{"id":48893215,"url":"https://github.com/rookiestar28/ComfyUI-OpenClaw","last_synced_at":"2026-04-23T18:01:08.053Z","repository":{"id":336754033,"uuid":"1150696087","full_name":"rookiestar28/ComfyUI-OpenClaw","owner":"rookiestar28","description":"Your own personal AIGC Factory. Any picture. Any reel. The Comfy way. ©️","archived":false,"fork":false,"pushed_at":"2026-04-18T13:35:04.000Z","size":5597,"stargazers_count":524,"open_issues_count":4,"forks_count":55,"subscribers_count":3,"default_branch":"main","last_synced_at":"2026-04-18T15:31:25.939Z","etag":null,"topics":["agent","agentic-ai","comfyui","comfyui-nodes","discord-bot","feishu-bot","kakaotalk-bot","lark-bot","linebot","openclaw","slack-bot","telegrambot","wechat-bot","whatsapp-bot"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/rookiestar28.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"docs/SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-02-05T15:29:14.000Z","updated_at":"2026-04-18T13:35:09.000Z","dependencies_parsed_at":null,"dependency_job_id":"18db148a-ce69-4371-a9d9-7dbf5b9bf427","html_url":"https://github.com/rookiestar28/ComfyUI-OpenClaw","commit_stats":null,"previous_names":["rookiestar28/comfyui-openclaw"],"tags_count":13,"template":false,"template_full_name":null,"purl":"pkg:github/rookiestar28/ComfyUI-OpenClaw","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rookiestar28%2FComfyUI-OpenClaw","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rookiestar28%2FComfyUI-OpenClaw/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rookiestar28%2FComfyUI-OpenClaw/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rookiestar28%2FComfyUI-OpenClaw/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/rookiestar28","download_url":"https://codeload.github.com/rookiestar28/ComfyUI-OpenClaw/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rookiestar28%2FComfyUI-OpenClaw/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32191873,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-23T15:28:30.493Z","status":"ssl_error","status_checked_at":"2026-04-23T15:28:29.972Z","response_time":53,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["agent","agentic-ai","comfyui","comfyui-nodes","discord-bot","feishu-bot","kakaotalk-bot","lark-bot","linebot","openclaw","slack-bot","telegrambot","wechat-bot","whatsapp-bot"],"created_at":"2026-04-16T10:00:26.697Z","updated_at":"2026-04-23T18:01:08.040Z","avatar_url":"https://github.com/rookiestar28.png","language":"Python","funding_links":[],"categories":["Skills \u0026 Plugins","Workflows pushed in 7 days","Image, Video \u0026 Multimodal","Integrations \u0026 Extensions"],"sub_categories":["Third-Party Platforms"],"readme":"# ComfyUI-OpenClaw\n\n![OpenClaw /run command example](assets/run.png)\n\nComfyUI-OpenClaw is a **security-first orchestration layer** for ComfyUI that combines hardened automation APIs, embedded operator UX, and production deployment controls:\n\n- **LLM-assisted nodes** (planner/refiner/vision/batch variants)\n- **A built-in extension UI** (`OpenClaw` panel)\n- **A standalone Remote Admin Console** (`/openclaw/admin`) for mobile/remote browser operations\n- **A secure-by-default HTTP API** for automation (webhooks, triggers, schedules, approvals, presets, rewrite recipes, model manager)\n- **Public-ready control-plane split architecture** (embedded UX + externalized high-risk control surfaces)\n- **Verification-first hardening lanes** (staged coverage governance, test-debt governance, route drift, real-backend E2E, adversarial fuzz/mutation gates)\n- **Now supports 8 major messaging platforms, including Discord, Telegram, WhatsApp, LINE, WeChat, KakaoTalk, Slack, and Feishu/Lark.**\n- **And more exciting features being added continuously**\n\n---\n\u003cbr\u003e\n\n\u003cdiv align=\"center\"\u003e\n  \u003cimg src=\"assets/adminMobileConsole.png\" width=\"70%\" /\u003e\n\u003c/div\u003e\n\n\u003cbr\u003e\n\u003cbr\u003e\n\n```\nComfyUI Process (single Python process + shared aiohttp app)\n│\n├── ComfyUI Core (owned by ComfyUI)\n│   ├── Native routes: /prompt, /history, /view, /upload, /ws, ...\n│   └── Execution engine + model runtime\n│\n└── OpenClaw package (loaded from custom_nodes/comfyui-openclaw)\n    ├── Registers OpenClaw-managed routes into the same PromptServer app:\n    │   ├── /openclaw/*\n    │   ├── /api/openclaw/* (browser/API shim)\n    │   └── Legacy aliases: /moltbot/* and /api/moltbot/*\n    ├── Security/runtime modules (startup gate, RBAC, CSRF, HMAC, audit, SSRF controls)\n    ├── Automation services (approvals, schedules, presets, webhook/assist flows)\n    ├── State + secrets storage (openclaw_state/*)\n    ├── Embedded frontend extension (OpenClaw sidebar tabs) + remote admin page (/openclaw/admin)\n    └── ComfyUI nodes exported by this pack (planner/refiner/image-to-prompt/batch variants)\n\nOptional companion process (outside the ComfyUI process):\n└── Connector sidecar (Telegram/Discord/LINE/WhatsApp/WeChat/Kakao/Slack/Feishu) -\u003e calls OpenClaw HTTP APIs\n```\n\nThis project is designed to make **ComfyUI a reliable automation target** with an explicit admin boundary and hardened defaults.\n\u003cbr\u003e\n\n\u003cdetails\u003e\u003csummary\u003e\u003ch2\u003eSecurity stance (how this project differs from convenience-first automation packs) - Click to expand\u003c/h2\u003e\u003c/summary\u003e\n\n- Public and hardened deployment postures are fail-closed by design: shared-surface acknowledgement, startup gates, route-plane governance, and control-plane split all aim to reduce accidental exposure.\n- Admin writes, webhook ingress, and bridge worker paths are protected as explicit trust boundaries rather than convenience-only localhost helpers.\n- Connector ingress keeps allowlist and policy checks as first-class controls, with degraded/public posture handled deliberately instead of silently widening access.\n- Interactive connector actions are treated as a security boundary too: callback-capable platforms use signed envelopes, timestamp/replay guards, dedupe, and explicit policy mapping instead of trusting button actions as implicit admin intent.\n- Outbound egress is constrained: callback delivery and custom LLM base URLs stay behind SSRF-safe validation, exact-host policy, and explicit insecure overrides.\n- Secret handling stays server-side: browser storage is not used for secrets, local secret-manager integration is opt-in, and secrets-at-rest / token lifecycle controls are treated as operational boundaries.\n- Multi-tenant mode is isolation-first: tenant mismatches fail closed across config, secret sources, connector installations, approvals, visibility, and execution budgets.\n- Connector multi-workspace and multi-account bindings are secret-ref-only and fail-closed by design, so tenant/binding mismatches degrade to explicit rejection paths instead of silently reusing the wrong installation context.\n- Operator-facing payloads default to redaction for provider reasoning-like content, while audit trails, diagnostics, and runtime guardrails remain explicit and tamper-evident.\n- Verification is part of the security model: route drift checks, coverage governance, adversarial gates, and doctor/compatibility diagnostics are all wired into CI-parity workflows.\n\nDeployment profiles and hardening references:\n- [Security Deployment Guide](docs/security_deployment_guide.md)\n- [Security Key/Token Lifecycle SOP](docs/security_key_lifecycle_sop.md)\n- [Security Checklist](docs/security_checklist.md)\n- [Runtime Hardening and Startup](docs/runtime_hardening_and_startup.md)\n- [Threat Model](docs/release/threat_model.md)\n- [R69 Frontend Migration Decision](docs/r69_ui_framework_migration_decision.md)\n\n\u003c/details\u003e\n\n\n\n\u003cdetails\u003e\u003csummary\u003e\u003ch2\u003eLatest Updates - Click to expand\u003c/h2\u003e\u003c/summary\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003eVerification governance, config bootstrap hygiene, and connector env hardening aligned with the current runtime\u003c/strong\u003e\u003c/summary\u003e\n\n- Promoted the staged coverage-ratchet baseline to the enforced `45%` floor, added retained review-cycle evidence for hotspot families, and wired backend coverage collection through one shared local/CI helper instead of ad hoc `fail_under` edits.\n- Added focused connector and config/bootstrap hotspot regressions, reviewed the governed hotspot-family coverage summaries, and retired the temporary promotion-gap exceptions now that both promotion-blocking families are represented by explicit review evidence.\n- Added fail-closed test-debt governance for no-skip modules and mutation-survivor allowlist entries, with explicit `reason` and `review_after` metadata now enforced by the standard full-test flow.\n- Hardened pack metadata/version fallback parsing and made config/bootstrap imports side-effect-safe, so pack version fallback stays deterministic and importing config helpers no longer creates the state directory or log file before first real use.\n- Added bounded connector numeric env parsing for delivery, media, timeout, rate-limit, command-length, OAuth TTL, and bind-port settings, so malformed values degrade to documented defaults or clamps with warnings instead of crashing startup.\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003eOutput contract, outbound egress handling, Security Doctor structure, and audit verification tooling aligned with the current runtime\u003c/strong\u003e\u003c/summary\u003e\n\n- Kept `/history` + `/view` as the supported runtime output contract for current operator flows, and made asset-service-only refs stay explicit as a bounded fallback state instead of silently guessing a direct `/api/assets` fetch path.\n- Consolidated outbound safe HTTP execution behind one shared `safe_io` executor seam so local-provider checks, connector callbacks, and redirect handling now follow the same SSRF-safe validation, pinning, and redirect re-check rules.\n- Split Security Doctor internals into focused endpoint, runtime, connector, report, and remediation modules while keeping the operator-facing doctor API and remediation workflow unchanged.\n- Added retained audit-chain verification tooling, including a persisted `audit.log.key` sidecar when no environment key is provided, so operators can verify the current audit log plus retained rotations after restart or log rotation.\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003eProvider URL parity and CI harness resilience tightened for local LLM defaults and Playwright bootstrap stability\u003c/strong\u003e\u003c/summary\u003e\n\n- Fixed the built-in `Ollama (Local)` provider default so OpenClaw's OpenAI-compatible requests now target the correct `/v1` surface by default, and existing loopback-root overrides are normalized onto the same bounded path instead of failing on `/models` or `/chat/completions` at the daemon root.\n- Added a provider URL contract matrix that pins built-in provider defaults, adapter endpoint assembly, and bounded Ollama normalization in one regression lane so future `LM Studio`, `Ollama`, and custom OpenAI-compatible drift is caught before release.\n- Hardened the shared Playwright harness bootstrap so a single transient `openclaw.js` module-fetch failure in CI is retried once instead of failing the whole UI load, while still surfacing real import/runtime errors as hard test failures.\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003ePNG Info sidebar workflow added with ComfyUI metadata extraction, better large-image handling, and lower-noise operator alerts\u003c/strong\u003e\u003c/summary\u003e\n\n- Added a new `PNG Info` sidebar tab with drag-and-drop, file picker, scoped paste, preview rendering, prompt copy actions, structured summary cards, and raw metadata inspection for saved generation images.