v0.6.4

0.6.4 (2026-04-17)

Changed

• Compat with OpenClaw 2026.4.16 plugin-sdk API:
  • upsertPairingRequest now requires accountId — pass "default" to match src/channel.ts.
  • ChatType literal "dm" renamed to "direct" for resolveAgentRoute peer kinds.
  • ReplyDispatcher gained required getFailedCounts and markComplete members (no-op stubs — clawg-ui doesn't track retries or typing indicators).
  • openclaw/plugin-sdk/plugin-runtime is now a typed public subpath; removed the @ts-expect-error suppression in index.ts.

Fixed

• Two src/integration.test.ts cases (rejects missing user message with 400, rejects empty messages array with 400) expected HTTP 400 but the handler has returned 200 with an empty SSE run since commit e3a88c8 (AG-UI protocol compliance for init/sync). Tests now match the current protocol-compliant behavior.

v0.5.4

Fixed

• Use registerPluginHttpRoute() from openclaw/plugin-sdk/plugin-runtime (dynamic import) to write directly to the pinned HTTP route registry. Fixes 404 on OpenClaw 2026.3.23+ where api.registerHttpRoute() writes to the loader's private registry which the HTTP handler never reads.

Changed (since 0.4.5)

• Breaking: Peer ID now uses the stable device UUID instead of per-thread ID, enabling identity linking across channels
• Session keys include :thread:<threadId> suffix for per-thread session separation

Migration

• Device UUIDs can now be added to session.identityLinks in openclaw.json
• Existing session histories keyed on old format won't be matched; devices start new sessions after upgrade

v0.4.5

What's New

Added

• Agent routing via X-OpenClaw-Agent-Id header — pass the header value as accountId to resolveAgentRoute, enabling agent selection via bindings (e.g. { "agentId": "auditor", "match": { "channel": "clawg-ui", "accountId": "auditor" } })
• AG-UI context forwarding — RunAgentInput.context entries are now forwarded to the LLM prompt as structured markdown sections

v0.3.2

Fixed

• Pass { channel: "clawg-ui" } object to readAllowFromStore — API changed in OpenClaw 2026.3.7 (fixes #17)
• Keep auth: "plugin" on registerHttpRoute with a type cast — required at runtime but not yet in SDK typings (fixes #16)
• Compile TypeScript to dist/ and point openclaw.extensions to ./dist/index.js instead of ./index.ts — fixes "loaded without install/load-path provenance" warning in OpenClaw 3.7
• Remove onToolResult from reply options — property now explicitly omitted from the type
• Use EventType enum instead of plain string in EventWriter type

Changed

• Add main, build, files, and prepublishOnly fields to package.json for proper npm packaging
• Add declaration: true and exclude: ["**/*.test.ts"] to tsconfig.json

Full changelog: https://github.com/contextablemark/clawg-ui/blob/main/CHANGELOG.md

v0.2.9

Fixed

• Route 404: Added auth: "plugin" to registerHttpRoute — required by OpenClaw 2026.3.2; omitting it silently dropped the /v1/clawg-ui route
• Approved device 403: Fixed readAllowFromStore call to pass { channel, accountId } object instead of a bare string — pairing API change in 2026.3.2 caused approved devices to keep receiving 403s
• Kotlin client pairing: Added flat pairing_code and bearer_token fields at the root of the 403 pairing response, restoring compatibility with ClawgUIPairingResponse clients expecting flat fields
• Diagnostics: Added console.log for 400 responses to log message roles/content for debugging

Compatibility

Requires OpenClaw 2026.3.2 or later.

v0.2.8

Fixed

• Remove literal process.env from a code comment in http-handler.ts that was itself triggering the security scanner — the comment documenting the v0.2.5/v0.2.6 fix contained the exact pattern the scanner flags (#8)

See CHANGELOG.md for full history.

v0.2.7

Fixed

• Close open text messages before emitting RUN_FINISHED in splitRunIfToolFired() — fixes AGUIError: Cannot send 'RUN_FINISHED' while text messages are still active when text streaming is followed by a server-side tool call and then more text

Installation

npm install @contextableai/clawg-ui@0.2.7

Full Changelog

v0.2.6...v0.2.7

v0.2.4

Changes since v0.2.1

• Split tool and text events into separate AG-UI runs (#4)
• Fix paragraph joiner for streamed text, add runId to text events (#3)
• Fix: use standard git+https format for repository URL (#2)
• Fix: include messageId in TOOL_CALL_RESULT events

v0.2.1

Fixed

• Return HTTP 429 rate_limit error when max pending pairing requests (3) is reached, instead of returning an empty pairing code

🤖 Generated with Claude Code

v0.2.0

Added

• Device pairing authentication - Secure per-device access control
  • HMAC-signed device tokens (no master token exposure)
  • Pairing approval workflow (openclaw pairing approve clawg-ui <code>)
  • New CLI command: openclaw clawg-ui devices - List approved devices

Changed

• Breaking: Direct bearer token authentication using OPENCLAW_GATEWAY_TOKEN is now deprecated and no longer supported. All clients must use device pairing.

Security

• Device tokens are HMAC-signed and do not expose the gateway's master secret
• Pending pairing requests expire after 10 minutes (max 3 per channel)
• Each device requires explicit approval by the gateway owner