* refactor(state): fold singleton tables into config_machine_state at schema v11 Eight singleton tables (skill_curator_state, update_check_state, clawhub_promotions_feed_state, model_catalog_remote, voicewake_triggers, voicewake_routing_config, voicewake_routing_routes, onboarding_recommendations) were each one logical JSON value behind a fixed key; their bespoke schemas, lazy ensures, and per-table accessors collapse onto the shared config_machine_state KV under namespaced keys. cron_store_epochs retires outright: it was born write-only in #114388 and no reader ever existed in any language. Durable values (update check state, voicewake triggers and routing, per-workspace onboarding answers) migrate insert-if-absent during the v10->v11 migration; cache class contents rebuild on next use. Deferred with named reasons: exec_approvals_config (macOS direct-SQL contract), installed_plugin_index (same-tx lease fence), node_host_config and web_push_vapid_keys (secret-table git-backup redaction). # Conflicts: # src/skills/workshop/collection-review-state.ts # src/skills/workshop/collection-review.gateway-admission.test.ts * test: register v11 guard carve-outs and suppression pin The v11 migration module joins the raw-SQLite allowlist (migrations are the named guardrail exception), the lint-suppression allowlist records the second type-parameter suppression in config-machine-state, and the identity module keeps only externally consumed exports. * test: surface CLI stderr when migration-diagnostic assertion fails * test: expect migration diagnostics on stderr for models plain commands The #129037 pending-migration cases asserted that aliases/fallbacks lists never open the state database, but config-health observation (observeConfigSnapshot -> readConfigHealthStateFromStore) full-opens it on any config read whose file exists — reproduced identically on clean main with a main-built dist. The protected contract is exact stdout; the diagnostic legitimately lands on stderr for every case. * test: drop unused defaults import from CLI stdout e2e * test: split session path derivation out of oversized session-files suite #130016 pushed session-files.test.ts to 1008 lines, over the 1000-line lint cap and red for every PR's check-lint. The sessionPathForFile describe moves to a self-contained sibling following the existing session-files.*.test.ts split pattern; no assertions change. * refactor(state): fold four more singleton tables into schema v12 tui_last_sessions (cache-class, regenerates on next session switch), sidebar_sections (persistent section order, migrated as one JSON array), node_host_config, and web_push_vapid_keys join the v12 fold-in, taking the retirement to thirteen tables at the same version. The two secret singletons were blocked on table-granular git-backup redaction; backups now exclude config_machine_state rows by secret key prefix (nodeHost.*, webPush.vapidKeys) with a fail-closed row filter and regression proof, so STATE_SECRET_TABLE_NAMES sheds both tables. The sidebar fold also retires its lazy-ensure WeakSet and inline DDL; sidebar edits stay inside the existing session-group write transaction via direct Kysely. * fix(node-host): omit absent Cloudflare Access config like the column reader The KV rewrite returned gateway.cloudflareAccess as an own undefined property where the retired column reader omitted the key; toStrictEqual consumers (state-migrations doctor-repair test) caught the shape drift. Mirror the column reader's conditional spread at both construction sites. * fix(backup): disclose redacted machine-state prefixes after restore The prefix-granular secret redaction recorded omitted key prefixes in the backup manifest but the restore result exposed only excludedTables, so a redacted restore looked complete while nodeHost.* and webPush.vapidKeys configuration were intentionally absent. The restore result and CLI output now disclose the omitted prefixes (JSON mode carries them via the result shape), with restore-side regression coverage. * fix(tui): compare-and-delete retired session pointers Doctor cleanup read matching pointer keys then deleted them unconditionally, so a replacement pointer written between the scan and the delete was erased. The delete now re-checks the stored value inside the write transaction and only removes pointers that still name a retired session; a live replacement survives (regression covered). Also corrects the stale schema-version line in database-first.md.
3.9 KiB
summary, read_when, title
| summary | read_when | title | ||
|---|---|---|---|---|
| Global voice wake words (Gateway-owned) and how they sync across nodes |
|
Voice wake |
Wake words are one global list owned by the Gateway — there are no per-node custom lists. Any node or app UI can edit the list; the Gateway persists the change and broadcasts it to every connected client.
- macOS: local Voice Wake enable/disable toggle. Requires macOS 26+; see Voice wake (macOS) for runtime/PTT details.
- iOS: local Voice Wake enable/disable toggle in Settings.
- Android: local Voice Wake enable/disable toggle and wake-word editor in Settings → Voice. Requires Android on-device speech recognition.
Storage
Wake words and routing rules live in the Gateway state database, ~/.openclaw/state/openclaw.sqlite by default (override with OPENCLAW_STATE_DIR), under the config_machine_state keys voicewake.triggers and voicewake.routing. Legacy settings/voicewake.json and settings/voicewake-routing.json are openclaw doctor --fix migration inputs only — runtime never reads them.
Protocol
Trigger list
| Method | Params | Result |
|---|---|---|
voicewake.get |
none | { triggers: string[] } |
voicewake.set |
{ triggers: string[] } |
{ triggers: string[] } |
voicewake.set normalizes input: trims whitespace, drops empty entries, keeps at most 32 triggers, and truncates each to 64 UTF-16 code units without splitting surrogate pairs. An empty result falls back to the built-in defaults (openclaw, claude, computer).
Routing (trigger to target)
| Method | Params | Result |
|---|---|---|
voicewake.routing.get |
none | { config: VoiceWakeRoutingConfig } |
{
"version": 1,
"defaultTarget": { "mode": "current" },
"routes": [{ "trigger": "robot wake", "target": { "sessionKey": "agent:main:main" } }],
"updatedAtMs": 1730000000000
}
Each route target supports exactly one of:
{ "mode": "current" }{ "agentId": "main" }{ "sessionKey": "agent:main:main" }
Limits: at most 32 routes, trigger text at most 64 characters. Route triggers are normalized for matching and duplicate detection by lowercasing, stripping leading/trailing punctuation from each word, and collapsing whitespace ("Hey, Bot!!" and "hey bot" match and count as duplicates) — this is a stricter normalization than the plain trim used for the global trigger list above.
Events
| Event | Payload |
|---|---|
voicewake.changed |
{ triggers: string[] } |
voicewake.routing.changed |
{ config: VoiceWakeRoutingConfig } |
Both broadcast to every WebSocket client with read scope (macOS app, WebChat, and similar) and to every connected node. A node also gets both as an initial snapshot push right after it connects.
Client behavior
- macOS: calls
voicewake.set/voicewake.getand listens forvoicewake.changedto stay in sync with other clients. - iOS: calls
voicewake.set/voicewake.getand listens forvoicewake.changedto keep local wake-word detection responsive. - Android: calls
voicewake.set/voicewake.get, listens forvoicewake.changed, and advertisesvoiceWakewhile enabled. Recognition stays on-device and foreground-only; it pauses while Talk, manual dictation, voice-note capture, or message speech owns audio.