\n- Added backend metadata parsing for A1111 infotext and ComfyUI `prompt` / `workflow` metadata, including prompt/sampler/model/size extraction from standard ComfyUI graphs and a larger dedicated payload ceiling for original metadata-bearing images.\n- Improved operator-facing UX by making large-image failures explain the metadata-preservation constraint more clearly, letting the PNG Info input area scroll with the rest of the content, and moving prompt copy surfaces to the top of the information area.\n- Reduced noise in ComfyUI prompt extraction so generic custom `CLIPTextEncode*` nodes now prefer explicit prompt-bearing keys instead of surfacing parser/config strings as if they were prompt text.\n- Tightened queue-monitor alert sensitivity so sidebar startup races no longer generate persistent disconnect noise unless the backend stays unavailable long enough to look like a real incident.\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003eRepo-native CodeQL baseline and residual GitHub Security verification chain completed\u003c/strong\u003e\u003c/summary\u003e\n\n- Added a versioned GitHub Actions `CodeQL` workflow that scans Python, JavaScript/TypeScript, and GitHub Actions on push, pull request, manual dispatch, and a weekly schedule, so static security analysis now has an explicit in-repo baseline instead of depending only on opaque UI configuration.\n- Kept the rollout visibility-first: CodeQL is now a GitHub Actions security lane and documented CI boundary, but it is not treated as a new local mandatory full-SOP command; local acceptance stays seam-first while GitHub-hosted scanning owns the repository-wide static-analysis baseline.\n- Closed the acceptance-gap that surfaced during the residual verification push by propagating `defusedxml` through `requirements.txt`, preflight checks, local acceptance bootstraps, and CI preflight installation, with a repo-local dependency-parity regression seam to prevent future drift.\n- Re-ran the full existing pre-push acceptance gate successfully after the parity fix: detect-secrets, pre-commit, governance verification, backend full suites, real-backend lanes, adaptive adversarial gate, and Playwright E2E.\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003eSecurity hardening wave completed across CI permissions, path boundaries, redaction, connector ingress, notification rendering, and GitHub security closure\u003c/strong\u003e\u003c/summary\u003e\n\n- Verified the minimal Vite development-tooling hotfix path already merged cleanly, so the repo now resolves the patched `vite` version without broadening the frontend toolchain scope.\n- Added explicit least-privilege GitHub Actions `permissions:` declarations and a repo-local regression seam so workflow token scope drift is now treated as a tracked security regression instead of an implicit repository default.\n- Hardened checkpoint, integrity, and managed model-transfer path handling to fail closed on invalid IDs, traversal markers, and rebased install targets, with focused regression coverage on every flagged filesystem sink.\n- Replaced raw security-sensitive identifiers in bridge, auth, audit, proxy, and safe-IO diagnostics with stable redacted tags, and upgraded sensitive hashing paths to keyed constructions instead of plain or hardcoded hash inputs.\n- Tightened connector ingress failure handling so WeChat rejects unsafe XML declarations before parser entry, while Slack and Feishu return bounded external failure text/codes instead of echoing raw exception detail.\n- Added a targeted Playwright seam proving notification payloads render as escaped text rather than live markup, locking the production notification sink against future HTML-interpolation regressions.\n- Completed the GitHub-side closeout for the same wave by switching the repository from GitHub code-scanning default setup to the versioned advanced CodeQL workflow, dismissing the final residual CodeQL false positives with recorded rationale, resolving the historical docs-only secret-scanning false positive, and bringing GitHub `Code scanning` / `Secret scanning` back to `0` open findings as of `2026-04-08`.\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003eDesktop host parity lane, refreshed compatibility anchors, and live-backend mock parity completed\u003c/strong\u003e\u003c/summary\u003e\n\n- Added an executable desktop-host regression lane for the OpenClaw sidebar and Remote Admin Console, so desktop-specific runtime drift is now verified separately from standalone frontend assumptions instead of being left to unit-only host detection.\n- Added shared Playwright host/runtime shims and remote-admin baseline mocks so desktop-host metadata, approvals refresh behavior, and host-sensitive UI evidence stay deterministic under the test harness.\n- Refreshed the recorded compatibility anchors against the current reference ComfyUI, ComfyUI Frontend, and Desktop hosts, keeping desktop embedded-frontend lag explicit in the published compatibility matrix and governance checks.\n- Updated the mocked live-backend parity lane so image-output surfaces now return deterministic mocked output artifacts, closing the remaining preview/result gap in the real-backend-style E2E contract.\n- Re-validated the combined batch on WSL with the full SOP gate: detect-secrets, pre-commit, governance verification, backend full suites, strict implementation-record lint, real-backend lanes, adaptive adversarial gate, and Playwright E2E.\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003eFeishu connector chain completed with long-connection transport, tenant-aware bindings, and interactive approval callbacks\u003c/strong\u003e\u003c/summary\u003e\n\n- Added a Feishu/Lark connector baseline that supports both long-connection and webhook ingress modes, keeps transport behavior aligned through the shared connector authorization model, and makes host-domain differences explicit through `feishu` vs `lark` account binding metadata instead of ad hoc runtime branching.\n- Added Feishu account/workspace installation bindings with fail-closed resolution, tenant-aware diagnostics, normalized installation records, and support for multi-account binding manifests so one connector runtime can host more than one Feishu workspace contract safely.\n- Added Feishu interactive-card callback handling for approval and command actions, including signed callback envelopes, stale/replay rejection, duplicate-action dedupe, actor-context mapping, and explicit approval downgrade when untrusted users press run-affecting actions.\n- Updated the connector runtime so websocket-mode Feishu deployments also host the callback ingress surface, keeping interactive-card approvals available even when message ingress is handled over long connection instead of pure webhook mode.\n- Re-validated the full Feishu batch on WSL with the full SOP gate: detect-secrets, pre-commit, governance verification, backend full suites, strict implementation-record lint, real-backend lanes, adaptive adversarial gate, and Playwright E2E.\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003eSnapshot-first diagnostics, delta polling contracts, schema alignment, and optional-dependency import hardening completed\u003c/strong\u003e\u003c/summary\u003e\n\n- Moved Explorer inventory diagnostics onto a snapshot-first contract so `/openclaw/preflight/inventory` returns quickly with explicit `snapshot_ts`, `scan_state`, `stale`, and `last_error` metadata while deep refresh continues in the background.\n- Hardened event and managed-download polling around deterministic cursor metadata, so operator surfaces can resume from `effective` and `next` sequence markers instead of relying on duplicate-prone full refresh loops.\n- Unified webhook and managed-model request/documentation fixtures around one shared contract bundle, tightened model-import destination validation to reject traversal markers fail-closed, and kept the published API/OpenAPI surfaces aligned with the runtime validators.\n- Removed the remaining import-time `aiohttp` traps from high-impact route/service modules by moving them onto one bounded compatibility seam, so minimal environments degrade deterministically at call time instead of crashing on module import.\n- Re-validated the full batch on WSL with the full SOP gate: detect-secrets, pre-commit, governance verification, backend full suites, strict implementation-record lint, real-backend lanes, adaptive adversarial gate, and Playwright E2E.\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003eFrontend host compatibility, asset-backed output interop, and CI audit alignment completed\u003c/strong\u003e\u003c/summary\u003e\n\n- Hardened frontend host compatibility against current standalone frontend and desktop bundle drift by moving graph/widget compatibility logic onto shared host helpers, adding explicit sidebar host-surface stamping, and surfacing desktop embedded-frontend parity through compatibility diagnostics instead of implicit assumptions.\n- Added a bounded asset-output interoperability seam so classic ComfyUI history refs and newer asset-backed refs both resolve through the existing `/view` contract, preserving current temp/output behavior while allowing hash-backed previews where upstream metadata provides them.\n- Updated output/history-facing frontend and backend parsers together, so `Jobs` previews, callback payload image refs, and history extraction follow one canonical path rather than duplicating view-URL assembly logic in separate layers.\n- Refreshed compatibility anchors against the current reference repos and fixed the CI Python dependency audit path so the enforced audit checks declared project requirements instead of scanning unrelated runner/toolchain packages.\n- Re-validated the implementation on WSL with the full SOP gate: detect-secrets, pre-commit, backend full suites, strict implementation-record lint, adaptive adversarial gate, and Playwright E2E.\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003eException-fidelity cleanup and verification-governance baseline completed\u003c/strong\u003e\u003c/summary\u003e\n\n- Preserved original traceback origins on the remaining planner/refiner/vision/config failure paths and aligned request-time default `LLMClient` refresh so runtime config hot-reload no longer mutates long-lived service state just to get a fresh client.\n- Added explicit coverage governance in `pyproject.toml`, including the active `45%` `fail_under`, visible missing-line reporting, and skip-covered output, so baseline quality drift is no longer implicit.\n- Added a stdlib-only governance verifier that fails closed when coverage config, adversarial mutation thresholds, SOP guidance, or mutation-survivor allowlist shape drift away from the enforced baseline.\n- Wired the governance verifier into Linux/Windows full-test flows and the repo pre-push gate, keeping local CI-parity checks aligned with the enforced verification contract.\n- Re-validated the full implementation on WSL with the full SOP gate: detect-secrets, pre-commit, governance verification, backend full suites, adaptive adversarial gate, and Playwright E2E.\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003eMaintainability wave completed across routes, model operations, admin shell, and compatibility cleanup\u003c/strong\u003e\u003c/summary\u003e\n\n- Split route registration into focused route-family registrars while keeping one startup composition root and preserving legacy `/moltbot/*` plus `/api/*` fallback behavior.\n- Split Model Manager internals into dedicated catalog, task-lifecycle, and transfer/security service slices without changing the accepted managed-download, resume, import, and recovery contract.