +147,7 @@ internal fun parseGatewayEndpointResult(rawInput: String): GatewayEndpointParseR
     return GatewayEndpointParseResult(error = GatewayEndpointValidationError.INVALID_URL)
   }
   val tls = scheme == "wss" || scheme == "https"
-  if (!tls && !isLoopbackGatewayHost(host)) {
+  if (!tls && !isLocalCleartextGatewayHost(host)) {
     return GatewayEndpointParseResult(error = GatewayEndpointValidationError.INSECURE_REMOTE_URL)
   }
   val defaultPort = if (tls) 443 else 18789

apps/android/app/src/main/java/ai/openclaw/app/ui/GatewayDiagnostics.kt

@@ -51,7 +51,7 @@ internal fun buildGatewayDiagnosticsReport(
     Please:
     - pick one route only: same machine, same LAN, Tailscale, or public URL
     - classify this as pairing/auth, TLS trust, wrong advertised route, wrong address/port, or gateway down
-    - remember: Tailscale/public mobile routes require wss:// or Tailscale Serve; ws:// is loopback-only
+    - remember: public routes require wss:// or Tailscale Serve; ws:// is allowed for localhost, the Android emulator, and private LAN IPs
     - quote the exact app status/error below
     - tell me whether `openclaw devices list` should show a pending pairing request
     - if more signal is needed, ask for `openclaw qr --json`, `openclaw devices list`, and `openclaw nodes status`

apps/android/app/src/test/java/ai/openclaw/app/node/ConnectionManagerTest.kt

@@ -4,8 +4,8 @@ import ai.openclaw.app.LocationMode
 import ai.openclaw.app.SecurePrefs
 import ai.openclaw.app.VoiceWakeMode
 import ai.openclaw.app.gateway.GatewayEndpoint
+import ai.openclaw.app.gateway.isLocalCleartextGatewayHost
 import ai.openclaw.app.gateway.isLoopbackGatewayHost
-import ai.openclaw.app.gateway.isPrivateLanGatewayHost
 import ai.openclaw.app.protocol.OpenClawCallLogCommand
 import ai.openclaw.app.protocol.OpenClawCameraCommand
 import ai.openclaw.app.protocol.OpenClawCapability
@@ -109,7 +109,7 @@ class ConnectionManagerTest {
   }
 
   @Test
-  fun resolveTlsParamsForEndpoint_manualPrivateLanForcesTlsWhenToggleIsOff() {
+  fun resolveTlsParamsForEndpoint_manualPrivateLanRespectsManualTlsToggle() {
     val endpoint = GatewayEndpoint.manual(host = "192.168.1.20", port = 18789)
 
     val params =
@@ -119,9 +119,21 @@ class ConnectionManagerTest {
         manualTlsEnabled = false,
       )
 
-    assertEquals(true, params?.required)
-    assertNull(params?.expectedFingerprint)
-    assertEquals(false, params?.allowTOFU)
+    assertNull(params)
+  }
+
+  @Test
+  fun resolveTlsParamsForEndpoint_manualPrivateLanCleartextCanOverrideStoredPin() {
+    val endpoint = GatewayEndpoint.manual(host = "192.168.1.20", port = 18789)
+
+    val params =
+      ConnectionManager.resolveTlsParamsForEndpoint(
+        endpoint,
+        storedFingerprint = "pinned",
+        manualTlsEnabled = false,
+      )
+
+    assertNull(params)
   }
 
   @Test
@@ -245,11 +257,11 @@ class ConnectionManagerTest {
   }
 
   @Test
-  fun isPrivateLanGatewayHost_acceptsLanIpsButRejectsMdnsAndTailnetHosts() {
-    assertTrue(isPrivateLanGatewayHost("192.168.1.20"))
-    assertFalse(isPrivateLanGatewayHost("gateway.local"))
-    assertFalse(isPrivateLanGatewayHost("100.64.0.9"))
-    assertFalse(isPrivateLanGatewayHost("gateway.tailnet.ts.net"))
+  fun isLocalCleartextGatewayHost_acceptsLanIpsButRejectsMdnsAndTailnetHosts() {
+    assertTrue(isLocalCleartextGatewayHost("192.168.1.20"))
+    assertFalse(isLocalCleartextGatewayHost("gateway.local"))
+    assertFalse(isLocalCleartextGatewayHost("100.64.0.9"))
+    assertFalse(isLocalCleartextGatewayHost("gateway.tailnet.ts.net"))
   }
 
   @Test

apps/android/app/src/test/java/ai/openclaw/app/ui/GatewayConfigResolverTest.kt

@@ -99,9 +99,18 @@ class GatewayConfigResolverTest {
   }
 
   @Test
-  fun parseGatewayEndpointRejectsPrivateLanCleartextWsUrls() {
+  fun parseGatewayEndpointAllowsPrivateLanCleartextWsUrls() {
     val parsed = parseGatewayEndpoint("ws://192.168.1.20:18789")
-    assertNull(parsed)
+
+    assertEquals(
+      GatewayEndpointConfig(
+        host = "192.168.1.20",
+        port = 18789,
+        tls = false,
+        displayUrl = "http://192.168.1.20:18789",
+      ),
+      parsed,
+    )
   }
 
   @Test
@@ -146,9 +155,13 @@ class GatewayConfigResolverTest {
   }
 
   @Test
-  fun parseGatewayEndpointRejectsLinkLocalIpv6ZoneCleartextWsUrls() {
+  fun parseGatewayEndpointAllowsLinkLocalIpv6ZoneCleartextWsUrls() {
     val parsed = parseGatewayEndpoint("ws://[fe80::1%25eth0]")
-    assertNull(parsed)
+
+    assertEquals("fe80::1%25eth0", parsed?.host)
+    assertEquals(18789, parsed?.port)
+    assertEquals(false, parsed?.tls)
+    assertEquals("http://[fe80::1%25eth0]:18789", parsed?.displayUrl)
   }
 
   @Test
@@ -249,6 +262,16 @@ class GatewayConfigResolverTest {
     assertNull(resolved)
   }
 
+  @Test
+  fun resolveScannedSetupCodeAcceptsPrivateLanCleartextGateway() {
+    val setupCode =
+      encodeSetupCode("""{"url":"ws://192.168.31.100:18789","bootstrapToken":"bootstrap-1"}""")
+
+    val resolved = resolveScannedSetupCode(setupCode)
+
+    assertEquals(setupCode, resolved)
+  }
+
   @Test
   fun resolveScannedSetupCodeResultFlagsInsecureRemoteGateway() {
     val setupCode =
@@ -277,10 +300,19 @@ class GatewayConfigResolverTest {
   }
 
   @Test
-  fun parseGatewayEndpointResultFlagsInsecureLanCleartextGateway() {
+  fun parseGatewayEndpointResultAllowsPrivateLanCleartextGateway() {
     val parsed = parseGatewayEndpointResult("ws://192.168.1.20:18789")
-    assertNull(parsed.config)
-    assertEquals(GatewayEndpointValidationError.INSECURE_REMOTE_URL, parsed.error)
+
+    assertEquals(
+      GatewayEndpointConfig(
+        host = "192.168.1.20",
+        port = 18789,
+        tls = false,
+        displayUrl = "http://192.168.1.20:18789",
+      ),
+      parsed.config,
+    )
+    assertNull(parsed.error)
   }
 
   @Test
@@ -421,7 +453,7 @@ class GatewayConfigResolverTest {
   }
 
   @Test
-  fun resolveGatewayConnectConfigRejectsPrivateLanManualCleartextEndpoint() {
+  fun resolveGatewayConnectConfigAllowsPrivateLanManualCleartextEndpoint() {
     val resolved =
       resolveGatewayConnectConfig(
         useSetupCode = false,
@@ -437,7 +469,9 @@ class GatewayConfigResolverTest {
         fallbackPassword = "",
       )
 
-    assertNull(resolved)
+    assertEquals("192.168.31.100", resolved?.host)
+    assertEquals(18789, resolved?.port)
+    assertEquals(false, resolved?.tls)
   }
 
   @Test

apps/ios/CHANGELOG.md

@@ -1,5 +1,13 @@
 # OpenClaw iOS Changelog
 
+## 2026.5.28 - 2026-05-28
+
+Maintenance update for the current OpenClaw release.
+
+## 2026.5.27 - 2026-05-27
+
+Maintenance update for the current OpenClaw release.
+
 ## 2026.5.26 - 2026-05-26
 
 Maintenance update for the current OpenClaw release.

apps/ios/Config/Version.xcconfig

@@ -2,8 +2,8 @@
 // Source of truth: apps/ios/version.json
 // Generated by scripts/ios-sync-versioning.ts.
 
-OPENCLAW_IOS_VERSION = 2026.5.26
-OPENCLAW_MARKETING_VERSION = 2026.5.26
+OPENCLAW_IOS_VERSION = 2026.5.28
+OPENCLAW_MARKETING_VERSION = 2026.5.28
 OPENCLAW_BUILD_VERSION = 1
 
 #include? "../build/Version.xcconfig"

apps/ios/Sources/Assets.xcassets/OpenClawIcon.imageset/Contents.json

@@ -0,0 +1,12 @@
+{
+  "images": [
+    {
+      "filename": "openclaw-icon.png",
+      "idiom": "universal"
+    }
+  ],
+  "info": {
+    "author": "xcode",
+    "version": 1
+  }
+}

apps/ios/Sources/Chat/ChatSheet.swift

@@ -1,47 +0,0 @@
-import OpenClawChatUI
-import OpenClawKit
-import SwiftUI
-
-struct ChatSheet: View {
-    @Environment(\.dismiss) private var dismiss
-    @State private var viewModel: OpenClawChatViewModel
-    private let userAccent: Color?
-    private let agentName: String?
-
-    init(gateway: GatewayNodeSession, sessionKey: String, agentName: String? = nil, userAccent: Color? = nil) {
-        let transport = IOSGatewayChatTransport(gateway: gateway)
-        self._viewModel = State(
-            initialValue: OpenClawChatViewModel(
-                sessionKey: sessionKey,
-                transport: transport))
-        self.userAccent = userAccent
-        self.agentName = agentName
-    }
-
-    var body: some View {
-        NavigationStack {
-            OpenClawChatView(
-                viewModel: self.viewModel,
-                showsSessionSwitcher: true,
-                userAccent: self.userAccent)
-                .navigationTitle(self.chatTitle)
-                .navigationBarTitleDisplayMode(.inline)
-                .toolbar {
-                    ToolbarItem(placement: .topBarTrailing) {
-                        Button {
-                            self.dismiss()
-                        } label: {
-                            Image(systemName: "xmark")
-                        }
-                        .accessibilityLabel("Close")
-                    }
-                }
-        }
-    }
-
-    private var chatTitle: String {
-        let trimmed = (self.agentName ?? "").trimmingCharacters(in: .whitespacesAndNewlines)
-        if trimmed.isEmpty { return "Chat" }
-        return "Chat (\(trimmed))"
-    }
-}

apps/ios/Sources/Chat/IOSGatewayChatTransport.swift

@@ -6,30 +6,162 @@ import OSLog
 
 struct IOSGatewayChatTransport: OpenClawChatTransport {
     private static let logger = Logger(subsystem: "ai.openclaw", category: "ios.chat.transport")
+    static let defaultChatSendTimeoutMs = 30000
     private let gateway: GatewayNodeSession
 
+    private struct CreateSessionParams: Codable {
+        var key: String
+        var label: String?
+        var parentSessionKey: String?
+    }
+
+    private struct RunParams: Codable {
+        var sessionKey: String
+        var runId: String
+    }
+
+    private struct ListSessionsParams: Codable {
+        var includeGlobal: Bool
+        var includeUnknown: Bool
+        var limit: Int?
+    }
+
+    private struct SessionKeyParams: Codable {
+        var key: String
+    }
+
+    private struct ChatSendParams: Codable {
+        var sessionKey: String
+        var message: String
+        var thinking: String
+        var attachments: [OpenClawChatAttachmentPayload]?
+        var timeoutMs: Int
+        var idempotencyKey: String
+    }
+
+    private struct AgentWaitParams: Codable {
+        var runId: String
+        var timeoutMs: Int
+    }
+
+    private struct AgentWaitResponse: Codable {
+        var runId: String?
+        var status: String?
+        var error: String?
+    }
+
+    struct AgentWaitCompletion: Equatable {
+        var runId: String
+        var status: String
+        var completed: Bool
+    }
+
+    static func isAgentWaitCompletionStatus(_ status: String) -> Bool {
+        switch status.trimmingCharacters(in: .whitespacesAndNewlines).lowercased() {
+        case "ok", "completed", "success", "succeeded":
+            true
+        default:
+            false
+        }
+    }
+
     init(gateway: GatewayNodeSession) {
         self.gateway = gateway
     }
 
-    func abortRun(sessionKey: String, runId: String) async throws {
-        struct Params: Codable {
-            var sessionKey: String
-            var runId: String
+    static func agentWaitRequestTimeoutSeconds(timeoutMs: Int) -> Int {
+        max(1, Int(ceil(Double(timeoutMs) / 1000.0)) + 5)
+    }
+
+    static func makeListSessionsParamsJSON(limit: Int?) throws -> String {
+        try self.encodeParams(ListSessionsParams(includeGlobal: true, includeUnknown: false, limit: limit))
+    }
+
+    static func makeChatSendParamsJSON(
+        sessionKey: String,
+        message: String,
+        thinking: String,
+        idempotencyKey: String,
+        attachments: [OpenClawChatAttachmentPayload]) throws -> String
+    {
+        let params = ChatSendParams(
+            sessionKey: sessionKey,
+            message: message,
+            thinking: thinking,
+            attachments: attachments.isEmpty ? nil : attachments,
+            timeoutMs: self.defaultChatSendTimeoutMs,
+            idempotencyKey: idempotencyKey)
+        return try self.encodeParams(params)
+    }
+
+    static func decodeAgentWaitCompletion(_ data: Data, fallbackRunId: String) throws -> AgentWaitCompletion {
+        let decoded = try JSONDecoder().decode(AgentWaitResponse.self, from: data)
+        let status = (decoded.status ?? "unknown").lowercased()
+        return AgentWaitCompletion(
+            runId: decoded.runId ?? fallbackRunId,
+            status: status,
+            completed: self.isAgentWaitCompletionStatus(status))
+    }
+
+    private static func makeCreateSessionParamsJSON(
+        key: String,
+        label: String?,
+        parentSessionKey: String?) throws -> String
+    {
+        let params = CreateSessionParams(
+            key: key,
+            label: label,
+            parentSessionKey: parentSessionKey)
+        return try self.encodeParams(params)
+    }
+
+    private static func makeRunParamsJSON(sessionKey: String, runId: String) throws -> String {
+        try self.encodeParams(RunParams(sessionKey: sessionKey, runId: runId))
+    }
+
+    private static func makeSessionKeyParamsJSON(_ sessionKey: String) throws -> String {
+        try self.encodeParams(SessionKeyParams(key: sessionKey))
+    }
+
+    private static func makeHistoryParamsJSON(sessionKey: String) throws -> String {
+        struct Params: Codable { var sessionKey: String }
+        return try self.encodeParams(Params(sessionKey: sessionKey))
+    }
+
+    private static func makeAgentWaitParamsJSON(runId: String, timeoutMs: Int) throws -> String {
+        try self.encodeParams(AgentWaitParams(runId: runId, timeoutMs: timeoutMs))
+    }
+
+    private static func encodeParams(_ params: some Encodable) throws -> String {
+        let data = try JSONEncoder().encode(params)
+        guard let json = String(bytes: data, encoding: .utf8) else {
+            throw EncodingError.invalidValue(
+                params,
+                EncodingError.Context(codingPath: [], debugDescription: "Encoded gateway params were not UTF-8"))
         }
-        let data = try JSONEncoder().encode(Params(sessionKey: sessionKey, runId: runId))
-        let json = String(data: data, encoding: .utf8)
+        return json
+    }
+
+    func createSession(
+        key: String,
+        label: String?,
+        parentSessionKey: String?) async throws -> OpenClawChatCreateSessionResponse
+    {
+        let json = try Self.makeCreateSessionParamsJSON(
+            key: key,
+            label: label,
+            parentSessionKey: parentSessionKey)
+        let res = try await self.gateway.request(method: "sessions.create", paramsJSON: json, timeoutSeconds: 15)
+        return try JSONDecoder().decode(OpenClawChatCreateSessionResponse.self, from: res)
+    }
+
+    func abortRun(sessionKey: String, runId: String) async throws {
+        let json = try Self.makeRunParamsJSON(sessionKey: sessionKey, runId: runId)
         _ = try await self.gateway.request(method: "chat.abort", paramsJSON: json, timeoutSeconds: 10)
     }
 
     func listSessions(limit: Int?) async throws -> OpenClawChatSessionsListResponse {
-        struct Params: Codable {
-            var includeGlobal: Bool
-            var includeUnknown: Bool
-            var limit: Int?
-        }
-        let data = try JSONEncoder().encode(Params(includeGlobal: true, includeUnknown: false, limit: limit))
-        let json = String(data: data, encoding: .utf8)
+        let json = try Self.makeListSessionsParamsJSON(limit: limit)
         let res = try await self.gateway.request(method: "sessions.list", paramsJSON: json, timeoutSeconds: 15)
         return try JSONDecoder().decode(OpenClawChatSessionsListResponse.self, from: res)
     }
@@ -40,23 +172,17 @@ struct IOSGatewayChatTransport: OpenClawChatTransport {
     }
 
     func resetSession(sessionKey: String) async throws {
-        struct Params: Codable { var key: String }
-        let data = try JSONEncoder().encode(Params(key: sessionKey))
-        let json = String(data: data, encoding: .utf8)
+        let json = try Self.makeSessionKeyParamsJSON(sessionKey)
         _ = try await self.gateway.request(method: "sessions.reset", paramsJSON: json, timeoutSeconds: 10)
     }
 
     func compactSession(sessionKey: String) async throws {
-        struct Params: Codable { var key: String }
-        let data = try JSONEncoder().encode(Params(key: sessionKey))
-        let json = String(data: data, encoding: .utf8)
+        let json = try Self.makeSessionKeyParamsJSON(sessionKey)
         _ = try await self.gateway.request(method: "sessions.compact", paramsJSON: json, timeoutSeconds: 10)
     }
 
     func requestHistory(sessionKey: String) async throws -> OpenClawChatHistoryPayload {
-        struct Params: Codable { var sessionKey: String }
-        let data = try JSONEncoder().encode(Params(sessionKey: sessionKey))
-        let json = String(data: data, encoding: .utf8)
+        let json = try Self.makeHistoryParamsJSON(sessionKey: sessionKey)
         let res = try await self.gateway.request(method: "chat.history", paramsJSON: json, timeoutSeconds: 15)
         return try JSONDecoder().decode(OpenClawChatHistoryPayload.self, from: res)
     }
@@ -73,35 +199,52 @@ struct IOSGatewayChatTransport: OpenClawChatTransport {
                 + "len=\(message.count) attachments=\(attachments.count)"
         Self.logger.info(
             "\(startLogMessage, privacy: .public)")
-        struct Params: Codable {
-            var sessionKey: String
-            var message: String
-            var thinking: String
-            var attachments: [OpenClawChatAttachmentPayload]?
-            var timeoutMs: Int
-            var idempotencyKey: String
-        }
-
-        let params = Params(
+        GatewayDiagnostics.log(startLogMessage)
+        let json = try Self.makeChatSendParamsJSON(
             sessionKey: sessionKey,
             message: message,
             thinking: thinking,
-            attachments: attachments.isEmpty ? nil : attachments,
-            timeoutMs: 30000,
-            idempotencyKey: idempotencyKey)
-        let data = try JSONEncoder().encode(params)
-        let json = String(data: data, encoding: .utf8)
+            idempotencyKey: idempotencyKey,
+            attachments: attachments)
         do {
             let res = try await self.gateway.request(method: "chat.send", paramsJSON: json, timeoutSeconds: 35)
             let decoded = try JSONDecoder().decode(OpenClawChatSendResponse.self, from: res)
             Self.logger.info("chat.send ok runId=\(decoded.runId, privacy: .public)")
+            GatewayDiagnostics.log("chat.send ok runId=\(decoded.runId) status=\(decoded.status)")
             return decoded
         } catch {
             Self.logger.error("chat.send failed \(error.localizedDescription, privacy: .public)")
+            GatewayDiagnostics.log("chat.send failed error=\(error.localizedDescription)")
             throw error
         }
     }
 
+    func waitForRunCompletion(runId rawRunId: String, timeoutMs: Int) async -> Bool {
+        let runId = rawRunId.trimmingCharacters(in: .whitespacesAndNewlines)
+        guard !runId.isEmpty else { return false }
+
+        do {
+            let json = try Self.makeAgentWaitParamsJSON(runId: runId, timeoutMs: timeoutMs)
+            let requestTimeoutSeconds = Self.agentWaitRequestTimeoutSeconds(timeoutMs: timeoutMs)
+            GatewayDiagnostics.log("agent.wait start runId=\(runId)")
+            let res = try await self.gateway.request(
+                method: "agent.wait",
+                paramsJSON: json,
+                timeoutSeconds: requestTimeoutSeconds)
+            let completion = try Self.decodeAgentWaitCompletion(res, fallbackRunId: runId)
+            GatewayDiagnostics.log("agent.wait completed runId=\(completion.runId) status=\(completion.status)")
+            if !completion.completed {
+                Self.logger.warning(
+                    "agent.wait status \(completion.status, privacy: .public) runId=\(runId, privacy: .public)")
+            }
+            return completion.completed
+        } catch {
+            Self.logger.warning("agent.wait failed \(error.localizedDescription, privacy: .public)")
+            GatewayDiagnostics.log("agent.wait failed runId=\(runId) error=\(error.localizedDescription)")
+            return false
+        }
+    }
+
     func requestHealth(timeoutMs: Int) async throws -> Bool {
         let seconds = max(1, Int(ceil(Double(timeoutMs) / 1000.0)))
         let res = try await self.gateway.request(method: "health", paramsJSON: nil, timeoutSeconds: seconds)

apps/ios/Sources/Design/AgentProDreamingDestination.swift

@@ -0,0 +1,690 @@
+import Foundation
+import OpenClawKit
+import SwiftUI
+
+struct AgentProDreamingDestination: View {
+    @Environment(NodeAppModel.self) private var appModel
+    let overview: AgentOverviewSnapshot?
+    let gatewayConnected: Bool
+    let overviewLoading: Bool
+    let dreamingValue: String
+    let dreamingDetail: String
+    let dreamingColor: Color
+    let refresh: () async -> Void
+    @State private var selectedDreamDiaryDayID: String?
+    @State private var dreamActionBusy: DreamAction?
+    @State private var dreamActionStatusText: String?
+
+    var body: some View {
+        ZStack {
+            OpenClawProBackground()
+            ScrollView {
+                VStack(alignment: .leading, spacing: 16) {
+                    self.detailSummaryCard(
+                        icon: "moon",
+                        title: "Dreaming",
+                        value: self.dreamingValue,
+                        detail: self.dreamingDetail,
+                        color: self.dreamingColor)
+                    self.dreamingTotalsCard
+                    self.dreamingActionsCard
+                    self.dreamDiaryCard
+                    self.dreamingEntriesList(
+                        title: "Promoted Entries",
+                        entries: self.overview?.dreaming?.promotedEntries ?? [],
+                        emptyTitle: "No promoted entries",
+                        emptyDetail: "Dreaming has not promoted durable memory entries yet.")
+                    self.dreamingEntriesList(
+                        title: "Signal Entries",
+                        entries: self.overview?.dreaming?.signalEntries ?? [],
+                        emptyTitle: "No signal entries",
+                        emptyDetail: "No recent recall, daily, grounded, or phase signals were reported.")
+                    self.dreamingEntriesList(
+                        title: "Short-Term Recall",
+                        entries: self.overview?.dreaming?.shortTermEntries ?? [],
+                        emptyTitle: "No short-term entries",
+                        emptyDetail: "The short-term dreaming store is empty.")
+                    self.dreamingPhasesCard
+                }
+                .padding(.vertical, 18)
+            }
+            .refreshable {
+                await self.refresh()
+            }
+            .safeAreaPadding(.bottom, OpenClawProMetric.bottomScrollInset)
+        }
+        .navigationTitle("Dreaming")
+        .navigationBarTitleDisplayMode(.inline)
+    }
+
+    private enum DreamAction: String, CaseIterable, Identifiable {
+        case backfill
+        case repair
+        case dedupe
+
+        var id: Self {
+            self
+        }
+
+        var title: String {
+            switch self {
+            case .backfill: "Backfill"
+            case .repair: "Repair"
+            case .dedupe: "Dedupe"
+            }
+        }
+
+        var icon: String {
+            switch self {
+            case .backfill: "book.pages"
+            case .repair: "wrench.and.screwdriver"
+            case .dedupe: "square.stack.3d.down.right"
+            }
+        }
+
+        var method: String {
+            switch self {
+            case .backfill: "doctor.memory.backfillDreamDiary"
+            case .repair: "doctor.memory.repairDreamingArtifacts"
+            case .dedupe: "doctor.memory.dedupeDreamDiary"
+            }
+        }
+    }
+
+    private func detailSummaryCard(
+        icon: String,
+        title: String,
+        value: String,
+        detail: String,
+        color: Color) -> some View
+    {
+        ProCard {
+            HStack(spacing: 12) {
+                ProIconBadge(systemName: icon, color: color)
+                VStack(alignment: .leading, spacing: 3) {
+                    Text(title)
+                        .font(.headline)
+                    Text(detail)
+                        .font(.caption)
+                        .foregroundStyle(.secondary)
+                }
+                Spacer(minLength: 8)
+                ProValuePill(value: value, color: color)
+            }
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+
+    private var dreamingTotalsCard: some View {
+        ProCard {
+            VStack(alignment: .leading, spacing: 12) {
+                HStack {
+                    Text("Memory State")
+                        .font(.headline)
+                    Spacer()
+                    ProValuePill(value: self.dreamingValue, color: self.dreamingColor)
+                }
+                HStack(spacing: 10) {
+                    self.detailMetric(
+                        label: "Short-term",
+                        value: Self.compactNumber(self.overview?.dreaming?.shortTermCount ?? 0))
+                    self.detailMetric(
+                        label: "Signals",
+                        value: Self.compactNumber(self.overview?.dreaming?.totalSignalCount ?? 0))
+                    self.detailMetric(
+                        label: "Promoted",
+                        value: Self.compactNumber(self.overview?.dreaming?.promotedToday ?? 0))
+                }
+                if let storeError = self.normalized(self.overview?.dreaming?.storeError) {
+                    Text(storeError)
+                        .font(.caption2)
+                        .foregroundStyle(OpenClawBrand.warn)
+                }
+            }
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+
+    private var dreamingActionsCard: some View {
+        ProCard {
+            VStack(alignment: .leading, spacing: 12) {
+                HStack {
+                    VStack(alignment: .leading, spacing: 3) {
+                        Text("Maintenance")
+                            .font(.headline)
+                        Text("Refresh reads live state. Maintenance actions update the gateway diary/artifacts.")
+                            .font(.caption)
+                            .foregroundStyle(.secondary)
+                            .lineLimit(2)
+                    }
+                    Spacer(minLength: 8)
+                    Button {
+                        Task { await self.refresh() }
+                    } label: {
+                        Image(systemName: self.overviewLoading ? "hourglass" : "arrow.clockwise")
+                    }
+                    .buttonStyle(.bordered)
+                    .controlSize(.small)
+                    .disabled(self.overviewLoading)
+                    .accessibilityLabel("Refresh dreaming")
+                }
+
+                HStack(spacing: 8) {
+                    ForEach(DreamAction.allCases) { action in
+                        Button {
+                            Task { await self.runDreamAction(action) }
+                        } label: {
+                            Label(action.title, systemImage: self.dreamActionBusy == action ? "hourglass" : action.icon)
+                        }
+                        .buttonStyle(.bordered)
+                        .controlSize(.small)
+                        .disabled(!self.gatewayConnected || self.dreamActionBusy != nil)
+                    }
+                }
+
+                if let dreamActionStatusText {
+                    Text(dreamActionStatusText)
+                        .font(.caption2)
+                        .foregroundStyle(.secondary)
+                        .lineLimit(3)
+                }
+            }
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+
+    private var dreamDiaryCard: some View {
+        VStack(alignment: .leading, spacing: 8) {
+            ProSectionHeader(title: "Dream Diary")
+            ProCard(padding: 0) {
+                if let diary = self.overview?.dreamDiary {
+                    if diary.found, let content = self.normalizedMultiline(diary.content) {
+                        let days = Self.dreamDiaryDays(from: content)
+                        let selectedDay = self.selectedDreamDiaryDay(from: days)
+                        VStack(alignment: .leading, spacing: 12) {
+                            HStack {
+                                ProIconBadge(systemName: "book.pages", color: OpenClawBrand.accent)
+                                VStack(alignment: .leading, spacing: 2) {
+                                    Text(diary.path)
+                                        .font(.subheadline.weight(.semibold))
+                                        .lineLimit(1)
+                                    Text(self.dreamDiaryUpdatedLabel(diary))
+                                        .font(.caption)
+                                        .foregroundStyle(.secondary)
+                                }
+                                Spacer(minLength: 8)
+                                if !days.isEmpty {
+                                    self.dreamDiaryDayMenu(days: days, selectedDay: selectedDay)
+                                }
+                            }
+                            if let selectedDay {
+                                self.dreamDiaryDayView(selectedDay)
+                            } else {
+                                self.emptyDetailRow(
+                                    icon: "calendar.badge.exclamationmark",
+                                    title: "No day entries",
+                                    detail: "The diary is present, but it does not contain dated Dream Diary blocks.")
+                            }
+                        }
+                        .padding(14)
+                    } else {
+                        self.emptyDetailRow(
+                            icon: "book.closed",
+                            title: diary.found ? "Dream diary is empty" : "No dream diary yet",
+                            detail: diary.found
+                                ? "\(diary.path) exists but has no readable content."
+                                : "The gateway did not find DREAMS.md or dreams.md in the active agent workspace.")
+                            .padding(14)
+                    }
+                } else {
+                    self.emptyDetailRow(
+                        icon: "book.closed",
+                        title: self.gatewayConnected ? "Diary unavailable" : "Dreaming unavailable",
+                        detail: self.gatewayConnected
+                            ? "The gateway did not return dream diary content."
+                            : "Connect a gateway to read dream diary entries.")
+                        .padding(14)
+                }
+            }
+            .padding(.horizontal, OpenClawProMetric.pagePadding)
+        }
+    }
+
+    private func dreamDiaryDayMenu(days: [DreamDiaryDay], selectedDay: DreamDiaryDay?) -> some View {
+        Menu {
+            ForEach(Array(days.reversed())) { day in
+                Button {
+                    self.selectedDreamDiaryDayID = day.id
+                } label: {
+                    Label(
+                        day.title,
+                        systemImage: day.id == selectedDay?.id ? "checkmark.circle.fill" : "calendar")
+                }
+            }
+        } label: {
+            HStack(spacing: 6) {
+                Image(systemName: "calendar")
+                Text(selectedDay?.title ?? "Day")
+                    .lineLimit(1)
+                    .minimumScaleFactor(0.75)
+            }
+            .font(.caption.weight(.semibold))
+            .foregroundStyle(.primary)
+            .padding(.horizontal, 10)
+            .frame(height: 34)
+            .background(Color.primary.opacity(0.055), in: Capsule())
+        }
+        .accessibilityLabel("Dream diary day")
+    }
+
+    private func dreamDiaryDayView(_ day: DreamDiaryDay) -> some View {
+        VStack(alignment: .leading, spacing: 8) {
+            HStack(alignment: .firstTextBaseline) {
+                Text(day.title)
+                    .font(.subheadline.weight(.semibold))
+                    .lineLimit(1)
+                Spacer(minLength: 8)
+                Text("\(day.entryCount) \(day.entryCount == 1 ? "entry" : "entries")")
+                    .font(.caption2.weight(.semibold))
+                    .foregroundStyle(OpenClawBrand.accent)
+            }
+            Text(day.body)
+                .font(.caption.monospaced())
+                .foregroundStyle(.primary)
+                .lineLimit(120)
+                .textSelection(.enabled)
+                .frame(maxWidth: .infinity, alignment: .leading)
+        }
+        .padding(10)
+        .background(Color.primary.opacity(0.045), in: RoundedRectangle(cornerRadius: 10, style: .continuous))
+    }
+
+    private func selectedDreamDiaryDay(from days: [DreamDiaryDay]) -> DreamDiaryDay? {
+        if let selectedDreamDiaryDayID,
+           let match = days.first(where: { $0.id == selectedDreamDiaryDayID })
+        {
+            return match
+        }
+        return days.last
+    }
+
+    private func dreamingEntriesList(
+        title: String,
+        entries: [DreamingEntryLite],
+        emptyTitle: String,
+        emptyDetail: String) -> some View
+    {
+        VStack(alignment: .leading, spacing: 8) {
+            ProSectionHeader(title: title)
+            ProCard(padding: 0) {
+                if entries.isEmpty {
+                    self.emptyDetailRow(
+                        icon: "doc.text.magnifyingglass",
+                        title: emptyTitle,
+                        detail: self.gatewayConnected ? emptyDetail : "Connect a gateway to load dreaming entries.")
+                        .padding(14)
+                } else {
+                    VStack(spacing: 0) {
+                        ForEach(Array(entries.enumerated()), id: \.element.id) { index, entry in
+                            self.dreamingEntryRow(entry)
+                            if index < entries.count - 1 {
+                                Divider().padding(.leading, 60)
+                            }
+                        }
+                    }
+                }
+            }
+            .padding(.horizontal, OpenClawProMetric.pagePadding)
+        }
+    }
+
+    private func dreamingEntryRow(_ entry: DreamingEntryLite) -> some View {
+        HStack(alignment: .top, spacing: 12) {
+            ProIconBadge(systemName: "text.page", color: OpenClawBrand.accent)
+            VStack(alignment: .leading, spacing: 4) {
+                Text(self.dreamingEntryTitle(entry))
+                    .font(.subheadline.weight(.semibold))
+                    .lineLimit(1)
+                Text(entry.snippet)
+                    .font(.caption)
+                    .foregroundStyle(.secondary)
+                    .lineLimit(4)
+                    .textSelection(.enabled)
+                Text(self.dreamingEntryDetail(entry))
+                    .font(.caption2)
+                    .foregroundStyle(.secondary)
+                    .lineLimit(1)
+            }
+            Spacer(minLength: 8)
+            Text("\(entry.totalSignalCount)")
+                .font(.caption2.weight(.semibold))
+                .foregroundStyle(OpenClawBrand.accent)
+                .lineLimit(1)
+        }
+        .padding(.vertical, 10)
+        .padding(.horizontal, 14)
+    }
+
+    private var dreamingPhasesCard: some View {
+        VStack(alignment: .leading, spacing: 8) {
+            ProSectionHeader(title: "Phases")
+            ProCard(padding: 0) {
+                let phases = self.dreamingPhases
+                if phases.isEmpty {
+                    self.emptyDetailRow(
+                        icon: "moon.zzz",
+                        title: self.gatewayConnected ? "No phase status" : "Dreaming unavailable",
+                        detail: self.gatewayConnected
+                            ? "The gateway did not return dreaming phase details."
+                            : "Connect a gateway to load dreaming phases.")
+                        .padding(14)
+                } else {
+                    VStack(spacing: 0) {
+                        ForEach(Array(phases.enumerated()), id: \.element.id) { index, phase in
+                            self.dreamingPhaseRow(phase)
+                            if index < phases.count - 1 {
+                                Divider().padding(.leading, 60)
+                            }
+                        }
+                    }
+                }
+            }
+            .padding(.horizontal, OpenClawProMetric.pagePadding)
+        }
+    }
+
+    private var dreamingPhases: [DreamingPhaseRow] {
+        let phaseOrder = ["light", "deep", "rem"]
+        let phases = self.overview?.dreaming?.phases ?? [:]
+        return phaseOrder.compactMap { id in
+            guard let phase = phases[id] else { return nil }
+            return DreamingPhaseRow(id: id, title: id.capitalized, status: phase)
+        }
+    }
+
+    private func dreamingPhaseRow(_ phase: DreamingPhaseRow) -> some View {
+        HStack(alignment: .top, spacing: 12) {
+            ProIconBadge(
+                systemName: phase.status.enabled == false ? "pause.circle" : "moon.stars",
+                color: phase.status.enabled == false ? .secondary : OpenClawBrand.accent)
+            VStack(alignment: .leading, spacing: 4) {
+                Text(phase.title)
+                    .font(.subheadline.weight(.semibold))
+                Text(self.dreamingPhaseDetail(phase.status))
+                    .font(.caption)
+                    .foregroundStyle(.secondary)
+                    .lineLimit(2)
+                if let cron = self.normalized(phase.status.cron) {
+                    Text(cron)
+                        .font(.caption2)
+                        .foregroundStyle(.secondary)
+                        .lineLimit(1)
+                }
+            }
+            Spacer(minLength: 8)
+            Text(self.dreamingPhaseState(phase.status))
+                .font(.caption2.weight(.semibold))
+                .foregroundStyle(phase.status.managedCronPresent == true ? OpenClawBrand.accent : .secondary)
+                .lineLimit(1)
+        }
+        .padding(.vertical, 10)
+        .padding(.horizontal, 14)
+    }
+
+    private func emptyDetailRow(icon: String, title: String, detail: String) -> some View {
+        HStack(spacing: 12) {
+            ProIconBadge(systemName: icon, color: .secondary)
+            VStack(alignment: .leading, spacing: 3) {
+                Text(title)
+                    .font(.subheadline.weight(.semibold))
+                Text(detail)
+                    .font(.caption)
+                    .foregroundStyle(.secondary)
+                    .lineLimit(2)
+            }
+            Spacer(minLength: 8)
+        }
+    }
+
+    private func detailMetric(label: String, value: String) -> some View {
+        VStack(alignment: .leading, spacing: 3) {
+            Text(label)
+                .font(.caption2.weight(.medium))
+                .foregroundStyle(.secondary)
+            Text(value)
+                .font(.subheadline.weight(.semibold))
+                .lineLimit(1)
+                .minimumScaleFactor(0.8)
+        }
+        .frame(maxWidth: .infinity, alignment: .leading)
+        .padding(10)
+        .background(Color.primary.opacity(0.055), in: RoundedRectangle(cornerRadius: 10, style: .continuous))
+    }
+
+    private func dreamingEntryTitle(_ entry: DreamingEntryLite) -> String {
+        let path = entry.path.split(separator: "/").last.map(String.init) ?? entry.path
+        return "\(path):\(entry.startLine)"
+    }
+
+    private func dreamingEntryDetail(_ entry: DreamingEntryLite) -> String {
+        let parts = [
+            entry.promotedAt.map { "promoted \($0)" },
+            entry.lastRecalledAt.map { "recalled \($0)" },
+            "\(entry.recallCount) recalls",
+            "\(entry.groundedCount) grounded",
+        ].compactMap(\.self)
+        return parts.joined(separator: " • ")
+    }
+
+    private func dreamingPhaseDetail(_ phase: DreamingPhaseStatusLite) -> String {
+        if let nextRunAtMs = phase.nextRunAtMs {
+            return "Next cycle \(Self.relativeTime(fromMilliseconds: nextRunAtMs))"
+        }
+        if phase.managedCronPresent == true {
+            return "Managed cron is installed."
+        }
+        return "Managed cron is not installed."
+    }
+
+    private func dreamingPhaseState(_ phase: DreamingPhaseStatusLite) -> String {
+        if phase.enabled == false { return "off" }
+        return phase.managedCronPresent == true ? "scheduled" : "setup"
+    }
+
+    private func dreamDiaryUpdatedLabel(_ diary: DreamDiaryLite) -> String {
+        guard let updatedAtMs = diary.updatedAtMs else { return "No update timestamp" }
+        return "Updated \(Self.relativeTime(fromMilliseconds: updatedAtMs))"
+    }
+
+    @MainActor
+    private func runDreamAction(_ action: DreamAction) async {
+        guard self.gatewayConnected, self.dreamActionBusy == nil else { return }
+        self.dreamActionBusy = action
+        self.dreamActionStatusText = nil
+        defer { self.dreamActionBusy = nil }
+
+        do {
+            let data = try await self.appModel.operatorSession.request(
+                method: action.method,
+                paramsJSON: "{}",
+                timeoutSeconds: 30)
+            self.dreamActionStatusText = Self.dreamActionSummary(action: action, data: data)
+            await self.refresh()
+        } catch {
+            self.dreamActionStatusText = error.localizedDescription
+        }
+    }
+
+    private static func dreamActionSummary(action: DreamAction, data: Data) -> String {
+        guard let json = try? JSONSerialization.jsonObject(with: data) as? [String: Any] else {
+            return "\(action.title) complete."
+        }
+        let written = json["written"] as? Int
+        let replaced = json["replaced"] as? Int
+        let removed = json["removedEntries"] as? Int
+        let changed = json["changed"] as? Bool
+        let parts = [
+            written.map { "\($0) written" },
+            replaced.map { "\($0) replaced" },
+            removed.map { "\($0) removed" },
+            changed.map { $0 ? "artifacts repaired" : "no repair needed" },
+        ].compactMap(\.self)
+        if parts.isEmpty {
+            return "\(action.title) complete."
+        }
+        return "\(action.title): \(parts.joined(separator: ", "))."
+    }
+
+    private func normalized(_ value: String?) -> String? {
+        let trimmed = value?.trimmingCharacters(in: .whitespacesAndNewlines) ?? ""
+        return trimmed.isEmpty ? nil : trimmed
+    }
+
+    private func normalizedMultiline(_ value: String?) -> String? {
+        guard let value else { return nil }
+        let trimmed = value.trimmingCharacters(in: .whitespacesAndNewlines)
+        return trimmed.isEmpty ? nil : trimmed
+    }
+
+    private static func compactNumber(_ value: Int) -> String {
+        value.formatted(.number.notation(.compactName))
+    }
+
+    private static func relativeTime(fromMilliseconds milliseconds: Int) -> String {
+        let date = Date(timeIntervalSince1970: Double(milliseconds) / 1000)
+        return date.formatted(.relative(presentation: .named, unitsStyle: .abbreviated))
+    }
+
+    private static func dreamDiaryDays(from content: String) -> [DreamDiaryDay] {
+        let inner = Self.dreamDiaryInnerContent(content)
+        let separatorBlocks = inner
+            .components(separatedBy: "\n---")
+            .flatMap { $0.components(separatedBy: "\r\n---") }
+            .map { $0.trimmingCharacters(in: .whitespacesAndNewlines) }
+            .filter { !$0.isEmpty }
+        let blocks = separatorBlocks.count > 1 ? separatorBlocks : Self.splitDiaryBlocksByDateLine(inner)
+        let parsedBlocks = blocks.enumerated().map { index, block in
+            Self.dreamDiaryBlock(from: block, index: index)
+        }.filter(\.hasDatedEntry)
+        return Self.mergeDiaryBlocksByDay(parsedBlocks)
+    }
+
+    private static func dreamDiaryInnerContent(_ content: String) -> String {
+        let start = "<!-- openclaw:dreaming:diary:start -->"
+        let end = "<!-- openclaw:dreaming:diary:end -->"
+        guard let startRange = content.range(of: start),
+              let endRange = content.range(of: end, range: startRange.upperBound..<content.endIndex)
+        else {
+            return content
+        }
+        return String(content[startRange.upperBound..<endRange.lowerBound])
+    }
+
+    private static func dreamDiaryBlock(from block: String, index: Int) -> DreamDiaryDay {
+        let rawLines = block.split(separator: "\n", omittingEmptySubsequences: false).map(String.init)
+        let dateLineIndex = rawLines.firstIndex { line in
+            Self.isDiaryDateLine(line)
+        }
+        let markerDay = rawLines.compactMap(Self.backfillDay).first
+        let rawTitle = dateLineIndex.flatMap { Self.unwrappedEmphasis(rawLines[$0]) } ?? markerDay
+        let title = rawTitle.map(Self.dayTitle) ?? markerDay ?? "Diary"
+        let id = markerDay ?? Self.dayID(title)
+        let bodyLines = rawLines.enumerated().compactMap { offset, line -> String? in
+            let trimmed = line.trimmingCharacters(in: .whitespacesAndNewlines)
+            if offset == dateLineIndex { return nil }
+            if trimmed.hasPrefix("<!--") && trimmed.hasSuffix("-->") { return nil }
+            if trimmed == "#" || trimmed == "# Dream Diary" { return nil }
+            return line
+        }
+        let body = bodyLines
+            .joined(separator: "\n")
+            .trimmingCharacters(in: .whitespacesAndNewlines)
+        return DreamDiaryDay(
+            id: id.isEmpty ? "\(index)" : id,
+            title: title,
+            body: body.isEmpty ? "No diary prose for this day." : body,
+            entryCount: 1,
+            hasDatedEntry: rawTitle != nil)
+    }
+
+    private static func mergeDiaryBlocksByDay(_ blocks: [DreamDiaryDay]) -> [DreamDiaryDay] {
+        var ordered: [DreamDiaryDay] = []
+        for block in blocks {
+            if let existingIndex = ordered.firstIndex(where: { $0.title == block.title }) {
+                let existing = ordered[existingIndex]
+                ordered[existingIndex] = DreamDiaryDay(
+                    id: existing.id,
+                    title: existing.title,
+                    body: [existing.body, block.body].joined(separator: "\n\n---\n\n"),
+                    entryCount: existing.entryCount + block.entryCount,
+                    hasDatedEntry: true)
+            } else {
+                ordered.append(block)
+            }
+        }
+        return ordered
+    }
+
+    private static func splitDiaryBlocksByDateLine(_ content: String) -> [String] {
+        var blocks: [String] = []
+        var current: [String] = []
+        for line in content.split(separator: "\n", omittingEmptySubsequences: false).map(String.init) {
+            if Self.isDiaryDateLine(line), !current.isEmpty {
+                blocks.append(current.joined(separator: "\n"))
+                current = []
+            }
+            current.append(line)
+        }
+        if !current.isEmpty {
+            blocks.append(current.joined(separator: "\n"))
+        }
+        return blocks
+            .map { $0.trimmingCharacters(in: .whitespacesAndNewlines) }
+            .filter { !$0.isEmpty }
+    }
+
+    private static func isDiaryDateLine(_ line: String) -> Bool {
+        guard let value = unwrappedEmphasis(line) else { return false }
+        let monthNames = "January|February|March|April|May|June|July|August|September|October|November|December"
+        let monthDatePattern = #"\b("# + monthNames + #")\s+\d{1,2},\s+\d{4}\b"#
+        let isoDatePattern = #"\b\d{4}-\d{2}-\d{2}\b"#
+        return value.range(
+            of: "\(monthDatePattern)|\(isoDatePattern)",
+            options: .regularExpression) != nil
+    }
+
+    private static func dayTitle(_ rawTitle: String) -> String {
+        let noTime = rawTitle.replacingOccurrences(
+            of: #"\s+at\s+\d{1,2}:\d{2}.*$"#,
+            with: "",
+            options: .regularExpression)
+        return noTime.trimmingCharacters(in: .whitespacesAndNewlines)
+    }
+
+    private static func dayID(_ title: String) -> String {
+        title.lowercased()
+            .replacingOccurrences(of: #"[^a-z0-9]+"#, with: "-", options: .regularExpression)
+            .trimmingCharacters(in: CharacterSet(charactersIn: "-"))
+    }
+
+    private static func unwrappedEmphasis(_ line: String) -> String? {
+        let trimmed = line.trimmingCharacters(in: .whitespacesAndNewlines)
+        guard trimmed.hasPrefix("*"), trimmed.hasSuffix("*"), trimmed.count > 2 else { return nil }
+        return String(trimmed.dropFirst().dropLast())
+    }
+
+    private static func backfillDay(_ line: String) -> String? {
+        guard let range = line.range(of: #"day=\d{4}-\d{2}-\d{2}"#, options: .regularExpression) else {
+            return nil
+        }
+        return String(line[range].dropFirst(4))
+    }
+}
+
+private struct DreamDiaryDay: Identifiable {
+    let id: String
+    let title: String
+    let body: String
+    let entryCount: Int
+    let hasDatedEntry: Bool
+}

