… and docs (openclaw#16761)

Add inline file attachment support for sessions_spawn (subagent runtime only):

- Schema: attachments[] (name, content, encoding, mimeType) and attachAs.mountPath hint
- Materialization: files written to .openclaw/attachments/<uuid>/ with manifest.json
- Validation: strict base64 decode, filename checks, size limits, duplicate detection
- Transcript redaction: sanitizeToolCallInputs redacts attachment content from persisted transcripts
- Lifecycle cleanup: safeRemoveAttachmentsDir with symlink-safe path containment check
- Config: tools.sessions_spawn.attachments (enabled, maxFiles, maxFileBytes, maxTotalBytes, retainOnSessionKeep)
- Registry: attachmentsDir/attachmentsRootDir/retainAttachmentsOnKeep on SubagentRunRecord
- ACP rejection: attachments rejected for runtime=acp with clear error message
- Docs: updated tools/index.md, concepts/session-tool.md, configuration-reference.md
- Tests: 85 new/updated tests across 5 test files

Fixes:
- Guard fs.rm in materialization catch block with try/catch (review concern #1)
- Remove unreachable fallback in safeRemoveAttachmentsDir (review concern #7)
- Move attachment cleanup out of retry path to avoid timing issues with announce loop

Co-authored-by: Tyler Yust <TYTYYUST@YAHOO.COM>
Co-authored-by: napetrov <napetrov@users.noreply.github.com>

… and docs (openclaw#16761)

Add inline file attachment support for sessions_spawn (subagent runtime only):

- Schema: attachments[] (name, content, encoding, mimeType) and attachAs.mountPath hint
- Materialization: files written to .openclaw/attachments/<uuid>/ with manifest.json
- Validation: strict base64 decode, filename checks, size limits, duplicate detection
- Transcript redaction: sanitizeToolCallInputs redacts attachment content from persisted transcripts
- Lifecycle cleanup: safeRemoveAttachmentsDir with symlink-safe path containment check
- Config: tools.sessions_spawn.attachments (enabled, maxFiles, maxFileBytes, maxTotalBytes, retainOnSessionKeep)
- Registry: attachmentsDir/attachmentsRootDir/retainAttachmentsOnKeep on SubagentRunRecord
- ACP rejection: attachments rejected for runtime=acp with clear error message
- Docs: updated tools/index.md, concepts/session-tool.md, configuration-reference.md
- Tests: 85 new/updated tests across 5 test files

Fixes:
- Guard fs.rm in materialization catch block with try/catch (review concern #1)
- Remove unreachable fallback in safeRemoveAttachmentsDir (review concern #7)
- Move attachment cleanup out of retry path to avoid timing issues with announce loop

Co-authored-by: Tyler Yust <TYTYYUST@YAHOO.COM>
Co-authored-by: napetrov <napetrov@users.noreply.github.com>
(cherry picked from commit a9f1188)

… and docs (openclaw#16761)

Add inline file attachment support for sessions_spawn (subagent runtime only):

- Schema: attachments[] (name, content, encoding, mimeType) and attachAs.mountPath hint
- Materialization: files written to .openclaw/attachments/<uuid>/ with manifest.json
- Validation: strict base64 decode, filename checks, size limits, duplicate detection
- Transcript redaction: sanitizeToolCallInputs redacts attachment content from persisted transcripts
- Lifecycle cleanup: safeRemoveAttachmentsDir with symlink-safe path containment check
- Config: tools.sessions_spawn.attachments (enabled, maxFiles, maxFileBytes, maxTotalBytes, retainOnSessionKeep)
- Registry: attachmentsDir/attachmentsRootDir/retainAttachmentsOnKeep on SubagentRunRecord
- ACP rejection: attachments rejected for runtime=acp with clear error message
- Docs: updated tools/index.md, concepts/session-tool.md, configuration-reference.md
- Tests: 85 new/updated tests across 5 test files

Fixes:
- Guard fs.rm in materialization catch block with try/catch (review concern #1)
- Remove unreachable fallback in safeRemoveAttachmentsDir (review concern #7)
- Move attachment cleanup out of retry path to avoid timing issues with announce loop

Co-authored-by: Tyler Yust <TYTYYUST@YAHOO.COM>
Co-authored-by: napetrov <napetrov@users.noreply.github.com>
(cherry picked from commit a9f1188)

#2201)

PR #2191 wholesale-restored 20 files from pre-v2026.3.1, discarding
legitimate upstream security improvements. Re-apply 3 of 4 findings
(finding #1 was already present):

- acp/client.ts: scoped read-tool auto-approval — auto-approves `read`
  calls only when target path is within cwd, preventing unrestricted
  filesystem access. Adds `web_search` to safe auto-approve set.
  Excludes `memory_search` (gutted subsystem).