\n- Extracted sidebar notification/banner runtime and standalone admin-console browser logic into dedicated modules so the shell stays a composition root instead of a growing page-level hotspot.\n- Centralized runtime generation of legacy `moltbot-*` class aliases and removed residual duplicated node image-helper wrappers, so canonical `openclaw-*` markup and shared image encoding logic now have one maintained path.\n- Re-validated the full batch on WSL with the full SOP gate: detect-secrets, pre-commit, backend full suites, adaptive adversarial gate, and Playwright E2E.\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003eSlack multi-workspace installation flow completed, with final egress and notification-center hardening\u003c/strong\u003e\u003c/summary\u003e\n\n- Added Slack multi-workspace OAuth install/callback handling with single-use state validation, workspace-scoped installation binding, encrypted token refs, and workspace-aware reply routing for inbound events and delayed result delivery.\n- Expanded connector diagnostics so Slack installation health now surfaces stable fail-closed states such as `ok`, `invalid_token`, `revoked`, `workspace_unbound`, and `degraded` without exposing token material.\n- Moved Slack OAuth token exchange onto the same SSRF-safe outbound layer used by other protected network paths, closing the late-stage egress policy regression found during the full acceptance sweep.\n- Fixed a notification-center persistence regression so dismissed model-manager failure alerts stay hidden after reload instead of being immediately re-created by repeated background refresh failures, while historical storage remains intact.\n- Re-validated the final implementation on WSL with the full SOP gate: detect-secrets, pre-commit, backend full suites, adaptive adversarial gate, and Playwright E2E.\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003ePlanning, startup/config hardening, compatibility governance, and frontend hotspot reduction batch\u003c/strong\u003e\u003c/summary\u003e\n\n- Normalized the active planning surface onto `.planning/roadmap.md` and clarified the docs-only test-flow exemption in the project SOP guidance.\n- Hardened route/bootstrap registration around a declarative manifest and centralized validation seam so startup wiring is less fragile under delayed readiness and import-order edge cases.\n- Completed the next config-unification pass around one effective-config read facade, reducing precedence drift across backend and frontend-facing config consumers.\n- Centralized legacy compatibility handling for backend headers and frontend API/storage fallbacks so deprecation behavior is explicit, shared, and regression-covered.\n- Split the frontend shell hotspot and LLM model-list helper logic into smaller seams, then fixed the timer-binding regression uncovered during full-gate Playwright validation.\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003ePrivate-host LLM SSRF contract clarified across Remote Admin, docs, and deployment guidance\u003c/strong\u003e\u003c/summary\u003e\n\n- Clarified that `OPENCLAW_LLM_ALLOWED_HOSTS` only extends the exact public-host allowlist for custom LLM `base_url` values and does not permit private/reserved LAN targets by itself.\n- Updated Remote Admin and model-refresh SSRF error messages so operators can distinguish public-host allowlisting from the explicit insecure override required for private-IP targets.\n- Documented Windows portable env inheritance expectations, including the need to set variables before launching `python_embeded\\python.exe`, restart after changes, and avoid unsupported wildcard entries such as `*`.\n- Fixed request-time parity so Remote Admin validation, `/openclaw/llm/models`, and outbound provider requests now honor the same explicit insecure override for intentional private-host/HTTP LLM targets.\n- Added a pre-commit autofix guard that regenerates `docs/openapi.yaml` when OpenAPI contract/generator inputs change, preventing generated-spec drift from surfacing only at push time.\n- Added regression coverage for the clarified SSRF error contract and re-validated with the full SOP gate.\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003eInventory indexing moved to snapshot-first refresh with background deep-scan\u003c/strong\u003e\u003c/summary\u003e\n\n- Changed `/openclaw/preflight/inventory` to return a fast snapshot first, then refresh inventory state in the background instead of blocking on full directory traversal.\n- Added snapshot freshness/status metadata (`snapshot_ts`, `scan_state`, `stale`, `last_error`) so the API and explorer UI can surface refresh progress and degraded scan results explicitly.\n- Added bounded traversal checkpoints and background refresh scheduling to reduce latency spikes on large model directories while keeping later reads convergent.\n- Added backend regression coverage for snapshot, stale/error, and API-state transitions, then validated with the full SOP gate.\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003eModel Manager reliability upgrade: resumable downloads and restart-safe recovery\u003c/strong\u003e\u003c/summary\u003e\n\n- Added resumable managed download support using staged `.part` artifacts plus checkpoint metadata, so interrupted transfers can continue via HTTP Range when upstream contracts are compatible.\n- Added deterministic fallback-to-full restart paths when resume preconditions fail (range unsupported, validator drift, content-range mismatch) without bypassing existing provenance/SHA256 import gates.\n- Added persisted download task registry with startup recovery replay and bounded replay limit control (`OPENCLAW_MODEL_DOWNLOAD_RECOVERY_REPLAY_LIMIT`) to prevent unbounded restart churn.\n- Added backend regression coverage for resume success, fallback behavior, and replay-limit overflow handling, then validated with the full SOP gate.\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003eReasoning trace redaction hardening and privileged local-debug reveal gate\u003c/strong\u003e\u003c/summary\u003e\n\n- Added a shared reasoning-redaction boundary helper so reasoning/thinking-like fields are stripped by default from assist responses, event/SSE payloads, trace responses, callback payloads, and connector-facing trace formatting.\n- Added an explicit privileged reveal path that now requires request opt-in, server-side debug enablement, admin authorization, loopback source, and permissive local posture, with audit visibility for reveal attempts.\n- Kept final user-visible answers intact while preventing internal reasoning traces from leaking through default operator-facing serializers.\n- Closed a serializer compatibility regression found during full-gate validation and hardened WSL `/mnt/*` Playwright stability with environment-aware worker and readiness-timeout guardrails.\n- Validated with the full SOP gate on WSL (detect-secrets, pre-commit, backend full suite, real-backend lanes, adversarial gate, and frontend Playwright E2E).\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003eEmbedded model operations UX update: new Model Manager tab and Parameter Lab icon fix\u003c/strong\u003e\u003c/summary\u003e\n\n- Added a dedicated `Model Manager` sidebar tab for model search, managed download task queueing, task lifecycle monitoring, and completed-task import into managed install paths.\n- Added frontend regression coverage for the new tab flow (sidebar visibility/switching plus queue/import interaction path in Playwright E2E).\n- Fixed the `Parameter Lab` tab icon contract by using a PrimeIcon class so the tab icon renders correctly in the sidebar.\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003eMulti-tenant isolation baseline, optional local secret sourcing, and layered config unification completed\u003c/strong\u003e\u003c/summary\u003e\n\n- Added a fail-closed tenant boundary model with tenant-scoped config/secret resolution, connector installation isolation, approvals/presets/templates visibility boundaries, and per-tenant execution concurrency caps.\n- Added optional local 1Password CLI key sourcing with explicit enablement, command allowlist, template validation, and bounded fail-closed lookup behavior.\n- Unified config precedence across runtime/config/provider call paths around a shared layered resolver (`env \u003e runtime override \u003e persisted \u003e default`) with compatibility aliases preserved.\n- Completed full verification gate pass on `dev` (detect-secrets, pre-commit, backend unit suites, and frontend Playwright E2E).\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003eOptional local secret-manager baseline for safer key sourcing\u003c/strong\u003e\u003c/summary\u003e\n\n- Added a pluggable backend secret-provider chain for API keys (`env -\u003e optional 1Password CLI -\u003e encrypted server store -\u003e none`) so operators can keep runtime keys out of plaintext deployment config where needed.\n- Added fail-closed 1Password guardrails requiring explicit enablement, executable allowlist, command path validation, and bounded lookup timeout behavior.\n- Added regression coverage for precedence resolution, allowlist/failure fallback behavior, and no-secret-leak logging expectations.\n- Completed full verification gate pass on `dev` (detect-secrets, pre-commit, backend unit suites, adversarial/retry/real-backend lanes, and frontend Playwright E2E).\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003eToday’s implementation roundup across frontend quality, planner contracts, and connector security baselines\u003c/strong\u003e\u003c/summary\u003e\n\n- Completed the frontend quality bundle by stabilizing canonical style ownership, adding baseline frontend unit coverage, and expanding regression coverage for Library/Approvals/admin-console parity.\n- Completed SSRF pinning regression hardening with dedicated no-skip coverage for pinned connect paths, multi-IP failover ordering, and TLS wrap degradation branches.\n- Completed planner profile/system-prompt externalization with validated file-backed registry loading, runtime-safe fallback/reload behavior, and synchronized profile sourcing across API, node, and Planner tab.\n- Completed connector contract baseline with multi-workspace installation lifecycle registry, encrypted token references, fail-closed workspace resolution, and reusable interactive callback security decisions (signature/timestamp/hash/replay/idempotency/policy mapping) plus admin diagnostics APIs.\n- Completed full verification gate pass on `dev` (detect-secrets, pre-commit, backend unit suites, adversarial/retry/real-backend lanes, and frontend Playwright E2E).\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003eConnector multi-workspace installation and interactive callback contract baseline\u003c/strong\u003e\u003c/summary\u003e\n\n- Added a persistent connector installation registry with normalized installation identity (`platform`, `workspace_id`, `installation_id`, `token_refs`, `status`, `updated_at`) and explicit lifecycle transitions (`created`, `active`, `rotating`, `revoked`, `deactivated`, `uninstalled`).\n- Enforced fail-closed workspace resolution for connector ingress (`missing`, `ambiguous`, `inactive`, and `stale token ref` bindings are rejected deterministically).\n- Added reusable interactive callback security contract primitives (signed envelope, timestamp window, payload hash verification, replay/idempotency enforcement, ack/deferred callback lifecycle, and policy mapping to `public` / `run` / `admin` with explicit force-approval handling).\n- Added admin read/diagnostic APIs for connector installation state, resolution evidence, and lifecycle audit visibility, with redacted outputs only.