apps/ios/Sources/Design/AgentProModels.swift

@@ -0,0 +1,368 @@
+import Foundation
+import OpenClawKit
+import OpenClawProtocol
+
+enum AgentProValueReader {
+    static func intValue(_ value: AnyCodable?) -> Int? {
+        switch value?.value {
+        case let int as Int: int
+        case let double as Double where double.isFinite: Int(double)
+        case let string as String: Int(string)
+        default: nil
+        }
+    }
+
+    static func doubleValue(_ value: AnyCodable?) -> Double? {
+        switch value?.value {
+        case let double as Double where double.isFinite: double
+        case let int as Int: Double(int)
+        case let string as String: Double(string)
+        default: nil
+        }
+    }
+}
+
+struct AgentOverviewSnapshot {
+    let skills: SkillStatusReportLite?
+    let presence: [PresenceEntry]
+    let cronStatus: CronStatusLite?
+    let cronJobs: [CronJob]
+    let dreaming: DreamingStatusLite?
+    let dreamDiary: DreamDiaryLite?
+    let usage: CostUsageSummaryLite?
+    let activeAgentId: String
+    let agentSkillFilter: [String]?
+    let loadedAt: Date
+
+    var hasAnyLiveData: Bool {
+        self.skills != nil
+            || !self.presence.isEmpty
+            || self.cronStatus != nil
+            || !self.cronJobs.isEmpty
+            || self.dreaming != nil
+            || self.dreamDiary != nil
+            || self.usage != nil
+    }
+}
+
+struct SkillStatusReportLite: Decodable {
+    let workspaceDir: String?
+    let managedSkillsDir: String?
+    let agentId: String?
+    let agentSkillFilter: [String]?
+    let skills: [SkillStatusEntryLite]
+
+    var totalCount: Int {
+        self.skills.count
+    }
+
+    var enabledCount: Int {
+        self.skills.count {
+            $0.isEnabled
+        }
+    }
+
+    var blockedCount: Int {
+        self.skills.count {
+            $0.blockedByAllowlist == true || $0.blockedByAgentFilter == true
+        }
+    }
+
+    var missingRequirementCount: Int {
+        self.skills.count {
+            $0.hasMissingRequirements
+        }
+    }
+}
+
+struct SkillStatusEntryLite: Decodable {
+    let name: String
+    let description: String?
+    let source: String?
+    let filePath: String?
+    let skillKey: String?
+    let primaryEnv: String?
+    let emoji: String?
+    let homepage: String?
+    let disabled: Bool?
+    let blockedByAllowlist: Bool?
+    let blockedByAgentFilter: Bool?
+    let missing: SkillStatusMissingLite?
+    let install: [SkillInstallOptionLite]?
+
+    var displayName: String {
+        if let emoji, !emoji.isEmpty {
+            return "\(emoji) \(self.name)"
+        }
+        return self.name
+    }
+
+    var effectiveSkillKey: String {
+        let trimmed = (self.skillKey ?? "").trimmingCharacters(in: .whitespacesAndNewlines)
+        return trimmed.isEmpty ? self.name : trimmed
+    }
+
+    var isGloballyEnabled: Bool {
+        self.disabled != true
+    }
+
+    var isEnabled: Bool {
+        self.disabled != true
+            && self.blockedByAllowlist != true
+            && self.blockedByAgentFilter != true
+    }
+
+    var hasMissingRequirements: Bool {
+        guard let missing else { return false }
+        return !missing.bins.isEmpty
+            || !missing.env.isEmpty
+            || !missing.config.isEmpty
+            || !missing.os.isEmpty
+    }
+
+    var missingSummary: String? {
+        guard let missing else { return nil }
+        let values = [
+            missing.bins,
+            missing.env,
+            missing.config,
+            missing.os,
+        ].flatMap(\.self)
+        return values.isEmpty ? nil : values.prefix(3).joined(separator: ", ")
+    }
+
+    var installSummary: String? {
+        guard let option = self.install?.first else { return nil }
+        return option.label
+    }
+
+    var missingBins: [String] {
+        self.missing?.bins ?? []
+    }
+
+    var homepageURL: URL? {
+        guard let homepage else { return nil }
+        return URL(string: homepage)
+    }
+}
+
+struct SkillInstallOptionLite: Decodable {
+    let id: String?
+    let kind: String?
+    let label: String
+    let bins: [String]?
+}
+
+struct SkillUpdateParams: Encodable {
+    let skillKey: String
+    var enabled: Bool?
+    var apiKey: String?
+}
+
+struct SkillInstallParams: Encodable {
+    let name: String
+    let installId: String
+    let timeoutMs: Int
+}
+
+struct SkillInstallResultLite: Decodable {
+    let message: String?
+}
+
+struct ClawHubSearchParams: Encodable {
+    let query: String?
+    let limit: Int
+}
+
+struct ClawHubSearchResponseLite: Decodable {
+    let results: [ClawHubSearchResultLite]
+}
+
+struct ClawHubSearchResultLite: Decodable {
+    let slug: String
+    let displayName: String
+    let summary: String?
+    let version: String?
+}
+
+struct ClawHubInstallParams: Encodable {
+    let source = "clawhub"
+    let slug: String
+}
+
+struct CronRunParams: Encodable {
+    let id: String
+    let mode: String
+}
+
+struct CronUpdatePatch: Encodable {
+    let enabled: Bool
+}
+
+struct CronUpdateParams: Encodable {
+    let id: String
+    let patch: CronUpdatePatch
+}
+
+struct SkillStatusMissingLite: Decodable {
+    let bins: [String]
+    let env: [String]
+    let config: [String]
+    let os: [String]
+}
+
+struct CronStatusLite: Decodable {
+    let enabled: Bool
+    let jobs: Int
+    let nextwakeatms: Int?
+
+    enum CodingKeys: String, CodingKey {
+        case enabled
+        case jobs
+        case nextwakeatms = "nextWakeAtMs"
+    }
+}
+
+struct CronJobsListLite: Decodable {
+    let jobs: [CronJob]
+    let total: Int?
+}
+
+struct DreamingStatusEnvelope: Decodable {
+    let dreaming: DreamingStatusLite?
+}
+
+struct DreamingStatusLite: Decodable {
+    let enabled: Bool
+    let shortTermCount: Int?
+    let totalSignalCount: Int?
+    let promotedToday: Int?
+    let storeError: String?
+    let shortTermEntries: [DreamingEntryLite]?
+    let signalEntries: [DreamingEntryLite]?
+    let promotedEntries: [DreamingEntryLite]?
+    let phases: [String: DreamingPhaseStatusLite]?
+
+    var nextRunAtMs: Int? {
+        self.phases?.values
+            .compactMap(\.nextRunAtMs)
+            .min()
+    }
+}
+
+struct DreamingEntryLite: Decodable, Identifiable {
+    let key: String
+    let path: String
+    let startLine: Int
+    let endLine: Int
+    let snippet: String
+    let recallCount: Int
+    let dailyCount: Int
+    let groundedCount: Int
+    let totalSignalCount: Int
+    let lightHits: Int
+    let remHits: Int
+    let phaseHitCount: Int
+    let promotedAt: String?
+    let lastRecalledAt: String?
+
+    var id: String {
+        "\(self.key):\(self.path):\(self.startLine):\(self.endLine)"
+    }
+}
+
+struct DreamDiaryLite: Decodable {
+    let agentId: String
+    let found: Bool
+    let path: String
+    let content: String?
+    let updatedAtMs: Int?
+}
+
+struct DreamingPhaseStatusLite: Decodable {
+    let enabled: Bool?
+    let cron: String?
+    let managedCronPresent: Bool?
+    let nextRunAtMs: Int?
+}
+
+struct DreamingPhaseRow: Identifiable {
+    let id: String
+    let title: String
+    let status: DreamingPhaseStatusLite
+}
+
+struct ConfigSnapshotLite: Decodable {
+    let hash: String?
+    let config: ConfigRootLite?
+
+    func agentConfig(id: String) -> AgentConfigLite? {
+        self.config?.agents?.list?.first { $0.id == id }
+    }
+
+    func effectiveSkillFilter(agentId: String) -> [String]? {
+        if let agentSkills = self.agentConfig(id: agentId)?.skills {
+            return agentSkills
+        }
+        return self.config?.agents?.defaults?.skills
+    }
+}
+
+struct ConfigRootLite: Decodable {
+    let agents: AgentsConfigLite?
+}
+
+struct AgentsConfigLite: Decodable {
+    let defaults: AgentDefaultsConfigLite?
+    let list: [AgentConfigLite]?
+}
+
+struct AgentDefaultsConfigLite: Decodable {
+    let skills: [String]?
+}
+
+struct AgentConfigLite: Decodable {
+    let id: String
+    let skills: [String]?
+}
+
+struct ConfigPatchParams: Encodable {
+    let raw: String
+    let baseHash: String
+}
+
+enum SkillMutationError: LocalizedError {
+    case missingConfigHash
+    case invalidPatchPayload
+
+    var errorDescription: String? {
+        switch self {
+        case .missingConfigHash:
+            "Config hash missing; refresh and retry."
+        case .invalidPatchPayload:
+            "Could not encode the skill config update."
+        }
+    }
+}
+
+struct CostUsageSummaryLite: Decodable {
+    let updatedAt: Int?
+    let days: Int?
+    let daily: [CostUsageDailyEntryLite]?
+    let totals: [String: AnyCodable]?
+    let cacheStatus: [String: AnyCodable]?
+
+    var totalCost: Double? {
+        AgentProValueReader.doubleValue(self.totals?["totalCost"])
+    }
+
+    var totalTokens: Int? {
+        AgentProValueReader.intValue(self.totals?["totalTokens"])
+    }
+}
+
+struct CostUsageDailyEntryLite: Decodable {
+    let date: String
+    let totalTokens: Int?
+    let totalCost: Double?
+}

apps/ios/Sources/Design/AgentProNodesDestination.swift

@@ -0,0 +1,348 @@
+import OpenClawProtocol
+import SwiftUI
+import UIKit
+
+struct AgentProNodesDestination: View {
+    let overview: AgentOverviewSnapshot?
+    let gatewayConnected: Bool
+    let agentCount: Int
+    let instancesValue: String
+    let instancesDetail: String
+    let instancesColor: Color
+    let refresh: () async -> Void
+
+    var body: some View {
+        ZStack {
+            OpenClawProBackground()
+            ScrollView {
+                VStack(alignment: .leading, spacing: 16) {
+                    self.summaryCard
+                    self.totalsCard
+                    self.nodesList
+                }
+                .padding(.vertical, 18)
+            }
+            .refreshable {
+                await self.refresh()
+            }
+            .safeAreaPadding(.bottom, OpenClawProMetric.bottomScrollInset)
+        }
+        .navigationTitle("Nodes")
+        .navigationBarTitleDisplayMode(.inline)
+    }
+
+    private var summaryCard: some View {
+        ProCard {
+            HStack(spacing: 12) {
+                ProIconBadge(systemName: "display", color: self.instancesColor)
+                VStack(alignment: .leading, spacing: 3) {
+                    Text("Nodes")
+                        .font(.headline)
+                    Text(self.instancesDetail)
+                        .font(.caption)
+                        .foregroundStyle(.secondary)
+                }
+                Spacer(minLength: 8)
+                ProValuePill(value: self.instancesValue, color: self.instancesColor)
+            }
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+
+    private var totalsCard: some View {
+        ProCard {
+            VStack(alignment: .leading, spacing: 12) {
+                HStack {
+                    Text("Presence")
+                        .font(.headline)
+                    Spacer()
+                    ProValuePill(value: self.instancesValue, color: self.instancesColor)
+                }
+                HStack(spacing: 10) {
+                    self.detailMetric(label: "Connected", value: "\(self.overview?.presence.count ?? 0)")
+                    self.detailMetric(label: "Agents", value: "\(self.agentCount)")
+                    self.detailMetric(label: "Gateway", value: self.gatewayConnected ? "online" : "offline")
+                }
+            }
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+
+    private var nodesList: some View {
+        VStack(alignment: .leading, spacing: 8) {
+            ProSectionHeader(title: "Connected Nodes")
+            ProCard(padding: 0) {
+                let nodes = self.sortedPresenceEntries
+                if nodes.isEmpty {
+                    self.emptyRow(
+                        icon: "display",
+                        title: self.gatewayConnected ? "No nodes connected" : "Nodes unavailable",
+                        detail: self.gatewayConnected
+                            ? "The gateway did not report any system presence entries."
+                            : "Connect a gateway to inspect connected nodes.")
+                        .padding(14)
+                } else {
+                    VStack(spacing: 0) {
+                        ForEach(Array(nodes.enumerated()), id: \.element.presenceKey) { index, entry in
+                            NavigationLink {
+                                self.nodeDetail(entry)
+                            } label: {
+                                self.nodePresenceRow(entry, showsChevron: true)
+                            }
+                            .buttonStyle(.plain)
+                            if index < nodes.count - 1 {
+                                Divider().padding(.leading, 60)
+                            }
+                        }
+                    }
+                }
+            }
+            .padding(.horizontal, OpenClawProMetric.pagePadding)
+        }
+    }
+
+    private var sortedPresenceEntries: [PresenceEntry] {
+        (self.overview?.presence ?? [])
+            .sorted { lhs, rhs in
+                if lhs.ts != rhs.ts { return lhs.ts > rhs.ts }
+                return (Self.presenceLabel(lhs) ?? lhs.presenceKey)
+                    .localizedCaseInsensitiveCompare(Self.presenceLabel(rhs) ?? rhs.presenceKey) == .orderedAscending
+            }
+    }
+
+    private func nodePresenceRow(_ entry: PresenceEntry, showsChevron: Bool = false) -> some View {
+        HStack(alignment: .top, spacing: 12) {
+            ProIconBadge(systemName: Self.presenceIcon(entry), color: Self.presenceColor(entry))
+            VStack(alignment: .leading, spacing: 4) {
+                Text(Self.presenceLabel(entry) ?? "Node")
+                    .font(.subheadline.weight(.semibold))
+                    .lineLimit(1)
+                Text(Self.presenceDetail(entry))
+                    .font(.caption)
+                    .foregroundStyle(.secondary)
+                    .lineLimit(2)
+                if let meta = Self.presenceMeta(entry) {
+                    Text(meta)
+                        .font(.caption2)
+                        .foregroundStyle(.secondary)
+                        .lineLimit(1)
+                }
+            }
+            Spacer(minLength: 8)
+            Text(Self.presenceState(entry))
+                .font(.caption2.weight(.semibold))
+                .foregroundStyle(Self.presenceColor(entry))
+                .lineLimit(1)
+            if showsChevron {
+                Image(systemName: "chevron.right")
+                    .font(.caption2.weight(.bold))
+                    .foregroundStyle(.secondary)
+                    .padding(.top, 2)
+            }
+        }
+        .padding(.vertical, 10)
+        .padding(.horizontal, 14)
+    }
+
+    private func nodeDetail(_ entry: PresenceEntry) -> some View {
+        ZStack {
+            OpenClawProBackground()
+            ScrollView {
+                VStack(alignment: .leading, spacing: 16) {
+                    ProCard {
+                        HStack(spacing: 12) {
+                            ProIconBadge(systemName: Self.presenceIcon(entry), color: Self.presenceColor(entry))
+                            VStack(alignment: .leading, spacing: 3) {
+                                Text(Self.presenceLabel(entry) ?? "Node")
+                                    .font(.headline)
+                                Text(Self.presenceDetail(entry))
+                                    .font(.caption)
+                                    .foregroundStyle(.secondary)
+                            }
+                            Spacer(minLength: 8)
+                            ProValuePill(value: Self.presenceState(entry), color: Self.presenceColor(entry))
+                        }
+                    }
+                    .padding(.horizontal, OpenClawProMetric.pagePadding)
+
+                    ProCard {
+                        VStack(spacing: 0) {
+                            self.nodeDetailRow("Instance", value: entry.instanceid)
+                            Divider()
+                            self.nodeDetailRow("Device", value: entry.deviceid)
+                            Divider()
+                            self.nodeDetailRow("Host", value: entry.host)
+                            Divider()
+                            self.nodeDetailRow("IP", value: entry.ip)
+                            Divider()
+                            self.nodeDetailRow("Platform", value: entry.platform)
+                            Divider()
+                            self.nodeDetailRow("Version", value: entry.version)
+                            Divider()
+                            self.nodeDetailRow("Mode", value: entry.mode)
+                        }
+                    }
+                    .padding(.horizontal, OpenClawProMetric.pagePadding)
+
+                    self.nodeListCard(title: "Scopes", values: entry.scopes ?? [])
+                    self.nodeListCard(title: "Roles", values: entry.roles ?? [])
+                    self.nodeListCard(title: "Tags", values: entry.tags ?? [])
+                }
+                .padding(.vertical, 18)
+            }
+            .safeAreaPadding(.bottom, OpenClawProMetric.bottomScrollInset)
+        }
+        .navigationTitle(Self.presenceLabel(entry) ?? "Node")
+        .navigationBarTitleDisplayMode(.inline)
+    }
+
+    private func nodeDetailRow(_ title: String, value: String?) -> some View {
+        let normalized = Self.normalized(value) ?? "n/a"
+        return HStack(spacing: 10) {
+            Text(title)
+                .foregroundStyle(.secondary)
+            Spacer(minLength: 8)
+            Text(normalized)
+                .lineLimit(1)
+                .truncationMode(.middle)
+            Button {
+                UIPasteboard.general.string = normalized
+            } label: {
+                Image(systemName: "doc.on.doc")
+            }
+            .buttonStyle(.plain)
+            .disabled(normalized == "n/a")
+            .accessibilityLabel("Copy \(title)")
+        }
+        .font(.subheadline)
+        .padding(.vertical, 10)
+    }
+
+    private func nodeListCard(title: String, values: [String]) -> some View {
+        VStack(alignment: .leading, spacing: 8) {
+            ProSectionHeader(title: title)
+            ProCard {
+                if values.isEmpty {
+                    Text("None reported.")
+                        .font(.subheadline)
+                        .foregroundStyle(.secondary)
+                        .frame(maxWidth: .infinity, alignment: .leading)
+                } else {
+                    VStack(alignment: .leading, spacing: 8) {
+                        ForEach(values, id: \.self) { value in
+                            Text(value)
+                                .font(.caption.monospaced())
+                                .textSelection(.enabled)
+                                .frame(maxWidth: .infinity, alignment: .leading)
+                        }
+                    }
+                }
+            }
+            .padding(.horizontal, OpenClawProMetric.pagePadding)
+        }
+    }
+
+    private func detailMetric(label: String, value: String) -> some View {
+        VStack(alignment: .leading, spacing: 3) {
+            Text(label)
+                .font(.caption2.weight(.medium))
+                .foregroundStyle(.secondary)
+            Text(value)
+                .font(.subheadline.weight(.semibold))
+                .lineLimit(1)
+                .minimumScaleFactor(0.8)
+        }
+        .frame(maxWidth: .infinity, alignment: .leading)
+        .padding(10)
+        .background(Color.primary.opacity(0.055), in: RoundedRectangle(cornerRadius: 10, style: .continuous))
+    }
+
+    private func emptyRow(icon: String, title: String, detail: String) -> some View {
+        HStack(spacing: 12) {
+            ProIconBadge(systemName: icon, color: .secondary)
+            VStack(alignment: .leading, spacing: 3) {
+                Text(title)
+                    .font(.subheadline.weight(.semibold))
+                Text(detail)
+                    .font(.caption)
+                    .foregroundStyle(.secondary)
+                    .lineLimit(2)
+            }
+            Spacer(minLength: 8)
+        }
+    }
+
+    private static func presenceLabel(_ entry: PresenceEntry) -> String? {
+        self.normalized(entry.host)
+            ?? self.normalized(entry.devicefamily)
+            ?? self.normalized(entry.platform)
+            ?? self.normalized(entry.mode)
+    }
+
+    private static func presenceDetail(_ entry: PresenceEntry) -> String {
+        let parts = [
+            Self.normalized(entry.ip),
+            Self.normalized(entry.platform),
+            Self.normalized(entry.version),
+        ].compactMap(\.self)
+        if !parts.isEmpty {
+            return parts.joined(separator: " • ")
+        }
+        return Self.normalized(entry.text) ?? "Presence beacon received."
+    }
+
+    private static func presenceMeta(_ entry: PresenceEntry) -> String? {
+        let tags = (entry.tags ?? []).prefix(2).joined(separator: ", ")
+        let scopesCount = entry.scopes?.count ?? 0
+        let rolesCount = entry.roles?.count ?? 0
+        let labels = [
+            Self.normalized(entry.instanceid).map { "instance \($0)" },
+            tags.isEmpty ? nil : tags,
+            scopesCount > 0 ? "\(scopesCount) scopes" : nil,
+            rolesCount > 0 ? "\(rolesCount) roles" : nil,
+        ].compactMap(\.self)
+        return labels.isEmpty ? nil : labels.joined(separator: " • ")
+    }
+
+    private static func presenceState(_ entry: PresenceEntry) -> String {
+        if let reason = normalized(entry.reason) {
+            return reason
+        }
+        if let mode = Self.normalized(entry.mode) {
+            return mode
+        }
+        return Self.relativeTime(fromMilliseconds: entry.ts)
+    }
+
+    private static func presenceIcon(_ entry: PresenceEntry) -> String {
+        let family = Self.normalized(entry.devicefamily)?.lowercased()
+        if family?.contains("phone") == true { return "iphone" }
+        if family?.contains("tablet") == true || family?.contains("pad") == true { return "ipad" }
+        if family?.contains("desktop") == true || family?.contains("mac") == true { return "desktopcomputer" }
+        return "display"
+    }
+
+    private static func presenceColor(_ entry: PresenceEntry) -> Color {
+        self.normalized(entry.reason) == nil ? OpenClawBrand.accent : OpenClawBrand.warn
+    }
+
+    private static func normalized(_ value: String?) -> String? {
+        let trimmed = value?.trimmingCharacters(in: .whitespacesAndNewlines) ?? ""
+        return trimmed.isEmpty ? nil : trimmed
+    }
+
+    private static func relativeTime(fromMilliseconds milliseconds: Int) -> String {
+        let date = Date(timeIntervalSince1970: Double(milliseconds) / 1000)
+        return date.formatted(.relative(presentation: .named, unitsStyle: .abbreviated))
+    }
+}
+
+extension PresenceEntry {
+    fileprivate var presenceKey: String {
+        self.instanceid
+            ?? self.deviceid
+            ?? self.host
+            ?? self.ip
+            ?? "\(self.ts)"
+    }
+}

apps/ios/Sources/Design/AgentProTab+Cron.swift

@@ -0,0 +1,178 @@
+import OpenClawKit
+import OpenClawProtocol
+import SwiftUI
+
+extension AgentProTab {
+    var cronStatusCard: some View {
+        ProCard(radius: AgentLayout.cardRadius) {
+            VStack(alignment: .leading, spacing: 12) {
+                HStack {
+                    Text("Scheduler")
+                        .font(.headline)
+                    Spacer()
+                    ProValuePill(
+                        value: self.overview?.cronStatus?.enabled == true ? "on" : "off",
+                        color: self.cronColor)
+                }
+                HStack(spacing: 10) {
+                    let jobCount = self.overview?.cronStatus?.jobs
+                        ?? self.overview?.cronJobs.count
+                        ?? 0
+                    self.detailMetric(label: "Jobs", value: "\(jobCount)")
+                    self.detailMetric(label: "Next", value: self.cronNextRunLabel)
+                }
+                if let cronActionStatusText {
+                    Text(cronActionStatusText)
+                        .font(.caption2)
+                        .foregroundStyle(.secondary)
+                        .lineLimit(2)
+                }
+            }
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+
+    var cronNextRunLabel: String {
+        guard let nextWakeAtMs = self.overview?.cronStatus?.nextwakeatms else { return "none" }
+        return Self.relativeTime(fromMilliseconds: nextWakeAtMs)
+    }
+
+    func cronJobsList(limit: Int?) -> some View {
+        VStack(alignment: .leading, spacing: 8) {
+            ProSectionHeader(title: "Jobs")
+            ProCard(padding: 0, radius: AgentLayout.cardRadius) {
+                let jobs = self.sortedCronJobs
+                let visible = limit.map { Array(jobs.prefix($0)) } ?? jobs
+                if visible.isEmpty {
+                    self.emptyCronRow
+                        .padding(14)
+                } else {
+                    VStack(spacing: 0) {
+                        ForEach(Array(visible.enumerated()), id: \.element.id) { index, job in
+                            self.cronJobDetailRow(job)
+                            if index < visible.count - 1 {
+                                Divider().padding(.leading, 60)
+                            }
+                        }
+                    }
+                }
+            }
+            .padding(.horizontal, OpenClawProMetric.pagePadding)
+        }
+    }
+
+    var sortedCronJobs: [CronJob] {
+        (self.overview?.cronJobs ?? [])
+            .sorted { lhs, rhs in
+                let lhsNext = AgentProValueReader.intValue(lhs.state["nextRunAtMs"])
+                let rhsNext = AgentProValueReader.intValue(rhs.state["nextRunAtMs"])
+                switch (lhsNext, rhsNext) {
+                case let (lhsNext?, rhsNext?): return lhsNext < rhsNext
+                case (_?, nil): return true
+                case (nil, _?): return false
+                case (nil, nil): return lhs.name.localizedCaseInsensitiveCompare(rhs.name) == .orderedAscending
+                }
+            }
+    }
+
+    func cronJobDetailRow(_ job: CronJob) -> some View {
+        let busy = self.cronActionBusyIDs.contains(job.id)
+        return HStack(alignment: .top, spacing: 12) {
+            ProIconBadge(
+                systemName: job.enabled ? "clock.arrow.circlepath" : "pause.circle",
+                color: job.enabled ? OpenClawBrand.accent : .secondary)
+            VStack(alignment: .leading, spacing: 4) {
+                Text(job.name)
+                    .font(.subheadline.weight(.semibold))
+                    .lineLimit(1)
+                Text(self.cronJobDetail(job))
+                    .font(.caption)
+                    .foregroundStyle(.secondary)
+                    .lineLimit(2)
+                Text(self.cronScheduleSummary(job))
+                    .font(.caption2)
+                    .foregroundStyle(.secondary)
+                    .lineLimit(1)
+                HStack(spacing: 8) {
+                    Button {
+                        Task { await self.runCronJob(job) }
+                    } label: {
+                        Label("Run", systemImage: "play.fill")
+                    }
+                    .disabled(busy || !self.gatewayConnected)
+
+                    Button {
+                        Task { await self.setCronJob(job, enabled: !job.enabled) }
+                    } label: {
+                        Label(job.enabled ? "Pause" : "Enable", systemImage: job.enabled ? "pause.fill" : "checkmark")
+                    }
+                    .disabled(busy || !self.gatewayConnected)
+                }
+                .buttonStyle(.bordered)
+                .controlSize(.mini)
+            }
+            Spacer(minLength: 8)
+            if busy {
+                ProgressView()
+                    .progressViewStyle(.circular)
+                    .controlSize(.small)
+            } else {
+                Text(self.cronJobState(job))
+                    .font(.caption2.weight(.semibold))
+                    .foregroundStyle(job.enabled ? OpenClawBrand.accent : .secondary)
+                    .lineLimit(1)
+            }
+        }
+        .padding(.vertical, 10)
+        .padding(.horizontal, 14)
+    }
+
+    @MainActor
+    func runCronJob(_ job: CronJob) async {
+        await self.runCronAction(job, success: "Queued \(job.name).") {
+            let params = CronRunParams(id: job.id, mode: "force")
+            _ = try await self.requestGateway(method: "cron.run", params: params, timeoutSeconds: 20)
+        }
+    }
+
+    @MainActor
+    func setCronJob(_ job: CronJob, enabled: Bool) async {
+        await self.runCronAction(job, success: enabled ? "Enabled \(job.name)." : "Paused \(job.name).") {
+            let params = CronUpdateParams(id: job.id, patch: CronUpdatePatch(enabled: enabled))
+            _ = try await self.requestGateway(method: "cron.update", params: params, timeoutSeconds: 20)
+        }
+    }
+
+    @MainActor
+    func runCronAction(
+        _ job: CronJob,
+        success: String,
+        action: () async throws -> Void) async
+    {
+        guard self.gatewayConnected else { return }
+        self.cronActionBusyIDs.insert(job.id)
+        self.cronActionStatusText = nil
+        defer { self.cronActionBusyIDs.remove(job.id) }
+        do {
+            try await action()
+            self.cronActionStatusText = success
+            await self.refreshOverview(force: true)
+        } catch {
+            self.cronActionStatusText = Self.skillMutationMessage(error)
+        }
+    }
+
+    func cronScheduleSummary(_ job: CronJob) -> String {
+        guard let schedule = job.schedule.value as? [String: AnyCodable] else { return "Schedule configured" }
+        if let expr = Self.stringValue(schedule["expr"]) {
+            return "Cron \(expr)"
+        }
+        if let everyMs = AgentProValueReader.intValue(schedule["everyMs"]) {
+            return "Every \(Self.duration(milliseconds: everyMs))"
+        }
+        if let kind = Self.stringValue(schedule["kind"]) {
+            return kind
+        }
+        return "Schedule configured"
+    }
+}

apps/ios/Sources/Design/AgentProTab+Destinations.swift

@@ -0,0 +1,148 @@
+import OpenClawKit
+import OpenClawProtocol
+import SwiftUI
+
+extension AgentProTab {
+    @ViewBuilder
+    func destination(for route: AgentRoute) -> some View {
+        switch route {
+        case .skills:
+            self.skillsDestination
+        case .nodes:
+            self.nodesDestination
+        case .cron:
+            self.cronDestination
+        case .usage:
+            self.usageDestination
+        case .dreaming:
+            self.dreamingDestination
+        }
+    }
+
+    var skillsDestination: some View {
+        ZStack {
+            OpenClawProBackground()
+            ScrollView {
+                VStack(alignment: .leading, spacing: 16) {
+                    self.detailSummaryCard(
+                        icon: "sparkles",
+                        title: "Skills",
+                        value: self.skillsValue,
+                        detail: self.skillsDetail,
+                        color: self.gatewayConnected ? OpenClawBrand.accent : .secondary)
+                    self.skillsPolicyControls
+                    self.skillsFilterField
+                    self.clawHubSearchCard
+                    self.skillsList
+                }
+                .padding(.vertical, 18)
+            }
+            .refreshable {
+                await self.refreshOverview(force: true)
+            }
+            .safeAreaPadding(.bottom, OpenClawProMetric.bottomScrollInset)
+        }
+        .navigationTitle("Skills")
+        .navigationBarTitleDisplayMode(.inline)
+    }
+
+    var nodesDestination: some View {
+        AgentProNodesDestination(
+            overview: self.overview,
+            gatewayConnected: self.gatewayConnected,
+            agentCount: self.appModel.gatewayAgents.count,
+            instancesValue: self.instancesValue,
+            instancesDetail: self.instancesDetail,
+            instancesColor: self.instancesColor,
+            refresh: {
+                await self.refreshOverview(force: true)
+            })
+    }
+
+    var cronDestination: some View {
+        ZStack {
+            OpenClawProBackground()
+            ScrollView {
+                VStack(alignment: .leading, spacing: 16) {
+                    self.detailSummaryCard(
+                        icon: "clock.arrow.circlepath",
+                        title: "Cron Jobs",
+                        value: self.cronValue,
+                        detail: self.cronDetail,
+                        color: self.cronColor)
+                    self.cronStatusCard
+                    self.cronJobsList(limit: nil)
+                }
+                .padding(.vertical, 18)
+            }
+            .refreshable {
+                await self.refreshOverview(force: true)
+            }
+            .safeAreaPadding(.bottom, OpenClawProMetric.bottomScrollInset)
+        }
+        .navigationTitle("Cron Jobs")
+        .navigationBarTitleDisplayMode(.inline)
+    }
+
+    var usageDestination: some View {
+        ZStack {
+            OpenClawProBackground()
+            ScrollView {
+                VStack(alignment: .leading, spacing: 16) {
+                    self.detailSummaryCard(
+                        icon: "chart.line.uptrend.xyaxis",
+                        title: "Usage",
+                        value: self.usageValue,
+                        detail: self.usageDetail,
+                        color: self.gatewayConnected ? OpenClawBrand.accent : .secondary)
+                    self.usageTotalsCard
+                    self.usageDailyList
+                }
+                .padding(.vertical, 18)
+            }
+            .refreshable {
+                await self.refreshOverview(force: true)
+            }
+            .safeAreaPadding(.bottom, OpenClawProMetric.bottomScrollInset)
+        }
+        .navigationTitle("Usage")
+        .navigationBarTitleDisplayMode(.inline)
+    }
+
+    var dreamingDestination: some View {
+        AgentProDreamingDestination(
+            overview: self.overview,
+            gatewayConnected: self.gatewayConnected,
+            overviewLoading: self.overviewLoading,
+            dreamingValue: self.dreamingValue,
+            dreamingDetail: self.dreamingDetail,
+            dreamingColor: self.dreamingColor,
+            refresh: {
+                await self.refreshOverview(force: true)
+            })
+    }
+
+    func detailSummaryCard(
+        icon: String,
+        title: String,
+        value: String,
+        detail: String,
+        color: Color) -> some View
+    {
+        ProCard(radius: AgentLayout.cardRadius) {
+            HStack(spacing: 12) {
+                ProIconBadge(systemName: icon, color: color)
+                VStack(alignment: .leading, spacing: 3) {
+                    Text(title)
+                        .font(.headline)
+                    Text(detail)
+                        .font(.caption)
+                        .foregroundStyle(.secondary)
+                }
+                Spacer(minLength: 8)
+                ProValuePill(value: value, color: color)
+            }
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+}

apps/ios/Sources/Design/AgentProTab+DetailComponents.swift

@@ -0,0 +1,35 @@
+import OpenClawKit
+import OpenClawProtocol
+import SwiftUI
+
+extension AgentProTab {
+    func detailMetric(label: String, value: String) -> some View {
+        VStack(alignment: .leading, spacing: 3) {
+            Text(label)
+                .font(.caption2.weight(.medium))
+                .foregroundStyle(.secondary)
+            Text(value)
+                .font(.subheadline.weight(.semibold))
+                .lineLimit(1)
+                .minimumScaleFactor(0.8)
+        }
+        .frame(maxWidth: .infinity, alignment: .leading)
+        .padding(10)
+        .background(Color.primary.opacity(0.055), in: RoundedRectangle(cornerRadius: 10, style: .continuous))
+    }
+
+    func emptyDetailRow(icon: String, title: String, detail: String) -> some View {
+        HStack(spacing: 12) {
+            ProIconBadge(systemName: icon, color: .secondary)
+            VStack(alignment: .leading, spacing: 3) {
+                Text(title)
+                    .font(.subheadline.weight(.semibold))
+                Text(detail)
+                    .font(.caption)
+                    .foregroundStyle(.secondary)
+                    .lineLimit(2)
+            }
+            Spacer(minLength: 8)
+        }
+    }
+}