- doctor-config-flow.ts: allowlist policy detection + repair —
  `detectEmptyAllowlistPolicy` warns when empty allowlists silently
  block all DMs/group messages. `maybeRepairAllowlistPolicyAllowFrom`
  auto-recovers from pairing store.

- config/defaults.ts: replace naive string-based API key check with
  `hasConfiguredSecretInput()` to properly handle secret references
  (`$ENV_VAR`, `op://vault/item`).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

#2201) (#2254)

PR #2191 wholesale-restored 20 files from pre-v2026.3.1, discarding
legitimate upstream security improvements. Re-apply 3 of 4 findings
(finding #1 was already present):

- acp/client.ts: scoped read-tool auto-approval — auto-approves `read`
  calls only when target path is within cwd, preventing unrestricted
  filesystem access. Adds `web_search` to safe auto-approve set.
  Excludes `memory_search` (gutted subsystem).

- doctor-config-flow.ts: allowlist policy detection + repair —
  `detectEmptyAllowlistPolicy` warns when empty allowlists silently
  block all DMs/group messages. `maybeRepairAllowlistPolicyAllowFrom`
  auto-recovers from pairing store.

- config/defaults.ts: replace naive string-based API key check with
  `hasConfiguredSecretInput()` to properly handle secret references
  (`$ENV_VAR`, `op://vault/item`).

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…store structural type-checking (#2494) (#2500)

Removes the silent type-erasure pattern across ui/src/ui/ (63 occurrences
across 7 source files + 2 test files). The double-cast through `unknown`
was bypassing structural verification that the source class/Host type
satisfies the target Host interface — the root enabler of regressions
like #2493 where upstream field additions silently broke the fork.

## Source-class fixes (`app.ts`)

- Removed `private` modifier from 19 class fields now required by Host
  interfaces (`connectGeneration`, `chatHasAutoScrolled`, `toolStreamById`,
  etc.). These were already accessed externally via the Host contracts;
  the `private` modifier only blocked structural verification.
- Narrowed `chatToolMessages: unknown[]` → `Record<string, unknown>[]` to
  match `ToolStreamHost`. The cast previously hid this divergence.
- Dropped all 21 `this as ...` casts entirely — `RemoteClawApp` now
  structurally satisfies every Host interface.

## Host-type intersections

- `SettingsHost = PollingHost & ScrollHost & ChatHost & { ... }`
- `GatewayHost = SettingsHost & ToolStreamHost & { ... }`
- `LifecycleHost = SettingsHost & GatewayHost & PollingHost & ScrollHost & { ... }`
- `ChatHost`, `PollingHost`, `ScrollHost`, `ToolStreamHost` exported.

Function parameters in pass-through sites (`sendChatMessageNow`,
`flushChatQueue`, `handleSendChat`) typed as `SettingsHost & ToolStreamHost`.
`refreshChat` typed as `ChatHost & ScrollHost`.

## Surfaced divergences fixed at source

- `RemoteClawApp.chatToolMessages`: was `unknown[]`, now `Record<string, unknown>[]`
  (aligns with `ToolStreamHost`).
- `GatewayHost.presenceStatus`: was `StatusSummary | null`, now `string | null`
  (matches the string assignments in `controllers/presence.ts`).
- `AppViewState.chatToolMessages`: narrowed to match.

## Test mocks

- `app-settings.test.ts`: expanded mock with `ChatHost` + `ScrollHost` fields
  required by the `SettingsHost` intersection.
- `app-lifecycle.node.test.ts`: added `PollingHost`/`SettingsHost` fields;
  cast-through-RemoteClawApp (out of AC scope — different pattern).
- `app-gateway.node.test.ts`: cast-through-RemoteClawApp.
- `app-render.helpers.ts`: two cast sites converted to
  `as unknown as RemoteClawApp` (matches existing same-file pattern; out of
  AC #1 scope which targets only `as unknown as Parameters<typeof X>[0]`).

## Verification

- Pre: `grep -rnE 'as unknown as Parameters' ui/src/ui/` → 63 matches.
- Post: 0 matches.
- `pnpm tsgo` passes. `pnpm check` (format + typecheck + lint) passes.
- Fork gates (zombie-imports, stub-debt, throwing-stub-callers,
  obsolescence-audit, rebrand-leakage): all PASS.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>