\n- Completed full verification gate pass on `dev` (detect-secrets, pre-commit, backend unit suites, adversarial/retry/real-backend lanes, and frontend Playwright E2E).\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003ePlanner registry externalization with runtime-safe profile alignment\u003c/strong\u003e\u003c/summary\u003e\n\n- Moved planner profiles and the planner system prompt into validated file-backed defaults under `data/planner/`, with state-dir override precedence for operator-managed customization without source edits.\n- Added a planner profile list API so the Assist planner route, Prompt Planner node, and Planner tab resolve profiles from one synchronized source-of-truth.\n- Kept runtime behavior fail-closed with schema validation, prompt placeholder validation, embedded fallback defaults, and lazy reload on planner file changes.\n- Completed full verification gate pass on `dev` (detect-secrets, pre-commit, backend unit suites, adversarial/retry/real-backend lanes, and frontend Playwright E2E).\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003eFrontend quality baseline for Library and Approvals surfaces\u003c/strong\u003e\u003c/summary\u003e\n\n- Canonicalized active frontend styling ownership around `openclaw-*`, including shell/tab-manager cleanup and a deterministic split of `web/openclaw.css` into core and legacy-alias modules.\n- Added a frontend unit-test lane with Vitest + jsdom plus baseline coverage for shared UI helpers and extracted Library tab state logic.\n- Expanded Playwright coverage for `Library` and `Approvals`, including success/degraded paths and approvals parity between the sidebar and the Remote Admin Console.\n- Completed full verification gate pass (detect-secrets, pre-commit, backend unit suites, adversarial/retry/real-backend lanes, and frontend Playwright E2E).\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003eAudit event clarity and connector ingress fail-closed hardening\u003c/strong\u003e\u003c/summary\u003e\n\n- Normalized audit helper behavior so config/secret/LLM-test convenience wrappers now emit one canonical audit event per action, reducing duplicate noise while preserving legacy compatibility paths.\n- Added shared connector allowlist posture evaluation and enforced fail-closed startup behavior for public/hardened deployments when connector ingress is active without allowlist coverage.\n- Kept local/permissive posture as warning-only, with synchronized visibility across startup checks, deployment profile checks, and Security Doctor diagnostics.\n- Added focused regression coverage and completed full verification gate pass (detect-secrets, pre-commit, backend unit suites, and frontend Playwright E2E).\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003eStartup fail-closed bootstrap hardening and public boundary guardrail\u003c/strong\u003e\u003c/summary\u003e\n\n- Enforced strict fail-closed startup propagation so bootstrap security-gate failures are no longer logged-and-continued; route/worker registration now aborts deterministically on fatal startup failures.\n- Added an explicit public deployment boundary acknowledgement contract:\n  - `OPENCLAW_PUBLIC_SHARED_SURFACE_BOUNDARY_ACK=1` (legacy alias supported)\n  - public profile gate now fails deterministically when this acknowledgement is missing.\n- Added a dedicated Security Doctor boundary posture check and machine-readable environment marker so shared ComfyUI/OpenClaw surface risk is visible to operators.\n- Synchronized deployment/operator docs for public boundary controls (reverse proxy path allowlist + network ACL requirements).\n- Completed full verification gate pass (detect-secrets, pre-commit, backend unit suites, and frontend Playwright E2E).\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003eCore runtime maintainability and contract hardening batch\u003c/strong\u003e\u003c/summary\u003e\n\n- Refactored startup/bootstrap responsibilities into clearer service slices to keep the entry path thin and easier to validate.\n- Hardened provider adapter error contracts with safer HTTP error propagation and retry-after handling consistency.\n- Replaced fragile JSON object extraction logic in LLM output parsing with stdlib decoder-based behavior for stronger edge-case resilience.\n- Unified node/runtime consistency by converging shared image encoding helpers and internal node naming compatibility paths.\n- Added and aligned regression coverage, then completed full verification gate pass (detect-secrets, pre-commit, backend unit suites, and frontend Playwright E2E).\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003eSecurity and reliability hotfix chain: startup gate cleanup, atomic audit writes, and clearer CSRF override posture\u003c/strong\u003e\u003c/summary\u003e\n\n- Cleaned up unreachable startup security-gate code after fatal raise paths, keeping fail-closed behavior explicit and reducing maintenance ambiguity.\n- Hardened append-only audit integrity by making hash-chain write flow atomic under a process lock to avoid concurrent chain-fork risk.\n- Added explicit startup warning when localhost no-origin override is enabled, plus a dedicated Security Doctor posture check/violation mapping for operator visibility.\n- Added focused regression coverage for startup warning/doctor posture and audit lock path behavior.\n- Completed full verification gate pass (detect-secrets, pre-commit, backend unit suites, and frontend Playwright E2E).\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003eStandalone remote admin mobile console for phone/desktop operations\u003c/strong\u003e\u003c/summary\u003e\n\n- Added an independent remote admin entry page at `/openclaw/admin` (legacy `/moltbot/admin`), separate from the ComfyUI side panel.\n- Added a mobile-first admin console layout for operational flows:\n  - dashboard (health, provider/key state, scheduler/runs summary, recent error lines)\n  - jobs/events (recent runs + SSE connect/poll fallback)\n  - approvals (approve/reject)\n  - schedules/triggers (toggle/run/fire)\n  - config (read + guarded write)\n  - doctor/diagnostics and quick actions (retry/model refresh/drill via existing policy gates)\n- Preserved backend security boundaries: remote write actions still require explicit admin-token and remote-admin policy conditions.\n- Completed full verification gate pass (detect-secrets, pre-commit, backend unit suites, and frontend Playwright E2E).\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003eExecutor lane split and callback I/O isolation for better saturation resilience\u003c/strong\u003e\u003c/summary\u003e\n\n- Added dedicated executor lanes for LLM vs I/O workloads with bounded worker controls.\n- Migrated callback delivery and outbound HTTP callback paths to the I/O lane, reducing interference with LLM execution paths.\n- Added queue/saturation diagnostics and executor metrics exposure in health/stat telemetry.\n- Added targeted regression coverage for lane split behavior and callback I/O lane migration.\n- Completed full verification gate pass (detect-secrets, pre-commit, backend unit suites, and frontend Playwright E2E).\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003eRuntime lifecycle consistency, structured logging opt-in, and generated OpenAPI spec\u003c/strong\u003e\u003c/summary\u003e\n\n- Completed a focused runtime operability and contract maturity batch with full SOP verification:\n  - added graceful shutdown/reset consistency hooks so scheduler/failover runtime state flushes and resets are deterministic\n  - added opt-in structured JSON logging for core execution paths (including queue submit and LLM client) with bounded metadata events\n  - added machine-readable OpenAPI spec generation and committed `docs/openapi.yaml` for integrator/review tooling use\n  - added regression coverage for runtime lifecycle state handling, structured logging behavior, and OpenAPI generation drift\n  - completed full verification gate pass (detect-secrets, pre-commit, backend unit suites, and frontend Playwright E2E)\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003eAssist streaming UX and frontend fetch-wrapper safety hardening\u003c/strong\u003e\u003c/summary\u003e\n\n- Completed a focused assist UX + frontend transport reliability batch with full SOP verification:\n  - added optional streaming assist paths for Planner/Refiner with incremental preview updates and staged progress events\n  - added backend streaming endpoints for planner/refiner assist flows with capability-gated frontend enablement and safe fallback to the existing non-stream path\n  - added frontend live preview rendering for Planner/Refiner while preserving cancel/stale-response safety behavior\n  - added idempotent fetch-wrapper composition guards to prevent duplicate wrapper stacking during repeated frontend bootstrap/setup\n  - added backend/parser/frontend regression coverage for streaming assist behavior and fetch-wrapper idempotence, plus full verification gate pass (detect-secrets, pre-commit, backend unit suites, and frontend Playwright E2E)\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003eRecent hardening and reliability improvements: runtime guardrails, crypto drills, compatibility governance, and safer management queries\u003c/strong\u003e\u003c/summary\u003e\n\n- Completed a focused reliability + operations hardening batch with full SOP verification:\n  - consolidated shared frontend/backed helper paths to reduce duplicated cancellation, JSON parsing, and import-fallback logic\n  - added runtime guardrails diagnostics/contract enforcement so runtime-only safety limits stay visible and cannot be persisted back into config\n  - added cryptographic lifecycle drill automation with machine-readable evidence for rotation, revoke, key-loss recovery, and token-compromise scenarios\n  - added compatibility matrix governance metadata plus a refresh workflow script and operator-doctor freshness/drift warnings\n  - hardened management query pagination behavior with deterministic malformed-input handling, bounded scans, and clearer cursor diagnostics for admin/event list paths\n  - completed full verification gate pass (detect-secrets, pre-commit, backend unit suites, and frontend Playwright E2E)\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003eLatest completion: automation composer endpoint, safer payload drafting, and full verification pass\u003c/strong\u003e\u003c/summary\u003e\n\n- Completed the automation payload composer flow for safe draft generation:\n  - added a new admin-only compose endpoint for trigger/webhook payload drafts (generate-only, no execution side effects)\n  - added strict server-side validation and normalization for trigger/webhook draft payloads\n  - added tool-calling schema support for automation payload composition with deterministic fallback behavior\n  - exposed composer capability flag for frontend/runtime feature probing\n  - added and extended backend tests for API handler, composer service, schema/validator coverage, and capability contract\n  - completed full validation gate pass (detect-secrets, pre-commit, backend test lanes, adversarial smoke gate, and frontend Playwright E2E)\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003eSlack app support closeout: secure Events API ingress, connector parity, and no-skip verification lanes\u003c/strong\u003e\u003c/summary\u003e\n\n- Completed Slack implementation hardening chain with full SOP validation:\n  - added Slack Events API adapter with signed ingress checks, replay/dedupe handling, bot-loop suppression, allowlist enforcement, and thread-aware reply delivery\n  - wired Slack runtime policy into existing