apps/ios/Sources/Design/AgentProTab+GatewayData.swift

@@ -0,0 +1,251 @@
+import OpenClawKit
+import OpenClawProtocol
+import SwiftUI
+
+extension AgentProTab {
+    func agentName(for agent: AgentSummary) -> String {
+        self.normalized(agent.name) ?? agent.id
+    }
+
+    func agentBadge(for agent: AgentSummary) -> String {
+        if let identity = agent.identity,
+           let emoji = identity["emoji"]?.value as? String,
+           let normalizedEmoji = self.normalized(emoji)
+        {
+            return normalizedEmoji
+        }
+
+        let words = self.agentName(for: agent)
+            .split(whereSeparator: { $0.isWhitespace || $0 == "-" || $0 == "_" })
+            .prefix(2)
+        let initials = words.compactMap(\.first).map(String.init).joined()
+        return initials.isEmpty ? "OC" : initials.uppercased()
+    }
+
+    func agentTint(for agent: AgentSummary, state: AgentRosterState) -> Color {
+        if agent.id == self.activeAgentID { return OpenClawBrand.accent }
+        return state.color.opacity(0.62)
+    }
+
+    func agentDetail(for agent: AgentSummary) -> String {
+        let parts = [
+            self.normalized(agent.workspace),
+            self.modelLabel(for: agent),
+            agent.id == self.appModel.gatewayDefaultAgentId ? "default" : nil,
+        ].compactMap(\.self)
+        return parts.isEmpty ? agent.id : parts.joined(separator: " • ")
+    }
+
+    func agentSessionSummary(_ agent: AgentSummary) -> String {
+        guard self.gatewayConnected else { return "0" }
+        if agent.id == self.activeAgentID {
+            return self.appModel.isOperatorGatewayConnected ? "1 running" : "0"
+        }
+        return "0"
+    }
+
+    func agentRuntimeSummary(_ agent: AgentSummary) -> String {
+        if let runtime = agent.agentruntime,
+           let id = runtime["id"]?.value as? String,
+           let normalized = self.normalized(id)
+        {
+            return normalized
+        }
+        if let model = self.modelLabel(for: agent) {
+            return Self.shortModelLabel(model)
+        }
+        return "default"
+    }
+
+    func agentRosterState(for agent: AgentSummary) -> AgentRosterState {
+        guard self.gatewayConnected else { return .idle }
+        if agent.id == self.activeAgentID { return .online }
+        if self.cronJobsContain(agentID: agent.id) { return .busy }
+        return .idle
+    }
+
+    func cronJobsContain(agentID: String) -> Bool {
+        self.recentCronJobs.contains { job in
+            self.normalized(job.agentid) == agentID && job.enabled
+        }
+    }
+
+    func modelLabel(for agent: AgentSummary) -> String? {
+        guard let model = agent.model else { return nil }
+        for key in ["primary", "name", "id", "model"] {
+            if let value = model[key]?.value as? String,
+               let normalized = self.normalized(value)
+            {
+                return normalized
+            }
+        }
+        return nil
+    }
+
+    static func shortModelLabel(_ model: String) -> String {
+        let trimmed = model.trimmingCharacters(in: .whitespacesAndNewlines)
+        guard !trimmed.isEmpty else { return "default" }
+        let leaf = trimmed.split(separator: "/").last.map(String.init) ?? trimmed
+        return leaf
+            .replacingOccurrences(of: "claude-", with: "")
+            .replacingOccurrences(of: "gpt-", with: "")
+    }
+
+    func presenceLabel(_ entry: PresenceEntry) -> String? {
+        self.normalized(entry.host)
+            ?? self.normalized(entry.devicefamily)
+            ?? self.normalized(entry.platform)
+            ?? self.normalized(entry.mode)
+    }
+
+    func cronJobDetail(_ job: CronJob) -> String {
+        if let nextRunAtMs = AgentProValueReader.intValue(job.state["nextRunAtMs"]) {
+            return "Next \(Self.relativeTime(fromMilliseconds: nextRunAtMs))"
+        }
+        if let description = self.normalized(job.description) {
+            return description
+        }
+        if let agentId = self.normalized(job.agentid) {
+            return agentId
+        }
+        return job.id
+    }
+
+    func cronJobState(_ job: CronJob) -> String {
+        if !job.enabled {
+            return "paused"
+        }
+        if let status = Self.stringValue(job.state["lastStatus"]) ?? Self.stringValue(job.state["lastRunStatus"]) {
+            return status
+        }
+        return "enabled"
+    }
+
+    @MainActor
+    func refreshOverview(force: Bool) async {
+        guard self.scenePhase == .active else { return }
+        guard self.appModel.isOperatorGatewayConnected else {
+            self.overview = nil
+            self.overviewErrorText = nil
+            self.overviewLoading = false
+            return
+        }
+        if self.overviewLoading, force == false {
+            return
+        }
+
+        self.overviewLoading = true
+        self.overviewErrorText = nil
+        defer { self.overviewLoading = false }
+
+        let activeAgentID = self.activeAgentID
+        let skillsParams = Self.agentScopedParams(agentId: activeAgentID)
+        async let skills = self.requestOptional(
+            SkillStatusReportLite.self,
+            method: "skills.status",
+            paramsJSON: skillsParams)
+        async let config = self.requestOptional(ConfigSnapshotLite.self, method: "config.get")
+        async let presence = self.requestOptional([PresenceEntry].self, method: "system-presence")
+        async let cronStatus = self.requestOptional(CronStatusLite.self, method: "cron.status")
+        async let cronJobs = self.requestOptional(
+            CronJobsListLite.self,
+            method: "cron.list",
+            paramsJSON: "{\"includeDisabled\":true,\"limit\":8,\"sortBy\":\"nextRunAtMs\",\"sortDir\":\"asc\"}",
+            timeoutSeconds: 12)
+        async let dreaming = self.requestOptional(DreamingStatusEnvelope.self, method: "doctor.memory.status")
+        async let dreamDiary = self.requestOptional(DreamDiaryLite.self, method: "doctor.memory.dreamDiary")
+        async let usage = self.requestOptional(
+            CostUsageSummaryLite.self,
+            method: "usage.cost",
+            paramsJSON: "{\"days\":31}",
+            timeoutSeconds: 12)
+
+        let loadedSkills = await skills
+        let loadedConfig = await config
+        let loadedPresence = await presence
+        let loadedCronStatus = await cronStatus
+        let loadedCronJobs = await cronJobs
+        let loadedDreaming = await dreaming
+        let loadedDreamDiary = await dreamDiary
+        let loadedUsage = await usage
+        let snapshot = AgentOverviewSnapshot(
+            skills: loadedSkills,
+            presence: loadedPresence ?? [],
+            cronStatus: loadedCronStatus,
+            cronJobs: loadedCronJobs?.jobs ?? [],
+            dreaming: loadedDreaming?.dreaming,
+            dreamDiary: loadedDreamDiary,
+            usage: loadedUsage,
+            activeAgentId: activeAgentID,
+            agentSkillFilter: loadedSkills?.agentSkillFilter
+                ?? loadedConfig?.effectiveSkillFilter(agentId: activeAgentID),
+            loadedAt: Date())
+
+        if snapshot.hasAnyLiveData {
+            self.overview = snapshot
+        } else {
+            self.overview = snapshot
+            self.overviewErrorText = "Live overview could not load yet."
+        }
+    }
+
+    func requestOptional<T: Decodable>(
+        _ type: T.Type,
+        method: String,
+        paramsJSON: String = "{}",
+        timeoutSeconds: Int = 8) async -> T?
+    {
+        do {
+            let data = try await self.appModel.operatorSession.request(
+                method: method,
+                paramsJSON: paramsJSON,
+                timeoutSeconds: timeoutSeconds)
+            return try JSONDecoder().decode(T.self, from: data)
+        } catch {
+            return nil
+        }
+    }
+
+    func normalized(_ value: String?) -> String? {
+        let trimmed = value?.trimmingCharacters(in: .whitespacesAndNewlines) ?? ""
+        return trimmed.isEmpty ? nil : trimmed
+    }
+
+    static func stringValue(_ value: AnyCodable?) -> String? {
+        guard let string = value?.value as? String else { return nil }
+        let trimmed = string.trimmingCharacters(in: .whitespacesAndNewlines)
+        return trimmed.isEmpty ? nil : trimmed
+    }
+
+    static func relativeTime(fromMilliseconds milliseconds: Int) -> String {
+        let date = Date(timeIntervalSince1970: Double(milliseconds) / 1000)
+        return date.formatted(.relative(presentation: .named, unitsStyle: .abbreviated))
+    }
+
+    static func compactNumber(_ value: Int) -> String {
+        value.formatted(.number.notation(.compactName))
+    }
+
+    static func currency(_ value: Double) -> String {
+        value.formatted(.currency(code: "USD").precision(.fractionLength(0...2)))
+    }
+
+    static func duration(milliseconds: Int) -> String {
+        let seconds = max(0, milliseconds / 1000)
+        if seconds < 60 { return "\(seconds)s" }
+        let minutes = seconds / 60
+        if minutes < 60 { return "\(minutes)m" }
+        let hours = minutes / 60
+        if hours < 24 { return "\(hours)h" }
+        return "\(hours / 24)d"
+    }
+
+    static func agentScopedParams(agentId: String) -> String {
+        guard let data = try? JSONEncoder().encode(["agentId": agentId]),
+              let json = String(data: data, encoding: .utf8)
+        else {
+            return "{}"
+        }
+        return json
+    }
+}

apps/ios/Sources/Design/AgentProTab+Overview.swift

@@ -0,0 +1,724 @@
+import OpenClawKit
+import OpenClawProtocol
+import SwiftUI
+
+extension AgentProTab {
+    var rosterHeader: some View {
+        VStack(alignment: .leading, spacing: 10) {
+            HStack(alignment: .top, spacing: 12) {
+                VStack(alignment: .leading, spacing: 3) {
+                    Text("Agents")
+                        .font(.system(size: 28, weight: .bold))
+                    Text("\(self.sortedAgents.count) total")
+                        .font(.subheadline)
+                        .foregroundStyle(.secondary)
+                }
+
+                Spacer(minLength: 8)
+
+                HStack(spacing: 10) {
+                    self.headerIconButton(
+                        systemName: "magnifyingglass",
+                        label: "Search agents",
+                        action: {
+                            withAnimation(.snappy(duration: 0.18)) {
+                                self.agentSearchPresented.toggle()
+                            }
+                        })
+                    self.headerIconButton(
+                        systemName: "arrow.clockwise",
+                        label: self.overviewLoading ? "Refreshing agents" : "Refresh agents",
+                        action: {
+                            self.overviewRefreshNonce += 1
+                        })
+                }
+                .padding(.top, 2)
+            }
+
+            if self.agentSearchPresented {
+                TextField("Search agents", text: self.$agentSearchText)
+                    .textInputAutocapitalization(.never)
+                    .autocorrectionDisabled()
+                    .font(.subheadline)
+                    .padding(.horizontal, 12)
+                    .frame(height: 38)
+                    .background {
+                        Capsule()
+                            .fill(self.searchFieldFill)
+                            .overlay {
+                                Capsule().strokeBorder(self.searchFieldStroke, lineWidth: 1)
+                            }
+                    }
+                    .transition(.move(edge: .top).combined(with: .opacity))
+            }
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+        .padding(.top, 6)
+    }
+
+    var agentFilters: some View {
+        ScrollView(.horizontal, showsIndicators: false) {
+            HStack(spacing: 8) {
+                ForEach(AgentRosterFilter.allCases) { filter in
+                    Button {
+                        withAnimation(.snappy(duration: 0.18)) {
+                            self.agentRosterFilter = filter
+                        }
+                    } label: {
+                        Text(filter.title)
+                            .font(.caption.weight(.semibold))
+                            .foregroundStyle(self.agentRosterFilter == filter ? .primary : .secondary)
+                            .padding(.horizontal, 15)
+                            .frame(height: AgentLayout.filterHeight)
+                            .background {
+                                Capsule()
+                                    .fill(self.agentRosterFilter == filter
+                                        ? Color.primary.opacity(0.13)
+                                        : Color.primary.opacity(0.055))
+                            }
+                            .overlay {
+                                Capsule()
+                                    .strokeBorder(Color.primary.opacity(self.agentRosterFilter == filter ? 0.22 : 0.06))
+                            }
+                    }
+                    .buttonStyle(.plain)
+                }
+
+                if self.agentFiltersActive {
+                    self.headerIconButton(
+                        systemName: "xmark",
+                        label: "Clear filters",
+                        action: {
+                            self.agentRosterFilter = .all
+                            self.agentSearchText = ""
+                        })
+                        .frame(width: AgentLayout.filterHeight, height: AgentLayout.filterHeight)
+                }
+            }
+            .padding(.horizontal, OpenClawProMetric.pagePadding)
+        }
+    }
+
+    var agentFiltersActive: Bool {
+        self.agentRosterFilter != .all
+            || !self.agentSearchText.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty
+    }
+
+    var agentsSection: some View {
+        ProCard(padding: 0, radius: AgentLayout.cardRadius) {
+            if self.filteredAgents.isEmpty {
+                self.emptyAgentsRow
+                    .padding(14)
+            } else {
+                VStack(spacing: 0) {
+                    ForEach(Array(self.filteredAgents.enumerated()), id: \.element.id) { index, agent in
+                        self.agentRow(agent)
+                        if index < self.filteredAgents.count - 1 {
+                            Divider().padding(.leading, 76)
+                        }
+                    }
+                }
+            }
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+
+    var operationsSection: some View {
+        VStack(alignment: .leading, spacing: 8) {
+            ProSectionHeader(title: "Live Operations")
+            LazyVGrid(columns: [GridItem(.flexible()), GridItem(.flexible())], spacing: 10) {
+                self.metricTile(
+                    icon: "sparkles",
+                    title: "Skills",
+                    value: self.skillsValue,
+                    detail: self.skillsDetail,
+                    color: self.gatewayConnected ? OpenClawBrand.accent : .secondary,
+                    route: .skills)
+                self.metricTile(
+                    icon: "externaldrive.connected.to.line.below",
+                    title: "Instances",
+                    value: self.instancesValue,
+                    detail: self.instancesDetail,
+                    color: self.instancesColor,
+                    route: .nodes)
+                self.metricTile(
+                    icon: "clock.arrow.circlepath",
+                    title: "Cron",
+                    value: self.cronValue,
+                    detail: self.cronDetail,
+                    color: self.cronColor,
+                    route: .cron)
+                self.metricTile(
+                    icon: "chart.line.uptrend.xyaxis",
+                    title: "Usage",
+                    value: self.usageValue,
+                    detail: self.usageDetail,
+                    color: self.gatewayConnected ? OpenClawBrand.accent : .secondary,
+                    route: .usage)
+            }
+            .padding(.horizontal, OpenClawProMetric.pagePadding)
+
+            if let overviewErrorText {
+                Text(overviewErrorText)
+                    .font(.caption)
+                    .foregroundStyle(OpenClawBrand.warn)
+                    .padding(.horizontal, OpenClawProMetric.pagePadding)
+            }
+        }
+    }
+
+    var dreamingSection: some View {
+        VStack(alignment: .leading, spacing: 8) {
+            ProSectionHeader(title: "Dreaming")
+            ProCard(radius: AgentLayout.cardRadius) {
+                NavigationLink(value: AgentRoute.dreaming) {
+                    self.agentMenuRow(
+                        icon: "moon",
+                        title: "Dreaming",
+                        detail: self.dreamingDetail,
+                        value: self.dreamingValue,
+                        color: self.dreamingColor,
+                        showsChevron: true)
+                }
+                .buttonStyle(.plain)
+            }
+            .padding(.horizontal, OpenClawProMetric.pagePadding)
+        }
+    }
+
+    var cronSection: some View {
+        VStack(alignment: .leading, spacing: 8) {
+            ProSectionHeader(title: "Scheduled Work")
+            ProCard(padding: 0, radius: AgentLayout.cardRadius) {
+                let jobs = self.recentCronJobs
+                if jobs.isEmpty {
+                    NavigationLink(value: AgentRoute.cron) {
+                        self.emptyCronRow
+                            .padding(14)
+                    }
+                    .buttonStyle(.plain)
+                } else {
+                    VStack(spacing: 0) {
+                        ForEach(Array(jobs.enumerated()), id: \.element.id) { index, job in
+                            NavigationLink(value: AgentRoute.cron) {
+                                self.cronJobRow(job)
+                            }
+                            .buttonStyle(.plain)
+                            if index < jobs.count - 1 {
+                                Divider().padding(.leading, 60)
+                            }
+                        }
+                    }
+                }
+            }
+            .padding(.horizontal, OpenClawProMetric.pagePadding)
+        }
+    }
+
+    var emptyAgentsRow: some View {
+        HStack(spacing: 12) {
+            ProIconBadge(systemName: "person.2.slash", color: .secondary)
+            VStack(alignment: .leading, spacing: 3) {
+                Text(self.emptyAgentsTitle)
+                    .font(.subheadline.weight(.semibold))
+                Text(self.emptyAgentsDetail)
+                    .font(.caption)
+                    .foregroundStyle(.secondary)
+            }
+            Spacer()
+        }
+    }
+
+    func agentRow(_ agent: AgentSummary) -> some View {
+        let isActive = agent.id == self.activeAgentID
+        let state = self.agentRosterState(for: agent)
+        return HStack(alignment: .top, spacing: 12) {
+            self.agentAvatar(agent, state: state)
+
+            VStack(alignment: .leading, spacing: 8) {
+                VStack(alignment: .leading, spacing: 2) {
+                    HStack(spacing: 6) {
+                        Text(self.agentName(for: agent))
+                            .font(.subheadline.weight(.semibold))
+                            .lineLimit(1)
+
+                        HStack(spacing: 4) {
+                            Circle()
+                                .fill(state.color)
+                                .frame(width: 6, height: 6)
+                            Text(state.title)
+                                .font(.caption2.weight(.semibold))
+                        }
+                        .foregroundStyle(state.color)
+                        .lineLimit(1)
+                    }
+
+                    Text(self.agentDetail(for: agent))
+                        .font(.caption)
+                        .foregroundStyle(.secondary)
+                        .lineLimit(1)
+                }
+
+                HStack(spacing: 0) {
+                    self.agentMetric(label: "Sessions", value: self.agentSessionSummary(agent))
+                    Divider()
+                        .frame(height: 24)
+                        .padding(.horizontal, 12)
+                    self.agentMetric(label: "Runtime", value: self.agentRuntimeSummary(agent))
+                }
+            }
+            .layoutPriority(1)
+
+            Button {
+                self.appModel.setSelectedAgentId(agent.id)
+            } label: {
+                Image(systemName: isActive ? "checkmark" : "arrow.right")
+                    .font(.caption.weight(.bold))
+            }
+            .buttonStyle(.plain)
+            .foregroundStyle(isActive ? OpenClawBrand.accent : .primary)
+            .frame(width: AgentLayout.actionButtonSize, height: AgentLayout.actionButtonSize)
+            .background {
+                Circle()
+                    .fill(self.iconButtonFill)
+                    .overlay {
+                        Circle().strokeBorder(self.iconButtonStroke, lineWidth: 1)
+                    }
+            }
+            .accessibilityLabel(isActive ? "Active agent" : "Make active agent")
+        }
+        .padding(.vertical, 14)
+        .padding(.horizontal, 13)
+        .frame(minHeight: AgentLayout.rowMinHeight, alignment: .center)
+        .contentShape(Rectangle())
+        .onTapGesture {
+            self.appModel.setSelectedAgentId(agent.id)
+        }
+    }
+
+    func headerIconButton(
+        systemName: String,
+        label: String,
+        action: @escaping () -> Void) -> some View
+    {
+        Button(action: action) {
+            Image(systemName: systemName)
+                .font(.subheadline.weight(.semibold))
+                .frame(width: AgentLayout.filterHeight, height: AgentLayout.filterHeight)
+                .background {
+                    Circle()
+                        .fill(self.iconButtonFill)
+                        .overlay {
+                            Circle().strokeBorder(self.iconButtonStroke, lineWidth: 1)
+                        }
+                }
+        }
+        .buttonStyle(.plain)
+        .accessibilityLabel(label)
+    }
+
+    func agentAvatar(_ agent: AgentSummary, state: AgentRosterState) -> some View {
+        ZStack(alignment: .bottomTrailing) {
+            Text(self.agentBadge(for: agent))
+                .font(.system(size: self.agentBadge(for: agent).count > 2 ? 14 : 18, weight: .bold, design: .rounded))
+                .foregroundStyle(.white)
+                .minimumScaleFactor(0.62)
+                .lineLimit(1)
+                .frame(width: 48, height: 48)
+                .background(
+                    Circle()
+                        .fill(
+                            LinearGradient(
+                                colors: [
+                                    self.agentTint(for: agent, state: state),
+                                    Color.primary.opacity(0.38),
+                                ],
+                                startPoint: .topLeading,
+                                endPoint: .bottomTrailing)))
+                .overlay(Circle().strokeBorder(Color.white.opacity(0.18), lineWidth: 1))
+
+            Circle()
+                .fill(state.color)
+                .frame(width: 10, height: 10)
+                .overlay(Circle().strokeBorder(Color.primary.opacity(0.15), lineWidth: 1))
+        }
+    }
+
+    func agentMetric(label: String, value: String) -> some View {
+        VStack(alignment: .leading, spacing: 2) {
+            Text(label)
+                .font(.caption2)
+                .foregroundStyle(.secondary)
+            Text(value)
+                .font(.caption.weight(.semibold))
+                .foregroundStyle(.primary)
+                .lineLimit(1)
+                .minimumScaleFactor(0.74)
+        }
+        .frame(minWidth: 60, alignment: .leading)
+    }
+
+    func agentMenuRow(
+        icon: String,
+        title: String,
+        detail: String,
+        value: String,
+        color: Color,
+        showsChevron: Bool = false) -> some View
+    {
+        HStack(spacing: 12) {
+            ProIconBadge(systemName: icon, color: color)
+            VStack(alignment: .leading, spacing: 3) {
+                Text(title)
+                    .font(.subheadline.weight(.semibold))
+                Text(detail)
+                    .font(.caption)
+                    .foregroundStyle(.secondary)
+                    .lineLimit(1)
+            }
+            Spacer(minLength: 8)
+            Text(value)
+                .font(.caption2.weight(.semibold))
+                .foregroundStyle(color)
+                .lineLimit(1)
+            if showsChevron {
+                Image(systemName: "chevron.right")
+                    .font(.caption.weight(.semibold))
+                    .foregroundStyle(.secondary)
+            }
+        }
+        .padding(.vertical, 10)
+    }
+
+    func metricTile(
+        icon: String,
+        title: String,
+        value: String,
+        detail: String,
+        color: Color,
+        route: AgentRoute? = nil) -> some View
+    {
+        Group {
+            if let route {
+                NavigationLink(value: route) {
+                    self.metricTileContent(
+                        icon: icon,
+                        title: title,
+                        value: value,
+                        detail: detail,
+                        color: color,
+                        showsChevron: true)
+                }
+                .buttonStyle(.plain)
+            } else {
+                self.metricTileContent(
+                    icon: icon,
+                    title: title,
+                    value: value,
+                    detail: detail,
+                    color: color,
+                    showsChevron: false)
+            }
+        }
+    }
+
+    func metricTileContent(
+        icon: String,
+        title: String,
+        value: String,
+        detail: String,
+        color: Color,
+        showsChevron: Bool) -> some View
+    {
+        ProCard(padding: 12, radius: AgentLayout.cardRadius) {
+            VStack(alignment: .leading, spacing: 10) {
+                HStack {
+                    ProIconBadge(systemName: icon, color: color)
+                    Spacer()
+                    ProValuePill(value: value, color: color)
+                    if showsChevron {
+                        Image(systemName: "chevron.right")
+                            .font(.caption.weight(.semibold))
+                            .foregroundStyle(.secondary)
+                    }
+                }
+                VStack(alignment: .leading, spacing: 2) {
+                    Text(title)
+                        .font(.caption.weight(.semibold))
+                    Text(detail)
+                        .font(.caption2)
+                        .foregroundStyle(.secondary)
+                        .lineLimit(2)
+                        .multilineTextAlignment(.leading)
+                }
+            }
+            .frame(maxWidth: .infinity, alignment: .leading)
+            .frame(height: AgentLayout.metricTileHeight, alignment: .topLeading)
+        }
+    }
+
+    var emptyCronRow: some View {
+        HStack(spacing: 12) {
+            ProIconBadge(systemName: "clock.badge.questionmark", color: .secondary)
+            VStack(alignment: .leading, spacing: 3) {
+                Text(self.gatewayConnected ? "No scheduled jobs" : "Cron unavailable")
+                    .font(.subheadline.weight(.semibold))
+                Text(self.gatewayConnected
+                    ? "The gateway has no visible cron jobs."
+                    : "Connect a gateway to load scheduled work.")
+                    .font(.caption)
+                    .foregroundStyle(.secondary)
+            }
+            Spacer()
+        }
+    }
+
+    func cronJobRow(_ job: CronJob) -> some View {
+        HStack(spacing: 12) {
+            ProIconBadge(
+                systemName: job.enabled ? "clock.arrow.circlepath" : "pause.circle",
+                color: job.enabled ? OpenClawBrand.accent : .secondary)
+            VStack(alignment: .leading, spacing: 3) {
+                Text(job.name)
+                    .font(.subheadline.weight(.semibold))
+                    .lineLimit(1)
+                Text(self.cronJobDetail(job))
+                    .font(.caption)
+                    .foregroundStyle(.secondary)
+                    .lineLimit(1)
+            }
+            Spacer(minLength: 8)
+            Text(self.cronJobState(job))
+                .font(.caption2.weight(.semibold))
+                .foregroundStyle(job.enabled ? OpenClawBrand.accent : .secondary)
+                .lineLimit(1)
+        }
+        .padding(.vertical, 10)
+        .padding(.horizontal, 14)
+    }
+
+    var sortedAgents: [AgentSummary] {
+        self.appModel.gatewayAgents.sorted { lhs, rhs in
+            if lhs.id == self.activeAgentID { return true }
+            if rhs.id == self.activeAgentID { return false }
+            return self.agentName(for: lhs)
+                .localizedCaseInsensitiveCompare(self.agentName(for: rhs)) == .orderedAscending
+        }
+    }
+
+    var filteredAgents: [AgentSummary] {
+        let query = self.agentSearchText.trimmingCharacters(in: .whitespacesAndNewlines)
+        return self.sortedAgents.filter { agent in
+            let matchesFilter: Bool = switch self.agentRosterFilter {
+            case .all:
+                true
+            case .online:
+                self.agentRosterState(for: agent) == .online
+            case .busy:
+                self.agentRosterState(for: agent) == .busy
+            case .idle:
+                self.agentRosterState(for: agent) == .idle
+            }
+
+            guard matchesFilter else { return false }
+            guard !query.isEmpty else { return true }
+            let haystack = [
+                self.agentName(for: agent),
+                agent.id,
+                self.normalized(agent.workspace),
+                self.modelLabel(for: agent),
+            ]
+                .compactMap(\.self)
+                .joined(separator: " ")
+            return haystack.localizedCaseInsensitiveContains(query)
+        }
+    }
+
+    var activeAgentID: String {
+        self.normalized(self.appModel.selectedAgentId)
+            ?? self.normalized(self.appModel.gatewayDefaultAgentId)
+            ?? "main"
+    }
+
+    var gatewayConnected: Bool {
+        GatewayStatusBuilder.build(appModel: self.appModel) == .connected
+    }
+
+    private var searchFieldFill: Color {
+        self.colorScheme == .dark ? Color.white.opacity(0.045) : Color.white.opacity(0.78)
+    }
+
+    private var searchFieldStroke: Color {
+        self.colorScheme == .dark ? Color.white.opacity(0.11) : Color.black.opacity(0.07)
+    }
+
+    private var iconButtonFill: Color {
+        self.colorScheme == .dark ? Color.white.opacity(0.065) : Color.white.opacity(0.78)
+    }
+
+    private var iconButtonStroke: Color {
+        self.colorScheme == .dark ? Color.white.opacity(0.14) : Color.black.opacity(0.07)
+    }
+
+    var emptyAgentsTitle: String {
+        if !self.gatewayConnected { return "Agents unavailable" }
+        if !self.agentSearchText.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty { return "No matches" }
+        if self.agentRosterFilter != .all { return "No \(self.agentRosterFilter.title.lowercased()) agents" }
+        return "No agents reported"
+    }
+
+    var emptyAgentsDetail: String {
+        if !self.gatewayConnected { return "Connect a gateway to load the live agent roster." }
+        if !self.agentSearchText.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty {
+            return "Try another search or clear the agent filters."
+        }
+        if self.agentRosterFilter != .all { return "Clear the filter to view the full roster." }
+        return "The connected gateway did not return an agent list."
+    }
+
+    var overviewTaskID: String {
+        [
+            self.gatewayConnected ? "connected" : "offline",
+            self.appModel.isOperatorGatewayConnected ? "operator" : "no-operator",
+            self.activeAgentID,
+            self.scenePhase == .active ? "active" : "inactive",
+            "\(self.overviewRefreshNonce)",
+        ].joined(separator: ":")
+    }
+
+    var skillsValue: String {
+        guard self.gatewayConnected else { return "offline" }
+        guard let skills = self.overview?.skills else {
+            return self.overviewLoading ? "..." : "live"
+        }
+        return "\(skills.enabledCount)/\(skills.totalCount)"
+    }
+
+    var skillsDetail: String {
+        guard self.gatewayConnected else { return "Connect a gateway to load skills." }
+        guard let skills = self.overview?.skills else {
+            return self.overviewLoading ? "Loading skill status." : "Skill status is available from the gateway."
+        }
+        if skills.blockedCount > 0 {
+            return "\(skills.enabledCount) enabled, \(skills.blockedCount) blocked"
+        }
+        if skills.missingRequirementCount > 0 {
+            return "\(skills.enabledCount) enabled, \(skills.missingRequirementCount) need setup"
+        }
+        return "\(skills.enabledCount) enabled, \(skills.totalCount) installed"
+    }
+
+    var instancesValue: String {
+        guard self.gatewayConnected else { return "offline" }
+        guard let count = self.overview?.presence.count else {
+            return self.overviewLoading ? "..." : "live"
+        }
+        return "\(count)"
+    }
+
+    var instancesDetail: String {
+        guard self.gatewayConnected else { return "Connect a gateway to load instances." }
+        guard let presence = self.overview?.presence else {
+            return self.overviewLoading ? "Loading instance presence." : "Instance presence is available."
+        }
+        let labels = presence.prefix(2).compactMap(self.presenceLabel)
+        if labels.isEmpty {
+            return "No live instances reported."
+        }
+        return labels.joined(separator: ", ")
+    }
+
+    var instancesColor: Color {
+        guard self.gatewayConnected else { return .secondary }
+        return (self.overview?.presence.isEmpty == false) ? OpenClawBrand.accent : .secondary
+    }
+
+    var cronValue: String {
+        guard self.gatewayConnected else { return "offline" }
+        guard let cronStatus = self.overview?.cronStatus else {
+            return self.overviewLoading ? "..." : "live"
+        }
+        return cronStatus.enabled ? "\(cronStatus.jobs)" : "off"
+    }
+
+    var cronDetail: String {
+        guard self.gatewayConnected else { return "Connect a gateway to load cron." }
+        guard let cronStatus = self.overview?.cronStatus else {
+            return self.overviewLoading ? "Loading cron status." : "Cron status is available."
+        }
+        if let nextWakeAtMs = cronStatus.nextwakeatms {
+            return "Next wake \(Self.relativeTime(fromMilliseconds: nextWakeAtMs))"
+        }
+        return cronStatus.enabled ? "Scheduler enabled" : "Scheduler disabled"
+    }
+
+    var cronColor: Color {
+        guard self.gatewayConnected else { return .secondary }
+        return self.overview?.cronStatus?.enabled == true ? OpenClawBrand.accent : .secondary
+    }
+
+    var usageValue: String {
+        guard self.gatewayConnected else { return "offline" }
+        guard let usage = self.overview?.usage else {
+            return self.overviewLoading ? "..." : "7d"
+        }
+        if let cost = usage.totalCost {
+            return Self.currency(cost)
+        }
+        if let tokens = usage.totalTokens, tokens > 0 {
+            return Self.compactNumber(tokens)
+        }
+        return "7d"
+    }
+
+    var usageDetail: String {
+        guard self.gatewayConnected else { return "Connect a gateway to load usage." }
+        guard let usage = self.overview?.usage else {
+            return self.overviewLoading ? "Loading recent usage." : "Recent usage is available."
+        }
+        if let tokens = usage.totalTokens, tokens > 0 {
+            return "\(Self.compactNumber(tokens)) tokens in \(usage.days ?? 7)d"
+        }
+        return "No token usage reported for \(usage.days ?? 7)d."
+    }
+
+    var dreamingValue: String {
+        guard self.gatewayConnected else { return "offline" }
+        guard let dreaming = self.overview?.dreaming else {
+            return self.overviewLoading ? "..." : "live"
+        }
+        return dreaming.enabled ? "on" : "off"
+    }
+
+    var dreamingDetail: String {
+        guard self.gatewayConnected else { return "Connect a gateway to load dreaming." }
+        guard let dreaming = self.overview?.dreaming else {
+            return self.overviewLoading ? "Loading dreaming status." : "Background memory status is available."
+        }
+        if let nextRunAtMs = dreaming.nextRunAtMs {
+            return "Next cycle \(Self.relativeTime(fromMilliseconds: nextRunAtMs))"
+        }
+        return "\(dreaming.totalSignalCount ?? 0) signals, \(dreaming.promotedToday ?? 0) promoted today"
+    }
+
+    var dreamingColor: Color {
+        guard self.gatewayConnected else { return .secondary }
+        return self.overview?.dreaming?.enabled == true ? OpenClawBrand.accent : .secondary
+    }
+
+    var recentCronJobs: [CronJob] {
+        (self.overview?.cronJobs ?? [])
+            .sorted { lhs, rhs in
+                let lhsNext = AgentProValueReader.intValue(lhs.state["nextRunAtMs"])
+                let rhsNext = AgentProValueReader.intValue(rhs.state["nextRunAtMs"])
+                switch (lhsNext, rhsNext) {
+                case let (lhsNext?, rhsNext?): return lhsNext < rhsNext
+                case (_?, nil): return true
+                case (nil, _?): return false
+                case (nil, nil): return lhs.updatedatms > rhs.updatedatms
+                }
+            }
+            .prefix(4)
+            .map(\.self)
+    }
+}

apps/ios/Sources/Design/AgentProTab+Skills.swift

@@ -0,0 +1,766 @@
+import OpenClawKit
+import OpenClawProtocol
+import SwiftUI
+
+extension AgentProTab {
+    var skillsPolicyControls: some View {
+        ProCard(radius: AgentLayout.cardRadius) {
+            VStack(alignment: .leading, spacing: 12) {
+                HStack(alignment: .firstTextBaseline) {
+                    VStack(alignment: .leading, spacing: 3) {
+                        Text(self.activeAgentName)
+                            .font(.headline)
+                        Text(self.skillPolicySummary)
+                            .font(.caption)
+                            .foregroundStyle(.secondary)
+                    }
+                    Spacer(minLength: 8)
+                    ProValuePill(
+                        value: self.agentSkillFilter == nil ? "all" : "\(self.agentSkillFilter?.count ?? 0)",
+                        color: OpenClawBrand.accent)
+                }
+
+                HStack(spacing: 8) {
+                    Button("Enable All") {
+                        Task { await self.enableAllSkills() }
+                    }
+                    .disabled(self.skillMutationBusy)
+
+                    Button("Disable All", role: .destructive) {
+                        Task { await self.disableAllSkills() }
+                    }
+                    .disabled(self.skillMutationBusy)
+
+                    Button("Reset") {
+                        Task { await self.resetSkillPolicy() }
+                    }
+                    .disabled(self.skillMutationBusy || self.agentSkillFilter == nil)
+                }
+                .buttonStyle(.bordered)
+                .controlSize(.small)
+
+                if let skillMutationStatusText {
+                    Text(skillMutationStatusText)
+                        .font(.caption2)
+                        .foregroundStyle(OpenClawBrand.accent)
+                }
+                if let skillMutationErrorText {
+                    Text(skillMutationErrorText)
+                        .font(.caption2)
+                        .foregroundStyle(OpenClawBrand.warn)
+                }
+            }
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+
+    var skillsFilterField: some View {
+        ProCard(padding: 10, radius: AgentLayout.cardRadius) {
+            VStack(alignment: .leading, spacing: 10) {
+                HStack(spacing: 10) {
+                    Image(systemName: "magnifyingglass")
+                        .font(.caption.weight(.semibold))
+                        .foregroundStyle(.secondary)
+                    TextField("Search skills", text: self.$skillFilter)
+                        .textInputAutocapitalization(.never)
+                        .autocorrectionDisabled()
+                        .font(.subheadline)
+                    if !self.skillFilter.isEmpty {
+                        Button {
+                            self.skillFilter = ""
+                        } label: {
+                            Image(systemName: "xmark.circle.fill")
+                                .foregroundStyle(.secondary)
+                        }
+                        .buttonStyle(.plain)
+                    }
+                }
+                Picker("Status", selection: self.$skillStatusFilter) {
+                    ForEach(SkillStatusFilter.allCases) { filter in
+                        Text(filter.title).tag(filter)
+                    }
+                }
+                .pickerStyle(.segmented)
+                .controlSize(.small)
+            }
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+
+    var clawHubSearchCard: some View {
+        ProCard(radius: AgentLayout.cardRadius) {
+            VStack(alignment: .leading, spacing: 12) {
+                HStack(spacing: 10) {
+                    ProIconBadge(systemName: "square.and.arrow.down", color: OpenClawBrand.accent)
+                    VStack(alignment: .leading, spacing: 2) {
+                        Text("Install Skills")
+                            .font(.headline)
+                        Text("Search ClawHub and install into this workspace.")
+                            .font(.caption)
+                            .foregroundStyle(.secondary)
+                    }
+                    Spacer(minLength: 8)
+                    Button {
+                        Task { await self.searchClawHubSkills() }
+                    } label: {
+                        Image(systemName: "magnifyingglass")
+                    }
+                    .buttonStyle(.bordered)
+                    .controlSize(.small)
+                    .disabled(self.clawHubLoading || !self.gatewayConnected)
+                    .accessibilityLabel("Search ClawHub")
+                }
+
+                TextField("Search ClawHub", text: self.$clawHubQuery)
+                    .textInputAutocapitalization(.never)
+                    .autocorrectionDisabled()
+                    .font(.subheadline)
+                    .submitLabel(.search)
+                    .onSubmit {
+                        Task { await self.searchClawHubSkills() }
+                    }
+
+                if self.clawHubLoading {
+                    ProgressView()
+                        .controlSize(.small)
+                }
+                if let clawHubErrorText {
+                    Text(clawHubErrorText)
+                        .font(.caption2)
+                        .foregroundStyle(OpenClawBrand.warn)
+                }
+                if !self.clawHubResults.isEmpty {
+                    VStack(spacing: 0) {
+                        let results = Array(self.clawHubResults.prefix(8))
+                        ForEach(Array(results.enumerated()), id: \.element.slug) { index, result in
+                            self.clawHubResultRow(result)
+                            if index < results.count - 1 {
+                                Divider().padding(.leading, 42)
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+
+    func clawHubResultRow(_ result: ClawHubSearchResultLite) -> some View {
+        let installing = self.clawHubInstallSlug == result.slug
+        return HStack(alignment: .top, spacing: 10) {
+            ProIconBadge(systemName: "sparkles", color: OpenClawBrand.accent)
+            VStack(alignment: .leading, spacing: 3) {
+                Text(result.displayName)
+                    .font(.subheadline.weight(.semibold))
+                    .lineLimit(1)
+                Text(result.summary ?? result.slug)
+                    .font(.caption)
+                    .foregroundStyle(.secondary)
+                    .lineLimit(2)
+            }
+            Spacer(minLength: 8)
+            Button {
+                Task { await self.installClawHubSkill(result) }
+            } label: {
+                Image(systemName: installing ? "hourglass" : "square.and.arrow.down")
+            }
+            .buttonStyle(.bordered)
+            .controlSize(.small)
+            .disabled(installing || !self.skillConfigBusyKeys.isEmpty)
+            .accessibilityLabel("Install \(result.displayName)")
+        }
+        .padding(.vertical, 10)
+    }
+
+    var skillsList: some View {
+        VStack(alignment: .leading, spacing: 8) {
+            ProSectionHeader(title: "Installed Skills")
+            ProCard(padding: 0, radius: AgentLayout.cardRadius) {
+                let skills = self.filteredSkills
+                if skills.isEmpty {
+                    self.emptyDetailRow(
+                        icon: "sparkles",
+                        title: self.gatewayConnected ? "No skills found" : "Skills unavailable",
+                        detail: self.gatewayConnected
+                            ? "Try a different search or refresh from the gateway."
+                            : "Connect a gateway to load workspace skills.")
+                        .padding(14)
+                } else {
+                    VStack(spacing: 0) {
+                        ForEach(Array(skills.enumerated()), id: \.element.name) { index, skill in
+                            self.skillRow(skill)
+                            if index < skills.count - 1 {
+                                Divider().padding(.leading, 60)
+                            }
+                        }
+                    }
+                }
+            }
+            .padding(.horizontal, OpenClawProMetric.pagePadding)
+        }
+    }
+
+    var activeAgentName: String {
+        if let agent = self.appModel.gatewayAgents.first(where: { $0.id == self.activeAgentID }) {
+            return self.agentName(for: agent)
+        }
+        return self.activeAgentID
+    }
+
+    var agentSkillFilter: Set<String>? {
+        self.overview?.agentSkillFilter.map { Set($0) }
+    }
+
+    var skillPolicySummary: String {
+        guard self.gatewayConnected else { return "Connect a gateway to edit skills." }
+        guard let filter = self.agentSkillFilter else {
+            return "All available skills are allowed for this agent."
+        }
+        if filter.isEmpty {
+            return "No skills are allowed for this agent."
+        }
+        return "\(filter.count) skills are allowed for this agent."
+    }
+
+    var skillMutationBusy: Bool {
+        !self.skillMutationBusyKeys.isEmpty
+    }
+
+    var filteredSkills: [SkillStatusEntryLite] {
+        let skills = self.overview?.skills?.skills ?? []
+        let filter = self.skillFilter.trimmingCharacters(in: .whitespacesAndNewlines).lowercased()
+        return skills
+            .filter { skill in
+                self.matchesSkillStatusFilter(skill)
+            }
+            .filter { skill in
+                guard !filter.isEmpty else { return true }
+                return [
+                    skill.name,
+                    skill.description,
+                    skill.source,
+                ].compactMap(\.self)
+                    .joined(separator: " ")
+                    .lowercased()
+                    .contains(filter)
+            }
+            .sorted(by: self.sortSkills)
+    }
+
+    func matchesSkillStatusFilter(_ skill: SkillStatusEntryLite) -> Bool {
+        switch self.skillStatusFilter {
+        case .all:
+            true
+        case .enabled:
+            self.skillStatus(skill).text == "enabled"
+        case .off:
+            !self.isSkillAllowed(skill) || skill.blockedByAgentFilter == true
+        case .setup:
+            skill.hasMissingRequirements
+        case .blocked:
+            skill.blockedByAllowlist == true
+        }
+    }
+
+    func sortSkills(_ lhs: SkillStatusEntryLite, _ rhs: SkillStatusEntryLite) -> Bool {
+        let lhsEnabled = self.isSkillAllowed(lhs)
+        let rhsEnabled = self.isSkillAllowed(rhs)
+        if lhsEnabled != rhsEnabled { return lhsEnabled && !rhsEnabled }
+        return lhs.name.localizedCaseInsensitiveCompare(rhs.name) == .orderedAscending
+    }
+
+    func skillRow(_ skill: SkillStatusEntryLite) -> some View {
+        let status = self.skillStatus(skill)
+        let busy = self.skillMutationBusyKeys.contains(skill.name)
+        return HStack(alignment: .top, spacing: 12) {
+            ProIconBadge(systemName: self.isSkillAllowed(skill) ? "checkmark.circle" : "nosign", color: status.color)
+            VStack(alignment: .leading, spacing: 4) {
+                Text(skill.displayName)
+                    .font(.subheadline.weight(.semibold))
+                    .lineLimit(1)
+                Text(self.normalized(skill.description) ?? self.normalized(skill.source) ?? "Workspace skill")
+                    .font(.caption)
+                    .foregroundStyle(.secondary)
+                    .lineLimit(2)
+                if let missing = skill.missingSummary {
+                    Text("Missing: \(missing)")
+                        .font(.caption2)
+                        .foregroundStyle(OpenClawBrand.warn)
+                        .lineLimit(1)
+                }
+                if let install = skill.installSummary {
+                    Text("Setup: \(install)")
+                        .font(.caption2)
+                        .foregroundStyle(.secondary)
+                        .lineLimit(1)
+                }
+            }
+            Spacer(minLength: 8)
+            VStack(alignment: .trailing, spacing: 6) {
+                self.skillToggle(skill, title: status.text)
+                HStack(spacing: 6) {
+                    if self.canInstallSkillRequirements(skill) {
+                        Button {
+                            Task { await self.installSkillRequirements(skill) }
+                        } label: {
+                            Image(systemName: "wrench.and.screwdriver")
+                        }
+                        .buttonStyle(.bordered)
+                        .controlSize(.mini)
+                        .disabled(self.isSkillConfigBusy(skill))
+                        .accessibilityLabel("Set up \(skill.displayName)")
+                    }
+                    Button {
+                        self.openSkillEditor(skill)
+                    } label: {
+                        Image(systemName: "slider.horizontal.3")
+                    }
+                    .buttonStyle(.bordered)
+                    .controlSize(.mini)
+                    .accessibilityLabel("Edit \(skill.displayName)")
+                }
+                Text(busy ? "saving" : status.text)
+                    .font(.caption2.weight(.semibold))
+                    .foregroundStyle(status.color)
+                    .lineLimit(1)
+            }
+        }
+        .padding(.vertical, 10)
+        .padding(.horizontal, 14)
+    }
+
+    func skillToggle(_ skill: SkillStatusEntryLite, title: String) -> some View {
+        Toggle(
+            title,
+            isOn: Binding(
+                get: { self.isSkillAllowed(skill) },
+                set: { enabled in
+                    Task { await self.setSkillAllowed(skill, enabled: enabled) }
+                }))
+                .labelsHidden()
+                .disabled(self.skillMutationBusy)
+                .toggleStyle(.switch)
+                .controlSize(.mini)
+    }
+
+    func isSkillAllowed(_ skill: SkillStatusEntryLite) -> Bool {
+        guard let filter = self.agentSkillFilter else { return true }
+        return filter.contains(skill.name)
+    }
+
+    func isSkillConfigBusy(_ skill: SkillStatusEntryLite) -> Bool {
+        self.skillConfigBusyKeys.contains(skill.effectiveSkillKey)
+            || self.clawHubInstallSlug != nil
+    }
+
+    func canInstallSkillRequirements(_ skill: SkillStatusEntryLite) -> Bool {
+        skill.install?.first?.id?.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty == false
+            && !skill.missingBins.isEmpty
+    }
+
+    func skillByKey(_ key: String) -> SkillStatusEntryLite? {
+        (self.overview?.skills?.skills ?? []).first { skill in
+            skill.effectiveSkillKey == key || skill.name == key
+        }
+    }
+
+    func openSkillEditor(_ skill: SkillStatusEntryLite) {
+        self.skillEditorSelection = SkillEditorSelection(id: skill.effectiveSkillKey)
+    }
+
+    func skillAPIKeyBinding(for skill: SkillStatusEntryLite) -> Binding<String> {
+        Binding(
+            get: { self.skillAPIKeyDrafts[skill.effectiveSkillKey] ?? "" },
+            set: { self.skillAPIKeyDrafts[skill.effectiveSkillKey] = $0 })
+    }
+
+    var missingSkillEditorSheet: some View {
+        NavigationStack {
+            ContentUnavailableView("Skill unavailable", systemImage: "sparkles")
+                .navigationTitle("Skill")
+                .toolbar {
+                    ToolbarItem(placement: .cancellationAction) {
+                        Button("Close") {
+                            self.skillEditorSelection = nil
+                        }
+                    }
+                }
+        }
+    }
+
+    func skillEditorSheet(_ skill: SkillStatusEntryLite) -> some View {
+        NavigationStack {
+            ZStack {
+                OpenClawProBackground()
+                ScrollView {
+                    VStack(alignment: .leading, spacing: 16) {
+                        self.skillEditorHeader(skill)
+                        self.skillEditorControls(skill)
+                        self.skillEditorSetup(skill)
+                        self.skillEditorMetadata(skill)
+                    }
+                    .padding(.vertical, 18)
+                }
+            }
+            .navigationTitle(skill.displayName)
+            .navigationBarTitleDisplayMode(.inline)
+            .toolbar {
+                ToolbarItem(placement: .cancellationAction) {
+                    Button("Close") {
+                        self.skillEditorSelection = nil
+                    }
+                }
+            }
+        }
+    }
+
+    func skillEditorHeader(_ skill: SkillStatusEntryLite) -> some View {
+        let status = self.skillStatus(skill)
+        return ProCard(radius: AgentLayout.cardRadius) {
+            HStack(spacing: 12) {
+                ProIconBadge(
+                    systemName: skill.isGloballyEnabled ? "checkmark.circle" : "pause.circle",
+                    color: status.color)
+                VStack(alignment: .leading, spacing: 3) {
+                    Text(skill.displayName)
+                        .font(.headline)
+                    Text(self.normalized(skill.description) ?? self.normalized(skill.source) ?? "Workspace skill")
+                        .font(.caption)
+                        .foregroundStyle(.secondary)
+                        .lineLimit(3)
+                }
+                Spacer(minLength: 8)
+                ProValuePill(value: status.text, color: status.color)
+            }
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+
+    func skillEditorControls(_ skill: SkillStatusEntryLite) -> some View {
+        ProCard(radius: AgentLayout.cardRadius) {
+            VStack(alignment: .leading, spacing: 12) {
+                Toggle(
+                    "Enabled globally",
+                    isOn: Binding(
+                        get: { skill.isGloballyEnabled },
+                        set: { enabled in
+                            Task { await self.updateSkillGlobalEnabled(skill, enabled: enabled) }
+                        }))
+                        .disabled(self.isSkillConfigBusy(skill))
+
+                if let primaryEnv = skill.primaryEnv, !primaryEnv.isEmpty {
+                    VStack(alignment: .leading, spacing: 8) {
+                        Text("API key")
+                            .font(.subheadline.weight(.semibold))
+                        SecureField(primaryEnv, text: self.skillAPIKeyBinding(for: skill))
+                            .textInputAutocapitalization(.never)
+                            .autocorrectionDisabled()
+                        Button {
+                            Task { await self.saveSkillAPIKey(skill) }
+                        } label: {
+                            Label("Save key", systemImage: "key")
+                        }
+                        .buttonStyle(.borderedProminent)
+                        .controlSize(.small)
+                        .disabled(self.isSkillConfigBusy(skill))
+                        if let homepage = skill.homepageURL {
+                            Link("Get key", destination: homepage)
+                                .font(.caption)
+                        }
+                    }
+                }
+
+                if let message = self.skillConfigMessages[skill.effectiveSkillKey] {
+                    Text(message.text)
+                        .font(.caption2)
+                        .foregroundStyle(message.kind == .success ? OpenClawBrand.accent : OpenClawBrand.warn)
+                }
+            }
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+
+    func skillEditorSetup(_ skill: SkillStatusEntryLite) -> some View {
+        ProCard(radius: AgentLayout.cardRadius) {
+            VStack(alignment: .leading, spacing: 10) {
+                Text("Setup")
+                    .font(.headline)
+                if let missing = skill.missingSummary {
+                    Text("Missing: \(missing)")
+                        .font(.caption)
+                        .foregroundStyle(OpenClawBrand.warn)
+                } else {
+                    Text("No missing requirements reported.")
+                        .font(.caption)
+                        .foregroundStyle(.secondary)
+                }
+                if let install = skill.install?.first {
+                    Button {
+                        Task { await self.installSkillRequirements(skill) }
+                    } label: {
+                        Label(install.label, systemImage: "wrench.and.screwdriver")
+                    }
+                    .buttonStyle(.bordered)
+                    .controlSize(.small)
+                    .disabled(self.isSkillConfigBusy(skill) || install.id == nil)
+                }
+            }
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+
+    func skillEditorMetadata(_ skill: SkillStatusEntryLite) -> some View {
+        ProCard(radius: AgentLayout.cardRadius) {
+            VStack(alignment: .leading, spacing: 8) {
+                self.detailMetric(label: "Key", value: skill.effectiveSkillKey)
+                self.detailMetric(label: "Source", value: self.normalized(skill.source) ?? "unknown")
+                if let filePath = self.normalized(skill.filePath) {
+                    Text(filePath)
+                        .font(.caption2.monospaced())
+                        .foregroundStyle(.secondary)
+                        .textSelection(.enabled)
+                }
+            }
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+
+    @MainActor
+    func setSkillAllowed(_ skill: SkillStatusEntryLite, enabled: Bool) async {
+        let allNames = self.allSkillNames
+        guard !allNames.isEmpty else { return }
+        let base = self.agentSkillFilter ?? Set(allNames)
+        var next = base
+        if enabled {
+            next.insert(skill.name)
+        } else {
+            next.remove(skill.name)
+        }
+        await self.patchAgentSkills(Array(next).sorted(), busyKey: skill.name)
+    }
+
+    @MainActor
+    func enableAllSkills() async {
+        let allNames = self.allSkillNames
+        guard !allNames.isEmpty else { return }
+        await self.patchAgentSkills(allNames, busyKey: "__all__")
+    }
+
+    @MainActor
+    func disableAllSkills() async {
+        await self.patchAgentSkills([], busyKey: "__all__")
+    }
+
+    @MainActor
+    func resetSkillPolicy() async {
+        await self.patchAgentSkills(nil, busyKey: "__all__")
+    }
+
+    var allSkillNames: [String] {
+        (self.overview?.skills?.skills ?? [])
+            .map(\.name)
+            .filter { !$0.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty }
+            .sorted()
+    }
+
+    @MainActor
+    func patchAgentSkills(_ skills: [String]?, busyKey: String) async {
+        guard self.gatewayConnected else { return }
+        self.skillMutationBusyKeys.insert(busyKey)
+        self.skillMutationErrorText = nil
+        self.skillMutationStatusText = nil
+        defer { self.skillMutationBusyKeys.remove(busyKey) }
+
+        do {
+            let config = try await self.requestConfigSnapshot()
+            guard let baseHash = self.normalized(config.hash) else {
+                throw SkillMutationError.missingConfigHash
+            }
+            if skills == nil,
+               config.agentConfig(id: self.activeAgentID) == nil
+            {
+                self.skillMutationStatusText = "This agent already inherits the default skill policy."
+                return
+            }
+
+            let raw = try Self.agentSkillsPatchRaw(agentId: self.activeAgentID, skills: skills)
+            let params = ConfigPatchParams(raw: raw, baseHash: baseHash)
+            let data = try JSONEncoder().encode(params)
+            guard let json = String(data: data, encoding: .utf8) else {
+                throw SkillMutationError.invalidPatchPayload
+            }
+            _ = try await self.appModel.operatorSession.request(
+                method: "config.patch",
+                paramsJSON: json,
+                timeoutSeconds: 20)
+            self.skillMutationStatusText = skills == nil ? "Skill policy reset." : "Skill policy saved."
+            await self.appModel.refreshGatewayOverviewIfConnected()
+            await self.refreshOverview(force: true)
+        } catch {
+            self.skillMutationErrorText = Self.skillMutationMessage(error)
+        }
+    }
+
+    @MainActor
+    func updateSkillGlobalEnabled(_ skill: SkillStatusEntryLite, enabled: Bool) async {
+        await self.runSkillConfigMutation(skill) {
+            let params = SkillUpdateParams(skillKey: skill.effectiveSkillKey, enabled: enabled)
+            _ = try await self.requestGateway(method: "skills.update", params: params, timeoutSeconds: 20)
+            return enabled ? "Skill enabled." : "Skill disabled."
+        }
+    }
+
+    @MainActor
+    func saveSkillAPIKey(_ skill: SkillStatusEntryLite) async {
+        await self.runSkillConfigMutation(skill) {
+            let apiKey = self.skillAPIKeyDrafts[skill.effectiveSkillKey] ?? ""
+            let params = SkillUpdateParams(skillKey: skill.effectiveSkillKey, apiKey: apiKey)
+            _ = try await self.requestGateway(method: "skills.update", params: params, timeoutSeconds: 20)
+            self.skillAPIKeyDrafts[skill.effectiveSkillKey] = ""
+            return apiKey.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty
+                ? "API key cleared."
+                : "API key saved."
+        }
+    }
+
+    @MainActor
+    func installSkillRequirements(_ skill: SkillStatusEntryLite) async {
+        guard let installId = skill.install?.first?.id?.trimmingCharacters(in: .whitespacesAndNewlines),
+              !installId.isEmpty
+        else { return }
+        await self.runSkillConfigMutation(skill) {
+            let params = SkillInstallParams(name: skill.name, installId: installId, timeoutMs: 120_000)
+            let data = try await self.requestGateway(
+                method: "skills.install",
+                params: params,
+                timeoutSeconds: 125)
+            return (try? JSONDecoder().decode(SkillInstallResultLite.self, from: data).message) ?? "Installed."
+        }
+    }
+
+    @MainActor
+    func installClawHubSkill(_ result: ClawHubSearchResultLite) async {
+        guard self.gatewayConnected else { return }
+        self.clawHubInstallSlug = result.slug
+        self.clawHubErrorText = nil
+        defer { self.clawHubInstallSlug = nil }
+        do {
+            let params = ClawHubInstallParams(slug: result.slug)
+            _ = try await self.requestGateway(method: "skills.install", params: params, timeoutSeconds: 125)
+            await self.appModel.refreshGatewayOverviewIfConnected()
+            await self.refreshOverview(force: true)
+        } catch {
+            self.clawHubErrorText = Self.skillMutationMessage(error)
+        }
+    }
+
+    @MainActor
+    func searchClawHubSkills() async {
+        guard self.gatewayConnected else { return }
+        self.clawHubLoading = true
+        self.clawHubErrorText = nil
+        defer { self.clawHubLoading = false }
+        do {
+            let query = self.clawHubQuery.trimmingCharacters(in: .whitespacesAndNewlines)
+            let params = ClawHubSearchParams(query: query.isEmpty ? nil : query, limit: 20)
+            let data = try await self.requestGateway(method: "skills.search", params: params, timeoutSeconds: 20)
+            self.clawHubResults = try JSONDecoder().decode(ClawHubSearchResponseLite.self, from: data).results
+        } catch {
+            self.clawHubErrorText = Self.skillMutationMessage(error)
+        }
+    }
+
+    @MainActor
+    func runSkillConfigMutation(
+        _ skill: SkillStatusEntryLite,
+        action: () async throws -> String) async
+    {
+        let key = skill.effectiveSkillKey
+        self.skillConfigBusyKeys.insert(key)
+        self.skillConfigMessages[key] = nil
+        defer { self.skillConfigBusyKeys.remove(key) }
+
+        do {
+            let message = try await action()
+            self.skillConfigMessages[key] = SkillEditorMessage(kind: .success, text: message)
+            await self.appModel.refreshGatewayOverviewIfConnected()
+            await self.refreshOverview(force: true)
+        } catch {
+            self.skillConfigMessages[key] = SkillEditorMessage(
+                kind: .error,
+                text: Self.skillMutationMessage(error))
+        }
+    }
+
+    func requestGateway(
+        method: String,
+        params: some Encodable,
+        timeoutSeconds: Int) async throws -> Data
+    {
+        let data = try JSONEncoder().encode(params)
+        guard let json = String(data: data, encoding: .utf8) else {
+            throw SkillMutationError.invalidPatchPayload
+        }
+        return try await self.appModel.operatorSession.request(
+            method: method,
+            paramsJSON: json,
+            timeoutSeconds: timeoutSeconds)
+    }
+
+    func requestConfigSnapshot() async throws -> ConfigSnapshotLite {
+        let data = try await self.appModel.operatorSession.request(
+            method: "config.get",
+            paramsJSON: "{}",
+            timeoutSeconds: 12)
+        return try JSONDecoder().decode(ConfigSnapshotLite.self, from: data)
+    }
+
+    static func agentSkillsPatchRaw(agentId: String, skills: [String]?) throws -> String {
+        let skillValue: Any = skills ?? NSNull()
+        let patch: [String: Any] = [
+            "agents": [
+                "list": [
+                    [
+                        "id": agentId,
+                        "skills": skillValue,
+                    ],
+                ],
+            ],
+        ]
+        let data = try JSONSerialization.data(withJSONObject: patch, options: [.sortedKeys])
+        guard let raw = String(data: data, encoding: .utf8) else {
+            throw SkillMutationError.invalidPatchPayload
+        }
+        return raw
+    }
+
+    static func skillMutationMessage(_ error: Error) -> String {
+        if let gatewayError = error as? GatewayResponseError {
+            let lower = gatewayError.message.lowercased()
+            if lower.contains("operator.admin") || lower.contains("unauthorized") {
+                return "This gateway connection cannot edit config yet. Reconnect with admin scope."
+            }
+            return gatewayError.message
+        }
+        return error.localizedDescription
+    }
+
+    func skillStatus(_ skill: SkillStatusEntryLite) -> (text: String, color: Color) {
+        if !self.isSkillAllowed(skill) {
+            return ("off", .secondary)
+        }
+        if skill.blockedByAllowlist == true {
+            return ("blocked", .secondary)
+        }
+        if skill.blockedByAgentFilter == true {
+            return ("off", .secondary)
+        }
+        if skill.disabled == true {
+            return ("disabled", .secondary)
+        }
+        if skill.hasMissingRequirements {
+            return ("setup", OpenClawBrand.warn)
+        }
+        return ("enabled", OpenClawBrand.accent)
+    }
+}

apps/ios/Sources/Design/AgentProTab+Usage.swift

@@ -0,0 +1,81 @@
+import OpenClawKit
+import OpenClawProtocol
+import SwiftUI
+
+extension AgentProTab {
+    var usageTotalsCard: some View {
+        ProCard(radius: AgentLayout.cardRadius) {
+            VStack(alignment: .leading, spacing: 12) {
+                HStack {
+                    Text("Totals")
+                        .font(.headline)
+                    Spacer()
+                    ProValuePill(value: "\(self.overview?.usage?.days ?? 31)d", color: OpenClawBrand.accent)
+                }
+                HStack(spacing: 10) {
+                    self.detailMetric(label: "Cost", value: self.usageValue)
+                    self.detailMetric(label: "Tokens", value: self.usageTokenValue)
+                    self.detailMetric(label: "Cache", value: self.usageCacheValue)
+                }
+            }
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+
+    var usageTokenValue: String {
+        guard let tokens = self.overview?.usage?.totalTokens else { return "0" }
+        return Self.compactNumber(tokens)
+    }
+
+    var usageCacheValue: String {
+        guard let cacheStatus = self.normalized(self.overview?.usage?.cacheStatus?["status"]?.value as? String) else {
+            return "n/a"
+        }
+        return cacheStatus
+    }
+
+    var usageDailyList: some View {
+        VStack(alignment: .leading, spacing: 8) {
+            ProSectionHeader(title: "Daily")
+            ProCard(padding: 0, radius: AgentLayout.cardRadius) {
+                let days = self.overview?.usage?.daily ?? []
+                if days.isEmpty {
+                    self.emptyDetailRow(
+                        icon: "chart.bar",
+                        title: "No daily usage yet",
+                        detail: "The gateway returned totals without daily session cost rows.")
+                        .padding(14)
+                } else {
+                    VStack(spacing: 0) {
+                        ForEach(Array(days.prefix(14).enumerated()), id: \.element.date) { index, day in
+                            self.usageDayRow(day)
+                            if index < min(days.count, 14) - 1 {
+                                Divider().padding(.leading, 60)
+                            }
+                        }
+                    }
+                }
+            }
+            .padding(.horizontal, OpenClawProMetric.pagePadding)
+        }
+    }
+
+    func usageDayRow(_ day: CostUsageDailyEntryLite) -> some View {
+        HStack(spacing: 12) {
+            ProIconBadge(systemName: "calendar", color: OpenClawBrand.accent)
+            VStack(alignment: .leading, spacing: 3) {
+                Text(day.date)
+                    .font(.subheadline.weight(.semibold))
+                Text("\(Self.compactNumber(day.totalTokens ?? 0)) tokens")
+                    .font(.caption)
+                    .foregroundStyle(.secondary)
+            }
+            Spacer(minLength: 8)
+            Text(Self.currency(day.totalCost ?? 0))
+                .font(.caption2.weight(.semibold))
+                .foregroundStyle(OpenClawBrand.accent)
+        }
+        .padding(.vertical, 10)
+        .padding(.horizontal, 14)
+    }
+}

apps/ios/Sources/Design/AgentProTab.swift

@@ -0,0 +1,163 @@
+import OpenClawKit
+import OpenClawProtocol
+import SwiftUI
+
+struct AgentProTab: View {
+    @Environment(NodeAppModel.self) var appModel
+    @Environment(\.colorScheme) var colorScheme
+    @Environment(\.scenePhase) var scenePhase
+    @State var overview: AgentOverviewSnapshot?
+    @State var overviewErrorText: String?
+    @State var overviewLoading: Bool = false
+    @State var overviewRefreshNonce: Int = 0
+    @State var agentRosterFilter: AgentRosterFilter = .all
+    @State var agentSearchPresented = false
+    @State var agentSearchText = ""
+    @State var skillFilter: String = ""
+    @State var skillStatusFilter: SkillStatusFilter = .all
+    @State var skillMutationBusyKeys: Set<String> = []
+    @State var skillMutationErrorText: String?
+    @State var skillMutationStatusText: String?
+    @State var skillConfigBusyKeys: Set<String> = []
+    @State var skillConfigMessages: [String: SkillEditorMessage] = [:]
+    @State var skillAPIKeyDrafts: [String: String] = [:]
+    @State var skillEditorSelection: SkillEditorSelection?
+    @State var clawHubQuery: String = ""
+    @State var clawHubResults: [ClawHubSearchResultLite] = []
+    @State var clawHubLoading: Bool = false
+    @State var clawHubErrorText: String?
+    @State var clawHubInstallSlug: String?
+    @State var cronActionBusyIDs: Set<String> = []
+    @State var cronActionStatusText: String?
+
+    enum AgentRoute: Hashable {
+        case skills
+        case nodes
+        case cron
+        case usage
+        case dreaming
+    }
+
+    enum SkillStatusFilter: String, CaseIterable, Identifiable {
+        case all
+        case enabled
+        case off
+        case setup
+        case blocked
+
+        var id: Self {
+            self
+        }
+
+        var title: String {
+            switch self {
+            case .all: "All"
+            case .enabled: "Enabled"
+            case .off: "Off"
+            case .setup: "Setup"
+            case .blocked: "Blocked"
+            }
+        }
+    }
+
+    enum AgentRosterFilter: String, CaseIterable, Identifiable {
+        case all
+        case online
+        case busy
+        case idle
+
+        var id: Self {
+            self
+        }
+
+        var title: String {
+            switch self {
+            case .all: "All"
+            case .online: "Online"
+            case .busy: "Busy"
+            case .idle: "Idle"
+            }
+        }
+    }
+
+    enum AgentLayout {
+        static let cardRadius: CGFloat = 12
+        static let filterHeight: CGFloat = 34
+        static let rowMinHeight: CGFloat = 104
+        static let metricTileHeight: CGFloat = 94
+        static let actionButtonSize: CGFloat = 34
+    }
+
+    enum AgentRosterState: Equatable {
+        case online
+        case busy
+        case idle
+
+        var title: String {
+            switch self {
+            case .online: "Online"
+            case .busy: "Busy"
+            case .idle: "Idle"
+            }
+        }
+
+        var color: Color {
+            switch self {
+            case .online: OpenClawBrand.ok
+            case .busy: OpenClawBrand.warn
+            case .idle: Color(red: 0 / 255.0, green: 122 / 255.0, blue: 255 / 255.0)
+            }
+        }
+    }
+
+    struct SkillEditorSelection: Identifiable {
+        let id: String
+    }
+
+    struct SkillEditorMessage {
+        let kind: Kind
+        let text: String
+
+        enum Kind {
+            case success
+            case error
+        }
+    }
+
+    var body: some View {
+        NavigationStack {
+            ZStack {
+                OpenClawProBackground()
+                ScrollView {
+                    VStack(alignment: .leading, spacing: 18) {
+                        self.rosterHeader
+                        self.agentFilters
+                        self.agentsSection
+                        self.operationsSection
+                        self.dreamingSection
+                        self.cronSection
+                    }
+                    .padding(.vertical, 18)
+                }
+                .refreshable {
+                    await self.refreshOverview(force: true)
+                }
+                .safeAreaPadding(.bottom, OpenClawProMetric.bottomScrollInset)
+            }
+            .navigationBarHidden(true)
+            .navigationDestination(for: AgentRoute.self) { route in
+                self.destination(for: route)
+            }
+        }
+        .task(id: self.overviewTaskID) {
+            await self.refreshOverview(force: false)
+        }
+        .sheet(item: self.$skillEditorSelection) { selection in
+            if let skill = self.skillByKey(selection.id) {
+                self.skillEditorSheet(skill)
+            } else {
+                self.missingSkillEditorSheet
+            }
+        }
+    }
+}

apps/ios/Sources/Design/ChatProTab.swift

@@ -0,0 +1,191 @@
+import OpenClawChatUI
+import OpenClawProtocol
+import SwiftUI
+
+struct ChatProTab: View {
+    @Environment(NodeAppModel.self) private var appModel
+    @Environment(\.colorScheme) private var colorScheme
+    @State private var viewModel: OpenClawChatViewModel?
+
+    var body: some View {
+        NavigationStack {
+            ZStack {
+                OpenClawProBackground()
+                VStack(spacing: 0) {
+                    self.header
+                    if let viewModel {
+                        OpenClawChatView(
+                            viewModel: viewModel,
+                            drawsBackground: false,
+                            showsSessionSwitcher: false,
+                            userAccent: self.chatUserAccent,
+                            assistantName: self.agentDisplayName,
+                            assistantAvatarText: self.agentBadge,
+                            assistantAvatarTint: OpenClawBrand.accent,
+                            showsAssistantAvatars: false,
+                            composerChrome: .clean,
+                            messagePlaceholder: "Message \(self.agentDisplayName)...",
+                            talkControl: self.talkControl)
+                            .frame(maxWidth: .infinity, maxHeight: .infinity, alignment: .top)
+                    } else {
+                        ProCard {
+                            VStack(alignment: .leading, spacing: 8) {
+                                Text("Chat is preparing")
+                                    .font(.headline)
+                                Text("The operator session will attach when the gateway is ready.")
+                                    .font(.subheadline)
+                                    .foregroundStyle(.secondary)
+                            }
+                        }
+                        .padding()
+                        Spacer()
+                    }
+                }
+            }
+            .navigationBarHidden(true)
+        }
+        .task {
+            self.syncChatViewModel()
+        }
+        .onChange(of: self.appModel.chatSessionKey) { _, _ in
+            self.syncChatViewModel()
+        }
+    }
+
+    private var header: some View {
+        HStack(spacing: 11) {
+            Text(self.agentBadge)
+                .font(.system(size: self.agentBadge.count > 2 ? 13 : 16, weight: .bold, design: .rounded))
+                .foregroundStyle(.white)
+                .minimumScaleFactor(0.6)
+                .lineLimit(1)
+                .frame(width: 38, height: 38)
+                .background(
+                    Circle()
+                        .fill(
+                            LinearGradient(
+                                colors: [
+                                    OpenClawBrand.accent,
+                                    OpenClawBrand.accentHot,
+                                ],
+                                startPoint: .topLeading,
+                                endPoint: .bottomTrailing)))
+                .overlay(Circle().strokeBorder(.white.opacity(0.18), lineWidth: 1))
+                .shadow(color: OpenClawBrand.accent.opacity(0.18), radius: 10, y: 5)
+
+            VStack(alignment: .leading, spacing: 1) {
+                Text(self.agentDisplayName)
+                    .font(.headline.weight(.semibold))
+                    .lineLimit(1)
+                Text("AI Assistant")
+                    .font(.caption)
+                    .foregroundStyle(.secondary)
+                    .lineLimit(1)
+            }
+
+            Spacer(minLength: 8)
+
+            self.connectionPill
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+        .padding(.top, 8)
+        .padding(.bottom, 4)
+    }
+
+    private func syncChatViewModel() {
+        let sessionKey = self.appModel.chatSessionKey
+        guard let viewModel else {
+            self.viewModel = OpenClawChatViewModel(
+                sessionKey: sessionKey,
+                transport: IOSGatewayChatTransport(gateway: self.appModel.operatorSession),
+                onSessionChanged: { sessionKey in
+                    self.appModel.focusChatSession(sessionKey)
+                },
+                diagnosticsLog: { message in
+                    GatewayDiagnostics.log(message)
+                })
+            return
+        }
+        guard viewModel.sessionKey != sessionKey else { return }
+        viewModel.switchSession(to: sessionKey)
+    }
+
+    private var talkControl: OpenClawChatTalkControl {
+        OpenClawChatTalkControl(
+            isEnabled: self.appModel.talkMode.isEnabled,
+            isListening: self.appModel.talkMode.isListening,
+            isSpeaking: self.appModel.talkMode.isSpeaking,
+            isGatewayConnected: self.appModel.talkMode.isGatewayConnected,
+            statusText: self.appModel.talkMode.statusText,
+            providerLabel: self.appModel.talkMode.gatewayTalkProviderLabel,
+            toggle: { sessionKey in
+                self.appModel.focusChatSession(sessionKey)
+                self.appModel.setTalkEnabled(!self.appModel.talkMode.isEnabled)
+            })
+    }
+
+    private var activeAgentID: String {
+        self.normalized(self.appModel.selectedAgentId)
+            ?? self.normalized(self.appModel.gatewayDefaultAgentId)
+            ?? "main"
+    }
+
+    private var connectionPill: some View {
+        HStack(spacing: 6) {
+            ProStatusDot(color: self.gatewayConnected ? OpenClawBrand.ok : .orange)
+            Text(self.gatewayConnected ? "Connected" : "Connecting")
+                .font(.caption.weight(.semibold))
+                .lineLimit(1)
+        }
+        .foregroundStyle(self.gatewayConnected ? OpenClawBrand.ok : .orange)
+        .padding(.horizontal, 10)
+        .frame(height: 30)
+        .background {
+            Capsule()
+                .fill((self.gatewayConnected ? OpenClawBrand.ok : Color.orange).opacity(0.11))
+        }
+        .overlay {
+            Capsule()
+                .strokeBorder((self.gatewayConnected ? OpenClawBrand.ok : Color.orange).opacity(0.16), lineWidth: 1)
+        }
+    }
+
+    private var gatewayConnected: Bool {
+        GatewayStatusBuilder.build(appModel: self.appModel) == .connected
+    }
+
+    private var chatUserAccent: Color {
+        self.colorScheme == .light ? Color(red: 0 / 255.0, green: 122 / 255.0, blue: 255 / 255.0) : OpenClawBrand.accent
+    }
+
+    private var activeAgent: AgentSummary? {
+        self.appModel.gatewayAgents.first { $0.id == self.activeAgentID }
+    }
+
+    private var agentDisplayName: String {
+        self.normalized(self.activeAgent?.name) ?? self.appModel.activeAgentName
+    }
+
+    private var agentBadge: String {
+        if let identity = self.activeAgent?.identity,
+           let emoji = identity["emoji"]?.value as? String,
+           let normalizedEmoji = self.normalized(emoji)
+        {
+            return normalizedEmoji
+        }
+        let words = self.agentDisplayName
+            .split(whereSeparator: { $0.isWhitespace || $0 == "-" || $0 == "_" })
+            .prefix(2)
+        let initials = words.compactMap(\.first).map(String.init).joined()
+        if !initials.isEmpty {
+            return initials.uppercased()
+        }
+        return "OC"
+    }
+
+    private func normalized(_ value: String?) -> String? {
+        guard let value else { return nil }
+        let trimmed = value.trimmingCharacters(in: .whitespacesAndNewlines)
+        return trimmed.isEmpty ? nil : trimmed
+    }
+}

apps/ios/Sources/Design/CommandCenterSupport.swift

@@ -0,0 +1,281 @@
+import SwiftUI
+
+struct CommandPanel<Content: View>: View {
+    var tint: Color?
+    var isProminent = false
+    var padding: CGFloat = 13
+    @ViewBuilder var content: Content
+
+    init(
+        tint: Color? = nil,
+        isProminent: Bool = false,
+        padding: CGFloat = 13,
+        @ViewBuilder content: () -> Content)
+    {
+        self.tint = tint
+        self.isProminent = isProminent
+        self.padding = padding
+        self.content = content()
+    }
+
+    var body: some View {
+        ProCard(
+            tint: self.tint,
+            isProminent: self.isProminent,
+            padding: self.padding,
+            radius: 12)
+        {
+            self.content
+        }
+    }
+}
+
+struct CommandControlBackground: View {
+    @Environment(\.colorScheme) private var colorScheme
+
+    var body: some View {
+        LinearGradient(
+            colors: self.colorScheme == .dark ? self.darkColors : self.lightColors,
+            startPoint: .top,
+            endPoint: .bottom)
+            .overlay(alignment: .top) {
+                if self.colorScheme == .light {
+                    LinearGradient(
+                        colors: [
+                            Color.white.opacity(0.34),
+                            Color.clear,
+                        ],
+                        startPoint: .topLeading,
+                        endPoint: .bottomTrailing)
+                        .frame(height: 260)
+                }
+            }
+            .ignoresSafeArea()
+    }
+
+    private var darkColors: [Color] {
+        [
+            Color(red: 12 / 255, green: 13 / 255, blue: 15 / 255),
+            Color(red: 7 / 255, green: 8 / 255, blue: 10 / 255),
+            Color(red: 4 / 255, green: 5 / 255, blue: 6 / 255),
+        ]
+    }
+
+    private var lightColors: [Color] {
+        [
+            Color(red: 247 / 255, green: 248 / 255, blue: 249 / 255),
+            Color(red: 251 / 255, green: 252 / 255, blue: 253 / 255),
+            .white,
+        ]
+    }
+}
+
+struct CommandSessionRow: View {
+    @Environment(\.colorScheme) private var colorScheme
+    let item: CommandCenterTab.WorkItem
+
+    var body: some View {
+        HStack(alignment: .center, spacing: 12) {
+            Image(systemName: self.item.icon)
+                .font(.caption.weight(.semibold))
+                .foregroundStyle(self.item.color)
+                .frame(width: 30, height: 30)
+                .background {
+                    RoundedRectangle(cornerRadius: 9, style: .continuous)
+                        .fill(self.item.color.opacity(0.12))
+                }
+            VStack(alignment: .leading, spacing: 4) {
+                HStack(alignment: .firstTextBaseline, spacing: 8) {
+                    Text(self.item.title)
+                        .font(.subheadline.weight(.semibold))
+                        .lineLimit(1)
+                        .minimumScaleFactor(0.82)
+                    Spacer(minLength: 6)
+                    Text(self.item.trailing)
+                        .font(.caption2.weight(.medium))
+                        .foregroundStyle(.secondary)
+                }
+                HStack(spacing: 8) {
+                    Text(self.item.detail)
+                        .font(.caption)
+                        .foregroundStyle(.secondary)
+                        .lineLimit(1)
+                    Spacer(minLength: 6)
+                    if let progress = self.item.progress {
+                        ProProgressBar(progress: progress, color: self.item.color)
+                            .frame(width: 68)
+                    }
+                    Text(self.progressLabel)
+                        .font(.caption.weight(.semibold))
+                        .foregroundStyle(self.item.color)
+                        .lineLimit(1)
+                        .frame(width: 48, alignment: .trailing)
+                }
+            }
+        }
+        .padding(.horizontal, 10)
+        .padding(.vertical, 9)
+        .background {
+            RoundedRectangle(cornerRadius: 10, style: .continuous)
+                .fill(self.rowFill)
+                .overlay {
+                    RoundedRectangle(cornerRadius: 10, style: .continuous)
+                        .strokeBorder(self.rowBorder, lineWidth: 1)
+                }
+        }
+    }
+
+    private var progressLabel: String {
+        guard let progress = self.item.progress else {
+            return self.item.state
+        }
+        if self.item.state == "offline" || self.item.state == "off" || self.item.state == "idle" {
+            return self.item.state
+        }
+        return "\(Int((progress * 100).rounded()))%"
+    }
+
+    private var rowFill: Color {
+        self.colorScheme == .dark ? Color.white.opacity(0.035) : Color.black.opacity(0.025)
+    }
+
+    private var rowBorder: Color {
+        self.colorScheme == .dark ? Color.white.opacity(0.065) : Color.black.opacity(0.045)
+    }
+}
+
+struct CommandApprovalRow: View {
+    let item: CommandCenterTab.ApprovalItem
+
+    var body: some View {
+        HStack(spacing: 10) {
+            Image(systemName: self.item.icon)
+                .font(.caption.weight(.bold))
+                .foregroundStyle(.white)
+                .frame(width: 30, height: 30)
+                .background {
+                    RoundedRectangle(cornerRadius: 8, style: .continuous)
+                        .fill(self.item.color)
+                }
+            VStack(alignment: .leading, spacing: 2) {
+                Text(self.item.title)
+                    .font(.subheadline.weight(.semibold))
+                    .lineLimit(1)
+                Text(self.item.detail)
+                    .font(.caption2.weight(.medium))
+                    .foregroundStyle(.secondary)
+                    .lineLimit(1)
+            }
+            Spacer(minLength: 8)
+            Text(self.item.priority)
+                .font(.caption.weight(.bold))
+                .foregroundStyle(self.item.color)
+                .padding(.horizontal, 9)
+                .padding(.vertical, 5)
+                .background {
+                    Capsule()
+                        .fill(self.item.color.opacity(0.10))
+                }
+        }
+        .padding(.horizontal, 8)
+        .padding(.vertical, 7)
+    }
+}
+
+struct CommandEmptyStateRow: View {
+    let icon: String
+    let title: String
+    let detail: String
+
+    var body: some View {
+        HStack(spacing: 10) {
+            Image(systemName: self.icon)
+                .font(.caption.weight(.bold))
+                .foregroundStyle(OpenClawBrand.ok)
+                .frame(width: 30, height: 30)
+                .background {
+                    RoundedRectangle(cornerRadius: 8, style: .continuous)
+                        .fill(OpenClawBrand.ok.opacity(0.10))
+                }
+            VStack(alignment: .leading, spacing: 2) {
+                Text(self.title)
+                    .font(.subheadline.weight(.semibold))
+                    .lineLimit(1)
+                Text(self.detail)
+                    .font(.caption2.weight(.medium))
+                    .foregroundStyle(.secondary)
+                    .lineLimit(1)
+            }
+            Spacer(minLength: 0)
+        }
+        .padding(.horizontal, 8)
+        .padding(.vertical, 9)
+        .background {
+            RoundedRectangle(cornerRadius: 10, style: .continuous)
+                .fill(Color.black.opacity(0.06))
+                .overlay {
+                    RoundedRectangle(cornerRadius: 10, style: .continuous)
+                        .strokeBorder(Color.primary.opacity(0.055), lineWidth: 1)
+                }
+        }
+    }
+}
+
+struct CommandTaskRow: View {
+    let item: CommandCenterTab.WorkItem
+
+    var body: some View {
+        HStack(alignment: .center, spacing: 6) {
+            Text(self.item.title)
+                .font(.footnote.weight(.semibold))
+                .lineLimit(1)
+                .minimumScaleFactor(0.80)
+                .frame(maxWidth: .infinity, minHeight: 20, alignment: .leading)
+            Text(self.item.detail)
+                .font(.caption.weight(.medium))
+                .foregroundStyle(.secondary)
+                .lineLimit(1)
+                .minimumScaleFactor(0.78)
+                .frame(width: 64, alignment: .leading)
+            if let progress = self.item.progress {
+                ProProgressBar(progress: progress, color: self.item.color)
+                    .frame(width: 56)
+            }
+            Text(self.item.state)
+                .font(.footnote.weight(.medium))
+                .foregroundStyle(self.item.progress == nil ? self.item.color : .secondary)
+                .lineLimit(1)
+                .frame(width: self.item.progress == nil ? 58 : 34, alignment: .trailing)
+        }
+        .padding(.vertical, 8)
+    }
+}
+
+struct CommandLiveActivityRow: View {
+    let title: String
+    let value: String
+    let color: Color
+
+    var body: some View {
+        HStack(spacing: 8) {
+            ProStatusDot(color: self.color)
+            Text(self.title)
+                .font(.subheadline.weight(.semibold))
+                .lineLimit(1)
+            Spacer(minLength: 8)
+            Text(self.value)
+                .font(.caption.weight(.medium))
+                .foregroundStyle(.secondary)
+        }
+        .padding(.horizontal, 10)
+        .padding(.vertical, 9)
+        .background {
+            RoundedRectangle(cornerRadius: 10, style: .continuous)
+                .fill(Color.black.opacity(0.08))
+                .overlay {
+                    RoundedRectangle(cornerRadius: 10, style: .continuous)
+                        .strokeBorder(Color.primary.opacity(0.06), lineWidth: 1)
+                }
+        }
+    }
+}