connector authorization boundaries so command trust behavior stays consistent with other platforms\n  - added dedicated Slack verification lanes for ingress contract coverage and real-backend flow parity, both enforced by skip-policy and full-test scripts\n  - added optional Slack Socket Mode fallback transport with fail-closed startup checks and transport-parity behavior aligned to Events API safety controls\n  - expanded observability redaction coverage for Slack token families and added endpoint-level drift tests for logs/trace/config safety\n  - aligned local full-test scripts so Slack phase-2 suites run explicitly as part of the Slack integration gate step\n  - synchronized verification evidence through detect-secrets, pre-commit, backend unit + real lanes, adversarial gate, and frontend E2E full pass\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003ePost-Wave E closeout: Hardening chain completed\u003c/strong\u003e\u003c/summary\u003e\n\n- Completed on 2026-02 with full SOP validation:\n  - Bundle A: established security invariants registry and startup/CI invariant gates, plus route-plane explicit-classification governance to prevent unmanaged endpoint exposure drift\n  - Bundle B: converged outbound egress to a single safe path and added CI/local dependency parity preflight to prevent local-pass/CI-fail runtime drift\n  - Bundle C: added adversarial verification execution gates (bounded fuzz + mutation smoke with artifacts) and dual-lane retry partition hardening for deterministic degrade/audit behavior\n  - end-to-end verification evidence was synchronized across CI, local full-test scripts, and implementation records\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003eWave E closeout: deployment guardrails, contract parity, and verification hardening chain completed\u003c/strong\u003e\u003c/summary\u003e\n\n- Completed Wave E with full SOP validation:\n  - Bundle A delivered startup deployment gate enforcement and deployment-profile matrix parity, then locked critical operator flow parity (including degraded-path behavior)\n  - Bundle B closed security contract parity gaps across token/mapping/route/signature state matrices and threat-intel resilience paths\n  - Bundle C completed signed policy posture control, bounded security anomaly telemetry, deterministic adversarial fuzz harness coverage, and mutation-baseline evidence generation\n  - full detect-secrets + pre-commit + backend unit + frontend E2E gate passed and evidence is recorded in the Bundle C implementation record\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003eWave D closeout: control-plane split, ingress and supply-chain hardening, and verification governance baseline\u003c/strong\u003e\u003c/summary\u003e\n\n- Completed Wave D closeout full SOP validation:\n  - enforced split-mode control-plane boundaries for public deployments while preserving embedded daily UX flows\n  - finalized external control-plane adapter reliability behavior and split-mode degraded/blocked-action guidance\n  - completed secrets-at-rest hardening v2 with split-compatible secret-reference behavior\n  - closed bridge token lifecycle, legacy webhook ingress clamp, and public MAE route-plane enforcement gaps\n  - replaced registry signature placeholder posture with trust-root based cryptographic verification and signer governance\n  - established verification governance baseline with skip-budget enforcement, reject/degrade triple-assert contracts, and defect-first record lint gating\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003eWave A/B/C closeout: stability baseline, high-risk security gates, and operator UX completion\u003c/strong\u003e\u003c/summary\u003e\n\n- Completed baseline runtime/config/connector stability improvements:\n  - runtime provenance and manager-aware environment freshness checks\n  - safer config merge behavior for object arrays\n  - connector session invalidation resilience for 401/410 revoke paths\n  - durable replay/idempotency storage for webhook/bridge flows\n  - stricter outbound egress policy controls for callback and LLM targets\n- Completed high-risk security and supply-chain hardening:\n  - stronger external tool path resolution and allowlist enforcement\n  - bridge/device binding hardening with mTLS validation controls\n  - pack archive canonicalization and full manifest coverage enforcement\n  - global DoS governance (quota/priority/storage controls)\n  - signed release provenance pipeline and SBOM-integrity validation\n- Completed Wave C operator UX and functionality closeout:\n  - Wave C functionality closeout accepted on 2026-02-18 with full SOP validation\n  - deterministic operator guidance banners and deep-link recovery behavior\n  - capability-aware in-canvas quick actions with guarded mutation flow\n  - Parameter Lab schema lock and bounded sweep/compare orchestration\n  - compare winner-selection safety contract and expanded Wave C regression coverage\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\n\u003csummary\u003e\u003cstrong\u003eAudit trail and external tool sandbox hardening closeout\u003c/strong\u003e\u003c/summary\u003e\n\n- Added non-repudiation audit coverage for sensitive config/secrets/tools/approvals/bridge and startup-dangerous-override paths.\n- Standardized audit envelopes and append-only hash-chain logging to improve forensic traceability.\n- Added stricter external tool sandbox controls:\n  - hardened-mode fail-closed when sandbox posture/runtime is unsafe\n  - explicit network allowlist requirement when tooling enables egress\n  - pre-exec filesystem path allowlist enforcement for tool arguments\n- Expanded security regression coverage for audit contract paths and sandbox policy enforcement.\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cstrong\u003eEndpoint inventory hardening and route drift detection coverage\u003c/strong\u003e\u003c/summary\u003e\n\n- Added explicit endpoint security metadata across API handlers so auth/risk posture is machine-readable and auditable.\n- Added route inventory manifest generation to inspect registered API surfaces consistently.\n- Added drift regression tests that fail when any registered endpoint is missing security metadata.\n- Extended drift coverage to include optional bridge and packs routes to prevent false-green route scans.\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cstrong\u003eOperator UX improvements: context toolbox, parameter lab history/replay, and compare workflow baseline\u003c/strong\u003e\u003c/summary\u003e\n\n- Added in-canvas OpenClaw quick actions on node context menus: Inspect, Doctor, Queue Status, Compare, and Settings.\n- Improved operator recovery flow by wiring quick actions to capability-aware targets with deterministic fallback guidance when optional endpoints are unavailable.\n- Added Parameter Lab history flow so operators can browse saved experiments, load details, and replay run parameters back into the current graph.\n- Added compare workflow baseline in Parameter Lab, including a dedicated compare endpoint with bounded fan-out and stricter payload validation.\n- Expanded auth and regression coverage so compare routes remain admin-protected and route-registration drift is caught earlier.\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cstrong\u003ePack security hardening: path traversal defense and strict API validation\u003c/strong\u003e\u003c/summary\u003e\n\n- Added path traversal protection for pack uninstall and pack path resolution.\n- Hardened pack install path construction by validating pack metadata segments (`name`, `version`) and enforcing root-bounded path resolution.\n- Added stricter input validation on pack API route handlers for pack lifecycle operations.\n- Expanded regression coverage for traversal attempts and invalid input handling in pack flows.\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cstrong\u003eRuntime profile hardening and bridge startup compatibility checks\u003c/strong\u003e\u003c/summary\u003e\n\n- Added explicit runtime profiles with centralized resolution so startup behavior is deterministic across environments.\n- Added a hardened startup security gate that fails closed when mandatory controls are not correctly configured.\n- Added module capability boundaries so routes/workers only boot when their owning module is enabled.\n- Added a bridge protocol handshake path with version compatibility checks during sidecar startup.\n- Expanded regression coverage for profile resolution, startup gating, module boundaries, and bridge handshake behavior.\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cstrong\u003eConnector platform parity and sidecar worker runtime improvements\u003c/strong\u003e\u003c/summary\u003e\n\n- Added stronger KakaoTalk response handling:\n  - strict QuickReply cap with safe truncation\n  - empty-response guard to avoid invalid platform payloads\n  - more predictable output shaping and sanitization behavior\n- Added WeChat Official Account encrypted webhook support:\n  - AES encrypted ingress (`encrypt_type=aes`) with signature verification and fail-closed decrypt/app-id validation\n  - expanded event normalization coverage (`subscribe`, `unsubscribe`, `CLICK`, `VIEW`, `SCAN`)\n  - deterministic dedupe behavior for event payloads without `MsgId`\n  - bounded ACK-first flow with deferred reply handling for slow paths\n- Added sidecar worker bridge alignment end-to-end:\n  - worker poll/result/heartbeat bridge endpoints\n  - contract-driven sidecar client endpoint resolution and idempotency header behavior\n  - dedicated E2E test coverage for worker route registration, auth, and round-trip behavior\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cstrong\u003eSecurity Hardening: Auth/Observability boundaries, connector command controls, registry trust policy, transform isolation, integrity checks, and safe tooling controls\u003c/strong\u003e\u003c/summary\u003e\n\n- Delivered observability tier hardening with explicit sensitivity split:\n  - Public-safe: `/openclaw/health`\n  - Observability token: `/openclaw/config`, `/openclaw/events`, `/openclaw/events/stream`\n  - Admin-only: `/openclaw/logs/tail`, `/openclaw/trace/{prompt_id}`, `/openclaw/secrets/status`, `/openclaw/security/doctor`\n- Delivered constrained transform isolation hardening:\n  - process-boundary execution via `TransformProcessRunner`\n  - timeout/output caps and network-deny worker posture\n  - feature-gated default-off behavior for safer rollout\n- Delivered approval/checkpoint integrity hardening:\n  - canonical JSON + SHA-256 integrity envelopes\n  - tamper detection and fail-closed handling on integrity violations\n  - migration-safe loading behavior for legacy persistence files\n- Delivered external tooling execution policy:\n  - allowlist-driven tool definitions (`data/tools_allowlist.json`)\n  - strict argument validation, bounded timeout/output, and redacted output handling\n  - gated by `OPENCLAW_ENABLE_EXTERNAL_TOOLS` plus admin access policy\n- Extended security doctor coverage with wave-2 checks:\n  - validates transform isolation posture\n  - reports external tooling posture\n  - verifies integrity module availability\n- Auth-coverage contract tests were updated to include new tool routes and prevent future route-auth drift regressions.