apps/ios/Sources/Design/CommandCenterTab.swift

@@ -0,0 +1,692 @@
+import OpenClawChatUI
+import SwiftUI
+
+struct CommandCenterTab: View {
+    @Environment(NodeAppModel.self) private var appModel
+    @Environment(\.colorScheme) private var colorScheme
+    @Environment(\.scenePhase) private var scenePhase
+    @State private var activeChatSessions: [OpenClawChatSessionEntry] = []
+    var openChat: () -> Void
+    var openSettings: () -> Void
+
+    enum WorkRoute {
+        case chat(String?)
+        case settings
+    }
+
+    struct WorkItem: Identifiable {
+        let id: String
+        let icon: String
+        let title: String
+        let detail: String
+        let state: String
+        let trailing: String
+        let color: Color
+        let progress: Double?
+        let route: WorkRoute
+    }
+
+    struct ApprovalItem: Identifiable {
+        let id: String
+        let icon: String
+        let title: String
+        let detail: String
+        let priority: String
+        let color: Color
+    }
+
+    var body: some View {
+        NavigationStack {
+            ZStack {
+                CommandControlBackground()
+                self.commandAmbientOverlay
+                ScrollView {
+                    VStack(alignment: .leading, spacing: 10) {
+                        self.header
+                        self.gatewayCard
+                        self.pendingApprovals
+                        self.activeTasks
+                        self.liveActivity
+                        self.startWorkAction
+                    }
+                    .padding(.top, 16)
+                    .padding(.bottom, 18)
+                }
+                .safeAreaPadding(.bottom, OpenClawProMetric.bottomScrollInset)
+            }
+            .navigationBarHidden(true)
+        }
+        .task(id: self.activeSessionsRefreshID) {
+            await self.refreshActiveSessionsIfNeeded()
+        }
+    }
+
+    private var header: some View {
+        HStack(alignment: .center, spacing: 11) {
+            OpenClawProMark(size: 31, shadowRadius: 9)
+            Text("OpenClaw")
+                .font(.system(size: 27, weight: .bold, design: .rounded))
+            Spacer()
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+
+    private var commandAmbientOverlay: some View {
+        Group {
+            if self.colorScheme == .light {
+                LinearGradient(
+                    colors: [
+                        Color.white.opacity(0.05),
+                        Color.clear,
+                    ],
+                    startPoint: .top,
+                    endPoint: .bottom)
+                    .ignoresSafeArea()
+                    .allowsHitTesting(false)
+            }
+        }
+    }
+
+    private var gatewayCard: some View {
+        CommandPanel(isProminent: true, padding: 12) {
+            VStack(alignment: .leading, spacing: 10) {
+                self.cardHeader(
+                    title: "Gateway",
+                    value: self.gatewayStateText,
+                    color: self.gatewayStatusColor,
+                    icon: self.gatewayConnected ? "hourglass" : "wifi.slash")
+
+                HStack(spacing: 0) {
+                    self.gatewayFact(
+                        icon: "network",
+                        title: "Connection",
+                        value: self.gatewayConnected ? "Online" : "Offline",
+                        color: self.gatewayStatusColor)
+                    Divider().frame(height: 38)
+                    self.gatewayFact(
+                        icon: "server.rack",
+                        title: "Address",
+                        value: self.gatewayAddressText,
+                        color: OpenClawBrand.accent)
+                    Divider().frame(height: 38)
+                    self.gatewayFact(
+                        icon: "person.2.fill",
+                        title: "Agents",
+                        value: self.gatewayAgentCountText,
+                        color: OpenClawBrand.accentHot)
+                }
+                .padding(.vertical, 9)
+                .background {
+                    RoundedRectangle(cornerRadius: 10, style: .continuous)
+                        .fill(self.colorScheme == .dark ? Color.black.opacity(0.16) : Color.black.opacity(0.026))
+                        .overlay {
+                            RoundedRectangle(cornerRadius: 10, style: .continuous)
+                                .strokeBorder(
+                                    Color.primary.opacity(self.colorScheme == .dark ? 0.08 : 0.045),
+                                    lineWidth: 1)
+                        }
+                }
+            }
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+
+    private func gatewayFact(icon: String, title: String, value: String, color: Color) -> some View {
+        VStack(alignment: .leading, spacing: 6) {
+            HStack(spacing: 5) {
+                Image(systemName: icon)
+                    .font(.caption2.weight(.bold))
+                    .foregroundStyle(color)
+                Text(title)
+                    .font(.caption2.weight(.medium))
+                    .foregroundStyle(.secondary)
+                    .lineLimit(1)
+            }
+            Text(value)
+                .font(.caption.weight(.semibold))
+                .foregroundStyle(title == "Connection" ? color : .primary)
+                .lineLimit(1)
+                .minimumScaleFactor(0.72)
+        }
+        .frame(maxWidth: .infinity, alignment: .leading)
+        .padding(.horizontal, 10)
+    }
+
+    private var pendingApprovals: some View {
+        self.pendingApprovalsContent
+            .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+
+    private var pendingApprovalsContent: some View {
+        CommandPanel(
+            tint: self.pendingApproval == nil ? nil : OpenClawBrand.warn,
+            isProminent: self.pendingApproval != nil,
+            padding: self.pendingApproval == nil ? 11 : 13)
+        {
+            VStack(alignment: .leading, spacing: 10) {
+                self.cardHeader(
+                    title: "Pending approvals",
+                    value: self.pendingApproval == nil ? nil : "Review requests ›",
+                    color: OpenClawBrand.accentHot,
+                    badgeValue: self.approvalItems.isEmpty ? nil : "\(self.approvalItems.count)")
+
+                if self.approvalItems.isEmpty {
+                    CommandEmptyStateRow(
+                        icon: "checkmark.shield.fill",
+                        title: "No approvals waiting",
+                        detail: self
+                            .gatewayConnected ? "Gateway requests will appear here." : "Connect to the gateway.")
+                } else {
+                    VStack(spacing: 0) {
+                        ForEach(Array(self.approvalItems.enumerated()), id: \.element.id) { index, item in
+                            CommandApprovalRow(item: item)
+                            if index < self.approvalItems.count - 1 {
+                                Divider().padding(.leading, 48)
+                            }
+                        }
+                    }
+                    .padding(.vertical, 4)
+                    .background {
+                        RoundedRectangle(cornerRadius: 10, style: .continuous)
+                            .fill(self.approvalRowsFill)
+                            .overlay {
+                                RoundedRectangle(cornerRadius: 10, style: .continuous)
+                                    .strokeBorder(
+                                        Color.primary.opacity(self.colorScheme == .dark ? 0.08 : 0.04),
+                                        lineWidth: 1)
+                            }
+                    }
+                }
+
+                if let pendingApproval {
+                    HStack(spacing: 8) {
+                        Button {
+                            Task { await self.appModel.resolvePendingExecApprovalPrompt(decision: "allow-once") }
+                        } label: {
+                            Label("Allow", systemImage: "checkmark")
+                        }
+                        .buttonStyle(.borderedProminent)
+                        .disabled(self.appModel.pendingExecApprovalPromptResolving)
+
+                        if pendingApproval.allowsAllowAlways {
+                            Button {
+                                Task {
+                                    await self.appModel.resolvePendingExecApprovalPrompt(decision: "allow-always")
+                                }
+                            } label: {
+                                Label("Always", systemImage: "checkmark.shield")
+                            }
+                            .buttonStyle(.bordered)
+                            .disabled(self.appModel.pendingExecApprovalPromptResolving)
+                        }
+
+                        Button(role: .destructive) {
+                            Task { await self.appModel.resolvePendingExecApprovalPrompt(decision: "deny") }
+                        } label: {
+                            Label("Deny", systemImage: "xmark")
+                        }
+                        .buttonStyle(.bordered)
+                        .disabled(self.appModel.pendingExecApprovalPromptResolving)
+
+                        Spacer(minLength: 0)
+                    }
+                    .controlSize(.small)
+                }
+            }
+        }
+    }
+
+    private var activeTasks: some View {
+        CommandPanel(padding: 0) {
+            VStack(spacing: 0) {
+                self.cardHeader(
+                    title: "Active sessions",
+                    value: self.activeSessionsSummaryText,
+                    color: .secondary)
+                    .padding(.horizontal, 12)
+                    .padding(.top, 10)
+                    .padding(.bottom, 3)
+
+                VStack(spacing: 8) {
+                    ForEach(self.visibleActiveSessionRows) { item in
+                        Button {
+                            self.open(item.route)
+                        } label: {
+                            CommandSessionRow(item: item)
+                        }
+                        .buttonStyle(.plain)
+                    }
+                }
+                .padding(.horizontal, 10)
+                .padding(.bottom, 10)
+            }
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+
+    private var liveActivity: some View {
+        CommandPanel(padding: 0) {
+            VStack(spacing: 0) {
+                self.cardHeader(
+                    title: "Live activity",
+                    value: nil,
+                    color: OpenClawBrand.accent)
+                    .padding(.horizontal, 12)
+                    .padding(.top, 11)
+                    .padding(.bottom, 3)
+
+                CommandLiveActivityRow(
+                    title: self.liveActivityTitle,
+                    value: self.liveActivityValue,
+                    color: self.liveActivityColor)
+                    .padding(.horizontal, 14)
+                    .padding(.bottom, 10)
+            }
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+
+    private var startWorkAction: some View {
+        CommandPanel(tint: OpenClawBrand.accent, isProminent: true, padding: 9) {
+            Button(action: self.openChat) {
+                Label("Start work", systemImage: "play.fill")
+                    .font(.subheadline.weight(.bold))
+                    .foregroundStyle(.white)
+                    .frame(maxWidth: .infinity)
+                    .frame(height: 48)
+                    .background {
+                        RoundedRectangle(cornerRadius: 13, style: .continuous)
+                            .fill(LinearGradient(
+                                colors: [OpenClawBrand.accentHot, OpenClawBrand.accent],
+                                startPoint: .topLeading,
+                                endPoint: .bottomTrailing))
+                            .shadow(color: OpenClawBrand.accentHot.opacity(0.34), radius: 18, y: 8)
+                    }
+            }
+            .buttonStyle(.plain)
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+
+    private func cardHeader(
+        title: String,
+        value: String?,
+        color: Color,
+        icon: String? = nil,
+        badgeValue: String? = nil,
+        action: (() -> Void)? = nil) -> some View
+    {
+        HStack(spacing: 8) {
+            Text(title)
+                .font(.subheadline.weight(.bold))
+            if let badgeValue {
+                Text(badgeValue)
+                    .font(.caption2.weight(.bold))
+                    .foregroundStyle(.white)
+                    .padding(.horizontal, 6)
+                    .padding(.vertical, 3)
+                    .background(OpenClawBrand.accentHot, in: Capsule())
+            }
+            Spacer(minLength: 8)
+            if let value {
+                if let action {
+                    Button(value, action: action)
+                        .font(.caption.weight(.semibold))
+                        .foregroundStyle(color)
+                } else {
+                    HStack(spacing: 4) {
+                        if let icon {
+                            Image(systemName: icon)
+                                .font(.caption2.weight(.bold))
+                        }
+                        Text(value)
+                    }
+                    .font(.caption.weight(.semibold))
+                    .foregroundStyle(color)
+                }
+            }
+        }
+    }
+
+    private var gatewayConnected: Bool {
+        GatewayStatusBuilder.build(appModel: self.appModel) == .connected
+    }
+
+    private var gatewayStateText: String {
+        guard !self.gatewayConnected else { return "Healthy" }
+        let status = self.appModel.gatewayDisplayStatusText.trimmingCharacters(in: .whitespacesAndNewlines)
+        let lowercased = status.lowercased()
+        if lowercased.contains("approval") { return "Approval" }
+        if lowercased.contains("reconnect") { return "Reconnecting" }
+        if lowercased.contains("connect") { return "Connecting" }
+        if lowercased.contains("idle") { return "Idle" }
+        return "Offline"
+    }
+
+    private var gatewayStatusColor: Color {
+        self.gatewayConnected ? OpenClawBrand.ok : .secondary
+    }
+
+    private var gatewayAddressText: String {
+        self.normalized(self.appModel.gatewayRemoteAddress)
+            ?? self.normalized(self.appModel.gatewayServerName)
+            ?? "Unknown"
+    }
+
+    private var gatewayAgentCountText: String {
+        guard self.gatewayConnected else { return "—" }
+        return "\(self.appModel.gatewayAgents.count)"
+    }
+
+    private var activeSessionsSummaryText: String {
+        let count = self.activeSessionRows.count
+        if count == 0 {
+            return self.gatewayConnected ? "No sessions" : "Offline"
+        }
+        if self.sessionWorkItems.isEmpty {
+            return self.gatewayConnected ? "\(count) ready" : "Offline"
+        }
+        return "\(count) \(count == 1 ? "session" : "sessions")"
+    }
+
+    private var approvalItems: [ApprovalItem] {
+        if let pendingApproval {
+            return [
+                ApprovalItem(
+                    id: "pending-real",
+                    icon: "terminal.fill",
+                    title: pendingApproval.commandPreview ?? "Review gateway action",
+                    detail: "Agent: \(self.appModel.activeAgentName)",
+                    priority: self.appModel.pendingExecApprovalPromptResolving ? "Resolving" : "High",
+                    color: OpenClawBrand.danger),
+                ApprovalItem(
+                    id: "pending-context",
+                    icon: "doc.text.fill",
+                    title: pendingApproval.allowsAllowAlways ? "Permission can be saved" : "One-time approval",
+                    detail: "Gateway request",
+                    priority: pendingApproval.allowsAllowAlways ? "Medium" : "Review",
+                    color: OpenClawBrand.warn),
+            ]
+        }
+
+        return []
+    }
+
+    private var approvalRowsFill: Color {
+        self.colorScheme == .dark ? Color.black.opacity(0.12) : Color.black.opacity(0.022)
+    }
+
+    private var activeSessionRows: [WorkItem] {
+        self.sessionItems
+    }
+
+    private var visibleActiveSessionRows: [WorkItem] {
+        Array(self.activeSessionRows.prefix(3))
+    }
+
+    private var liveActivityTitle: String {
+        if let session = self.activeChatSessions.first(where: { !Self.isHiddenInternalSession($0.key) }) {
+            return "\(Self.sessionTitle(session)) updated"
+        }
+        if self.pendingApproval != nil {
+            return "Approval waiting"
+        }
+        return self.gatewayConnected ? "Gateway connected" : self.gatewayStateText
+    }
+
+    private var liveActivityValue: String {
+        if let session = self.activeChatSessions.first(where: { !Self.isHiddenInternalSession($0.key) }),
+           let updatedAt = session.updatedAt,
+           updatedAt > 0
+        {
+            return Self.relativeTimeText(forMilliseconds: updatedAt)
+        }
+        if self.pendingApproval != nil {
+            return "review"
+        }
+        return self.gatewayConnected ? self.gatewayAddressText : self.gatewayDisplayStatusValue
+    }
+
+    private var liveActivityColor: Color {
+        if self.pendingApproval != nil { return OpenClawBrand.warn }
+        return self.gatewayConnected ? OpenClawBrand.ok : .secondary
+    }
+
+    private var gatewayDisplayStatusValue: String {
+        let status = self.appModel.gatewayDisplayStatusText.trimmingCharacters(in: .whitespacesAndNewlines)
+        return status.isEmpty ? self.gatewayStateText : status
+    }
+
+    private var activeSessionsRefreshID: String {
+        [
+            self.appModel.isOperatorGatewayConnected ? "connected" : "offline",
+            self.appModel.chatSessionKey,
+            self.scenePhase == .active ? "active" : "inactive",
+        ].joined(separator: ":")
+    }
+
+    private var sessionItems: [WorkItem] {
+        let liveItems = self.sessionWorkItems
+        if !liveItems.isEmpty { return liveItems }
+        return self.defaultSessionItems
+    }
+
+    private var sessionWorkItems: [WorkItem] {
+        let currentSessionKey = self.appModel.chatSessionKey
+        return self.activeChatSessions
+            .filter { !Self.isHiddenInternalSession($0.key) }
+            .prefix(4)
+            .map { session in
+                let isCurrent = session.key == currentSessionKey
+                return WorkItem(
+                    id: "chat-session-\(session.key)",
+                    icon: isCurrent ? "bubble.left.and.text.bubble.right.fill" : "bubble.left.fill",
+                    title: Self.sessionTitle(session),
+                    detail: Self.sessionDetail(session),
+                    state: isCurrent ? "current" : "recent",
+                    trailing: "chat",
+                    color: isCurrent ? OpenClawBrand.accent : OpenClawBrand.ok,
+                    progress: nil,
+                    route: .chat(session.key))
+            }
+    }
+
+    private var defaultSessionItems: [WorkItem] {
+        [
+            WorkItem(
+                id: "main-chat",
+                icon: "bubble.left.and.text.bubble.right.fill",
+                title: "Main chat",
+                detail: self.appModel.activeAgentName,
+                state: self.gatewayConnected ? "ready" : "offline",
+                trailing: "session",
+                color: self.gatewayConnected ? OpenClawBrand.ok : .secondary,
+                progress: nil,
+                route: .chat(self.appModel.chatSessionKey)),
+            WorkItem(
+                id: "talk-mode",
+                icon: "waveform",
+                title: "Talk",
+                detail: self.appModel.talkMode.statusText,
+                state: self.appModel.talkMode.isEnabled ? "active" : "off",
+                trailing: "voice",
+                color: self.appModel.talkMode.isEnabled ? OpenClawBrand.ok : .secondary,
+                progress: nil,
+                route: .settings),
+            WorkItem(
+                id: "device-capture",
+                icon: self.appModel.screenRecordActive ? "record.circle.fill" : "display",
+                title: "Device capture",
+                detail: self.appModel.screenRecordActive ? "Screen capture is active" : "Screen and device tools",
+                state: self.appModel.screenRecordActive ? "running" : "idle",
+                trailing: "device",
+                color: self.appModel.screenRecordActive ? OpenClawBrand.warn : .secondary,
+                progress: nil,
+                route: .settings),
+            WorkItem(
+                id: "agent-roster",
+                icon: "person.2.fill",
+                title: "Agents",
+                detail: self.gatewayConnected ? "\(self.appModel.gatewayAgents.count) available" : "Roster unavailable",
+                state: self.gatewayConnected ? "online" : "offline",
+                trailing: "gateway",
+                color: self.gatewayConnected ? OpenClawBrand.ok : .secondary,
+                progress: nil,
+                route: .settings),
+        ]
+    }
+
+    private func open(_ route: WorkRoute) {
+        switch route {
+        case let .chat(sessionKey):
+            self.appModel.openChat(sessionKey: sessionKey)
+            self.openChat()
+        case .settings:
+            self.openSettings()
+        }
+    }
+
+    private func refreshActiveSessionsIfNeeded() async {
+        guard self.scenePhase == .active else { return }
+        guard self.appModel.isOperatorGatewayConnected else {
+            if !self.activeChatSessions.isEmpty {
+                self.activeChatSessions = []
+            }
+            return
+        }
+
+        do {
+            let transport = IOSGatewayChatTransport(gateway: appModel.operatorSession)
+            let response = try await transport.listSessions(limit: 12)
+            self.activeChatSessions = Self.sessionChoices(
+                response.sessions,
+                currentSessionKey: self.appModel.chatSessionKey)
+        } catch {
+            self.activeChatSessions = []
+        }
+    }
+
+    private static func sessionChoices(
+        _ sessions: [OpenClawChatSessionEntry],
+        currentSessionKey: String) -> [OpenClawChatSessionEntry]
+    {
+        let sorted = sessions.sorted { ($0.updatedAt ?? 0) > ($1.updatedAt ?? 0) }
+        var result: [OpenClawChatSessionEntry] = []
+        var included = Set<String>()
+
+        if let current = sorted.first(where: { $0.key == currentSessionKey }) {
+            result.append(current)
+            included.insert(current.key)
+        }
+
+        for session in sorted {
+            guard !included.contains(session.key) else { continue }
+            guard !Self.isHiddenInternalSession(session.key) else { continue }
+            result.append(session)
+            included.insert(session.key)
+            if result.count >= 4 { break }
+        }
+
+        return result
+    }
+
+    private static func sessionTitle(_ session: OpenClawChatSessionEntry) -> String {
+        if let title = redactedSessionTitle(for: session.key) {
+            return title
+        }
+
+        let displayName = session.displayName?.trimmingCharacters(in: .whitespacesAndNewlines)
+        if let displayName, !displayName.isEmpty {
+            return Self.redactedSessionTitle(for: displayName) ?? displayName
+        }
+        let subject = session.subject?.trimmingCharacters(in: .whitespacesAndNewlines)
+        if let subject, !subject.isEmpty {
+            return Self.redactedSessionTitle(for: subject) ?? subject
+        }
+        return session.key
+    }
+
+    private static func redactedSessionTitle(for key: String) -> String? {
+        let trimmed = key.trimmingCharacters(in: .whitespacesAndNewlines)
+        let lowercased = trimmed.lowercased()
+        guard !trimmed.isEmpty else { return nil }
+        if lowercased.contains(":ios-") {
+            return "iOS chat"
+        }
+        if lowercased.hasPrefix("telegram:") {
+            return "Telegram chat"
+        }
+        if lowercased.hasPrefix("user:+") {
+            return "Direct chat"
+        }
+        if lowercased.hasPrefix("cron:") {
+            return Self.humanizedSessionKey(String(trimmed.dropFirst("cron:".count)))
+        }
+        return nil
+    }
+
+    private static func humanizedSessionKey(_ key: String) -> String? {
+        let words = key
+            .replacingOccurrences(of: "_", with: "-")
+            .split(separator: "-")
+            .map(String.init)
+            .filter { !$0.isEmpty }
+        guard !words.isEmpty else { return nil }
+
+        return words
+            .map { word in
+                switch word.lowercased() {
+                case "ai", "api", "ios", "qmd", "url":
+                    word.uppercased()
+                default:
+                    word.prefix(1).uppercased() + String(word.dropFirst())
+                }
+            }
+            .joined(separator: " ")
+    }
+
+    private static func sessionDetail(_ session: OpenClawChatSessionEntry) -> String {
+        if let updatedAt = session.updatedAt, updatedAt > 0 {
+            return self.relativeTimeText(forMilliseconds: updatedAt)
+        }
+        return session.key
+    }
+
+    private static func relativeTimeText(forMilliseconds milliseconds: Double) -> String {
+        let date = Date(timeIntervalSince1970: milliseconds / 1000)
+        let formatter = RelativeDateTimeFormatter()
+        formatter.dateTimeStyle = .numeric
+        formatter.unitsStyle = .short
+        return formatter.localizedString(for: date, relativeTo: .now)
+    }
+
+    private static func isHiddenInternalSession(_ key: String) -> Bool {
+        let trimmed = key.trimmingCharacters(in: .whitespacesAndNewlines)
+        guard !trimmed.isEmpty else { return false }
+        return trimmed == "onboarding" || trimmed.hasSuffix(":onboarding")
+    }
+
+    private var gatewaySubtitle: String {
+        if let server = normalized(appModel.gatewayServerName) {
+            return "\(self.appModel.activeAgentName) on \(server)"
+        }
+        if let address = normalized(appModel.gatewayRemoteAddress) {
+            return "\(self.appModel.activeAgentName) via \(address)"
+        }
+        return self.appModel.gatewayDisplayStatusText
+    }
+
+    private var pendingApproval: NodeAppModel.ExecApprovalPrompt? {
+        self.appModel.pendingExecApprovalPrompt
+    }
+
+    private func normalized(_ value: String?) -> String? {
+        Self.normalized(value)
+    }
+
+    private static func normalized(_ value: String?) -> String? {
+        guard let value else { return nil }
+        let trimmed = value.trimmingCharacters(in: .whitespacesAndNewlines)
+        return trimmed.isEmpty ? nil : trimmed
+    }
+}

apps/ios/Sources/Design/OpenClawBrand.swift

@@ -0,0 +1,145 @@
+import SwiftUI
+
+enum AppAppearancePreference: String, CaseIterable, Identifiable {
+    case system
+    case light
+    case dark
+
+    static let storageKey = "appearance.preference"
+
+    static var launchArgumentPreference: AppAppearancePreference? {
+        let arguments = ProcessInfo.processInfo.arguments
+        guard let flagIndex = arguments.firstIndex(of: "--openclaw-appearance") else {
+            return nil
+        }
+        let valueIndex = arguments.index(after: flagIndex)
+        guard arguments.indices.contains(valueIndex) else { return nil }
+        return AppAppearancePreference(rawValue: arguments[valueIndex].lowercased())
+    }
+
+    var id: String {
+        self.rawValue
+    }
+
+    var label: String {
+        switch self {
+        case .system: "System"
+        case .light: "Light"
+        case .dark: "Dark"
+        }
+    }
+
+    var colorScheme: ColorScheme? {
+        switch self {
+        case .system: nil
+        case .light: .light
+        case .dark: .dark
+        }
+    }
+
+    var userInterfaceStyle: UIUserInterfaceStyle {
+        switch self {
+        case .system: .unspecified
+        case .light: .light
+        case .dark: .dark
+        }
+    }
+}
+
+enum OpenClawBrand {
+    static let lightCanvasTop = Color(red: 246 / 255.0, green: 247 / 255.0, blue: 249 / 255.0)
+    static let lightCanvasMiddle = Color(red: 250 / 255.0, green: 251 / 255.0, blue: 252 / 255.0)
+    static let lightCanvasBottom = Color.white
+    static let darkCanvasTop = Color(red: 3 / 255.0, green: 7 / 255.0, blue: 7 / 255.0)
+    static let darkCanvasMiddle = Color(red: 13 / 255.0, green: 17 / 255.0, blue: 17 / 255.0)
+    static let darkCanvasBottom = Color(red: 17 / 255.0, green: 18 / 255.0, blue: 20 / 255.0)
+
+    static let accent = Color(uiColor: UIColor { traits in
+        traits.userInterfaceStyle == .dark
+            ? UIColor(red: 198 / 255.0, green: 62 / 255.0, blue: 56 / 255.0, alpha: 1)
+            : UIColor(red: 183 / 255.0, green: 56 / 255.0, blue: 51 / 255.0, alpha: 1)
+    })
+    static let accentHot = Color(uiColor: UIColor { traits in
+        traits.userInterfaceStyle == .dark
+            ? UIColor(red: 232 / 255.0, green: 92 / 255.0, blue: 86 / 255.0, alpha: 1)
+            : UIColor(red: 204 / 255.0, green: 75 / 255.0, blue: 69 / 255.0, alpha: 1)
+    })
+    static let danger = Color(uiColor: UIColor { traits in
+        traits.userInterfaceStyle == .dark
+            ? UIColor(red: 252 / 255.0, green: 165 / 255.0, blue: 165 / 255.0, alpha: 1)
+            : UIColor(red: 185 / 255.0, green: 28 / 255.0, blue: 28 / 255.0, alpha: 1)
+    })
+    static let ok = Color(red: 34 / 255.0, green: 197 / 255.0, blue: 94 / 255.0)
+    static let warn = Color(red: 245 / 255.0, green: 158 / 255.0, blue: 11 / 255.0)
+    static let graphite = Color(uiColor: UIColor { traits in
+        traits.userInterfaceStyle == .dark
+            ? UIColor(red: 20 / 255.0, green: 22 / 255.0, blue: 24 / 255.0, alpha: 1)
+            : UIColor(red: 246 / 255.0, green: 247 / 255.0, blue: 249 / 255.0, alpha: 1)
+    })
+    static let graphiteElevated = Color(uiColor: UIColor { traits in
+        traits.userInterfaceStyle == .dark
+            ? UIColor(red: 34 / 255.0, green: 36 / 255.0, blue: 39 / 255.0, alpha: 1)
+            : UIColor.white
+    })
+    static let graphiteSoft = Color(uiColor: UIColor { traits in
+        traits.userInterfaceStyle == .dark
+            ? UIColor(red: 148 / 255.0, green: 163 / 255.0, blue: 184 / 255.0, alpha: 1)
+            : UIColor(red: 102 / 255.0, green: 112 / 255.0, blue: 133 / 255.0, alpha: 1)
+    })
+
+    static var sheetBackground: LinearGradient {
+        LinearGradient(
+            colors: [
+                graphite,
+                graphiteElevated.opacity(0.96),
+                Color(uiColor: .systemBackground),
+            ],
+            startPoint: .topLeading,
+            endPoint: .bottomTrailing)
+    }
+
+    static var toolbarChrome: LinearGradient {
+        LinearGradient(
+            colors: [
+                graphiteElevated.opacity(0.92),
+                graphite.opacity(0.78),
+            ],
+            startPoint: .topLeading,
+            endPoint: .bottomTrailing)
+    }
+
+    static func glassFill(brighten: Bool) -> Color {
+        Color.black.opacity(brighten ? 0.10 : 0.22)
+    }
+
+    static func glassStroke(brighten: Bool, increasedContrast: Bool, active: Bool = false) -> Color {
+        if active {
+            return self.accent.opacity(increasedContrast ? 0.70 : 0.46)
+        }
+        return Color.white.opacity(increasedContrast ? 0.50 : (brighten ? 0.24 : 0.16))
+    }
+
+    static func formSectionHeader(_ title: String) -> some View {
+        Text(title)
+            .font(.caption.weight(.semibold))
+            .foregroundStyle(self.accent)
+            .textCase(.uppercase)
+    }
+
+    static func canvasColors(for colorScheme: ColorScheme) -> [Color] {
+        colorScheme == .dark
+            ? [self.darkCanvasTop, self.darkCanvasMiddle, self.darkCanvasBottom]
+            : [self.lightCanvasTop, self.lightCanvasMiddle, self.lightCanvasBottom]
+    }
+}
+
+extension View {
+    func openClawSheetChrome() -> some View {
+        self
+            .tint(OpenClawBrand.accent)
+            .background {
+                OpenClawBrand.sheetBackground
+                    .ignoresSafeArea()
+            }
+    }
+}

apps/ios/Sources/Design/OpenClawProComponents.swift

@@ -0,0 +1,577 @@
+import SwiftUI
+
+enum OpenClawProMetric {
+    static let pagePadding: CGFloat = 20
+    static let cardRadius: CGFloat = 14
+    static let controlRadius: CGFloat = 12
+    static let bottomScrollInset: CGFloat = 96
+    static let heroRadius: CGFloat = 22
+}
+
+struct OpenClawProBackground: View {
+    @Environment(\.colorScheme) private var colorScheme
+
+    var body: some View {
+        LinearGradient(
+            colors: OpenClawBrand.canvasColors(for: self.colorScheme),
+            startPoint: .top,
+            endPoint: .bottom)
+            .ignoresSafeArea()
+            .overlay(alignment: .top) {
+                if self.colorScheme == .light {
+                    LinearGradient(
+                        colors: [
+                            OpenClawBrand.accent.opacity(0.05),
+                            .clear,
+                        ],
+                        startPoint: .topTrailing,
+                        endPoint: .bottomLeading)
+                        .frame(height: 260)
+                        .ignoresSafeArea()
+                }
+            }
+    }
+}
+
+struct ProSectionHeader: View {
+    let title: String
+    var actionTitle: String?
+    var action: (() -> Void)?
+    var uppercase = true
+
+    var body: some View {
+        HStack {
+            Text(self.title)
+                .font(.caption.weight(.medium))
+                .foregroundStyle(.secondary)
+                .textCase(self.uppercase ? .uppercase : nil)
+            Spacer()
+            if let actionTitle {
+                if let action {
+                    Button(actionTitle, action: action)
+                        .font(.caption.weight(.medium))
+                        .foregroundStyle(OpenClawBrand.accent)
+                } else {
+                    Text(actionTitle)
+                        .font(.caption.weight(.medium))
+                        .foregroundStyle(.secondary)
+                }
+            }
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+}
+
+struct ProCard<Content: View>: View {
+    var tint: Color?
+    var isProminent: Bool = false
+    var padding: CGFloat = 14
+    var radius: CGFloat = OpenClawProMetric.cardRadius
+    @ViewBuilder var content: Content
+
+    var body: some View {
+        self.content
+            .padding(self.padding)
+            .frame(maxWidth: .infinity, alignment: .leading)
+            .proPanelSurface(
+                tint: self.tint,
+                radius: self.radius,
+                isProminent: self.isProminent)
+    }
+}
+
+private struct ProPanelBackground: View {
+    @Environment(\.colorScheme) private var colorScheme
+    let radius: CGFloat
+    let tint: Color?
+    let isProminent: Bool
+
+    var body: some View {
+        let shape = RoundedRectangle(cornerRadius: self.radius, style: .continuous)
+        shape
+            .fill(self.fill)
+            .overlay {
+                ProPanelTexture()
+                    .opacity(self.colorScheme == .dark ? 0.22 : 0.08)
+                    .clipShape(shape)
+            }
+            .overlay {
+                shape.strokeBorder(self.borderStyle, lineWidth: 1)
+            }
+            .overlay {
+                shape
+                    .strokeBorder(Color.black.opacity(self.colorScheme == .dark ? 0.40 : 0.055), lineWidth: 0.7)
+                    .padding(1)
+            }
+            .overlay(alignment: .top) {
+                shape
+                    .strokeBorder(Color.white.opacity(self.colorScheme == .dark ? 0.07 : 0.36), lineWidth: 0.7)
+                    .mask(alignment: .top) {
+                        Rectangle().frame(height: 28)
+                    }
+            }
+    }
+
+    private var fill: AnyShapeStyle {
+        if self.colorScheme == .dark {
+            let base = self.isProminent
+                ? Color(red: 15 / 255, green: 17 / 255, blue: 19 / 255)
+                : Color(red: 10 / 255, green: 12 / 255, blue: 14 / 255)
+            return AnyShapeStyle(base)
+        }
+
+        let gradient = LinearGradient(
+            colors: [
+                Color.white.opacity(0.98),
+                (self.tint ?? Color.white).opacity(self.tint == nil ? 0.92 : 0.12),
+                Color(red: 246 / 255, green: 247 / 255, blue: 249 / 255),
+            ],
+            startPoint: .topLeading,
+            endPoint: .bottomTrailing)
+        return AnyShapeStyle(gradient)
+    }
+
+    private var borderStyle: AnyShapeStyle {
+        if self.colorScheme == .dark {
+            return AnyShapeStyle(Color.white.opacity(self.isProminent ? 0.15 : 0.11))
+        }
+
+        let gradient = LinearGradient(
+            colors: [
+                Color.white.opacity(0.72),
+                (self.tint ?? OpenClawBrand.accent).opacity(0.10),
+                Color.black.opacity(0.08),
+            ],
+            startPoint: .topLeading,
+            endPoint: .bottomTrailing)
+        return AnyShapeStyle(gradient)
+    }
+}
+
+private struct ProPanelTexture: View {
+    @Environment(\.colorScheme) private var colorScheme
+
+    var body: some View {
+        Canvas { context, size in
+            let color = self.colorScheme == .dark ? Color.white.opacity(0.11) : Color.black.opacity(0.08)
+            for y in stride(from: 2.0, through: size.height, by: 6.5) {
+                let offset = Int(y / 6.5).isMultiple(of: 2) ? 0.0 : 3.25
+                for x in stride(from: 2.0 + offset, through: size.width, by: 6.5) {
+                    let dot = CGRect(x: x, y: y, width: 0.7, height: 0.7)
+                    context.fill(Path(ellipseIn: dot), with: .color(color))
+                }
+            }
+        }
+    }
+}
+
+private struct ProLightGlassModifier: ViewModifier {
+    @Environment(\.colorScheme) private var colorScheme
+    let radius: CGFloat
+
+    func body(content: Content) -> some View {
+        if #available(iOS 26.0, *), self.colorScheme == .light {
+            content.glassEffect(.regular, in: .rect(cornerRadius: self.radius))
+        } else {
+            content
+        }
+    }
+}
+
+private struct ProGlassSurfaceModifier: ViewModifier {
+    @Environment(\.colorScheme) private var colorScheme
+    let fill: Color
+    let stroke: Color
+    let radius: CGFloat
+    let isProminent: Bool
+    var interactive = false
+
+    func body(content: Content) -> some View {
+        let shape = RoundedRectangle(cornerRadius: self.radius, style: .continuous)
+        let surfaced = content.background {
+            shape
+                .fill(self.fill)
+                .overlay {
+                    shape.strokeBorder(self.stroke, lineWidth: self.isProminent ? 1.2 : 1)
+                }
+        }
+
+        if #available(iOS 26.0, *), self.colorScheme == .light {
+            surfaced.glassEffect(
+                self.interactive ? .regular.interactive() : .regular,
+                in: .rect(cornerRadius: self.radius))
+        } else {
+            surfaced
+        }
+    }
+}
+
+extension View {
+    func proPanelSurface(
+        tint: Color? = nil,
+        radius: CGFloat = OpenClawProMetric.cardRadius,
+        isProminent: Bool = false) -> some View
+    {
+        self.modifier(ProPanelSurfaceModifier(
+            tint: tint,
+            radius: radius,
+            isProminent: isProminent))
+    }
+
+    func proGlassSurface(
+        fill: Color,
+        stroke: Color,
+        radius: CGFloat,
+        isProminent: Bool = false,
+        interactive: Bool = false) -> some View
+    {
+        self.modifier(ProGlassSurfaceModifier(
+            fill: fill,
+            stroke: stroke,
+            radius: radius,
+            isProminent: isProminent,
+            interactive: interactive))
+    }
+}
+
+private struct ProPanelSurfaceModifier: ViewModifier {
+    @Environment(\.colorScheme) private var colorScheme
+    let tint: Color?
+    let radius: CGFloat
+    let isProminent: Bool
+
+    func body(content: Content) -> some View {
+        content
+            .background {
+                ProPanelBackground(
+                    radius: self.radius,
+                    tint: self.tint,
+                    isProminent: self.isProminent)
+            }
+            .modifier(ProLightGlassModifier(radius: self.radius))
+            .shadow(
+                color: self.colorScheme == .dark ? .black.opacity(0.60) : .black.opacity(0.045),
+                radius: self.isProminent ? 20 : 12,
+                y: self.isProminent ? 10 : 6)
+    }
+}
+
+struct ProIconBadge: View {
+    let systemName: String
+    let color: Color
+
+    var body: some View {
+        Image(systemName: self.systemName)
+            .font(.subheadline.weight(.semibold))
+            .foregroundStyle(self.color)
+            .frame(width: 34, height: 34)
+            .background {
+                RoundedRectangle(cornerRadius: 10, style: .continuous)
+                    .fill(self.color.opacity(0.12))
+            }
+    }
+}
+
+struct ProStatusDot: View {
+    var color: Color
+
+    var body: some View {
+        Circle()
+            .fill(self.color)
+            .frame(width: 8, height: 8)
+            .shadow(color: self.color.opacity(0.35), radius: 4)
+    }
+}
+
+struct ProValuePill: View {
+    @Environment(\.colorScheme) private var colorScheme
+    let value: String
+    let color: Color
+
+    var body: some View {
+        Text(self.value)
+            .font(.caption.weight(.semibold))
+            .foregroundStyle(self.color)
+            .lineLimit(1)
+            .padding(.horizontal, 8)
+            .padding(.vertical, 5)
+            .background {
+                Capsule()
+                    .fill(self.color.opacity(self.colorScheme == .dark ? 0.12 : 0.08))
+            }
+    }
+}
+
+struct OpenClawProMark: View {
+    var size: CGFloat = 42
+    var shadowRadius: CGFloat = 10
+
+    var body: some View {
+        Image("OpenClawIcon")
+            .resizable()
+            .scaledToFit()
+            .frame(width: self.size, height: self.size)
+            .shadow(color: OpenClawBrand.accent.opacity(0.28), radius: self.shadowRadius, y: self.shadowRadius / 2)
+            .accessibilityLabel("OpenClaw")
+    }
+}
+
+struct ProProgressBar: View {
+    let progress: Double
+    var color: Color = OpenClawBrand.accentHot
+
+    var body: some View {
+        GeometryReader { proxy in
+            let clamped = max(0, min(self.progress, 1))
+            ZStack(alignment: .leading) {
+                Capsule()
+                    .fill(Color.primary.opacity(0.10))
+                Capsule()
+                    .fill(self.color)
+                    .frame(width: proxy.size.width * clamped)
+            }
+        }
+        .frame(height: 3)
+    }
+}
+
+struct ProWorkRow: View {
+    let icon: String
+    let title: String
+    let detail: String
+    let state: String
+    let trailing: String
+    let color: Color
+    var progress: Double?
+
+    var body: some View {
+        HStack(alignment: .top, spacing: 12) {
+            ProIconBadge(systemName: self.icon, color: self.color)
+            VStack(alignment: .leading, spacing: 5) {
+                HStack(alignment: .firstTextBaseline) {
+                    Text(self.title)
+                        .font(.subheadline.weight(.semibold))
+                    Spacer(minLength: 8)
+                    Text(self.trailing)
+                        .font(.caption2)
+                        .foregroundStyle(.secondary)
+                }
+                Text(self.detail)
+                    .font(.caption)
+                    .foregroundStyle(.secondary)
+                    .lineLimit(1)
+                HStack(spacing: 8) {
+                    if let progress {
+                        ProProgressBar(progress: progress, color: self.color)
+                            .frame(maxWidth: 120)
+                    }
+                    Text(self.state)
+                        .font(.caption2.weight(.semibold))
+                        .foregroundStyle(self.color)
+                }
+            }
+        }
+        .padding(.vertical, 9)
+    }
+}
+
+struct ProCapsule: View {
+    @Environment(\.colorScheme) private var colorScheme
+    let title: String
+    let color: Color
+    var icon: String?
+
+    var body: some View {
+        HStack(spacing: 6) {
+            if let icon {
+                Image(systemName: icon)
+                    .font(.caption.weight(.semibold))
+            }
+            Text(self.title)
+                .font(.caption.weight(.semibold))
+        }
+        .foregroundStyle(self.color)
+        .padding(.horizontal, 10)
+        .padding(.vertical, 7)
+        .background {
+            Capsule()
+                .fill(self.color.opacity(self.colorScheme == .dark ? 0.16 : 0.10))
+                .overlay {
+                    Capsule()
+                        .strokeBorder(self.color.opacity(self.colorScheme == .dark ? 0.30 : 0.18), lineWidth: 1)
+                }
+        }
+    }
+}
+
+struct ProSegmentedControl: View {
+    @Environment(\.colorScheme) private var colorScheme
+    let labels: [String]
+    @Binding var selection: Int
+
+    var body: some View {
+        HStack(spacing: 4) {
+            ForEach(Array(self.labels.enumerated()), id: \.offset) { index, label in
+                Button {
+                    self.selection = index
+                } label: {
+                    Text(label)
+                        .font(.subheadline.weight(self.selection == index ? .semibold : .regular))
+                        .frame(maxWidth: .infinity)
+                        .padding(.vertical, 9)
+                        .background(self.segmentFill(isSelected: self.selection == index), in: Capsule())
+                }
+                .buttonStyle(.plain)
+            }
+        }
+        .padding(4)
+        .background {
+            Capsule()
+                .fill(self.trackFill)
+                .overlay {
+                    Capsule().strokeBorder(self.trackStroke, lineWidth: 1)
+                }
+        }
+    }
+
+    private func segmentFill(isSelected: Bool) -> Color {
+        guard isSelected else { return .clear }
+        return self.colorScheme == .dark ? Color.white.opacity(0.12) : Color.primary.opacity(0.08)
+    }
+
+    private var trackFill: Color {
+        self.colorScheme == .dark ? Color.white.opacity(0.045) : Color.white.opacity(0.72)
+    }
+
+    private var trackStroke: Color {
+        self.colorScheme == .dark ? Color.white.opacity(0.10) : Color.black.opacity(0.06)
+    }
+}
+
+struct ProHeroActionButton: View {
+    @Environment(\.colorScheme) private var colorScheme
+    let title: String
+    let detail: String
+    let systemImage: String
+    let action: () -> Void
+
+    var body: some View {
+        Button(action: self.action) {
+            HStack(spacing: 12) {
+                Image(systemName: self.systemImage)
+                    .font(.headline.weight(.semibold))
+                    .foregroundStyle(.white)
+                    .frame(width: 42, height: 42)
+                    .background(OpenClawBrand.accentHot, in: RoundedRectangle(cornerRadius: 13, style: .continuous))
+
+                VStack(alignment: .leading, spacing: 3) {
+                    Text(self.title)
+                        .font(.subheadline.weight(.semibold))
+                        .foregroundStyle(.primary)
+                    Text(self.detail)
+                        .font(.caption)
+                        .foregroundStyle(.secondary)
+                        .lineLimit(1)
+                }
+
+                Spacer(minLength: 8)
+
+                Image(systemName: "arrow.right")
+                    .font(.subheadline.weight(.bold))
+                    .foregroundStyle(OpenClawBrand.accentHot)
+            }
+            .padding(12)
+            .proGlassSurface(
+                fill: self.colorScheme == .dark ? Color.white.opacity(0.045) : Color.white.opacity(0.68),
+                stroke: OpenClawBrand.accent.opacity(self.colorScheme == .dark ? 0.22 : 0.14),
+                radius: 18,
+                isProminent: true,
+                interactive: true)
+        }
+        .buttonStyle(.plain)
+    }
+}
+
+struct ProMetricTile: View {
+    @Environment(\.colorScheme) private var colorScheme
+    let title: String
+    let value: String
+    let icon: String
+    let color: Color
+
+    var body: some View {
+        VStack(alignment: .leading, spacing: 10) {
+            HStack {
+                Image(systemName: self.icon)
+                    .font(.caption.weight(.semibold))
+                    .foregroundStyle(self.color)
+                    .frame(width: 24, height: 24)
+                    .background(self.color.opacity(self.colorScheme == .dark ? 0.18 : 0.10), in: Circle())
+                Spacer(minLength: 4)
+            }
+
+            VStack(alignment: .leading, spacing: 2) {
+                Text(self.value)
+                    .font(.headline.weight(.bold))
+                    .lineLimit(1)
+                    .minimumScaleFactor(0.72)
+                Text(self.title)
+                    .font(.caption2.weight(.medium))
+                    .foregroundStyle(.secondary)
+                    .lineLimit(1)
+            }
+        }
+        .padding(11)
+        .frame(maxWidth: .infinity, alignment: .leading)
+        .proGlassSurface(
+            fill: self.colorScheme == .dark ? Color.white.opacity(0.04) : Color.white.opacity(0.52),
+            stroke: self.color.opacity(self.colorScheme == .dark ? 0.18 : 0.10),
+            radius: 16)
+    }
+}
+
+struct ProStatusRow: View {
+    let icon: String
+    let title: String
+    let detail: String
+    let value: String
+    let color: Color
+
+    var body: some View {
+        HStack(alignment: .center, spacing: 12) {
+            ProIconBadge(systemName: self.icon, color: self.color)
+            VStack(alignment: .leading, spacing: 4) {
+                Text(self.title)
+                    .font(.subheadline.weight(.semibold))
+                Text(self.detail)
+                    .font(.caption)
+                    .foregroundStyle(.secondary)
+                    .lineLimit(1)
+            }
+            Spacer(minLength: 8)
+            ProValuePill(value: self.value, color: self.color)
+        }
+        .padding(.vertical, 11)
+    }
+}
+
+struct ProTimelineRow: View {
+    let done: Bool
+    let title: String
+    let detail: String
+
+    var body: some View {
+        HStack(alignment: .top, spacing: 10) {
+            ProIconBadge(
+                systemName: self.done ? "checkmark.circle.fill" : "clock.fill",
+                color: self.done ? OpenClawBrand.ok : OpenClawBrand.warn)
+            VStack(alignment: .leading, spacing: 3) {
+                Text(self.title)
+                    .font(.subheadline.weight(.medium))
+                Text(self.detail)
+                    .font(.caption)
+                    .foregroundStyle(.secondary)
+            }
+        }
+    }
+}

apps/ios/Sources/Design/OpenClawProScreens.swift

@@ -0,0 +1,3 @@
+import SwiftUI
+
+// Pro UI surfaces are split by tab to keep SwiftLint file-length signal useful.