\n- Added connector command authorization hardening:\n  - separates command visibility from command execution privileges\n  - centralizes per-command access checks to reduce cross-platform auth drift\n  - supports explicit allow-list policy controls for sensitive command classes\n  - adds operator-configurable command policy controls via `OPENCLAW_COMMAND_OVERRIDES` and `OPENCLAW_COMMAND_ALLOW_FROM_{PUBLIC|RUN|ADMIN}`\n- Added registry anti-abuse controls for remote distribution paths:\n  - bounded request-rate controls and deduplication windows reduce abuse and accidental hot loops\n  - stale anti-abuse state pruning keeps long-running deployments stable\n- Added registry preflight and trust-policy hardening:\n  - static package safety checks are enforced before activation paths\n  - policy-driven signature/trust posture supports audit and strict enforcement modes\n  - registry trust mode is operator-controlled via `OPENCLAW_REGISTRY_POLICY` and preflight verification enforces fail-closed file-path requirements\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cstrong\u003eSprint A: closes out with five concrete reliability and security improvements\u003c/strong\u003e\u003c/summary\u003e\n\n- Configuration save/apply now returns explicit apply metadata, so callers can see what was actually applied, what requires restart, and which effective provider/model is active.\n- The Settings update flow adds defensive guards against stale or partial state, reducing accidental overwrites.\n- Provider/model precedence is now deterministic across save, test, and chat paths, and prevents model contamination when switching providers.\n- In localhost convenience mode (no admin token configured), chat requests enforce same-origin CSRF protection: same-origin requests are allowed, cross-origin requests are denied.\n- Model-list fetching now uses a bounded in-memory cache keyed by provider and base URL, with a 5-minute TTL and LRU eviction cap to improve responsiveness and stability.\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cstrong\u003eSprint B: ships security doctor diagnostics, registry quarantine gates, and constrained transforms defaults\u003c/strong\u003e\u003c/summary\u003e\n\n- Added the Security Doctor surface (`GET /openclaw/security/doctor`) for operator-focused security posture checks across endpoint exposure, token boundaries, SSRF posture, state-dir permissions, redaction drift, runtime mode, feature flags, and API key posture.\n- Added optional remote pack registry quarantine controls with explicit lifecycle states, SHA256 integrity verification, bounded local persistence, and per-entry audit trail; this path remains disabled by default and fail-closed.\n- Added optional constrained transform execution with trusted-directory + integrity pinning, timeout and output-size caps, and bounded chain execution semantics; transforms remain disabled by default and mapping-only behavior remains intact unless explicitly enabled.\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cstrong\u003eSettings contract, frontend graceful degradation, and provider drift governance\u003c/strong\u003e\u003c/summary\u003e\n\n- Enforced a strict settings write contract with schema-coerced values and explicit unknown-key rejection, reducing save/apply regressions across ComfyUI variants.\n- Hardened frontend behavior to degrade safely when optional routes or runtime capabilities are unavailable, with clearer recovery hints instead of brittle failures.\n- Added provider alias/deprecation governance and normalization coverage to reduce preset drift as upstream model IDs and endpoint shapes evolve.\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cstrong\u003eMapping v1, job event stream, and operator doctor\u003c/strong\u003e\u003c/summary\u003e\n\n- Added webhook mapping engine v1 with declarative field mapping + type coercion, enabling external payload normalization without custom adapter code paths.\n- Added real-time job event stream support via SSE (`/openclaw/events/stream`) with bounded buffering and polling fallback (`/openclaw/events`) for compatibility.\n- Added Operator Doctor diagnostics tooling for runtime/deployment checks (Python/Node environment, state-dir posture, and contract readiness signals).\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cstrong\u003e Security doctor, registry quarantine, and constrained transforms\u003c/strong\u003e\u003c/summary\u003e\n\n- Added Security Doctor diagnostics surface (`GET /openclaw/security/doctor`) for operator-focused security posture checks and guarded remediation flow.\n- Added optional remote registry quarantine lifecycle controls with integrity verification, bounded local persistence, and explicit trust/audit gates.\n- Added optional constrained transform execution with integrity pinning, timeout/output caps, and bounded chain semantics; default posture remains disabled/fail-closed.\n\n\u003c/details\u003e\n\n\u003c/details\u003e\n\n## Table of Contents\n\n- [Installation](#installation)\n- [Quick Start (Minimal)](#quick-start-minimal)\n  - [Configure an LLM key](#1-configure-an-llm-key-for-plannerrefinervision-helpers)\n  - [Configure webhook auth](#2-configure-webhook-auth-required-for-webhook)\n  - [Set an Admin Token](#3-optional-recommended-set-an-admin-token)\n- [Remote Admin Console (Mobile UI)](#remote-admin-console-mobile-ui)\n  - [Environment variables for remote admin](#environment-variables-for-remote-admin)\n  - [Connection from phone or other devices](#connection-from-phone-or-other-devices)\n  - [Basic operations](#basic-operations)\n  - [Reverse proxy and exposure notes](#reverse-proxy-and-exposure-notes)\n- [Nodes](#nodes)\n- [Extension UI](#extension-ui)\n  - [Sidebar Modules](#sidebar-modules)\n- [Operator UX Features](#operator-ux-features)\n  - [Notification Center](#notification-center)\n- [API Overview](#api-overview)\n- [Templates](#templates)\n- [Execution Budgets](#execution-budgets)\n- [LLM Failover](#llm-failover)\n- [Advanced Security and Runtime Setup](#advanced-security-and-runtime-setup)\n- [State Directory \u0026 Logs](#state-directory--logs)\n- [Audit Chain Verification](#audit-chain-verification)\n- [Troubleshooting](#troubleshooting)\n- [Tests](#tests)\n- [Updating](#updating)\n- [Remote Control (Connector)](#remote-control-connector)\n- [Security](#security)\n  - [Security Deployment Guide](#security-deployment-guide)\n  - [Deployment Self-check Command](#deployment-self-check-command)\n\n---\n\n## Installation\n\n- ComfyUI-Manager: install as a custom node (recommended for most users), then restart ComfyUI.\n- Git (manual):\n  - `git clone \u003crepo\u003e ComfyUI/custom_nodes/comfyui-openclaw`\n\nAlternative install options:\n\n1. Copy/clone this repository into your ComfyUI `custom_nodes` folder\n2. Restart ComfyUI.\n\nIf the UI loads but endpoints return 404, ComfyUI likely did not load the Python part of the pack (see Troubleshooting).\n\n## Quick Start (Minimal)\n\n### 1 Configure an LLM key (for Planner/Refiner/vision helpers)\n\nSet at least one of:\n\n- `OPENCLAW_LLM_API_KEY` (generic)\n- Provider-specific keys from the provider catalog (preferred; see `services/providers/catalog.py`)\n\nProvider/model configuration can be set via env or `/openclaw/config` (admin boundary; localhost-only convenience if no Admin Token configured).\n\nNotes:\n\n- Recommended: set API keys via environment variables.\n- Optional: for single-user localhost setups, you can store a provider API key from the Settings tab (UI Key Store (Advanced)).\n  - This writes to the server-side secret store (`{STATE_DIR}/secrets.json`).\n  - Environment variables always take priority over stored keys.\n- Built-in local-provider defaults use loopback-only OpenAI-compatible URLs:\n  - `Ollama (Local)` -\u003e `http://127.0.0.1:11434/v1`\n  - `LM Studio (Local)` -\u003e `http://localhost:1234/v1`\n\n### 2 Configure webhook auth (required for `/webhook*`)\n\nWebhooks are **deny-by-default** unless auth is configured:\n\n- `OPENCLAW_WEBHOOK_AUTH_MODE=bearer` and `OPENCLAW_WEBHOOK_BEARER_TOKEN=...`\n- or `OPENCLAW_WEBHOOK_AUTH_MODE=hmac` and `OPENCLAW_WEBHOOK_HMAC_SECRET=...`\n- or `OPENCLAW_WEBHOOK_AUTH_MODE=bearer_or_hmac` to accept either\n- optional replay protection: `OPENCLAW_WEBHOOK_REQUIRE_REPLAY_PROTECTION=1`\n\n### 3 Optional (recommended): set an Admin Token\n\nAdmin/write actions (save config, `/llm/test`, key store) are protected by the **Admin Token**:\n\n- If `OPENCLAW_ADMIN_TOKEN` (or legacy `MOLTBOT_ADMIN_TOKEN`) is set, clients must send it via `X-OpenClaw-Admin-Token`.\n- If no admin token is configured, admin actions are allowed on **localhost only** (convenience mode). Do not use this mode on shared/public deployments.\n\nRemote admin actions are denied by default. If you understand the risk and need remote administration, opt in explicitly:\n\n- `OPENCLAW_ALLOW_REMOTE_ADMIN=1`\n\nPublic profile boundary acknowledgement (required when `OPENCLAW_DEPLOYMENT_PROFILE=public`):\n\n- `OPENCLAW_PUBLIC_SHARED_SURFACE_BOUNDARY_ACK=1`\n  - set this only after your reverse proxy path allowlist + network ACL explicitly block ComfyUI-native high-risk routes (`/prompt`, `/history*`, `/view*`, `/upload*`, `/ws`, and `/api/*` equivalents)\n\n### Windows env var tips (PowerShell / CMD / portable .bat / Desktop)\n\n- PowerShell (current session only):\n  - `$env:OPENCLAW_LLM_API_KEY=\"\u003cYOUR_API_KEY\u003e\"`\n  - `$env:OPENCLAW_ADMIN_TOKEN=\"\u003cYOUR_ADMIN_TOKEN\u003e\"`\n  - `$env:OPENCLAW_LOG_TRUNCATE_ON_START=\"1\"` (optional: clear previous `openclaw.log` at startup)\n- PowerShell (persistent; takes effect in new shells):\n  - `setx OPENCLAW_LLM_API_KEY \"\u003cYOUR_API_KEY\u003e\"`\n  - `setx OPENCLAW_ADMIN_TOKEN \"\u003cYOUR_ADMIN_TOKEN\u003e\"`\n  - `setx OPENCLAW_LOG_TRUNCATE_ON_START \"1\"` (optional)\n- CMD (current session only): `set OPENCLAW_LLM_API_KEY=\u003cYOUR_API_KEY\u003e`\n- Portable `.bat` launchers: add `set OPENCLAW_LLM_API_KEY=...` / `set OPENCLAW_ADMIN_TOKEN=...` (optionally `set OPENCLAW_LOG_TRUNCATE_ON_START=1`) before launching ComfyUI.\n- Windows note: changing env vars in System Properties or with `setx` does not update an already-running portable ComfyUI process; fully restart the launcher so `python_embeded\\\\python.exe` inherits the new values.\n- ComfyUI Desktop: if env vars are not passed through reliably, prefer the Settings UI key store for localhost-only convenience, or set system-wide env vars.\n\n## Remote Admin Console (Mobile UI)\n\nThe project now includes a standalone admin UI endpoint for mobile/remote operations:\n\n- primary: `/openclaw/admin`\n- legacy alias: `/moltbot/admin`\n\nThis page is independent from the embedded ComfyUI side panel and is intended for phone/desktop browsers.\n\nImplementation shape:\n\n- static shell: `web/admin_console.html`\n- runtime app module: `web/admin_console_app.js`\n- runtime API client module: `web/admin_console_api.js`\n\n### Environment variables for remote admin\n\nRecommended baseline before enabling remote administration:\n\n- `OPENCLAW_ADMIN_TOKEN=\u003cstrong-secret\u003e`\n  - required for authenticated write/admin operations from remote devices\n- `OPENCLAW_ALLOW_REMOTE_ADMIN=1`\n  - explicit opt-in for remote admin write paths\n- `OPENCLAW_OBSERVABILITY_TOKEN=\u003cstrong-secret\u003e` (recommended)\n  - tokenized read access for observability routes in non-localhost scenarios\n\nOptional but commonly used with planner/refiner workflows:\n\n- `OPENCLAW_LLM_API_KEY=\u003cprovider-key\u003e` (or provider-specific key vars)\n\n### Connection from phone or other devices\n\n1. Start ComfyUI with external listen enabled (example):\n   - `python main.py --listen 0.0.0.0 --port 8200`\n2. Use your host LAN IP (for example `192.168.x.x`) and open:\n   - `http://\u003cHOST_LAN_IP\u003e:\u003cPORT\u003e/openclaw/admin`\n3. Enter the admin token in the page input and click `Save`.\n4. Click `Refresh All` to verify health and API reachability.\n\nNotes:\n\n- On Windows, if a port fails with bind errors (for example WinError 10013), choose a different port outside excluded ranges.\n- If write actions are denied remotely, verify both `OPENCLAW_ADMIN_TOKEN` and `OPENCLAW_ALLOW_REMOTE_ADMIN=1`.\n- Remote Admin being reachable from LAN does not imply LAN-hosted custom LLM targets are allowed. SSRF rules for `base_url` remain separate and stricter.\n\n### Basic operations\n\nAfter token save, typical flow is:\n\n- `Dashboard`: confirm provider/model/key status and recent errors\n- `Jobs / Events`: refresh runs, connect SSE stream, verify event updates\n- `Approvals`: approve/reject pending items\n- `Schedules / Triggers`: toggle schedules, run now, or fire manual trigger\n- `Config`: reload and safely update provider/model/base URL/retry/timeout\n- `Doctor / Diagnostics`: inspect security doctor + preflight inventory output\n- `Quick Actions`: retry failed schedule, refresh model list, or run drill (subject to existing policy/tool availability)\n\n### Reverse proxy and exposure notes\n\nDo **not** expose ComfyUI/OpenClaw admin endpoints directly to the public internet without a hardened edge.\n\nMinimum recommendations:\n\n- terminate TLS at reverse proxy (HTTPS only)\n- add authentication at edge (in addition to OpenClaw admin token)\n- restrict source IP ranges when possible\n- apply request-rate limits and connection limits\n- keep server and node package on current patched versions\n- if running `OPENCLAW_DEPLOYMENT_PROFILE=public`, set `OPENCLAW_PUBLIC_SHARED_SURFACE_BOUNDARY_ACK=1` only after enforcing reverse-proxy path allowlist + network ACL boundary controls\n\nFor internet-facing deployment templates and hardening checklist, follow:\n\n- `docs/security_deployment_guide.md`\n\n## Nodes\n\nNodes are exported as `Moltbot*` class names for compatibility, but appear as `openclaw:*` display names in ComfyUI:\n\n- `openclaw: Prompt Planner`\n- `openclaw: Prompt Refiner`\n- `openclaw: Image to Prompt`\n- `openclaw: Batch Variants`\n\nSee `web/docs/` for node usage notes.\n\n## Extension UI\n\n![OpenClaw /sidebar ui example](assets/sidebar.png)\n\nThe frontend lives in `web/` and is served by ComfyUI as an extension panel. It uses the backend routes below (preferring `/api/openclaw/*`).\n\nCurrent sidebar composition keeps `web/openclaw_ui.js` as the shell root and routes specialized browser logic through focused modules:\n\n- actions and submit/cancel wiring: `web/openclaw_actions.js`\n- queue polling and transient banners: `web/openclaw_queue_monitor.js` and `web/openclaw_banner_manager.js`\n- persistent operator notifications: `web/openclaw_notification_center.js`\n- tab registration/remount behavior: `web/openclaw_tabs.js`\n- shared error + compatibility helpers: `web/openclaw_utils.js`\n\nCanonical DOM/class ownership is now centered on `openclaw-*`; legacy `moltbot-*` class compatibility is still supported through shared runtime aliasing instead of duplicated markup in each tab template.\n\nThe sidebar now also resolves and stamps its active host surface (`standalone_frontend` vs desktop-embedded host) at mount time so frontend-host drift is explicit and testable instead of inferred from runtime accidents.\n\n### Sidebar Modules\n\n![OpenClaw /sidebar ui example](assets/sidebar_modules.png)\n\nThe OpenClaw sidebar includes these built-in tabs. Some tabs are capability-gated and may be hidden when the related backend feature is disabled.\n\n| Tab | What it does | Related docs |\n| --- | --- | --- |\n| `Settings` | Health/config/log visibility, provider/model setup, model connectivity checks, and optional localhost key storage. | [Quick Start](#quick-start-minimal), [LLM config](#llm-config-non-secret), [Troubleshooting](#troubleshooting) |\n| `Jobs` | Tracks prompt IDs, consumes deterministic event/task cursor metadata for polling, and shows output previews for recent jobs across classic history refs and asset-backed output refs through the same `/view` contract; refs that only expose asset-service identifiers stay explicit as an operator-visible fallback state instead of silently upgrading to `/api/assets`. | [Observability](#observability-read-only), [Remote Control (Connector)](#remote-control-connector) |\n| `Planner` | Uses assist endpoint to generate structured prompt plans (positive/negative/params). | [Configure an LLM key](#1-configure-an-llm-key-for-plannerrefinervision-helpers), [Nodes](#nodes) |\n| `Refiner` | Refines existing prompts with optional image context and issue/goal input. | [Configure an LLM key](#1-configure-an-llm-key-for-plannerrefinervision-helpers), [Nodes](#nodes) |\n| `Variants` | Local helper for generating batch variant parameter JSON (seed/range-style sweeps). | [Nodes](#nodes), [Operator UX Features](#operator-ux-features) |\n| `Library` | Manages reusable prompt/params presets and provides pack-oriented library operations in one place. | [Presets](#presets-admin), [Packs](#packs-admin) |\n| `Approvals` | Lists approval gates and supports approve/reject operations, including the same approval objects now surfaced through Slack and Feishu interactive connector actions. | [Triggers + approvals](#triggers--approvals-admin), [Remote Control (Connector)](#remote-control-connector) |\n| `Explorer` | Inventory/preflight diagnostics and snapshot/checkpoint troubleshooting workflows, including snapshot-first inventory refresh state (`snapshot_ts`, `scan_state`, `stale`, `last_error`). | [Operator UX Features](#operator-ux-features), [Troubleshooting](#troubleshooting) |\n| `Packs` | Dedicated pack lifecycle tab for import/export/delete under admin boundary. | [Packs](#packs-admin) |\n| `PNG Info` | Inspects saved generation images through drag-and-drop, file picker, or scoped paste, parses A1111 infotext plus ComfyUI `prompt` / `workflow` metadata, shows extracted prompt and generation fields when recoverable, and keeps raw metadata visible for operator inspection. | [API Overview](#api-overview), [Troubleshooting](#troubleshooting) |\n| `Model Manager` | Searches model catalog/install records, queues managed downloads, monitors task lifecycle, and imports completed tasks into the managed install root with the same trusted download/import contract used by the backend model manager APIs. | [Model manager](#model-manager-admin-f54), [API Overview](#api-overview) |\n| `Parameter Lab` | Runs bounded sweep/compare experiments, stores history, and replays parameters back into the graph. | [Operator UX Features](#operator-ux-features) |\n\n## Operator UX Features\n\n### Notification Center\n\nThe sidebar includes a persistent `Notification Center` for operator-facing alerts that should survive reloads:\n\n- warning/error banners and selected durable toasts are mirrored into a local notification store\n- entries are deduplicated by source-specific keys and keep an unread count\n- `Acknowledge` clears unread state without hiding the item\n- `Dismiss` removes the item from the active panel while preserving historical storage\n- notification message/source fields are rendered as escaped text, not trusted as HTML, so operator-facing payloads cannot turn stored notification content into live markup\n- action-enabled entries can deep-link back to the affected surface, such as `Model Manager` or `Jobs`\n\nCurrent examples include queue-monitor incidents and managed-model failures that need operator follow-up.\n\n### In-canvas context toolbox\n\nRight-click a node and open the `OpenClaw` menu to access:\n\n- `Inspect`: jump to the Explorer troubleshooting path.\n- `Doctor`: run diagnostics and show readiness feedback.\n- `Queue Status`: jump directly to queue/job monitoring.\n- `Compare`: open Parameter Lab in compare setup mode for the selected node.\n- `Settings`: jump to OpenClaw settings.\n\nThese actions are capability-aware and degrade to safe guidance when optional backend capabilities are unavailable.\n\n### Parameter Lab history and replay\n\nParameter Lab now supports experiment history and run replay:\n\n- `History` lists saved experiments from local state.\n- `Load` opens stored experiment details and run statuses.\n- `Replay` applies a selected run's parameter values back into the active workflow graph.\n\nThis makes iterative tuning and backtracking faster without manually retyping prior parameter sets.\n\n### Compare workflow baseline\n\nParameter Lab includes a baseline compare flow for model/widget A/B style checks:\n\n- Use `Compare` from the node context toolbox, or `Compare Models` inside Parameter Lab.\n- The compare planner generates bounded runs from one selected comparison dimension.\n- Backend compare submission is validated and admin-protected.\n- Compare experiments are persisted and visible in history alongside sweep experiments.\n\nCurrent scope is focused on bounded compare orchestration and replay-ready records; richer side-by-side evaluation and winner handoff are still being expanded.\n\n### Operator guidance and quick recovery\n\nOperator actions are wired for faster recovery loops:\n\n- queue/status routing prefers the dedicated monitor view when available\n- doctor checks surface immediate readiness feedback\n- compare and history flows are connected so experiments can be reviewed and replayed quickly\n\n## API Overview\n\nThis README now keeps only the high-level API map. Detailed route shapes, auth contracts, examples, and release-facing behavior live in `docs/`.\n\nBase path notes:\n\n- primary prefix: `/openclaw/*`\n- legacy prefix: `/moltbot/*`\n- browser/extension callers should prefer `/api/openclaw/*`\n- standalone admin UI entry: `GET /openclaw/admin`\n\nMain API families:\n\n- Observability: health, capabilities, logs, traces, event feeds\n- Admin diagnostics: preflight inventory snapshot/status, doctor-facing readiness views\n- Config + LLM: effective config, provider tests, model lists, assist planner/refiner\n- Connector installation diagnostics: installation state, resolution, callback/tenant binding evidence, audit views\n- Webhooks + events: validate, submit, callback delivery, SSE/polling status\n- Admin operations: approvals, schedules, presets, rewrite recipes\n- Model Manager + Packs: search, download/import lifecycle, pack import/export\n- Bridge / sidecar: worker poll/result/heartbeat and bridge health/submit routes\n\nPrimary references:\n\n- [API contract](docs/release/api_contract.md)\n- [Config and secrets contract](docs/release/config_secrets_contract.md)\n- [Connector guide](docs/connector.md)\n- [Sidecar guide](docs/sidecar.md)\n- [OpenAPI spec](docs/openapi.yaml)\n\nOperational notes:\n\n- Observability remains token-gated for remote access and redacts provider reasoning-like content by default.\n- Event and managed-download polling now expose deterministic cursor metadata so reconnect/backfill behavior can stay incremental instead of falling back to full-list refreshes on every poll.\n- Preflight inventory is snapshot-first: clients should treat `snapshot_ts`, `scan_state`, `stale`, and `last_error` as part of the normal operator-diagnostics contract.\n- Config/assist/model-management paths inherit the unified config precedence contract and SSRF-safe outbound policy.\n- Output/history-facing consumers should keep using the bounded `/history` + `/view` contract for supported preview flows; refs that are only representable through upstream asset APIs are surfaced explicitly as `asset_api_required` instead of being auto-fetched.\n- Connector installation diagnostics expose redacted token references only, never raw token material.\n- Webhook and rate-limit error paths expose machine-readable diagnostics; client integrations should consume codes and structured fields instead of free-form text.\n\n## Advanced Security and Runtime Setup\n\nUse this section as a pointer map rather than a second full deployment manual.