apps/ios/Sources/Design/SettingsProTab.swift

@@ -0,0 +1,167 @@
+import OpenClawKit
+import SwiftUI
+import UIKit
+import UserNotifications
+
+struct SettingsProTab: View {
+    @Environment(NodeAppModel.self) var appModel
+    @Environment(VoiceWakeManager.self) var voiceWake
+    @Environment(GatewayConnectionController.self) var gatewayController
+    @Environment(\.scenePhase) var scenePhase
+    @AppStorage(AppAppearancePreference.storageKey) var appearancePreferenceRaw: String =
+        AppAppearancePreference.system.rawValue
+    @AppStorage("node.displayName") var displayName: String = "iOS Node"
+    @AppStorage("node.instanceId") var instanceId: String = UUID().uuidString
+    @AppStorage("camera.enabled") var cameraEnabled: Bool = true
+    @AppStorage("location.enabledMode") var locationModeRaw: String = OpenClawLocationMode.off.rawValue
+    @AppStorage("screen.preventSleep") var preventSleep: Bool = true
+    @AppStorage("talk.enabled") var talkEnabled: Bool = false
+    @AppStorage(TalkModeProviderSelection.storageKey) var talkProviderSelectionRaw: String =
+        TalkModeProviderSelection.gatewayDefault.rawValue
+    @AppStorage(TalkModeRealtimeVoiceSelection.storageKey) var talkRealtimeVoiceSelectionRaw: String = ""
+    @AppStorage(TalkSpeechLocale.storageKey) var talkSpeechLocale: String = TalkSpeechLocale.automaticID
+    @AppStorage("talk.button.enabled") var talkButtonEnabled: Bool = true
+    @AppStorage("talk.background.enabled") var talkBackgroundEnabled: Bool = false
+    @AppStorage(TalkDefaults.speakerphoneEnabledKey) var talkSpeakerphoneEnabled: Bool =
+        TalkDefaults.speakerphoneEnabledByDefault
+    @AppStorage(VoiceWakePreferences.enabledKey) var voiceWakeEnabled: Bool = false
+    @AppStorage("gateway.autoconnect") var gatewayAutoConnect: Bool = false
+    @AppStorage("gateway.manual.enabled") var manualGatewayEnabled: Bool = false
+    @AppStorage("gateway.manual.host") var manualGatewayHost: String = ""
+    @AppStorage("gateway.manual.port") var manualGatewayPort: Int = 18789
+    @AppStorage("gateway.manual.tls") var manualGatewayTLS: Bool = true
+    @AppStorage("gateway.discovery.debugLogs") var discoveryDebugLogsEnabled: Bool = false
+    @AppStorage("canvas.debugStatusEnabled") var canvasDebugStatusEnabled: Bool = false
+    @AppStorage("gateway.setupCode") var setupCode: String = ""
+    @AppStorage("gateway.onboardingComplete") var onboardingComplete: Bool = false
+    @AppStorage("gateway.hasConnectedOnce") var hasConnectedOnce: Bool = false
+    @AppStorage("onboarding.requestID") var onboardingRequestID: Int = 0
+    @State var isReconnectingGateway = false
+    @State var isRefreshingGateway = false
+    @State var isChangingLocationMode = false
+    @State var connectingGatewayID: String?
+    @State var selectedAgentPickerId = ""
+    @State var gatewayToken = ""
+    @State var gatewayPassword = ""
+    @State var manualGatewayPortText = ""
+    @State var setupStatusText: String?
+    @State var pendingManualAuthOverride: GatewayConnectionController.ManualAuthOverride?
+    @State var defaultShareInstruction = ""
+    @State var showGatewayProblemDetails = false
+    @State var showQRScanner = false
+    @State var scannerError: String?
+    @State var showResetOnboardingAlert = false
+    @State var suppressCredentialPersist = false
+    @State var locationStatusText: String?
+    @State var previousLocationModeRaw: String = OpenClawLocationMode.off.rawValue
+    @State var notificationStatusText = "Checking"
+    @State var notificationActionText = "Request Access"
+    @State var diagnosticsLastRunText = "Not run"
+    @State var diagnosticsIssueCount: Int?
+
+    var body: some View {
+        NavigationStack {
+            ZStack {
+                OpenClawProBackground()
+                ScrollView {
+                    VStack(alignment: .leading, spacing: 18) {
+                        self.settingsHeader
+                        self.appearanceSection
+                        self.gatewaySection
+                        self.settingsListSection
+                    }
+                    .padding(.vertical, 18)
+                }
+                .safeAreaPadding(.bottom, OpenClawProMetric.bottomScrollInset)
+            }
+            .navigationBarHidden(true)
+            .navigationDestination(for: SettingsRoute.self) { route in
+                self.destination(for: route)
+            }
+            .task {
+                self.previousLocationModeRaw = self.locationModeRaw
+                self.syncSettingsState()
+                self.refreshNotificationSettings()
+            }
+            .onChange(of: self.scenePhase) { _, phase in
+                if phase == .active {
+                    self.syncSettingsState()
+                    self.refreshNotificationSettings()
+                }
+            }
+            .onChange(of: self.locationModeRaw) { _, newValue in
+                self.handleLocationModeChange(newValue)
+            }
+            .onChange(of: self.selectedAgentPickerId) { _, newValue in
+                let trimmed = newValue.trimmingCharacters(in: .whitespacesAndNewlines)
+                self.appModel.setSelectedAgentId(trimmed.isEmpty ? nil : trimmed)
+            }
+            .onChange(of: self.appModel.selectedAgentId ?? "") { _, newValue in
+                if newValue != self.selectedAgentPickerId {
+                    self.selectedAgentPickerId = newValue
+                }
+            }
+            .onChange(of: self.gatewayToken) { _, newValue in
+                self.persistGatewayToken(newValue)
+            }
+            .onChange(of: self.gatewayPassword) { _, newValue in
+                self.persistGatewayPassword(newValue)
+            }
+            .onChange(of: self.defaultShareInstruction) { _, newValue in
+                ShareToAgentSettings.saveDefaultInstruction(newValue)
+            }
+        }
+        .sheet(isPresented: self.$showGatewayProblemDetails) {
+            if let gatewayProblem = self.appModel.lastGatewayProblem {
+                GatewayProblemDetailsSheet(
+                    problem: gatewayProblem,
+                    primaryActionTitle: self.gatewayProblemPrimaryActionTitle(gatewayProblem),
+                    onPrimaryAction: {
+                        Task { await self.handleGatewayProblemPrimaryAction(gatewayProblem) }
+                    })
+            }
+        }
+        .sheet(isPresented: self.$showQRScanner) {
+            NavigationStack {
+                QRScannerView(
+                    onGatewayLink: { link in
+                        self.handleScannedGatewayLink(link)
+                    },
+                    onError: { error in
+                        self.showQRScanner = false
+                        self.setupStatusText = "Scanner error: \(error)"
+                        self.scannerError = error
+                    },
+                    onDismiss: {
+                        self.showQRScanner = false
+                    })
+                    .ignoresSafeArea()
+                    .navigationTitle("Scan QR Code")
+                    .navigationBarTitleDisplayMode(.inline)
+                    .toolbar {
+                        ToolbarItem(placement: .topBarLeading) {
+                            Button("Cancel") { self.showQRScanner = false }
+                        }
+                    }
+            }
+        }
+        .alert("Reset Onboarding?", isPresented: self.$showResetOnboardingAlert) {
+            Button("Reset", role: .destructive) {
+                self.resetOnboarding()
+            }
+            Button("Cancel", role: .cancel) {}
+        } message: {
+            Text("This disconnects, clears saved gateway credentials, and reopens onboarding.")
+        }
+        .alert(
+            "QR Scanner Unavailable",
+            isPresented: Binding(
+                get: { self.scannerError != nil },
+                set: { if !$0 { self.scannerError = nil } }))
+        {
+            Button("OK", role: .cancel) {}
+        } message: {
+            Text(self.scannerError ?? "")
+        }
+    }
+}

apps/ios/Sources/Design/SettingsProTabActions.swift

@@ -0,0 +1,646 @@
+import OpenClawKit
+import SwiftUI
+import UIKit
+import UserNotifications
+
+extension SettingsProTab {
+    func detailStatusCard(
+        icon: String,
+        title: String,
+        detail: String,
+        value: String,
+        color: Color) -> some View
+    {
+        ProCard(radius: SettingsLayout.cardRadius) {
+            HStack(spacing: 12) {
+                ProIconBadge(systemName: icon, color: color)
+                VStack(alignment: .leading, spacing: 3) {
+                    Text(title)
+                        .font(.headline)
+                    Text(detail)
+                        .font(.caption)
+                        .foregroundStyle(.secondary)
+                        .lineLimit(2)
+                }
+                Spacer(minLength: 8)
+                ProValuePill(value: value, color: color)
+            }
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+
+    var diagnosticChecksCard: some View {
+        ProCard(padding: 0, radius: SettingsLayout.cardRadius) {
+            VStack(spacing: 0) {
+                self.diagnosticCheckRow(
+                    icon: "stethoscope",
+                    title: "Last Run",
+                    detail: self.diagnosticsLastRunText,
+                    value: self.diagnosticsRunValue,
+                    color: self.diagnosticsRunColor)
+                Divider().padding(.leading, 60)
+                self.diagnosticCheckRow(
+                    icon: "antenna.radiowaves.left.and.right",
+                    title: "Gateway Link",
+                    detail: self.appModel.gatewayDisplayStatusText,
+                    value: self.gatewayConnected ? "online" : "offline",
+                    color: self.gatewayConnected ? OpenClawBrand.ok : .secondary)
+                Divider().padding(.leading, 60)
+                self.diagnosticCheckRow(
+                    icon: "dot.radiowaves.left.and.right",
+                    title: "Discovery",
+                    detail: self.gatewayController.discoveryStatusText,
+                    value: "\(self.gatewayController.gateways.count)",
+                    color: self.gatewayController.gateways.isEmpty ? .secondary : OpenClawBrand.accent)
+                Divider().padding(.leading, 60)
+                self.diagnosticCheckRow(
+                    icon: "waveform",
+                    title: "Talk Config",
+                    detail: self.appModel.talkMode.gatewayTalkTransportLabel,
+                    value: self.appModel.talkMode.gatewayTalkConfigLoaded ? "loaded" : "missing",
+                    color: self.appModel.talkMode.gatewayTalkConfigLoaded ? OpenClawBrand.ok : .secondary)
+                Divider().padding(.leading, 60)
+                self.diagnosticCheckRow(
+                    icon: "bell",
+                    title: "Notifications",
+                    detail: "Approval and event alert channel",
+                    value: self.notificationStatusText,
+                    color: self.notificationStatusText == "Allowed" ? OpenClawBrand.ok : .secondary)
+                Divider().padding(.leading, 60)
+                self.diagnosticCheckRow(
+                    icon: "rectangle.on.rectangle",
+                    title: "Screen Capture",
+                    detail: "Live foreground capture state",
+                    value: self.appModel.screenRecordActive ? "live" : "idle",
+                    color: self.appModel.screenRecordActive ? OpenClawBrand.ok : .secondary)
+                Divider().padding(.leading, 60)
+                self.diagnosticCheckRow(
+                    icon: "mic",
+                    title: "Voice Wake",
+                    detail: self.appModel.voiceWake.statusText,
+                    value: self.voiceWakeEnabled ? "on" : "off",
+                    color: self.voiceWakeEnabled ? OpenClawBrand.ok : .secondary)
+            }
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+
+    func diagnosticCheckRow(
+        icon: String,
+        title: String,
+        detail: String,
+        value: String,
+        color: Color) -> some View
+    {
+        HStack(spacing: 12) {
+            ProIconBadge(systemName: icon, color: color)
+            VStack(alignment: .leading, spacing: 3) {
+                Text(title)
+                    .font(.subheadline.weight(.semibold))
+                Text(detail)
+                    .font(.caption)
+                    .foregroundStyle(.secondary)
+                    .lineLimit(1)
+            }
+            Spacer(minLength: 8)
+            ProValuePill(value: value, color: color)
+        }
+        .padding(.horizontal, 14)
+        .padding(.vertical, 10)
+    }
+
+    func detailListCard(@ViewBuilder content: () -> some View) -> some View {
+        ProCard(padding: 0, radius: SettingsLayout.cardRadius) {
+            VStack(spacing: 0, content: content)
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+
+    func detailRow(_ label: String, value: String) -> some View {
+        HStack {
+            Text(label)
+                .font(.caption)
+                .foregroundStyle(.secondary)
+            Spacer(minLength: 8)
+            Text(value)
+                .font(.caption)
+                .lineLimit(1)
+                .truncationMode(.middle)
+        }
+        .padding(.horizontal, 14)
+        .frame(height: 42)
+    }
+
+    func reconnectGateway() async {
+        guard !self.isReconnectingGateway else { return }
+        self.isReconnectingGateway = true
+        defer { self.isReconnectingGateway = false }
+        await self.gatewayController.connectLastKnown()
+    }
+
+    func refreshGateway() async {
+        guard !self.isRefreshingGateway else { return }
+        self.isRefreshingGateway = true
+        defer { self.isRefreshingGateway = false }
+        self.gatewayController.refreshActiveGatewayRegistrationFromSettings()
+        self.gatewayController.restartDiscovery()
+        await self.appModel.refreshGatewayOverviewIfConnected()
+    }
+
+    @MainActor
+    func runDiagnostics() async {
+        guard !self.isRefreshingGateway else { return }
+        self.isRefreshingGateway = true
+        defer { self.isRefreshingGateway = false }
+
+        self.gatewayController.refreshActiveGatewayRegistrationFromSettings()
+        self.gatewayController.restartDiscovery()
+        await self.appModel.refreshGatewayOverviewIfConnected()
+        let notificationSettings = await UNUserNotificationCenter.current().notificationSettings()
+        self.applyNotificationStatus(notificationSettings.authorizationStatus)
+
+        let issueCount = SettingsDiagnostics.issueCount(
+            gatewayConnected: self.gatewayConnected,
+            discoveredGatewayCount: self.gatewayController.gateways.count,
+            talkConfigLoaded: self.appModel.talkMode.gatewayTalkConfigLoaded,
+            notificationStatusText: self.notificationStatusText)
+        self.diagnosticsIssueCount = issueCount
+        self.diagnosticsLastRunText = SettingsDiagnostics.timestamp(Date())
+    }
+
+    func syncSettingsState() {
+        self.manualGatewayPortText = self.manualGatewayPort > 0 ? String(self.manualGatewayPort) : ""
+        self.selectedAgentPickerId = self.appModel.selectedAgentId ?? ""
+        self.defaultShareInstruction = ShareToAgentSettings.loadDefaultInstruction()
+        let trimmedInstanceId = self.instanceId.trimmingCharacters(in: .whitespacesAndNewlines)
+        guard !trimmedInstanceId.isEmpty else { return }
+        self.gatewayToken = GatewaySettingsStore.loadGatewayToken(instanceId: trimmedInstanceId) ?? ""
+        self.gatewayPassword = GatewaySettingsStore.loadGatewayPassword(instanceId: trimmedInstanceId) ?? ""
+    }
+
+    func connect(_ gateway: GatewayDiscoveryModel.DiscoveredGateway) async {
+        self.connectingGatewayID = gateway.id
+        defer { self.connectingGatewayID = nil }
+        self.manualGatewayEnabled = false
+        GatewaySettingsStore.savePreferredGatewayStableID(gateway.stableID)
+        GatewaySettingsStore.saveLastDiscoveredGatewayStableID(gateway.stableID)
+        if let err = await self.gatewayController.connectWithDiagnostics(gateway) {
+            self.setupStatusText = err
+        }
+    }
+
+    func applySetupCodeAndConnect() async {
+        self.setupStatusText = nil
+        guard self.applySetupCode() else { return }
+        let host = self.manualGatewayHost.trimmingCharacters(in: .whitespacesAndNewlines)
+        guard let port = self.resolvedManualPort(host: host) else {
+            self.setupStatusText = "Failed: invalid port"
+            return
+        }
+        guard await self.preflightGateway(host: host, port: port, useTLS: self.manualGatewayTLS) else { return }
+        self.setupStatusText = "Setup code applied. Connecting..."
+        await self.connectManual()
+    }
+
+    @discardableResult
+    func applySetupCode() -> Bool {
+        let raw = self.setupCode.trimmingCharacters(in: .whitespacesAndNewlines)
+        guard !raw.isEmpty else {
+            self.setupStatusText = "Paste a setup code to continue."
+            return false
+        }
+        guard let link = GatewayConnectDeepLink.fromSetupInput(raw) else {
+            self.setupStatusText = "Setup code not recognized or uses an insecure ws:// gateway URL."
+            return false
+        }
+        self.applyGatewayLink(link)
+        return true
+    }
+
+    func applyGatewayLink(_ link: GatewayConnectDeepLink) {
+        self.manualGatewayHost = link.host
+        self.manualGatewayPort = link.port
+        self.manualGatewayPortText = String(link.port)
+        self.manualGatewayTLS = link.tls
+        let instanceId = GatewaySettingsStore.currentInstanceID()
+        let setupAuth = GatewayConnectionController.ManualAuthOverride.setupAuth(from: link)
+        if setupAuth.hasBootstrapToken {
+            GatewayOnboardingReset.prepareForBootstrapPairing(appModel: self.appModel, instanceId: instanceId)
+        }
+        if !instanceId.isEmpty {
+            GatewaySettingsStore.saveGatewayBootstrapToken(setupAuth.bootstrapToken, instanceId: instanceId)
+        }
+        if setupAuth.shouldApplyTokenField {
+            self.gatewayToken = setupAuth.token
+            if !instanceId.isEmpty {
+                GatewaySettingsStore.saveGatewayToken(setupAuth.token, instanceId: instanceId)
+            }
+        }
+        if setupAuth.shouldApplyPasswordField {
+            self.gatewayPassword = setupAuth.password
+            if !instanceId.isEmpty {
+                GatewaySettingsStore.saveGatewayPassword(setupAuth.password, instanceId: instanceId)
+            }
+        }
+        self.pendingManualAuthOverride = setupAuth.manualAuthOverride
+    }
+
+    func openGatewayQRScanner() {
+        self.appModel.disconnectGateway()
+        self.connectingGatewayID = nil
+        self.setupStatusText = "Opening QR scanner..."
+        self.showQRScanner = true
+    }
+
+    func handleScannedGatewayLink(_ link: GatewayConnectDeepLink) {
+        self.showQRScanner = false
+        self.setupCode = ""
+        self.applyGatewayLink(link)
+        self.setupStatusText = "QR loaded. Connecting to \(link.host):\(link.port)..."
+        Task { await self.connectAfterScannedGatewayLink() }
+    }
+
+    func connectAfterScannedGatewayLink() async {
+        let host = self.manualGatewayHost.trimmingCharacters(in: .whitespacesAndNewlines)
+        guard let port = self.resolvedManualPort(host: host) else {
+            self.setupStatusText = "Failed: invalid port"
+            return
+        }
+        guard await self.preflightGateway(host: host, port: port, useTLS: self.manualGatewayTLS) else { return }
+        await self.connectManual()
+    }
+
+    func connectManual() async {
+        let host = self.manualGatewayHost.trimmingCharacters(in: .whitespacesAndNewlines)
+        guard !host.isEmpty else {
+            self.setupStatusText = "Failed: host required"
+            return
+        }
+        guard self.manualPortIsValid else {
+            self.setupStatusText = "Failed: invalid port"
+            return
+        }
+        self.connectingGatewayID = "manual"
+        self.manualGatewayEnabled = true
+        defer { self.connectingGatewayID = nil }
+        let authOverride = GatewayConnectionController.ManualAuthOverride.currentManualInput(
+            token: self.gatewayToken,
+            pendingOverride: self.pendingManualAuthOverride,
+            password: self.gatewayPassword)
+        self.pendingManualAuthOverride = nil
+        await self.gatewayController.connectManual(
+            host: host,
+            port: self.manualGatewayPort,
+            useTLS: self.manualGatewayTLS,
+            authOverride: authOverride)
+    }
+
+    func preflightGateway(host: String, port: Int, useTLS: Bool) async -> Bool {
+        let trimmed = host.trimmingCharacters(in: .whitespacesAndNewlines)
+        guard !trimmed.isEmpty else { return false }
+        if Self.isTailnetHostOrIP(trimmed), !Self.hasTailnetIPv4() {
+            self.setupStatusText = "Tailscale is off on this iPhone. Turn it on, then try again."
+            return false
+        }
+        self.setupStatusText = "Checking gateway reachability..."
+        let ok = await TCPProbe.probe(host: trimmed, port: port, timeoutSeconds: 3, queueLabel: "gateway.preflight")
+        if !ok {
+            self.setupStatusText = "Can't reach gateway at \(trimmed):\(port). Check Tailscale or LAN."
+        }
+        return ok
+    }
+
+    func resetOnboarding() {
+        self.connectingGatewayID = nil
+        self.setupStatusText = nil
+        self.setupCode = ""
+        self.gatewayAutoConnect = false
+        self.suppressCredentialPersist = true
+        defer { self.suppressCredentialPersist = false }
+        self.gatewayToken = ""
+        self.gatewayPassword = ""
+        GatewayOnboardingReset.reset(appModel: self.appModel, instanceId: self.instanceId)
+        self.onboardingComplete = false
+        self.hasConnectedOnce = false
+        self.manualGatewayEnabled = false
+        self.manualGatewayHost = ""
+        self.onboardingRequestID += 1
+    }
+
+    func retryGatewayConnectionFromProblem() async {
+        if self.manualGatewayEnabled || self.connectingGatewayID == "manual" {
+            await self.connectManual()
+        } else {
+            await self.gatewayController.connectLastKnown()
+        }
+    }
+
+    func gatewayProblemPrimaryActionTitle(_ problem: GatewayConnectionProblem) -> String {
+        if problem.suggestsOnboardingReset { return "Reset onboarding" }
+        return problem.canTrustRotatedCertificate ? "Trust certificate" : "Retry connection"
+    }
+
+    func handleGatewayProblemPrimaryAction(_ problem: GatewayConnectionProblem) async {
+        if problem.suggestsOnboardingReset {
+            self.resetOnboarding()
+            return
+        }
+        if problem.canTrustRotatedCertificate {
+            _ = await self.gatewayController.trustRotatedGatewayCertificate(from: problem)
+            return
+        }
+        await self.retryGatewayConnectionFromProblem()
+    }
+
+    func handleLocationModeChange(_ newValue: String) {
+        guard !self.isChangingLocationMode else { return }
+        guard newValue != self.previousLocationModeRaw else { return }
+        guard let mode = OpenClawLocationMode(rawValue: newValue) else { return }
+        let previous = self.previousLocationModeRaw
+        Task {
+            await self.applyLocationMode(mode, rawValue: newValue, previous: previous)
+        }
+    }
+
+    @MainActor
+    func applyLocationMode(
+        _ mode: OpenClawLocationMode,
+        rawValue: String,
+        previous: String) async
+    {
+        self.isChangingLocationMode = true
+        self.locationStatusText = nil
+        defer { self.isChangingLocationMode = false }
+
+        if mode == .off {
+            self.previousLocationModeRaw = rawValue
+            self.gatewayController.refreshActiveGatewayRegistrationFromSettings()
+            return
+        }
+
+        let granted = await self.appModel.requestLocationPermissions(mode: mode)
+        if granted {
+            self.previousLocationModeRaw = rawValue
+            self.gatewayController.refreshActiveGatewayRegistrationFromSettings()
+        } else {
+            self.locationModeRaw = previous
+            self.previousLocationModeRaw = previous
+            self.locationStatusText = "Location permission was not granted."
+        }
+    }
+
+    func refreshNotificationSettings() {
+        UNUserNotificationCenter.current().getNotificationSettings { settings in
+            let status = settings.authorizationStatus
+            Task { @MainActor in
+                self.applyNotificationStatus(status)
+            }
+        }
+    }
+
+    func handleNotificationAction() {
+        if self.notificationStatusText == "Allowed" || self.notificationStatusText == "Not Allowed" {
+            self.openSystemSettings()
+            return
+        }
+
+        Task {
+            let granted = await (try? UNUserNotificationCenter.current().requestAuthorization(options: [
+                .alert,
+                .badge,
+                .sound,
+            ])) ?? false
+            await MainActor.run {
+                self.notificationStatusText = granted ? "Allowed" : "Not Allowed"
+                self.notificationActionText = granted ? "Open System Settings" : "Open System Settings"
+            }
+        }
+    }
+
+    @MainActor
+    func applyNotificationStatus(_ status: UNAuthorizationStatus) {
+        switch status {
+        case .authorized, .provisional, .ephemeral:
+            self.notificationStatusText = "Allowed"
+            self.notificationActionText = "Open System Settings"
+        case .denied:
+            self.notificationStatusText = "Not Allowed"
+            self.notificationActionText = "Open System Settings"
+        case .notDetermined:
+            self.notificationStatusText = "Not Set"
+            self.notificationActionText = "Request Access"
+        @unknown default:
+            self.notificationStatusText = "Unknown"
+            self.notificationActionText = "Open System Settings"
+        }
+    }
+
+    func persistGatewayToken(_ value: String) {
+        guard !self.suppressCredentialPersist else { return }
+        let instanceId = self.instanceId.trimmingCharacters(in: .whitespacesAndNewlines)
+        guard !instanceId.isEmpty else { return }
+        GatewaySettingsStore.saveGatewayToken(
+            value.trimmingCharacters(in: .whitespacesAndNewlines),
+            instanceId: instanceId)
+    }
+
+    func persistGatewayPassword(_ value: String) {
+        guard !self.suppressCredentialPersist else { return }
+        let instanceId = self.instanceId.trimmingCharacters(in: .whitespacesAndNewlines)
+        guard !instanceId.isEmpty else { return }
+        GatewaySettingsStore.saveGatewayPassword(
+            value.trimmingCharacters(in: .whitespacesAndNewlines),
+            instanceId: instanceId)
+    }
+
+    func openSystemSettings() {
+        guard let url = URL(string: UIApplication.openSettingsURLString) else { return }
+        UIApplication.shared.open(url)
+    }
+
+    func title(for route: SettingsRoute) -> String {
+        switch route {
+        case .gateway: "Gateway"
+        case .permissions: "Permissions"
+        case .voice: "Voice & Talk"
+        case .diagnostics: "Diagnostics"
+        case .privacy: "Privacy"
+        case .notifications: "Notifications"
+        case .about: "About"
+        }
+    }
+
+    var manualPortBinding: Binding<String> {
+        Binding(
+            get: { self.manualGatewayPortText },
+            set: { newValue in
+                let filtered = newValue.filter(\.isNumber)
+                self.manualGatewayPortText = filtered
+                self.manualGatewayPort = Int(filtered) ?? 0
+            })
+    }
+
+    var manualPortIsValid: Bool {
+        if self.manualGatewayPortText.isEmpty { return true }
+        return self.manualGatewayPort >= 1 && self.manualGatewayPort <= 65535
+    }
+
+    func resolvedManualPort(host: String) -> Int? {
+        if self.manualGatewayPort > 0 {
+            return self.manualGatewayPort <= 65535 ? self.manualGatewayPort : nil
+        }
+        let trimmed = host.trimmingCharacters(in: .whitespacesAndNewlines)
+        guard !trimmed.isEmpty else { return nil }
+        if self.manualGatewayTLS, trimmed.lowercased().hasSuffix(".ts.net") {
+            return 443
+        }
+        return 18789
+    }
+
+    var setupStatusLine: String? {
+        if let problem = self.appModel.lastGatewayProblem {
+            return problem.message
+        }
+        let trimmedSetup = self.setupStatusText?.trimmingCharacters(in: .whitespacesAndNewlines) ?? ""
+        let gatewayStatus = self.appModel.gatewayStatusText.trimmingCharacters(in: .whitespacesAndNewlines)
+        if let friendly = self.friendlyGatewayMessage(from: gatewayStatus) { return friendly }
+        if let friendly = self.friendlyGatewayMessage(from: trimmedSetup) { return friendly }
+        if !trimmedSetup.isEmpty { return trimmedSetup }
+        if gatewayStatus.isEmpty || gatewayStatus == "Offline" { return nil }
+        return gatewayStatus
+    }
+
+    var tailnetWarningText: String? {
+        let host = self.manualGatewayHost.trimmingCharacters(in: .whitespacesAndNewlines)
+        guard !host.isEmpty, Self.isTailnetHostOrIP(host), !Self.hasTailnetIPv4() else { return nil }
+        return "This gateway is on your tailnet. Turn on Tailscale on this iPhone, then tap Connect."
+    }
+
+    func friendlyGatewayMessage(from raw: String) -> String? {
+        let lower = raw.trimmingCharacters(in: .whitespacesAndNewlines).lowercased()
+        if lower.contains("pairing required") {
+            return "Pairing required. Run /pair approve in your OpenClaw chat, then connect again."
+        }
+        if lower.contains("device nonce required") || lower.contains("device nonce mismatch") {
+            return "Secure handshake failed. Check Tailscale, then connect again."
+        }
+        if lower.contains("timed out") {
+            return "Connection timed out. Make sure Tailscale is connected, then try again."
+        }
+        if lower.contains("unauthorized role") {
+            return "Connected, but some controls are restricted for nodes. This is expected."
+        }
+        return nil
+    }
+
+    var shouldShowRealtimeVoicePicker: Bool {
+        let providerSelection = TalkModeProviderSelection.resolved(self.talkProviderSelectionRaw)
+        return providerSelection == .openAIRealtime || self.appModel.talkMode.gatewayTalkUsesRealtime
+    }
+
+    var talkProviderSelectionBinding: Binding<String> {
+        Binding(
+            get: { self.talkProviderSelectionRaw },
+            set: { newValue in
+                let selection = TalkModeProviderSelection.resolved(newValue)
+                self.talkProviderSelectionRaw = selection.rawValue
+                self.appModel.setTalkProviderSelection(selection.rawValue)
+            })
+    }
+
+    var talkRealtimeVoiceSelectionBinding: Binding<String> {
+        Binding(
+            get: { self.talkRealtimeVoiceSelectionRaw },
+            set: { newValue in
+                let voice = TalkModeRealtimeVoiceSelection.resolvedOverride(newValue) ?? ""
+                self.talkRealtimeVoiceSelectionRaw = voice
+                self.appModel.setTalkRealtimeVoiceSelection(voice)
+            })
+    }
+
+    var talkSpeakerphoneBinding: Binding<Bool> {
+        Binding(
+            get: { self.talkSpeakerphoneEnabled },
+            set: { newValue in
+                self.talkSpeakerphoneEnabled = newValue
+                self.appModel.setTalkSpeakerphoneEnabled(newValue)
+            })
+    }
+
+    var talkApiKeyStatus: String {
+        guard self.appModel.talkMode.gatewayTalkConfigLoaded else { return "Not loaded" }
+        return self.appModel.talkMode.gatewayTalkApiKeyConfigured ? "Configured" : "Not configured"
+    }
+
+    func gatewayDetailLines(_ gateway: GatewayDiscoveryModel.DiscoveredGateway) -> [String] {
+        var lines: [String] = []
+        if let lanHost = gateway.lanHost { lines.append("LAN: \(lanHost)") }
+        if let tailnet = gateway.tailnetDns { lines.append("Tailnet: \(tailnet)") }
+        let gw = gateway.gatewayPort.map(String.init)
+        let canvas = gateway.canvasPort.map(String.init)
+        if gw != nil || canvas != nil {
+            lines.append("Ports: gateway \(gw ?? "-") / canvas \(canvas ?? "-")")
+        }
+        return lines.isEmpty ? [gateway.debugID] : lines
+    }
+
+    var gatewayConnected: Bool {
+        GatewayStatusBuilder.build(appModel: self.appModel) == .connected
+    }
+
+    var gatewayAddress: String {
+        self.appModel.gatewayRemoteAddress ?? "Waiting for gateway"
+    }
+
+    var gatewayServer: String {
+        self.appModel.gatewayServerName ?? "OpenClaw Gateway"
+    }
+
+    var permissionsDetail: String {
+        var enabled = 0
+        if self.cameraEnabled { enabled += 1 }
+        if self.locationModeRaw != OpenClawLocationMode.off.rawValue { enabled += 1 }
+        if self.preventSleep { enabled += 1 }
+        return "\(enabled) enabled"
+    }
+
+    var voiceDetail: String {
+        if self.talkEnabled, self.voiceWakeEnabled { return "Talk + Wake" }
+        if self.talkEnabled { return "Talk on" }
+        if self.voiceWakeEnabled { return "Wake on" }
+        return "Off"
+    }
+
+    var diagnosticsDetail: String {
+        "System checks"
+    }
+
+    var diagnosticsHealthValue: String {
+        if self.gatewayConnected { return "ready" }
+        if self.gatewayController.gateways.isEmpty { return "check" }
+        return "partial"
+    }
+
+    var diagnosticsRunValue: String {
+        guard let diagnosticsIssueCount else { return "pending" }
+        return diagnosticsIssueCount == 0 ? "pass" : "\(diagnosticsIssueCount)"
+    }
+
+    var diagnosticsRunColor: Color {
+        guard let diagnosticsIssueCount else { return .secondary }
+        return diagnosticsIssueCount == 0 ? OpenClawBrand.ok : OpenClawBrand.warn
+    }
+
+    var privacyDetail: String {
+        let location = OpenClawLocationMode(rawValue: self.locationModeRaw) ?? .off
+        return location == .off ? "Location off" : "Location \(self.locationLabel)"
+    }
+
+    var locationLabel: String {
+        switch OpenClawLocationMode(rawValue: self.locationModeRaw) ?? .off {
+        case .off: "Off"
+        case .whileUsing: "While Using"
+        case .always: "Always"
+        }
+    }
+}