\n\nPrimary references:\n\n- [Runtime hardening and startup](docs/runtime_hardening_and_startup.md)\n- [Security deployment guide](docs/security_deployment_guide.md)\n- [Security checklist](docs/security_checklist.md)\n- [Config surface ADR](docs/adr/ADR-0001-config-surface-unification.md)\n- [Config and secrets contract](docs/release/config_secrets_contract.md)\n- [Advanced registry and transforms](docs/advanced_registry_and_transforms.md)\n- [Connector guide](docs/connector.md)\n\nThe most important knobs in this area are:\n\n- runtime posture: `OPENCLAW_RUNTIME_PROFILE`\n- multi-tenant boundary: `OPENCLAW_MULTI_TENANT_ENABLED`, `OPENCLAW_TENANT_HEADER`\n- local secret-manager path: `OPENCLAW_1PASSWORD_ENABLED`, `OPENCLAW_1PASSWORD_ALLOWED_COMMANDS`, `OPENCLAW_1PASSWORD_VAULT`\n- registry / transform controls: `OPENCLAW_ENABLE_REGISTRY_SYNC`, `OPENCLAW_REGISTRY_POLICY`, `OPENCLAW_ENABLE_TRANSFORMS`\n- connector authorization: `OPENCLAW_COMMAND_OVERRIDES`, `OPENCLAW_COMMAND_ALLOW_FROM_PUBLIC`, `OPENCLAW_COMMAND_ALLOW_FROM_RUN`, `OPENCLAW_COMMAND_ALLOW_FROM_ADMIN`\n\nConfig precedence remains:\n\n- `env \u003e runtime override \u003e persisted config \u003e default`\n\nLegacy `MOLTBOT_*` aliases still exist for compatibility, but `OPENCLAW_*` is the supported canonical surface.\n\n## Templates\n\nTemplates live in `data/templates/`.\n\n- Any `data/templates/\u003ctemplate_id\u003e.json` file is runnable (template ID = filename stem).\n- `data/templates/manifest.json` is optional metadata (e.g. defaults).\n- Rendering performs **strict placeholder substitution**:\n  - Only exact string values matching `{{key}}` are replaced\n  - Partial substitutions (e.g. `\"foo {{bar}}\"`) are intentionally not supported\n\nFor the full step-by-step guide (where to put exported workflow JSON, how to author `manifest.json`, how to verify `/openclaw/templates`, and how to use `/run`), see `tests/TEST_SOP.md`.\n\n### Basic `/run` usage (chat)\n\n**Free-text prompt mode (no `key=value` needed):**\n\n```\n/run z \"a cinematic portrait\" seed=-1\n```\n\nThe connector will map the free text into a prompt field using:\n\n- `allowed_inputs` if a single key is declared in `manifest.json`, or\n- fallback order: `positive_prompt` -\u003e `prompt` -\u003e `text` -\u003e `positive` -\u003e `caption`.\n\n**Key=value mode (explicit mapping):**\n\n```\n/run z positive_prompt=\"a cat\" seed=-1\n```\n\nImportant:\n\n- Ensure your workflow uses the same placeholder (e.g., `\"text\": \"{{positive_prompt}}\"`).\n- `seed=-1` gives random seeds; a fixed seed reproduces outputs.\n\n## Execution Budgets\n\nQueue submissions are protected by concurrency caps and render size budgets (`services/execution_budgets.py`).\n\nEnvironment variables:\n\n- `OPENCLAW_MAX_INFLIGHT_SUBMITS_TOTAL` (default: 2)\n- `OPENCLAW_MAX_INFLIGHT_SUBMITS_WEBHOOK` (default: 1)\n- `OPENCLAW_MAX_INFLIGHT_SUBMITS_TRIGGER` (default: 1)\n- `OPENCLAW_MAX_INFLIGHT_SUBMITS_SCHEDULER` (default: 1)\n- `OPENCLAW_MAX_INFLIGHT_SUBMITS_BRIDGE` (default: 1)\n- `OPENCLAW_MAX_INFLIGHT_SUBMITS_PER_TENANT` (default: 1, only when multi-tenant mode is enabled)\n- `OPENCLAW_MAX_RENDERED_WORKFLOW_BYTES` (default: 524288)\n\nIf budgets are exceeded, callers should expect `429` (concurrency) or `413` (oversized render).\n\n## LLM Failover\n\nFailover is integrated into `services/llm_client.py` and controlled via runtime config:\n\n- `OPENCLAW_FALLBACK_MODELS` (CSV)\n- `OPENCLAW_FALLBACK_PROVIDERS` (CSV)\n- `OPENCLAW_MAX_FAILOVER_CANDIDATES` (int, 1-)\n\n## State Directory \u0026 Logs\n\nBy default, state is stored in a platform user-data directory:\n\n- Windows: `%LOCALAPPDATA%\\\\comfyui-openclaw\\\\`\n- macOS: `~/Library/Application Support/comfyui-openclaw/`\n- Linux: `~/.local/share/comfyui-openclaw/`\n\nOverride:\n\n- `OPENCLAW_STATE_DIR=/path/to/state`\n\nLogs:\n\n- `openclaw.log` (legacy `moltbot.log` is still supported)\n- `audit.log` for append-only audit events, plus retained rotated audit segments when log retention is enabled\n- `audit.log.key` when OpenClaw generates and persists the local audit chain key instead of receiving one from environment/config\n- Importing config helpers alone does not create the state directory or log files on current builds; writable paths are created lazily on first logger bootstrap or persisted-write paths.\n- Optional startup truncation: set `OPENCLAW_LOG_TRUNCATE_ON_START=1` to clear the active log file once at process startup (useful to avoid stale-history noise in UI log views).\n- Optional structured JSON logs for selected core paths:\n  - set `OPENCLAW_LOG_FORMAT=json` (or `OPENCLAW_STRUCTURED_LOGS=1`) before startup\n  - default behavior remains plain text logs (no structured log emission unless opt-in)\n\n## Audit Chain Verification\n\nOperators can verify retained audit-log continuity with:\n\n```bash\npython scripts/verify_audit_chain.py\n```\n\nMachine-readable output:\n\n```bash\npython scripts/verify_audit_chain.py --json\n```\n\nNotes:\n\n- The verifier checks the current `audit.log` and any retained rotated audit segments in the state directory.\n- When OpenClaw is not given an audit chain key explicitly, it persists a local `audit.log.key` sidecar so retained-chain verification still works across restart and rotation.\n- A failed verification should be treated as an operator-facing integrity incident and investigated before assuming the retained audit trail is trustworthy.\n\n## Troubleshooting\n\nCommon operator issues now live in a dedicated troubleshooting guide:\n\n- [Troubleshooting guide](docs/troubleshooting.md)\n\nQuick jumps:\n\n- backend not loaded / route 404 startup failures\n- Operator Doctor usage\n- Jobs preview fallback for asset-api-only output refs\n- audit chain verification after restart or rotation\n- webhook auth not configured\n- loopback LLM SSRF validation errors\n- Remote Admin vs private-LAN LLM target behavior\n- server-side Admin Token vs UI token usage\n\n## Tests\n\nFor the authoritative validation workflow, follow `tests/TEST_SOP.md`.\n\nFast backend-only check from the repo root:\n\n```bash\npython3 -m unittest discover -s tests -p \"test_*.py\"\n```\n\nFull local acceptance gate (recommended before push):\n\n```bash\nbash scripts/run_full_tests_linux.sh\n```\n\nThis full gate includes detect-secrets, pre-commit, coverage governance verification, backend suites, adaptive adversarial verification, Playwright E2E, and CI-parity dependency audit expectations scoped to declared project requirements.\nIt also includes backend regressions that pin snapshot-first diagnostics, delta cursor semantics, schema/OpenAPI drift checks, minimal-environment optional-dependency import behavior, and the import-safe config/bootstrap contract.\n\nThe shared backend coverage gate used by local scripts and CI is:\n\n```bash\npython scripts/run_backend_coverage.py --start-dir tests --pattern \"test_*.py\" --enforce-skip-policy tests/skip_policy.json --coverage-json .tmp/coverage/backend_unit_coverage.json\n```\n\nVerification-governance details now live in [docs/release/verification_governance.md](docs/release/verification_governance.md), including the staged coverage ratchet, test-debt governance checks, and hotspot-family coverage review workflow.\n\n## Updating\n\n- Git install: `git pull` inside `custom_nodes/comfyui-openclaw/`, then restart ComfyUI.\n- ComfyUI-Manager install: update from Manager UI, then restart ComfyUI.\n\n## Remote Control (Connector)\n\nOpenClaw includes a standalone **Connector** process that allows you to control your local instance securely via **Telegram**, **Discord**, **LINE**, **WhatsApp**, **WeChat**, **KakaoTalk**, **Slack**, and **Feishu/Lark**.\n\n- **Status \u0026 Queue**: Check job progress remotely.\n- **Run Jobs**: Submit templates via chat commands.\n- **Approvals**: Approve/Reject paused workflows from your phone.\n- **Secure**: Outbound-only for Telegram/Discord. LINE/WhatsApp/WeChat/KakaoTalk/Slack require inbound HTTPS (webhook), while Slack can also use Socket Mode and Feishu can run in either webhook or long-connection mode with a dedicated callback ingress path.\n- **WeChat encrypted mode**: Official Account encrypted webhook mode is supported when AES settings are configured.\n- **KakaoTalk response safety**: QuickReply limits and safe fallback handling are enforced for reliable payload behavior.\n- **Slack multi-workspace mode**: Workspace installs can be handled through connector-managed OAuth install/callback routes with per-workspace token binding and fail-closed health diagnostics.\n- **Feishu/Lark multi-account mode**: Connector-managed account/workspace bindings support tenant-aware installation resolution, interactive approval cards, and signed callback handling without exposing raw app secrets or widening command trust implicitly.\n- **Bounded connector numeric envs**: Delivery/media/time-budget settings, bind ports, rate limits, and command-length knobs now clamp or fall back to documented defaults with warnings instead of crashing connector startup on malformed values.\n\n- [See Setup Guide (`docs/connector.md`)](docs/connector.md)\n\n## Security\n\nRead [SECURITY.md](docs/SECURITY.md) before exposing any endpoint beyond localhost. The project is designed to be secure-by-default (deny-by-default auth, SSRF protections, redaction, bounded outputs), but unsafe deployment can still create risk.\n\n### Security Deployment Guide\n\n- [Security Deployment Guide](docs/security_deployment_guide.md)\n- Includes three copy-paste deployment profiles (`local`, `lan`, `public`) and step-by-step checklists.\n\n### Deployment Self-check Command\n\nValidate current env against deployment profile:\n\n```bash\npython scripts/check_deployment_profile.py --profile local\npython scripts/check_deployment_profile.py --profile lan\npython scripts/check_deployment_profile.py --profile public\n```\n\nFail on warnings too (recommended for hardened/public pipelines):\n\n```bash\npython scripts/check_deployment_profile.py --profile public --strict-warnings\n```\n\n---\n\n## Disclaimer (Security \u0026 Liability)\n\nThis project is provided **as-is** without warranty of any kind. You are solely responsible for:\n\n- **API keys / Admin tokens**: creation, storage, rotation, and revocation\n- **Runtime configuration**: environment variables, config files, UI settings\n- **Network exposure**: tunnels, reverse proxies, public endpoints\n- **Data handling**: logs, prompts, outputs, and any content generated or transmitted\n\n### Key Handling Guidance (all environments)\n\n- **Prefer environment variables** for API keys and admin tokens.\n- **UI key storage (if enabled)** is for local, single-user setups only.\n- **Never commit secrets** or embed them in versioned files.\n- **Rotate tokens** regularly and after any suspected exposure.\n\n### Common Deployment Contexts (you must secure each)\n\n- **Local / single-user**: treat keys as secrets; avoid long-term browser storage.\n- **LAN / shared machines**: require admin tokens, restrict IPs, disable unsafe endpoints.\n- **Public / tunneled / reverse-proxy**: enforce strict allowlists, HTTPS, least-privilege access.\n- **Desktop / portable / scripts**: ensure secrets are not logged or persisted by launchers.\n\n### No Liability\n\nThe maintainers and contributors **accept no responsibility** for:\n\n- Unauthorized access or misuse of your instance\n- Loss of data, keys, or generated content\n- Any direct or indirect damages resulting from use of this software\n\nBy using this project, you acknowledge and accept these terms.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frookiestar28%2FComfyUI-OpenClaw","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frookiestar28%2FComfyUI-OpenClaw","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frookiestar28%2FComfyUI-OpenClaw/lists"}