apps/ios/Sources/Design/SettingsProTabSections.swift

@@ -0,0 +1,807 @@
+import OpenClawKit
+import SwiftUI
+
+extension SettingsProTab {
+    var settingsHeader: some View {
+        Text("Settings")
+            .font(.system(size: 28, weight: .bold))
+            .padding(.horizontal, OpenClawProMetric.pagePadding)
+            .padding(.top, 6)
+    }
+
+    var appearanceSection: some View {
+        VStack(alignment: .leading, spacing: 8) {
+            ProSectionHeader(title: "Appearance", uppercase: false)
+            ProCard(radius: SettingsLayout.cardRadius) {
+                VStack(alignment: .leading, spacing: 12) {
+                    Picker("Appearance", selection: self.$appearancePreferenceRaw) {
+                        ForEach(AppAppearancePreference.allCases) { preference in
+                            Text(preference.label).tag(preference.rawValue)
+                        }
+                    }
+                    .pickerStyle(.segmented)
+                    Text("Follows iOS appearance.")
+                        .font(.caption)
+                        .foregroundStyle(.secondary)
+                }
+            }
+            .padding(.horizontal, OpenClawProMetric.pagePadding)
+        }
+    }
+
+    var gatewaySection: some View {
+        VStack(alignment: .leading, spacing: 8) {
+            ProSectionHeader(title: "Gateway", uppercase: false)
+            ProCard(padding: 0, radius: SettingsLayout.cardRadius) {
+                VStack(spacing: 0) {
+                    NavigationLink(value: SettingsRoute.gateway) {
+                        self.gatewayConnectionRow
+                            .padding(14)
+                    }
+                    .buttonStyle(.plain)
+                    Divider()
+                    self.gatewayDetailRow(label: "Address", value: self.gatewayAddress)
+                    Divider()
+                    self.gatewayDetailRow(label: "Server", value: self.gatewayServer)
+                    Divider()
+                    self.gatewayDetailRow(label: "Agents", value: "\(self.appModel.gatewayAgents.count)")
+                    Divider()
+                    self.gatewayActions
+                        .padding(14)
+                }
+            }
+            .padding(.horizontal, OpenClawProMetric.pagePadding)
+        }
+    }
+
+    var gatewayConnectionRow: some View {
+        HStack(spacing: 12) {
+            ProIconBadge(
+                systemName: "antenna.radiowaves.left.and.right",
+                color: self.gatewayConnected ? OpenClawBrand.ok : .secondary)
+
+            VStack(alignment: .leading, spacing: 3) {
+                Text("Connection")
+                    .font(.subheadline.weight(.semibold))
+                Text(self.gatewayConnected ? "Connected" : self.appModel.gatewayDisplayStatusText)
+                    .font(.caption)
+                    .foregroundStyle(self.gatewayConnected ? OpenClawBrand.ok : .secondary)
+            }
+
+            Spacer(minLength: 8)
+
+            Image(systemName: "chevron.right")
+                .font(.caption.weight(.semibold))
+                .foregroundStyle(.secondary)
+        }
+    }
+
+    func gatewayDetailRow(label: String, value: String) -> some View {
+        HStack {
+            Text(label)
+                .font(.caption)
+                .foregroundStyle(.secondary)
+            Spacer(minLength: 8)
+            Text(value)
+                .font(.caption)
+                .foregroundStyle(.secondary)
+                .lineLimit(1)
+                .truncationMode(.middle)
+        }
+        .padding(.horizontal, 14)
+        .frame(height: 40)
+    }
+
+    var gatewayActions: some View {
+        HStack(spacing: 10) {
+            self.gatewayActionButton(
+                title: "Reconnect",
+                icon: "arrow.triangle.2.circlepath",
+                color: OpenClawBrand.warn,
+                isBusy: self.isReconnectingGateway)
+            {
+                Task { await self.reconnectGateway() }
+            }
+
+            self.gatewayActionButton(
+                title: "Diagnose",
+                icon: "cross.case",
+                color: Color(red: 0 / 255.0, green: 122 / 255.0, blue: 255 / 255.0),
+                isBusy: self.isRefreshingGateway)
+            {
+                Task { await self.runDiagnostics() }
+            }
+        }
+    }
+
+    var settingsListSection: some View {
+        VStack(spacing: 10) {
+            self.settingsListRow(
+                icon: "person.2",
+                title: "Permissions",
+                detail: self.permissionsDetail,
+                route: .permissions)
+            self.settingsListRow(
+                icon: "waveform",
+                title: "Voice & Talk",
+                detail: self.voiceDetail,
+                route: .voice)
+            self.settingsListRow(
+                icon: "globe",
+                title: "Diagnostics",
+                detail: self.diagnosticsDetail,
+                route: .diagnostics)
+            self.settingsListRow(
+                icon: "hand.raised",
+                title: "Privacy",
+                detail: self.privacyDetail,
+                route: .privacy)
+            self.settingsListRow(
+                icon: "bell",
+                title: "Notifications",
+                detail: self.notificationStatusText,
+                route: .notifications)
+            self.settingsListRow(
+                icon: "info.circle",
+                title: "About",
+                detail: DeviceInfoHelper.openClawVersionString(),
+                route: .about)
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+
+    func settingsListRow(
+        icon: String,
+        title: String,
+        detail: String,
+        route: SettingsRoute) -> some View
+    {
+        NavigationLink(value: route) {
+            HStack(spacing: 12) {
+                ProIconBadge(systemName: icon, color: .secondary)
+                VStack(alignment: .leading, spacing: 2) {
+                    Text(title)
+                        .font(.subheadline.weight(.semibold))
+                    Text(detail)
+                        .font(.caption2)
+                        .foregroundStyle(.secondary)
+                        .lineLimit(1)
+                }
+                Spacer(minLength: 8)
+                Image(systemName: "chevron.right")
+                    .font(.caption.weight(.semibold))
+                    .foregroundStyle(.secondary)
+            }
+            .padding(12)
+            .frame(maxWidth: .infinity, minHeight: SettingsLayout.rowHeight, alignment: .leading)
+            .proPanelSurface(radius: SettingsLayout.cardRadius)
+        }
+        .buttonStyle(.plain)
+    }
+
+    func destination(for route: SettingsRoute) -> some View {
+        ZStack {
+            OpenClawProBackground()
+            ScrollView {
+                VStack(alignment: .leading, spacing: 14) {
+                    switch route {
+                    case .gateway:
+                        self.gatewayDestination
+                    case .permissions:
+                        self.permissionsDestination
+                    case .voice:
+                        self.voiceDestination
+                    case .diagnostics:
+                        self.diagnosticsDestination
+                    case .privacy:
+                        self.privacyDestination
+                    case .notifications:
+                        self.notificationsDestination
+                    case .about:
+                        self.aboutDestination
+                    }
+                }
+                .padding(.vertical, 18)
+            }
+            .safeAreaPadding(.bottom, OpenClawProMetric.bottomScrollInset)
+        }
+        .navigationTitle(self.title(for: route))
+        .navigationBarTitleDisplayMode(.inline)
+    }
+
+    var gatewayDestination: some View {
+        VStack(alignment: .leading, spacing: 14) {
+            if let gatewayProblem = self.appModel.lastGatewayProblem {
+                self.gatewayProblemCard(gatewayProblem)
+            }
+
+            self.detailStatusCard(
+                icon: "antenna.radiowaves.left.and.right",
+                title: "Gateway",
+                detail: self.gatewayConnected ? "Connected" : self.appModel.gatewayDisplayStatusText,
+                value: self.gatewayConnected ? "online" : "offline",
+                color: self.gatewayConnected ? OpenClawBrand.ok : .secondary)
+
+            self.detailListCard {
+                self.detailRow("Address", value: self.gatewayAddress)
+                Divider()
+                self.detailRow("Server", value: self.gatewayServer)
+                Divider()
+                self.detailRow("Discovered", value: "\(self.gatewayController.gateways.count)")
+                Divider()
+                self.detailRow("Active Agent", value: self.appModel.activeAgentName)
+                Divider()
+                self.detailRow("Agents", value: "\(self.appModel.gatewayAgents.count)")
+            }
+
+            ProCard(radius: SettingsLayout.cardRadius) {
+                self.gatewayActions
+            }
+            .padding(.horizontal, OpenClawProMetric.pagePadding)
+
+            self.deviceIdentityCard
+            self.agentSelectionCard
+            self.gatewaySetupCard
+            self.discoveredGatewaysCard
+            self.manualGatewayCard
+            self.gatewayAdvancedCard
+        }
+    }
+
+    var permissionsDestination: some View {
+        VStack(alignment: .leading, spacing: 14) {
+            self.toggleCard(
+                icon: "camera",
+                title: "Camera",
+                detail: "Allow the gateway to request photos or video while OpenClaw is foregrounded.",
+                isOn: self.$cameraEnabled)
+
+            self.locationModeCard
+
+            self.toggleCard(
+                icon: "lock.display",
+                title: "Keep Awake",
+                detail: "Keep the screen awake while OpenClaw is open.",
+                isOn: self.$preventSleep)
+
+            self.privacyAccessCard
+        }
+    }
+
+    var voiceDestination: some View {
+        VStack(alignment: .leading, spacing: 14) {
+            self.detailStatusCard(
+                icon: "waveform",
+                title: "Voice & Talk",
+                detail: self.appModel.talkMode.gatewayTalkVoiceModeTitle,
+                value: self.voiceDetail,
+                color: self.talkEnabled || self.voiceWakeEnabled ? OpenClawBrand.accent : .secondary)
+
+            self.voiceFeatureCard
+            self.talkVoiceSettingsCard
+            self.shareSettingsCard
+        }
+    }
+
+    var diagnosticsDestination: some View {
+        VStack(alignment: .leading, spacing: 14) {
+            self.detailStatusCard(
+                icon: "checklist.checked",
+                title: "Health Check",
+                detail: "Run app, permission, and gateway-adjacent checks without editing setup.",
+                value: self.diagnosticsHealthValue,
+                color: self.gatewayConnected ? OpenClawBrand.ok : OpenClawBrand.warn)
+
+            self.diagnosticChecksCard
+
+            self.detailListCard {
+                self.detailRow("Device", value: DeviceInfoHelper.deviceFamily())
+                Divider()
+                self.detailRow("Platform", value: DeviceInfoHelper.platformStringForDisplay())
+                Divider()
+                self.detailRow("App", value: DeviceInfoHelper.openClawVersionString())
+                Divider()
+                self.detailRow("Model", value: DeviceInfoHelper.modelIdentifier())
+            }
+
+            ProCard(radius: SettingsLayout.cardRadius) {
+                self.gatewayActionButton(
+                    title: "Run Diagnostics",
+                    icon: "cross.case",
+                    color: Color(red: 0 / 255.0, green: 122 / 255.0, blue: 255 / 255.0),
+                    isBusy: self.isRefreshingGateway)
+                {
+                    Task { await self.runDiagnostics() }
+                }
+            }
+            .padding(.horizontal, OpenClawProMetric.pagePadding)
+
+            self.diagnosticsAdvancedCard
+        }
+    }
+
+    var privacyDestination: some View {
+        VStack(alignment: .leading, spacing: 14) {
+            self.detailStatusCard(
+                icon: "hand.raised",
+                title: "Privacy",
+                detail: "Control what device context OpenClaw can expose to the gateway.",
+                value: self.privacyDetail,
+                color: .secondary)
+
+            self.toggleCard(
+                icon: "camera",
+                title: "Camera Access",
+                detail: "Disable to block camera capture requests from the gateway.",
+                isOn: self.$cameraEnabled)
+
+            self.locationModeCard
+
+            self.toggleCard(
+                icon: "lock.open.display",
+                title: "Background Listening",
+                detail: "Allow active Talk sessions to continue while the app is backgrounded.",
+                isOn: self.$talkBackgroundEnabled)
+
+            self.privacyAccessCard
+        }
+    }
+
+    var notificationsDestination: some View {
+        VStack(alignment: .leading, spacing: 14) {
+            self.detailStatusCard(
+                icon: "bell",
+                title: "Notifications",
+                detail: "Approvals and event alerts from OpenClaw.",
+                value: self.notificationStatusText,
+                color: self.notificationStatusText == "Allowed" ? OpenClawBrand.ok : .secondary)
+
+            ProCard(radius: SettingsLayout.cardRadius) {
+                VStack(alignment: .leading, spacing: 12) {
+                    Button {
+                        self.handleNotificationAction()
+                    } label: {
+                        Label(
+                            self.notificationActionText,
+                            systemImage: self.notificationStatusText == "Allowed" ? "gear" : "bell.badge")
+                            .frame(maxWidth: .infinity)
+                    }
+                    .buttonStyle(.borderedProminent)
+                    .controlSize(.small)
+
+                    Text("OpenClaw uses notifications for approval prompts and mirrored event alerts.")
+                        .font(.caption)
+                        .foregroundStyle(.secondary)
+                }
+            }
+            .padding(.horizontal, OpenClawProMetric.pagePadding)
+        }
+    }
+
+    var aboutDestination: some View {
+        VStack(alignment: .leading, spacing: 14) {
+            self.detailStatusCard(
+                icon: "info.circle",
+                title: "OpenClaw",
+                detail: "iOS companion app",
+                value: DeviceInfoHelper.openClawVersionString(),
+                color: OpenClawBrand.accent)
+
+            self.detailListCard {
+                self.detailRow("Version", value: DeviceInfoHelper.openClawVersionString())
+                Divider()
+                self.detailRow("Device", value: DeviceInfoHelper.deviceFamily())
+                Divider()
+                self.detailRow("Platform", value: DeviceInfoHelper.platformStringForDisplay())
+                Divider()
+                self.detailRow("Model", value: DeviceInfoHelper.modelIdentifier())
+            }
+        }
+    }
+
+    func gatewayActionButton(
+        title: String,
+        icon: String,
+        color: Color,
+        isBusy: Bool,
+        action: @escaping () -> Void) -> some View
+    {
+        Button(action: action) {
+            HStack(spacing: 7) {
+                Image(systemName: isBusy ? "hourglass" : icon)
+                    .font(.caption.weight(.semibold))
+                Text(title)
+                    .font(.caption.weight(.semibold))
+                    .lineLimit(1)
+                    .minimumScaleFactor(0.76)
+            }
+            .frame(maxWidth: .infinity)
+            .frame(height: 34)
+            .foregroundStyle(color)
+            .background(color.opacity(0.09), in: RoundedRectangle(cornerRadius: 8, style: .continuous))
+            .overlay {
+                RoundedRectangle(cornerRadius: 8, style: .continuous)
+                    .strokeBorder(color.opacity(0.14))
+            }
+        }
+        .buttonStyle(.plain)
+        .disabled(isBusy)
+    }
+
+    func toggleCard(
+        icon: String,
+        title: String,
+        detail: String,
+        isOn: Binding<Bool>) -> some View
+    {
+        ProCard(radius: SettingsLayout.cardRadius) {
+            Toggle(isOn: isOn) {
+                HStack(spacing: 12) {
+                    ProIconBadge(systemName: icon, color: isOn.wrappedValue ? OpenClawBrand.accent : .secondary)
+                    VStack(alignment: .leading, spacing: 3) {
+                        Text(title)
+                            .font(.subheadline.weight(.semibold))
+                        Text(detail)
+                            .font(.caption)
+                            .foregroundStyle(.secondary)
+                            .lineLimit(2)
+                    }
+                }
+            }
+            .toggleStyle(.switch)
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+
+    var locationModeCard: some View {
+        ProCard(radius: SettingsLayout.cardRadius) {
+            VStack(alignment: .leading, spacing: 12) {
+                HStack(spacing: 12) {
+                    ProIconBadge(
+                        systemName: "location",
+                        color: self.locationModeRaw == OpenClawLocationMode.off.rawValue ? .secondary : OpenClawBrand
+                            .accent)
+                    VStack(alignment: .leading, spacing: 3) {
+                        Text("Location")
+                            .font(.subheadline.weight(.semibold))
+                        Text("Controls whether location can be shared with gateway tools.")
+                            .font(.caption)
+                            .foregroundStyle(.secondary)
+                            .lineLimit(2)
+                    }
+                    Spacer(minLength: 8)
+                    if self.isChangingLocationMode {
+                        ProgressView()
+                            .controlSize(.small)
+                    }
+                }
+
+                Picker("Location", selection: self.$locationModeRaw) {
+                    Text("Off").tag(OpenClawLocationMode.off.rawValue)
+                    Text("While Using").tag(OpenClawLocationMode.whileUsing.rawValue)
+                    Text("Always").tag(OpenClawLocationMode.always.rawValue)
+                }
+                .pickerStyle(.segmented)
+                .disabled(self.isChangingLocationMode)
+
+                if let locationStatusText {
+                    Text(locationStatusText)
+                        .font(.caption2)
+                        .foregroundStyle(OpenClawBrand.warn)
+                }
+            }
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+
+    var agentSelectionCard: some View {
+        ProCard(radius: SettingsLayout.cardRadius) {
+            VStack(alignment: .leading, spacing: 10) {
+                Text("Active Agent")
+                    .font(.subheadline.weight(.semibold))
+                Picker("Agent", selection: self.$selectedAgentPickerId) {
+                    Text("Default").tag("")
+                    let defaultId = (self.appModel.gatewayDefaultAgentId ?? "")
+                        .trimmingCharacters(in: .whitespacesAndNewlines)
+                    ForEach(self.appModel.gatewayAgents.filter { $0.id != defaultId }, id: \.id) { agent in
+                        let name = (agent.name ?? "").trimmingCharacters(in: .whitespacesAndNewlines)
+                        Text(name.isEmpty ? agent.id : name).tag(agent.id)
+                    }
+                }
+                Text("Controls which agent Chat and Talk use.")
+                    .font(.caption)
+                    .foregroundStyle(.secondary)
+            }
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+
+    var gatewaySetupCard: some View {
+        ProCard(radius: SettingsLayout.cardRadius) {
+            VStack(alignment: .leading, spacing: 12) {
+                Text("Setup Code")
+                    .font(.subheadline.weight(.semibold))
+                TextField("Paste setup code", text: self.$setupCode)
+                    .textInputAutocapitalization(.never)
+                    .autocorrectionDisabled()
+                    .textFieldStyle(.roundedBorder)
+                HStack(spacing: 10) {
+                    self.gatewayActionButton(
+                        title: "Scan QR",
+                        icon: "qrcode.viewfinder",
+                        color: OpenClawBrand.accent,
+                        isBusy: self.connectingGatewayID != nil)
+                    {
+                        self.openGatewayQRScanner()
+                    }
+                    self.gatewayActionButton(
+                        title: "Connect",
+                        icon: "bolt.horizontal.circle",
+                        color: OpenClawBrand.ok,
+                        isBusy: self.connectingGatewayID == "manual")
+                    {
+                        Task { await self.applySetupCodeAndConnect() }
+                    }
+                    .disabled(self.setupCode.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty)
+                }
+                if let status = self.setupStatusLine {
+                    Text(status)
+                        .font(.caption)
+                        .foregroundStyle(.secondary)
+                        .textSelection(.enabled)
+                }
+                if let warning = self.tailnetWarningText {
+                    Text(warning)
+                        .font(.caption.weight(.semibold))
+                        .foregroundStyle(OpenClawBrand.warn)
+                }
+            }
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+
+    var discoveredGatewaysCard: some View {
+        ProCard(radius: SettingsLayout.cardRadius) {
+            VStack(alignment: .leading, spacing: 12) {
+                Text("Discovered Gateways")
+                    .font(.subheadline.weight(.semibold))
+                if self.gatewayController.gateways.isEmpty {
+                    Text("No gateways found yet. Use manual setup if Bonjour is blocked.")
+                        .font(.caption)
+                        .foregroundStyle(.secondary)
+                } else {
+                    ForEach(self.gatewayController.gateways) { gateway in
+                        self.discoveredGatewayRow(gateway)
+                        if gateway.id != self.gatewayController.gateways.last?.id {
+                            Divider()
+                        }
+                    }
+                }
+            }
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+
+    func discoveredGatewayRow(_ gateway: GatewayDiscoveryModel.DiscoveredGateway) -> some View {
+        HStack(spacing: 12) {
+            VStack(alignment: .leading, spacing: 3) {
+                Text(verbatim: gateway.name)
+                    .font(.subheadline.weight(.semibold))
+                Text(verbatim: self.gatewayDetailLines(gateway).joined(separator: " • "))
+                    .font(.caption)
+                    .foregroundStyle(.secondary)
+                    .lineLimit(2)
+            }
+            Spacer(minLength: 8)
+            Button {
+                Task { await self.connect(gateway) }
+            } label: {
+                if self.connectingGatewayID == gateway.id {
+                    ProgressView().controlSize(.small)
+                } else {
+                    Text("Connect")
+                }
+            }
+            .buttonStyle(.bordered)
+            .disabled(self.connectingGatewayID != nil)
+        }
+    }
+
+    var manualGatewayCard: some View {
+        ProCard(radius: SettingsLayout.cardRadius) {
+            VStack(alignment: .leading, spacing: 12) {
+                Toggle("Use Manual Gateway", isOn: self.$manualGatewayEnabled)
+                TextField("Host", text: self.$manualGatewayHost)
+                    .textInputAutocapitalization(.never)
+                    .autocorrectionDisabled()
+                    .textFieldStyle(.roundedBorder)
+                TextField("Port", text: self.manualPortBinding)
+                    .keyboardType(.numberPad)
+                    .textFieldStyle(.roundedBorder)
+                Toggle("Use TLS", isOn: self.$manualGatewayTLS)
+                self.gatewayActionButton(
+                    title: "Connect Manual",
+                    icon: "network",
+                    color: OpenClawBrand.accent,
+                    isBusy: self.connectingGatewayID == "manual")
+                {
+                    Task { await self.connectManual() }
+                }
+                .disabled(self.manualGatewayHost.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty
+                    || !self.manualPortIsValid)
+            }
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+
+    var gatewayAdvancedCard: some View {
+        ProCard(radius: SettingsLayout.cardRadius) {
+            VStack(alignment: .leading, spacing: 12) {
+                Toggle("Auto-connect on launch", isOn: self.$gatewayAutoConnect)
+                SecureField("Gateway Auth Token", text: self.$gatewayToken)
+                    .textInputAutocapitalization(.never)
+                    .autocorrectionDisabled()
+                    .textFieldStyle(.roundedBorder)
+                SecureField("Gateway Password", text: self.$gatewayPassword)
+                    .textFieldStyle(.roundedBorder)
+                Button("Reset Onboarding", role: .destructive) {
+                    self.showResetOnboardingAlert = true
+                }
+            }
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+
+    var voiceFeatureCard: some View {
+        ProCard(radius: SettingsLayout.cardRadius) {
+            VStack(alignment: .leading, spacing: 12) {
+                self.settingsToggle("Voice Wake", isOn: self.$voiceWakeEnabled) { enabled in
+                    self.appModel.setVoiceWakeEnabled(enabled)
+                }
+                self.settingsToggle("Talk Mode", isOn: self.$talkEnabled) { enabled in
+                    self.appModel.setTalkEnabled(enabled)
+                }
+                Picker("Speech Language", selection: self.$talkSpeechLocale) {
+                    ForEach(TalkSpeechLocale.supportedOptions()) { option in
+                        Text(option.label).tag(option.id)
+                    }
+                }
+                self.settingsToggle("Background Listening", isOn: self.$talkBackgroundEnabled)
+                self.settingsToggle("Speakerphone", isOn: self.talkSpeakerphoneBinding)
+                NavigationLink {
+                    VoiceWakeWordsSettingsView()
+                } label: {
+                    self.simpleSettingsRow(
+                        title: "Wake Words",
+                        value: VoiceWakePreferences.displayString(for: self.voiceWake.triggerWords))
+                }
+            }
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+
+    var talkVoiceSettingsCard: some View {
+        ProCard(radius: SettingsLayout.cardRadius) {
+            VStack(alignment: .leading, spacing: 12) {
+                Picker("Provider", selection: self.talkProviderSelectionBinding) {
+                    ForEach(TalkModeProviderSelection.allCases) { option in
+                        Text(option.label).tag(option.rawValue)
+                    }
+                }
+                if self.shouldShowRealtimeVoicePicker {
+                    Picker("Realtime Voice", selection: self.talkRealtimeVoiceSelectionBinding) {
+                        Text("Gateway Default").tag("")
+                        ForEach(TalkModeRealtimeVoiceSelection.voices, id: \.self) { voice in
+                            Text(TalkModeRealtimeVoiceSelection.label(for: voice)).tag(voice)
+                        }
+                    }
+                }
+                self.detailRow("Voice Mode", value: self.appModel.talkMode.gatewayTalkVoiceModeTitle)
+                Divider()
+                self.detailRow("Transport", value: self.appModel.talkMode.gatewayTalkTransportLabel)
+                Divider()
+                self.detailRow("API Key", value: self.talkApiKeyStatus)
+            }
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+
+    var shareSettingsCard: some View {
+        ProCard(radius: SettingsLayout.cardRadius) {
+            VStack(alignment: .leading, spacing: 12) {
+                Toggle("Show Talk Control", isOn: self.$talkButtonEnabled)
+                TextField("Default Share Instruction", text: self.$defaultShareInstruction, axis: .vertical)
+                    .lineLimit(2...5)
+                    .textInputAutocapitalization(.sentences)
+                    .textFieldStyle(.roundedBorder)
+                Button {
+                    Task { await self.appModel.runSharePipelineSelfTest() }
+                } label: {
+                    Label("Run Share Self-Test", systemImage: "checkmark.seal")
+                }
+                .buttonStyle(.bordered)
+                Text(self.appModel.lastShareEventText)
+                    .font(.caption)
+                    .foregroundStyle(.secondary)
+            }
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+
+    var privacyAccessCard: some View {
+        ProCard(radius: SettingsLayout.cardRadius) {
+            PrivacyAccessSectionView()
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+
+    var diagnosticsAdvancedCard: some View {
+        ProCard(radius: SettingsLayout.cardRadius) {
+            VStack(alignment: .leading, spacing: 12) {
+                Toggle("Discovery Debug Logs", isOn: self.$discoveryDebugLogsEnabled)
+                    .onChange(of: self.discoveryDebugLogsEnabled) { _, enabled in
+                        self.gatewayController.setDiscoveryDebugLoggingEnabled(enabled)
+                    }
+                Toggle("Debug Screen Status", isOn: self.$canvasDebugStatusEnabled)
+                NavigationLink {
+                    GatewayDiscoveryDebugLogView()
+                } label: {
+                    self.simpleSettingsRow(title: "Discovery Logs", value: self.gatewayController.discoveryStatusText)
+                }
+            }
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+
+    var deviceIdentityCard: some View {
+        ProCard(radius: SettingsLayout.cardRadius) {
+            VStack(alignment: .leading, spacing: 12) {
+                TextField("Device Name", text: self.$displayName)
+                    .textFieldStyle(.roundedBorder)
+                self.detailRow("Instance ID", value: self.instanceId)
+            }
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+
+    func gatewayProblemCard(_ problem: GatewayConnectionProblem) -> some View {
+        ProCard(radius: SettingsLayout.cardRadius) {
+            GatewayProblemBanner(
+                problem: problem,
+                primaryActionTitle: self.gatewayProblemPrimaryActionTitle(problem),
+                onPrimaryAction: {
+                    Task { await self.handleGatewayProblemPrimaryAction(problem) }
+                },
+                onShowDetails: {
+                    self.showGatewayProblemDetails = true
+                })
+        }
+        .padding(.horizontal, OpenClawProMetric.pagePadding)
+    }
+
+    func settingsToggle(
+        _ title: String,
+        isOn: Binding<Bool>,
+        onChange: ((Bool) -> Void)? = nil) -> some View
+    {
+        Toggle(title, isOn: isOn)
+            .onChange(of: isOn.wrappedValue) { _, enabled in
+                onChange?(enabled)
+            }
+    }
+
+    func simpleSettingsRow(title: String, value: String) -> some View {
+        HStack {
+            Text(title)
+            Spacer(minLength: 8)
+            Text(value)
+                .foregroundStyle(.secondary)
+                .lineLimit(1)
+                .truncationMode(.middle)
+            Image(systemName: "chevron.right")
+                .font(.caption.weight(.semibold))
+                .foregroundStyle(.secondary)
+        }
+        .font(.subheadline)
+    }
+}

apps/ios/Sources/Design/SettingsProTabSupport.swift

@@ -0,0 +1,105 @@
+import Darwin
+import SwiftUI
+
+enum SettingsRoute: Hashable {
+    case gateway
+    case permissions
+    case voice
+    case diagnostics
+    case privacy
+    case notifications
+    case about
+}
+
+enum SettingsLayout {
+    static let cardRadius: CGFloat = 12
+    static let rowHeight: CGFloat = 58
+}
+
+enum SettingsDiagnosticIssue: String, Equatable, CaseIterable {
+    case gatewayOffline
+    case discoveryUnavailable
+    case talkConfigMissing
+    case notificationsUnavailable
+}
+
+enum SettingsDiagnostics {
+    static func issues(
+        gatewayConnected: Bool,
+        discoveredGatewayCount: Int,
+        talkConfigLoaded: Bool,
+        notificationStatusText: String) -> [SettingsDiagnosticIssue]
+    {
+        var issues: [SettingsDiagnosticIssue] = []
+        if !gatewayConnected { issues.append(.gatewayOffline) }
+        if discoveredGatewayCount == 0 { issues.append(.discoveryUnavailable) }
+        if gatewayConnected, !talkConfigLoaded { issues.append(.talkConfigMissing) }
+        if notificationStatusText != "Allowed" { issues.append(.notificationsUnavailable) }
+        return issues
+    }
+
+    static func issueCount(
+        gatewayConnected: Bool,
+        discoveredGatewayCount: Int,
+        talkConfigLoaded: Bool,
+        notificationStatusText: String) -> Int
+    {
+        self.issues(
+            gatewayConnected: gatewayConnected,
+            discoveredGatewayCount: discoveredGatewayCount,
+            talkConfigLoaded: talkConfigLoaded,
+            notificationStatusText: notificationStatusText).count
+    }
+
+    static func timestamp(_ date: Date) -> String {
+        date.formatted(date: .omitted, time: .shortened)
+    }
+}
+
+extension SettingsProTab {
+    static func hasTailnetIPv4() -> Bool {
+        var addrList: UnsafeMutablePointer<ifaddrs>?
+        guard getifaddrs(&addrList) == 0, let first = addrList else { return false }
+        defer { freeifaddrs(addrList) }
+        for ptr in sequence(first: first, next: { $0.pointee.ifa_next }) {
+            let flags = Int32(ptr.pointee.ifa_flags)
+            let isUp = (flags & IFF_UP) != 0
+            let isLoopback = (flags & IFF_LOOPBACK) != 0
+            guard let addrPtr = ptr.pointee.ifa_addr else { continue }
+            let family = addrPtr.pointee.sa_family
+            if !isUp || isLoopback || family != UInt8(AF_INET) { continue }
+            var addr = addrPtr.pointee
+            var buffer = [CChar](repeating: 0, count: Int(NI_MAXHOST))
+            let result = getnameinfo(
+                &addr,
+                socklen_t(addrPtr.pointee.sa_len),
+                &buffer,
+                socklen_t(buffer.count),
+                nil,
+                0,
+                NI_NUMERICHOST)
+            guard result == 0 else { continue }
+            let bytes = buffer.prefix { $0 != 0 }.map { UInt8(bitPattern: $0) }
+            guard let ip = String(bytes: bytes, encoding: .utf8) else { continue }
+            if self.isTailnetIPv4(ip) { return true }
+        }
+        return false
+    }
+
+    static func isTailnetHostOrIP(_ host: String) -> Bool {
+        let trimmed = host.trimmingCharacters(in: .whitespacesAndNewlines).lowercased()
+        if trimmed.hasSuffix(".ts.net") || trimmed.hasSuffix(".ts.net.") { return true }
+        return self.isTailnetIPv4(trimmed)
+    }
+
+    static func isTailnetIPv4(_ ip: String) -> Bool {
+        let parts = ip.split(separator: ".")
+        guard parts.count == 4 else { return false }
+        let octets = parts.compactMap { Int($0) }
+        guard octets.count == 4 else { return false }
+        let a = octets[0]
+        let b = octets[1]
+        guard (0...255).contains(a), (0...255).contains(b) else { return false }
+        return a == 100 && b >= 64 && b <= 127
+    }
+}

apps/ios/Sources/Gateway/ExecApprovalPromptDialog.swift

@@ -2,7 +2,6 @@ import SwiftUI
 
 private struct ExecApprovalPromptDialogModifier: ViewModifier {
     @Environment(NodeAppModel.self) private var appModel: NodeAppModel
-    @Environment(\.colorScheme) private var colorScheme
 
     func body(content: Content) -> some View {
         content
@@ -16,7 +15,6 @@ private struct ExecApprovalPromptDialogModifier: ViewModifier {
                             prompt: prompt,
                             isResolving: self.appModel.pendingExecApprovalPromptResolving,
                             errorText: self.appModel.pendingExecApprovalPromptErrorText,
-                            brighten: self.colorScheme == .light,
                             onAllowOnce: {
                                 Task {
                                     await self.appModel.resolvePendingExecApprovalPrompt(decision: "allow-once")
@@ -50,7 +48,6 @@ private struct ExecApprovalPromptCard: View {
     let prompt: NodeAppModel.ExecApprovalPrompt
     let isResolving: Bool
     let errorText: String?
-    let brighten: Bool
     let onAllowOnce: () -> Void
     let onAllowAlways: () -> Void
     let onDeny: () -> Void
@@ -147,7 +144,8 @@ private struct ExecApprovalPromptCard: View {
             .controlSize(.large)
             .frame(maxWidth: .infinity)
         }
-        .statusGlassCard(brighten: self.brighten, verticalPadding: 18, horizontalPadding: 18)
+        .padding(18)
+        .proPanelSurface(tint: OpenClawBrand.accentHot, radius: 20, isProminent: true)
     }
 
     private func normalized(_ value: String?) -> String? {

apps/ios/Sources/Gateway/GatewayConnectConfig.swift

@@ -25,4 +25,53 @@ struct GatewayConnectConfig {
         if trimmed.isEmpty { return self.url.absoluteString }
         return trimmed
     }
+
+    func hasSameConnectionInputs(as other: GatewayConnectConfig) -> Bool {
+        self.url == other.url &&
+            self.stableID == other.stableID &&
+            Self.sameTLS(self.tls, other.tls) &&
+            self.token == other.token &&
+            self.bootstrapToken == other.bootstrapToken &&
+            self.password == other.password &&
+            Self.sameOptions(self.nodeOptions, other.nodeOptions)
+    }
+
+    private static func sameTLS(_ lhs: GatewayTLSParams?, _ rhs: GatewayTLSParams?) -> Bool {
+        switch (lhs, rhs) {
+        case (nil, nil):
+            true
+        case let (lhs?, rhs?):
+            lhs.required == rhs.required &&
+                lhs.expectedFingerprint == rhs.expectedFingerprint &&
+                lhs.allowTOFU == rhs.allowTOFU &&
+                lhs.storeKey == rhs.storeKey
+        default:
+            false
+        }
+    }
+
+    private static func sameOptions(_ lhs: GatewayConnectOptions, _ rhs: GatewayConnectOptions) -> Bool {
+        let lhsScopes = Self.normalizedValues(lhs.scopes)
+        let rhsScopes = Self.normalizedValues(rhs.scopes)
+        let lhsCaps = Self.normalizedValues(lhs.caps)
+        let rhsCaps = Self.normalizedValues(rhs.caps)
+        let lhsCommands = Self.normalizedValues(lhs.commands)
+        let rhsCommands = Self.normalizedValues(rhs.commands)
+        return lhs.role == rhs.role &&
+            lhs.scopesAreExplicit == rhs.scopesAreExplicit &&
+            lhs.clientId == rhs.clientId &&
+            lhs.clientMode == rhs.clientMode &&
+            lhs.clientDisplayName == rhs.clientDisplayName &&
+            lhs.includeDeviceIdentity == rhs.includeDeviceIdentity &&
+            lhsScopes == rhsScopes &&
+            lhsCaps == rhsCaps &&
+            lhsCommands == rhsCommands &&
+            lhs.permissions == rhs.permissions
+    }
+
+    private static func normalizedValues(_ values: [String]) -> [String] {
+        values.map { $0.trimmingCharacters(in: .whitespacesAndNewlines) }
+            .filter { !$0.isEmpty }
+            .sorted()
+    }
 }

apps/ios/Sources/Gateway/GatewayConnectionController.swift

@@ -131,6 +131,12 @@ final class GatewayConnectionController {
     private var pendingServiceResolvers: [String: GatewayServiceResolver] = [:]
     private var pendingTrustConnect: PendingTrustConnect?
 
+    private struct SavedManualEndpoint: Equatable {
+        let host: String
+        let port: Int
+        let useTLS: Bool
+    }
+
     init(appModel: NodeAppModel, startDiscovery: Bool = true) {
         self.appModel = appModel
 
@@ -181,7 +187,8 @@ final class GatewayConnectionController {
     }
 
     private func connectDiscoveredGateway(
-        _ gateway: GatewayDiscoveryModel.DiscoveredGateway) async -> String?
+        _ gateway: GatewayDiscoveryModel.DiscoveredGateway,
+        forceReconnect: Bool = false) async -> String?
     {
         let instanceId = UserDefaults.standard.string(forKey: "node.instanceId")?
             .trimmingCharacters(in: .whitespacesAndNewlines) ?? ""
@@ -245,7 +252,8 @@ final class GatewayConnectionController {
             tls: tlsParams,
             token: token,
             bootstrapToken: bootstrapToken,
-            password: password)
+            password: password,
+            forceReconnect: forceReconnect)
         return nil
     }
 
@@ -257,7 +265,8 @@ final class GatewayConnectionController {
         host: String,
         port: Int,
         useTLS: Bool,
-        authOverride: ManualAuthOverride? = nil) async
+        authOverride: ManualAuthOverride? = nil,
+        forceReconnect: Bool = false) async
     {
         let instanceId = GatewaySettingsStore.currentInstanceID()
         let token =
@@ -319,27 +328,38 @@ final class GatewayConnectionController {
             tls: tlsParams,
             token: token,
             bootstrapToken: bootstrapToken,
-            password: password)
+            password: password,
+            forceReconnect: forceReconnect)
     }
 
     func connectLastKnown() async {
         guard let last = GatewaySettingsStore.loadLastGatewayConnection() else { return }
         switch last {
         case let .manual(host, port, useTLS, _):
-            await self.connectManual(host: host, port: port, useTLS: useTLS)
+            await self.connectManual(host: host, port: port, useTLS: useTLS, forceReconnect: true)
         case let .discovered(stableID, _):
-            guard let gateway = self.gateways.first(where: { $0.stableID == stableID }) else { return }
-            _ = await self.connectDiscoveredGateway(gateway)
+            guard let gateway = self.gateways.first(where: { $0.stableID == stableID }) else {
+                _ = await self.connectSavedManualEndpointFallback()
+                return
+            }
+            _ = await self.connectDiscoveredGateway(gateway, forceReconnect: true)
         }
     }
 
     /// Rebuild connect options from current local settings (caps/commands/permissions)
     /// and re-apply the active gateway config so capability changes take effect immediately.
     func refreshActiveGatewayRegistrationFromSettings() {
+        Task { [weak self] in
+            await self?.refreshActiveGatewayRegistrationFromSettingsAsync()
+        }
+    }
+
+    private func refreshActiveGatewayRegistrationFromSettingsAsync() async {
         guard let appModel else { return }
         guard let cfg = appModel.activeGatewayConnectConfig else { return }
         guard appModel.gatewayAutoReconnectEnabled else { return }
 
+        let nodeOptions = await self.makeConnectOptions(stableID: cfg.stableID)
         let refreshedConfig = GatewayConnectConfig(
             url: cfg.url,
             stableID: cfg.stableID,
@@ -347,7 +367,7 @@ final class GatewayConnectionController {
             token: cfg.token,
             bootstrapToken: cfg.bootstrapToken,
             password: cfg.password,
-            nodeOptions: self.makeConnectOptions(stableID: cfg.stableID))
+            nodeOptions: nodeOptions)
         appModel.applyGatewayConnectConfig(refreshedConfig)
     }
 
@@ -522,32 +542,14 @@ final class GatewayConnectionController {
             return
         }
 
-        if let lastKnown = GatewaySettingsStore.loadLastGatewayConnection() {
-            if case let .manual(host, port, useTLS, stableID) = lastKnown {
-                let resolvedUseTLS = self.resolveManualUseTLS(host: host, useTLS: useTLS)
-                let stored = GatewayTLSStore.loadFingerprint(stableID: stableID)
-                let tlsParams = stored.map { fp in
-                    GatewayTLSParams(required: true, expectedFingerprint: fp, allowTOFU: false, storeKey: stableID)
-                }
-                guard let url = self.buildGatewayURL(
-                    host: host,
-                    port: port,
-                    useTLS: resolvedUseTLS && tlsParams != nil)
-                else { return }
-
-                // Security: autoconnect only to previously trusted gateways (stored TLS pin).
-                guard tlsParams != nil else { return }
-
-                self.didAutoConnect = true
-                self.startAutoConnect(
-                    url: url,
-                    gatewayStableID: stableID,
-                    tls: tlsParams,
-                    token: token,
-                    bootstrapToken: bootstrapToken,
-                    password: password)
-                return
-            }
+        if let lastKnown = GatewaySettingsStore.loadLastGatewayConnection(),
+           self.startLastKnownAutoConnect(
+               lastKnown,
+               token: token,
+               bootstrapToken: bootstrapToken,
+               password: password)
+        {
+            return
         }
 
         let preferredStableID = defaults.string(forKey: "gateway.preferredStableID")?
@@ -582,6 +584,44 @@ final class GatewayConnectionController {
             }
             return
         }
+
+        _ = self.startSavedManualEndpointFallback()
+    }
+
+    private func startLastKnownAutoConnect(
+        _ lastKnown: GatewaySettingsStore.LastGatewayConnection,
+        token: String?,
+        bootstrapToken: String?,
+        password: String?) -> Bool
+    {
+        switch lastKnown {
+        case let .manual(host, port, useTLS, stableID):
+            let resolvedUseTLS = self.resolveManualUseTLS(host: host, useTLS: useTLS)
+            let stored = GatewayTLSStore.loadFingerprint(stableID: stableID)
+            let tlsParams = stored.map { fp in
+                GatewayTLSParams(required: true, expectedFingerprint: fp, allowTOFU: false, storeKey: stableID)
+            }
+            guard let url = self.buildGatewayURL(
+                host: host,
+                port: port,
+                useTLS: resolvedUseTLS && tlsParams != nil)
+            else { return false }
+
+            // Security: autoconnect only to previously trusted gateways (stored TLS pin).
+            guard tlsParams != nil else { return false }
+
+            self.didAutoConnect = true
+            self.startAutoConnect(
+                url: url,
+                gatewayStableID: stableID,
+                tls: tlsParams,
+                token: token,
+                bootstrapToken: bootstrapToken,
+                password: password)
+            return true
+        case .discovered:
+            return false
+        }
     }
 
     private func attemptAutoReconnectIfNeeded() {
@@ -594,6 +634,46 @@ final class GatewayConnectionController {
         self.maybeAutoConnect()
     }
 
+    private func savedManualEndpointFallback(defaults: UserDefaults = .standard) -> SavedManualEndpoint? {
+        guard defaults.bool(forKey: "gateway.autoconnect") else { return nil }
+        guard defaults.bool(forKey: "gateway.manual.enabled") else { return nil }
+        let host = defaults.string(forKey: "gateway.manual.host")?
+            .trimmingCharacters(in: .whitespacesAndNewlines) ?? ""
+        guard !host.isEmpty else { return nil }
+
+        let configuredPort = defaults.integer(forKey: "gateway.manual.port")
+        let configuredUseTLS = defaults.bool(forKey: "gateway.manual.tls")
+        let resolvedUseTLS = self.resolveManualUseTLS(host: host, useTLS: configuredUseTLS)
+        guard let resolvedPort = self.resolveManualPort(
+            host: host,
+            port: configuredPort,
+            useTLS: resolvedUseTLS)
+        else { return nil }
+
+        return SavedManualEndpoint(host: host, port: resolvedPort, useTLS: resolvedUseTLS)
+    }
+
+    private func startSavedManualEndpointFallback() -> Bool {
+        guard let endpoint = self.savedManualEndpointFallback() else { return false }
+        self.didAutoConnect = true
+        Task { [weak self] in
+            await self?.connectManual(
+                host: endpoint.host,
+                port: endpoint.port,
+                useTLS: endpoint.useTLS)
+        }
+        return true
+    }
+
+    private func connectSavedManualEndpointFallback() async -> Bool {
+        guard let endpoint = self.savedManualEndpointFallback() else { return false }
+        await self.connectManual(
+            host: endpoint.host,
+            port: endpoint.port,
+            useTLS: endpoint.useTLS)
+        return true
+    }
+
     private func updateLastDiscoveredGateway(from gateways: [GatewayDiscoveryModel.DiscoveredGateway]) {
         let defaults = UserDefaults.standard
         let preferred = defaults.string(forKey: "gateway.preferredStableID")?
@@ -615,16 +695,14 @@ final class GatewayConnectionController {
         tls: GatewayTLSParams?,
         token: String?,
         bootstrapToken: String?,
-        password: String?)
+        password: String?,
+        forceReconnect: Bool = false)
     {
         guard let appModel else { return }
-        let connectOptions = self.makeConnectOptions(stableID: gatewayStableID)
-
-        Task { [weak appModel] in
-            guard let appModel else { return }
-            await MainActor.run {
-                appModel.gatewayStatusText = "Connecting…"
-            }
+        appModel.gatewayStatusText = "Connecting…"
+        Task { [weak self, weak appModel] in
+            guard let self, let appModel else { return }
+            let nodeOptions = await self.makeConnectOptions(stableID: gatewayStableID)
             let cfg = GatewayConnectConfig(
                 url: url,
                 stableID: gatewayStableID,
@@ -632,8 +710,8 @@ final class GatewayConnectionController {
                 token: token,
                 bootstrapToken: bootstrapToken,
                 password: password,
-                nodeOptions: connectOptions)
-            appModel.applyGatewayConnectConfig(cfg)
+                nodeOptions: nodeOptions)
+            appModel.applyGatewayConnectConfig(cfg, forceReconnect: forceReconnect)
         }
     }
 
@@ -824,7 +902,9 @@ final class GatewayConnectionController {
             }
         }
     }
+}
 
+extension GatewayConnectionController {
     private func buildGatewayURL(host: String, port: Int, useTLS: Bool) -> URL? {
         let scheme = useTLS ? "wss" : "ws"
         var components = URLComponents()
@@ -852,17 +932,18 @@ final class GatewayConnectionController {
         "manual|\(host.lowercased())|\(port)"
     }
 
-    private func makeConnectOptions(stableID: String?) -> GatewayConnectOptions {
+    private func makeConnectOptions(stableID: String?) async -> GatewayConnectOptions {
         let defaults = UserDefaults.standard
         let displayName = self.resolvedDisplayName(defaults: defaults)
         let resolvedClientId = self.resolvedClientId(defaults: defaults, stableID: stableID)
+        let permissions = await self.currentPermissions()
 
         return GatewayConnectOptions(
             role: "node",
             scopes: [],
             caps: self.currentCaps(),
             commands: self.currentCommands(),
-            permissions: self.currentPermissions(),
+            permissions: permissions,
             clientId: resolvedClientId,
             clientMode: "node",
             clientDisplayName: displayName)
@@ -1000,14 +1081,16 @@ final class GatewayConnectionController {
         return commands
     }
 
-    private func currentPermissions() -> [String: Bool] {
+    private func currentPermissions() async -> [String: Bool] {
         var permissions: [String: Bool] = [:]
         permissions["camera"] = AVCaptureDevice.authorizationStatus(for: .video) == .authorized
         permissions["microphone"] = AVCaptureDevice.authorizationStatus(for: .audio) == .authorized
         permissions["speechRecognition"] = SFSpeechRecognizer.authorizationStatus() == .authorized
-        permissions["location"] = Self.isLocationAuthorized(
-            status: CLLocationManager().authorizationStatus)
-            && CLLocationManager.locationServicesEnabled()
+        let locationStatus = CLLocationManager().authorizationStatus
+        let locationServicesEnabled = await Self.locationServicesEnabled()
+        permissions["location"] = Self.isLocationAvailable(
+            servicesEnabled: locationServicesEnabled,
+            status: locationStatus)
         permissions["screenRecording"] = RPScreenRecorder.shared().isAvailable
 
         let photoStatus = PHPhotoLibrary.authorizationStatus(for: .readWrite)
@@ -1034,12 +1117,19 @@ final class GatewayConnectionController {
         return permissions
     }
 
-    private static func isLocationAuthorized(status: CLAuthorizationStatus) -> Bool {
+    private static func locationServicesEnabled() async -> Bool {
+        await Task.detached(priority: .utility) {
+            CLLocationManager.locationServicesEnabled()
+        }.value
+    }
+
+    private static func isLocationAvailable(servicesEnabled: Bool, status: CLAuthorizationStatus) -> Bool {
+        guard servicesEnabled else { return false }
         switch status {
         case .authorizedAlways, .authorizedWhenInUse:
-            true
+            return true
         default:
-            false
+            return false
         }
     }
 
@@ -1066,8 +1156,12 @@ extension GatewayConnectionController {
         self.currentCommands()
     }
 
-    func _test_currentPermissions() -> [String: Bool] {
-        self.currentPermissions()
+    func _test_currentPermissions() async -> [String: Bool] {
+        await self.currentPermissions()
+    }
+
+    static func _test_isLocationAvailable(servicesEnabled: Bool, status: CLAuthorizationStatus) -> Bool {
+        self.isLocationAvailable(servicesEnabled: servicesEnabled, status: status)
     }
 
     func _test_platformString() -> String {
@@ -1112,6 +1206,14 @@ extension GatewayConnectionController {
     func _test_resolveManualPort(host: String, port: Int, useTLS: Bool) -> Int? {
         self.resolveManualPort(host: host, port: port, useTLS: useTLS)
     }
+
+    func _test_savedManualEndpointFallback(
+        defaults: UserDefaults = .standard) -> (host: String, port: Int, useTLS: Bool)?
+    {
+        self.savedManualEndpointFallback(defaults: defaults).map { endpoint in
+            (host: endpoint.host, port: endpoint.port, useTLS: endpoint.useTLS)
+        }
+    }
 }
 #endif
 

apps/ios/Sources/Gateway/GatewayProblemView.swift

@@ -3,6 +3,8 @@ import SwiftUI
 import UIKit
 
 struct GatewayProblemBanner: View {
+    @Environment(\.colorScheme) private var colorScheme
+
     let problem: GatewayConnectionProblem
     var primaryActionTitle: String?
     var onPrimaryAction: (() -> Void)?
@@ -57,9 +59,15 @@ struct GatewayProblemBanner: View {
         }
         .frame(maxWidth: .infinity, alignment: .leading)
         .padding(14)
-        .background(
-            .thinMaterial,
-            in: RoundedRectangle(cornerRadius: 16, style: .continuous))
+        .background {
+            RoundedRectangle(cornerRadius: 16, style: .continuous)
+                .fill(.ultraThickMaterial)
+                .overlay {
+                    RoundedRectangle(cornerRadius: 16, style: .continuous)
+                        .strokeBorder(Color.primary.opacity(self.colorScheme == .dark ? 0.12 : 0.07), lineWidth: 1)
+                }
+                .shadow(color: .black.opacity(self.colorScheme == .dark ? 0.18 : 0.08), radius: 18, y: 8)
+        }
     }
 
     private var iconName: String {

apps/ios/Sources/HomeToolbar.swift

@@ -1,605 +0,0 @@
-import SwiftUI
-
-struct HomeToolbar: View {
-    var gateway: StatusPill.GatewayState
-    var voiceWakeEnabled: Bool
-    var activity: StatusPill.Activity?
-    var brighten: Bool
-    var talkButtonEnabled: Bool
-    var talkActive: Bool
-    var talkTint: Color
-    var onStatusTap: () -> Void
-    var onChatTap: () -> Void
-    var onTalkTap: () -> Void
-    var onSettingsTap: () -> Void
-
-    @Environment(\.colorSchemeContrast) private var contrast
-
-    var body: some View {
-        VStack(spacing: 0) {
-            Rectangle()
-                .fill(.white.opacity(self.contrast == .increased ? 0.46 : (self.brighten ? 0.18 : 0.12)))
-                .frame(height: self.contrast == .increased ? 1.0 : 0.6)
-                .allowsHitTesting(false)
-
-            HStack(spacing: 12) {
-                HomeToolbarStatusButton(
-                    gateway: self.gateway,
-                    voiceWakeEnabled: self.voiceWakeEnabled,
-                    activity: self.activity,
-                    brighten: self.brighten,
-                    onTap: self.onStatusTap)
-
-                Spacer(minLength: 0)
-
-                HStack(spacing: 8) {
-                    HomeToolbarActionButton(
-                        systemImage: "text.bubble.fill",
-                        accessibilityLabel: "Chat",
-                        brighten: self.brighten,
-                        action: self.onChatTap)
-
-                    if self.talkButtonEnabled {
-                        HomeToolbarActionButton(
-                            systemImage: self.talkActive ? "waveform.circle.fill" : "waveform.circle",
-                            accessibilityLabel: self.talkActive ? "Talk Mode On" : "Talk Mode Off",
-                            brighten: self.brighten,
-                            tint: self.talkTint,
-                            isActive: self.talkActive,
-                            action: self.onTalkTap)
-                    }
-
-                    HomeToolbarActionButton(
-                        systemImage: "gearshape.fill",
-                        accessibilityLabel: "Settings",
-                        brighten: self.brighten,
-                        action: self.onSettingsTap)
-                }
-            }
-            .padding(.horizontal, 12)
-            .padding(.top, 10)
-            .padding(.bottom, 8)
-        }
-        .frame(maxWidth: .infinity)
-        .background(.ultraThinMaterial)
-        .overlay(alignment: .top) {
-            LinearGradient(
-                colors: [
-                    .white.opacity(self.brighten ? 0.10 : 0.06),
-                    .clear,
-                ],
-                startPoint: .top,
-                endPoint: .bottom)
-                .allowsHitTesting(false)
-        }
-    }
-}
-
-struct TalkToolbarTray: View {
-    var brighten: Bool
-    var tint: Color
-    var statusText: String
-    var agentName: String
-    var micLevel: Double
-    var isListening: Bool
-    var isSpeaking: Bool
-    var isUserSpeechDetected: Bool
-    var permissionState: TalkGatewayPermissionState
-    var voiceModeTitle: String
-    var voiceModeSubtitle: String?
-    var onEnableTalk: () -> Void
-    var onStopTalk: () -> Void
-
-    @Environment(\.colorSchemeContrast) private var contrast
-
-    private var state: TalkToolbarTrayState {
-        TalkToolbarTrayState(
-            statusText: self.statusText,
-            isListening: self.isListening,
-            isSpeaking: self.isSpeaking,
-            isUserSpeechDetected: self.isUserSpeechDetected,
-            permissionState: self.permissionState)
-    }
-
-    var body: some View {
-        HStack(spacing: 12) {
-            ZStack {
-                Circle()
-                    .fill(self.tint.opacity(self.state.iconFillOpacity))
-                    .frame(width: 36, height: 36)
-                Image(systemName: self.state.systemImage)
-                    .font(.system(size: 15, weight: .semibold))
-                    .foregroundStyle(self.state.iconColor(tint: self.tint))
-            }
-
-            VStack(alignment: .leading, spacing: 5) {
-                HStack(spacing: 8) {
-                    Text(self.state.title)
-                        .font(.subheadline.weight(.semibold))
-                        .foregroundStyle(.primary)
-                        .lineLimit(1)
-
-                    if self.state.showsProgress {
-                        ProgressView()
-                            .controlSize(.mini)
-                    }
-                }
-
-                HStack(spacing: 8) {
-                    TalkWaveformView(
-                        mode: self.state.waveformMode(micLevel: self.micLevel),
-                        tint: self.state.waveformTint(tint: self.tint))
-                        .frame(width: 84, height: 18)
-                        .accessibilityHidden(true)
-
-                    Text(self.subtitle)
-                        .font(.caption.weight(.medium))
-                        .foregroundStyle(.secondary)
-                        .lineLimit(1)
-                }
-
-                if let voiceModeText = self.voiceModeText {
-                    Text(voiceModeText)
-                        .font(.caption2.weight(.semibold))
-                        .foregroundStyle(.secondary)
-                        .lineLimit(1)
-                }
-            }
-
-            Spacer(minLength: 0)
-
-            switch self.state.action {
-            case .enable:
-                Button(action: self.onEnableTalk) {
-                    Label("Enable Talk", systemImage: "key.fill")
-                        .labelStyle(.titleAndIcon)
-                }
-                .font(.caption.weight(.semibold))
-                .buttonStyle(.borderedProminent)
-                .controlSize(.small)
-            case .stop:
-                Button(action: self.onStopTalk) {
-                    Image(systemName: "xmark")
-                        .font(.system(size: 13, weight: .bold))
-                        .frame(width: 28, height: 28)
-                }
-                .buttonStyle(.plain)
-                .background {
-                    Circle()
-                        .fill(Color.black.opacity(self.brighten ? 0.10 : 0.18))
-                        .overlay {
-                            Circle()
-                                .strokeBorder(
-                                    .white.opacity(self.contrast == .increased ? 0.42 : 0.16),
-                                    lineWidth: self.contrast == .increased ? 1.0 : 0.6)
-                        }
-                }
-                .accessibilityLabel("Stop Talk")
-            case .none:
-                EmptyView()
-            }
-        }
-        .padding(.horizontal, 14)
-        .padding(.vertical, 12)
-        .frame(maxWidth: .infinity)
-        .background(.ultraThinMaterial)
-        .overlay(alignment: .top) {
-            Rectangle()
-                .fill(.white.opacity(self.contrast == .increased ? 0.46 : (self.brighten ? 0.18 : 0.12)))
-                .frame(height: self.contrast == .increased ? 1.0 : 0.6)
-                .allowsHitTesting(false)
-        }
-        .overlay(alignment: .bottom) {
-            LinearGradient(
-                colors: [
-                    self.tint.opacity(self.brighten ? 0.12 : 0.16),
-                    .clear,
-                ],
-                startPoint: .leading,
-                endPoint: .trailing)
-                .frame(height: 1)
-                .allowsHitTesting(false)
-        }
-        .accessibilityElement(children: .combine)
-        .accessibilityLabel("Talk Mode")
-        .accessibilityValue(self.accessibilityValue)
-    }
-
-    private var accessibilityValue: String {
-        if let voiceModeText {
-            return "\(self.state.title), \(self.subtitle), \(voiceModeText)"
-        }
-        return "\(self.state.title), \(self.subtitle)"
-    }
-
-    private var voiceModeText: String? {
-        guard !self.state.prefersPermissionCopy else { return nil }
-        let title = self.voiceModeTitle.trimmingCharacters(in: .whitespacesAndNewlines)
-        guard !title.isEmpty, title != "Not loaded" else { return nil }
-        let subtitle = (self.voiceModeSubtitle ?? "").trimmingCharacters(in: .whitespacesAndNewlines)
-        return subtitle.isEmpty ? title : "\(title) • \(subtitle)"
-    }
-
-    private var subtitle: String {
-        let trimmedAgent = self.agentName.trimmingCharacters(in: .whitespacesAndNewlines)
-        if self.state.prefersPermissionCopy {
-            return "Gateway approval needed"
-        }
-        if !trimmedAgent.isEmpty {
-            return trimmedAgent
-        }
-        return "OpenClaw"
-    }
-}
-
-private enum TalkToolbarTrayAction {
-    case none
-    case enable
-    case stop
-}
-
-private enum TalkWaveformMode: Equatable {
-    case level(Double)
-    case inputSpeech
-    case speaking
-    case indeterminate
-    case still
-}
-
-private struct TalkToolbarTrayState: Equatable {
-    let statusText: String
-    let isListening: Bool
-    let isSpeaking: Bool
-    let isUserSpeechDetected: Bool
-    let permissionState: TalkGatewayPermissionState
-
-    private var normalizedStatus: String {
-        self.statusText.trimmingCharacters(in: .whitespacesAndNewlines).lowercased()
-    }
-
-    var title: String {
-        switch self.permissionState {
-        case .missingScope, .requestFailed:
-            return "Gateway permission required"
-        case .requestingUpgrade:
-            return "Requesting approval"
-        case .upgradeRequested:
-            return "Approval requested"
-        default:
-            break
-        }
-
-        if self.isSpeaking { return "Speaking" }
-        if self.isListening { return "Listening" }
-        if self.normalizedStatus.contains("connecting") { return "Connecting" }
-        if self.normalizedStatus.contains("thinking") { return "Asking OpenClaw" }
-        if self.normalizedStatus == "ready" { return "Ready to talk" }
-        if self.normalizedStatus.isEmpty || self.normalizedStatus == "off" { return "Talk" }
-        return self.statusText
-    }
-
-    var systemImage: String {
-        switch self.permissionState {
-        case .missingScope, .requestFailed:
-            return "key.fill"
-        case .requestingUpgrade:
-            return "paperplane.fill"
-        case .upgradeRequested:
-            return "hourglass"
-        default:
-            break
-        }
-
-        if self.isSpeaking { return "speaker.wave.2.fill" }
-        if self.isListening { return "mic.fill" }
-        if self.normalizedStatus.contains("thinking") { return "sparkles" }
-        if self.normalizedStatus.contains("connecting") { return "dot.radiowaves.left.and.right" }
-        return "waveform"
-    }
-
-    var action: TalkToolbarTrayAction {
-        switch self.permissionState {
-        case .missingScope, .requestFailed:
-            .enable
-        case .requestingUpgrade, .upgradeRequested:
-            .none
-        default:
-            .stop
-        }
-    }
-
-    var showsProgress: Bool {
-        switch self.permissionState {
-        case .requestingUpgrade, .upgradeRequested:
-            true
-        default:
-            self.normalizedStatus.contains("connecting") || self.normalizedStatus.contains("thinking")
-        }
-    }
-
-    var prefersPermissionCopy: Bool {
-        switch self.permissionState {
-        case .missingScope, .requestingUpgrade, .upgradeRequested, .requestFailed:
-            true
-        default:
-            false
-        }
-    }
-
-    var iconFillOpacity: Double {
-        self.prefersPermissionCopy ? 0.18 : 0.24
-    }
-
-    func iconColor(tint: Color) -> Color {
-        switch self.permissionState {
-        case .requestFailed:
-            .red
-        case .missingScope, .requestingUpgrade, .upgradeRequested:
-            .orange
-        default:
-            tint
-        }
-    }
-
-    func waveformTint(tint: Color) -> Color {
-        switch self.permissionState {
-        case .requestFailed:
-            .red
-        case .missingScope, .requestingUpgrade, .upgradeRequested:
-            .orange
-        default:
-            tint
-        }
-    }
-
-    func waveformMode(micLevel: Double) -> TalkWaveformMode {
-        switch self.permissionState {
-        case .requestingUpgrade, .upgradeRequested:
-            return .indeterminate
-        case .missingScope, .requestFailed:
-            return .still
-        default:
-            break
-        }
-
-        if self.isSpeaking {
-            return .speaking
-        }
-        if self.isListening, self.isUserSpeechDetected {
-            return .inputSpeech
-        }
-        if self.isListening {
-            return .level(micLevel)
-        }
-        if self.normalizedStatus.contains("connecting") || self.normalizedStatus.contains("thinking") {
-            return .indeterminate
-        }
-        return .still
-    }
-}
-
-private struct TalkWaveformView: View {
-    var mode: TalkWaveformMode
-    var tint: Color
-
-    @Environment(\.accessibilityReduceMotion) private var reduceMotion
-
-    private let barCount = 14
-
-    var body: some View {
-        TimelineView(.periodic(from: .now, by: 1.0 / 24.0)) { timeline in
-            HStack(alignment: .center, spacing: 3) {
-                ForEach(0..<self.barCount, id: \.self) { index in
-                    Capsule(style: .continuous)
-                        .fill(self.tint.opacity(self.opacity(for: index)))
-                        .frame(width: 3, height: self.height(for: index, date: timeline.date))
-                }
-            }
-            .frame(maxHeight: .infinity)
-        }
-    }
-
-    private func height(for index: Int, date: Date) -> CGFloat {
-        let minimum: Double = 4
-        let maximum: Double = 18
-        let amplitude = self.amplitude(for: index, date: date)
-        return CGFloat(minimum + ((maximum - minimum) * amplitude))
-    }
-
-    private func opacity(for index: Int) -> Double {
-        switch self.mode {
-        case .still:
-            index == self.barCount / 2 ? 0.64 : 0.32
-        default:
-            0.78
-        }
-    }
-
-    private func amplitude(for index: Int, date: Date) -> Double {
-        if self.reduceMotion {
-            switch self.mode {
-            case let .level(level):
-                return min(max(level, 0.10), 1.0)
-            case .inputSpeech:
-                return 0.72
-            case .speaking:
-                return 0.62
-            case .indeterminate:
-                return 0.34
-            case .still:
-                return 0.18
-            }
-        }
-
-        let t = date.timeIntervalSinceReferenceDate
-        let phase = Double(index) * 0.52
-        switch self.mode {
-        case let .level(level):
-            let clamped = min(max(level, 0), 1)
-            let shaped = 0.12 + (0.88 * clamped)
-            let variation = 0.72 + (0.28 * sin((t * 12.0) + phase))
-            return min(max(shaped * variation, 0.10), 1.0)
-        case .inputSpeech:
-            let primary = 0.5 + (0.5 * sin((t * 14.0) + phase))
-            let secondary = 0.5 + (0.5 * sin((t * 5.0) + (phase * 1.35)))
-            return min(max(0.16 + (0.60 * primary) + (0.24 * secondary), 0.14), 1.0)
-        case .speaking:
-            let wave = 0.5 + (0.5 * sin((t * 7.5) + phase))
-            let secondary = 0.5 + (0.5 * sin((t * 3.0) + (phase * 0.7)))
-            return min(max(0.18 + (0.58 * wave) + (0.24 * secondary), 0.12), 1.0)
-        case .indeterminate:
-            let center = (sin((t * 3.2) + phase) + 1) / 2
-            return 0.16 + (0.42 * center)
-        case .still:
-            return index == self.barCount / 2 ? 0.32 : 0.16
-        }
-    }
-}
-
-private struct HomeToolbarStatusButton: View {
-    @Environment(\.scenePhase) private var scenePhase
-    @Environment(\.accessibilityReduceMotion) private var reduceMotion
-    @Environment(\.colorSchemeContrast) private var contrast
-
-    var gateway: StatusPill.GatewayState
-    var voiceWakeEnabled: Bool
-    var activity: StatusPill.Activity?
-    var brighten: Bool
-    var onTap: () -> Void
-
-    @State private var pulse: Bool = false
-
-    var body: some View {
-        Button(action: self.onTap) {
-            HStack(spacing: 8) {
-                HStack(spacing: 6) {
-                    Circle()
-                        .fill(self.gateway.color)
-                        .frame(width: 8, height: 8)
-                        .scaleEffect(
-                            self.gateway == .connecting && !self.reduceMotion
-                                ? (self.pulse ? 1.15 : 0.85)
-                                : 1.0)
-                        .opacity(self.gateway == .connecting && !self.reduceMotion ? (self.pulse ? 1.0 : 0.6) : 1.0)
-
-                    Text(self.gateway.title)
-                        .font(.footnote.weight(.semibold))
-                        .foregroundStyle(.primary)
-                        .lineLimit(1)
-                }
-
-                if let activity {
-                    Image(systemName: activity.systemImage)
-                        .font(.footnote.weight(.semibold))
-                        .foregroundStyle(activity.tint ?? .primary)
-                        .transition(.opacity.combined(with: .move(edge: .top)))
-                } else {
-                    Image(systemName: self.voiceWakeEnabled ? "mic.fill" : "mic.slash")
-                        .font(.footnote.weight(.semibold))
-                        .foregroundStyle(self.voiceWakeEnabled ? .primary : .secondary)
-                        .transition(.opacity.combined(with: .move(edge: .top)))
-                }
-            }
-            .padding(.horizontal, 12)
-            .padding(.vertical, 8)
-            .background {
-                RoundedRectangle(cornerRadius: 14, style: .continuous)
-                    .fill(Color.black.opacity(self.brighten ? 0.12 : 0.18))
-                    .overlay {
-                        RoundedRectangle(cornerRadius: 14, style: .continuous)
-                            .strokeBorder(
-                                .white.opacity(self.contrast == .increased ? 0.46 : (self.brighten ? 0.22 : 0.16)),
-                                lineWidth: self.contrast == .increased ? 1.0 : 0.6)
-                    }
-            }
-        }
-        .buttonStyle(.plain)
-        .accessibilityLabel("Connection Status")
-        .accessibilityValue(self.accessibilityValue)
-        .accessibilityHint(
-            self.gateway == .connected
-                ? "Double tap for gateway actions"
-                : "Double tap to open settings")
-        .onAppear { self.updatePulse(for: self.gateway, scenePhase: self.scenePhase, reduceMotion: self.reduceMotion) }
-        .onDisappear { self.pulse = false }
-        .onChange(of: self.gateway) { _, newValue in
-            self.updatePulse(for: newValue, scenePhase: self.scenePhase, reduceMotion: self.reduceMotion)
-        }
-        .onChange(of: self.scenePhase) { _, newValue in
-            self.updatePulse(for: self.gateway, scenePhase: newValue, reduceMotion: self.reduceMotion)
-        }
-        .onChange(of: self.reduceMotion) { _, newValue in
-            self.updatePulse(for: self.gateway, scenePhase: self.scenePhase, reduceMotion: newValue)
-        }
-        .animation(.easeInOut(duration: 0.18), value: self.activity?.title)
-    }
-
-    private var accessibilityValue: String {
-        if let activity {
-            return "\(self.gateway.title), \(activity.title)"
-        }
-        return "\(self.gateway.title), Voice Wake \(self.voiceWakeEnabled ? "enabled" : "disabled")"
-    }
-
-    private func updatePulse(for gateway: StatusPill.GatewayState, scenePhase: ScenePhase, reduceMotion: Bool) {
-        guard gateway == .connecting, scenePhase == .active, !reduceMotion else {
-            withAnimation(reduceMotion ? .none : .easeOut(duration: 0.2)) { self.pulse = false }
-            return
-        }
-
-        guard !self.pulse else { return }
-        withAnimation(.easeInOut(duration: 0.9).repeatForever(autoreverses: true)) {
-            self.pulse = true
-        }
-    }
-}
-
-private struct HomeToolbarActionButton: View {
-    @Environment(\.colorSchemeContrast) private var contrast
-
-    let systemImage: String
-    let accessibilityLabel: String
-    let brighten: Bool
-    var tint: Color?
-    var isActive: Bool = false
-    let action: () -> Void
-
-    var body: some View {
-        Button(action: self.action) {
-            Image(systemName: self.systemImage)
-                .font(.system(size: 16, weight: .semibold))
-                .foregroundStyle(self.isActive ? (self.tint ?? .primary) : .primary)
-                .frame(width: 40, height: 40)
-                .background {
-                    RoundedRectangle(cornerRadius: 12, style: .continuous)
-                        .fill(Color.black.opacity(self.brighten ? 0.12 : 0.18))
-                        .overlay {
-                            if let tint {
-                                RoundedRectangle(cornerRadius: 12, style: .continuous)
-                                    .fill(
-                                        LinearGradient(
-                                            colors: [
-                                                tint.opacity(self.isActive ? 0.22 : 0.14),
-                                                tint.opacity(self.isActive ? 0.08 : 0.04),
-                                                .clear,
-                                            ],
-                                            startPoint: .topLeading,
-                                            endPoint: .bottomTrailing))
-                                    .blendMode(.overlay)
-                            }
-                        }
-                        .overlay {
-                            RoundedRectangle(cornerRadius: 12, style: .continuous)
-                                .strokeBorder(
-                                    (self.tint ?? .white).opacity(
-                                        self.isActive
-                                            ? 0.34
-                                            : (self.contrast == .increased ? 0.4 : (self.brighten ? 0.22 : 0.16))),
-                                    lineWidth: self.contrast == .increased ? 1.0 : (self.isActive ? 0.8 : 0.6))
-                        }
-                }
-        }
-        .buttonStyle(.plain)
-        .accessibilityLabel(self.accessibilityLabel)
-    }
-}

apps/ios/Sources/Info.plist

@@ -24,8 +24,6 @@
 	<string>APPL</string>
 	<key>CFBundleShortVersionString</key>
 	<string>$(OPENCLAW_MARKETING_VERSION)</string>
-	<key>OpenClawCanonicalVersion</key>
-	<string>$(OPENCLAW_IOS_VERSION)</string>
 	<key>CFBundleURLTypes</key>
 	<array>
 		<dict>
@@ -45,19 +43,21 @@
 	<dict>
 		<key>NSAllowsArbitraryLoadsInWebContent</key>
 		<true/>
+		<key>NSAllowsLocalNetworking</key>
+		<true/>
 	</dict>
 	<key>NSBonjourServices</key>
 	<array>
 		<string>_openclaw-gw._tcp</string>
 	</array>
-	<key>NSCameraUsageDescription</key>
-	<string>OpenClaw can capture photos or short video clips when requested via the gateway.</string>
-	<key>NSCalendarsUsageDescription</key>
-	<string>OpenClaw uses your calendars to show events and scheduling context when you enable calendar access.</string>
 	<key>NSCalendarsFullAccessUsageDescription</key>
 	<string>OpenClaw uses your calendars to show events and scheduling context when you enable calendar access.</string>
+	<key>NSCalendarsUsageDescription</key>
+	<string>OpenClaw uses your calendars to show events and scheduling context when you enable calendar access.</string>
 	<key>NSCalendarsWriteOnlyAccessUsageDescription</key>
 	<string>OpenClaw uses your calendars to add events when you enable calendar access.</string>
+	<key>NSCameraUsageDescription</key>
+	<string>OpenClaw can capture photos or short video clips when requested via the gateway.</string>
 	<key>NSContactsUsageDescription</key>
 	<string>OpenClaw uses your contacts so you can search and reference people while using the assistant.</string>
 	<key>NSLocalNetworkUsageDescription</key>
@@ -67,7 +67,7 @@
 	<key>NSLocationWhenInUseUsageDescription</key>
 	<string>OpenClaw uses your location when you allow location sharing.</string>
 	<key>NSMicrophoneUsageDescription</key>
-	<string>OpenClaw needs microphone access for voice wake.</string>
+	<string>OpenClaw uses the microphone for realtime chat, voice wake, and push-to-talk.</string>
 	<key>NSMotionUsageDescription</key>
 	<string>OpenClaw may use motion data to support device-aware interactions and automations.</string>
 	<key>NSPhotoLibraryUsageDescription</key>
@@ -75,9 +75,11 @@
 	<key>NSRemindersFullAccessUsageDescription</key>
 	<string>OpenClaw uses your reminders to list, add, and complete tasks when you enable reminders access.</string>
 	<key>NSSpeechRecognitionUsageDescription</key>
-	<string>OpenClaw uses on-device speech recognition for voice wake.</string>
+	<string>OpenClaw uses on-device speech recognition for talk mode and voice wake.</string>
 	<key>NSSupportsLiveActivities</key>
 	<true/>
+	<key>OpenClawCanonicalVersion</key>
+	<string>$(OPENCLAW_IOS_VERSION)</string>
 	<key>OpenClawPushAPNsEnvironment</key>
 	<string>$(OPENCLAW_PUSH_APNS_ENVIRONMENT)</string>
 	<key>OpenClawPushDistribution</key>

apps/ios/Sources/Model/NodeAppModel.swift

@@ -111,6 +111,10 @@ final class NodeAppModel {
     var gatewayStatusText: String = "Offline"
     var nodeStatusText: String = "Offline"
     var operatorStatusText: String = "Offline"
+    var isOperatorGatewayConnected: Bool {
+        self.operatorConnected
+    }
+
     var gatewayServerName: String?
     var gatewayRemoteAddress: String?
     var connectedGatewayID: String?
@@ -127,6 +131,7 @@ final class NodeAppModel {
 
     var seamColorHex: String?
     private var mainSessionBaseKey: String = "main"
+    private var focusedChatSessionKey: String?
     var selectedAgentId: String?
     var gatewayDefaultAgentId: String?
     var gatewayAgents: [AgentSummary] = []
@@ -291,7 +296,6 @@ final class NodeAppModel {
         self.talkMode.attachGateway(self.operatorGateway)
         self.refreshLastShareEventFromRelay()
         let talkEnabled = UserDefaults.standard.bool(forKey: "talk.enabled")
-        // Route through the coordinator so VoiceWake and Talk don't fight over the microphone.
         self.setTalkEnabled(talkEnabled)
 
         // Wire up deep links from canvas taps
@@ -452,7 +456,7 @@ final class NodeAppModel {
                         await self.operatorGateway.disconnect()
                         await self.nodeGateway.disconnect()
                         await MainActor.run {
-                            self.operatorConnected = false
+                            self.setOperatorConnected(false)
                             self.gatewayConnected = false
                             // Foreground recovery must actively restart the saved gateway config.
                             // Disconnecting stale sockets alone can leave us idle if the old
@@ -543,7 +547,7 @@ final class NodeAppModel {
             await self.operatorGateway.disconnect()
             await self.nodeGateway.disconnect()
             await MainActor.run {
-                self.operatorConnected = false
+                self.setOperatorConnected(false)
                 self.gatewayConnected = false
                 self.talkMode.updateGatewayConnected(false)
                 if self.isBackgrounded {
@@ -690,6 +694,11 @@ final class NodeAppModel {
         await self.talkMode.prefetchRealtimeSessionIfReady(reason: "talk_permission_poll_connected")
     }
 
+    func setTalkSpeakerphoneEnabled(_ enabled: Bool) {
+        UserDefaults.standard.set(enabled, forKey: TalkDefaults.speakerphoneEnabledKey)
+        self.talkMode.applyAudioRoutePreferenceChanged()
+    }
+
     func requestLocationPermissions(mode: OpenClawLocationMode) async -> Bool {
         guard mode != .off else { return true }
         let status = await self.locationService.ensureAuthorization(mode: mode)
@@ -892,7 +901,7 @@ final class NodeAppModel {
                 await self.operatorGateway.disconnect()
                 await self.nodeGateway.disconnect()
                 await MainActor.run {
-                    self.operatorConnected = false
+                    self.setOperatorConnected(false)
                     self.gatewayConnected = false
                     self.gatewayStatusText = "Reconnecting…"
                     self.talkMode.updateGatewayConnected(false)
@@ -1840,9 +1849,25 @@ extension NodeAppModel {
     }
 
     var chatSessionKey: String {
+        if let focused = self.focusedChatSessionKey?.trimmingCharacters(in: .whitespacesAndNewlines),
+           !focused.isEmpty
+        {
+            return focused
+        }
         // Keep chat aligned with the gateway's resolved main session key.
         // A hardcoded "ios" base creates synthetic placeholder sessions in the chat UI.
-        self.mainSessionKey
+        return self.mainSessionKey
+    }
+
+    func openChat(sessionKey: String?) {
+        self.focusChatSession(sessionKey)
+        self.openChatRequestID &+= 1
+    }
+
+    func focusChatSession(_ sessionKey: String?) {
+        let trimmed = (sessionKey ?? "").trimmingCharacters(in: .whitespacesAndNewlines)
+        self.focusedChatSessionKey = trimmed.isEmpty ? nil : trimmed
+        self.talkMode.updateMainSessionKey(self.chatSessionKey)
     }
 
     var activeAgentName: String {
@@ -1864,13 +1889,13 @@ extension NodeAppModel {
         token: String?,
         bootstrapToken: String?,
         password: String?,
-        connectOptions: GatewayConnectOptions)
+        connectOptions: GatewayConnectOptions,
+        forceReconnect: Bool = false)
     {
         let stableID = gatewayStableID.trimmingCharacters(in: .whitespacesAndNewlines)
         let effectiveStableID = stableID.isEmpty ? url.absoluteString : stableID
         let sessionBox = tls.map { WebSocketSessionBox(session: GatewayTLSPinningSession(params: $0)) }
-
-        self.activeGatewayConnectConfig = GatewayConnectConfig(
+        let nextConfig = GatewayConnectConfig(
             url: url,
             stableID: stableID,
             tls: tls,
@@ -1878,13 +1903,24 @@ extension NodeAppModel {
             bootstrapToken: bootstrapToken,
             password: password,
             nodeOptions: connectOptions)
-        self.prepareForGatewayConnect(url: url, stableID: effectiveStableID)
-        if self.shouldStartOperatorGatewayLoop(
+        let operatorLoopRequired = self.shouldStartOperatorGatewayLoop(
             token: token,
             bootstrapToken: bootstrapToken,
             password: password,
             stableID: effectiveStableID)
+        if let activeConfig = self.activeGatewayConnectConfig,
+           activeConfig.hasSameConnectionInputs(as: nextConfig),
+           self.nodeGatewayTask != nil,
+           self.operatorGatewayTask != nil || !operatorLoopRequired,
+           !forceReconnect
         {
+            self.gatewayAutoReconnectEnabled = true
+            return
+        }
+
+        self.activeGatewayConnectConfig = nextConfig
+        self.prepareForGatewayConnect(url: url, stableID: effectiveStableID)
+        if operatorLoopRequired {
             self.startOperatorGatewayLoop(
                 url: url,
                 stableID: effectiveStableID,
@@ -1908,8 +1944,7 @@ extension NodeAppModel {
     }
 
     /// Preferred entry-point: apply a single config object and start both sessions.
-    func applyGatewayConnectConfig(_ cfg: GatewayConnectConfig) {
-        self.activeGatewayConnectConfig = cfg
+    func applyGatewayConnectConfig(_ cfg: GatewayConnectConfig, forceReconnect: Bool = false) {
         self.connectToGateway(
             url: cfg.url,
             // Preserve the caller-provided stableID (may be empty) and let connectToGateway
@@ -1919,7 +1954,8 @@ extension NodeAppModel {
             token: cfg.token,
             bootstrapToken: cfg.bootstrapToken,
             password: cfg.password,
-            connectOptions: cfg.nodeOptions)
+            connectOptions: cfg.nodeOptions,
+            forceReconnect: forceReconnect)
     }
 
     func disconnectGateway() {
@@ -1945,7 +1981,7 @@ extension NodeAppModel {
         self.connectedGatewayID = nil
         self.activeGatewayConnectConfig = nil
         self.gatewayConnected = false
-        self.operatorConnected = false
+        self.setOperatorConnected(false)
         self.talkMode.updateGatewayConnected(false)
         self.seamColorHex = nil
         self.mainSessionBaseKey = "main"
@@ -1968,7 +2004,7 @@ extension NodeAppModel {
         self.gatewayRemoteAddress = nil
         self.connectedGatewayID = stableID
         self.gatewayConnected = false
-        self.operatorConnected = false
+        self.setOperatorConnected(false)
         self.voiceWakeSyncTask?.cancel()
         self.voiceWakeSyncTask = nil
         LiveActivityManager.shared.endActivity(reason: "new_gateway_connect")
@@ -2206,7 +2242,7 @@ extension NodeAppModel {
                         onConnected: { [weak self] in
                             guard let self else { return }
                             await MainActor.run {
-                                self.operatorConnected = true
+                                self.setOperatorConnected(true)
                                 self.forceOperatorTalkPermissionUpgradeRequest = false
                                 self.talkMode.updateGatewayConnected(true)
                             }
@@ -2224,7 +2260,7 @@ extension NodeAppModel {
                         onDisconnected: { [weak self] reason in
                             guard let self else { return }
                             await MainActor.run {
-                                self.operatorConnected = false
+                                self.setOperatorConnected(false)
                                 self.talkMode.updateGatewayConnected(false)
                                 LiveActivityManager.shared.endActivity(reason: "operator_disconnected")
                             }
@@ -2491,7 +2527,7 @@ extension NodeAppModel {
                 self.gatewayRemoteAddress = nil
                 self.connectedGatewayID = nil
                 self.gatewayConnected = false
-                self.operatorConnected = false
+                self.setOperatorConnected(false)
                 self.talkMode.updateGatewayConnected(false)
                 self.seamColorHex = nil
                 self.mainSessionBaseKey = "main"
@@ -2566,6 +2602,11 @@ extension NodeAppModel {
     private func isOperatorConnected() async -> Bool {
         self.operatorConnected
     }
+
+    private func setOperatorConnected(_ connected: Bool) {
+        self.operatorConnected = connected
+        self.operatorStatusText = connected ? "Connected" : "Offline"
+    }
 }
 
 extension NodeAppModel {
@@ -3908,7 +3949,7 @@ extension NodeAppModel {
         self.operatorGatewayTask?.cancel()
         self.operatorGatewayTask = nil
         await self.operatorGateway.disconnect()
-        self.operatorConnected = false
+        self.setOperatorConnected(false)
         self.talkMode.updateGatewayConnected(false)
         self.stopGatewayHealthMonitor()
 
@@ -3977,7 +4018,7 @@ extension NodeAppModel {
             self.grantBackgroundReconnectLease(seconds: 30, reason: "wake_\(wakeId)")
             await self.operatorGateway.disconnect()
             await self.nodeGateway.disconnect()
-            self.operatorConnected = false
+            self.setOperatorConnected(false)
             self.gatewayConnected = false
             self.gatewayStatusText = "Reconnecting…"
             self.talkMode.updateGatewayConnected(false)

apps/ios/Sources/Onboarding/OnboardingStateStore.swift

@@ -24,11 +24,16 @@ enum OnboardingStateStore {
     private static let lastSuccessTimeDefaultsKey = "onboarding.last_success_time"
 
     @MainActor
-    static func shouldPresentOnLaunch(appModel: NodeAppModel, defaults: UserDefaults = .standard) -> Bool {
+    static func shouldPresentOnLaunch(
+        appModel: NodeAppModel,
+        defaults: UserDefaults = .standard,
+        hasSavedGatewayConnection: Bool? = nil)
+        -> Bool
+    {
         if defaults.bool(forKey: self.completedDefaultsKey) { return false }
-        // If we have a last-known connection config, don't force onboarding on launch. Auto-connect
-        // should handle reconnecting, and users can always open onboarding manually if needed.
-        if GatewaySettingsStore.loadLastGatewayConnection() != nil { return false }
+        let hasSavedGatewayConnection =
+            hasSavedGatewayConnection ?? (GatewaySettingsStore.loadLastGatewayConnection() != nil)
+        if hasSavedGatewayConnection { return false }
         return appModel.gatewayServerName == nil
     }