v0.12.230 — fix #213: Kimi K3 nameless tool-call recovery

Fixes #213 — Kimi K3 tool calls leaking into OpenClaw as plain assistant text.

---

npm install -g @blockrun/clawrouter@0.12.230

v0.12.229 — sync Kimi K3

Syncs Kimi K3, which blockrun added and live-probed on 2026-07-17 (blockrun src/lib/models.ts).

---

npm install -g @blockrun/clawrouter@0.12.229

v0.12.228 — blockrun 07-17 free re-probe + $0.002/tx fee

Catches up with blockrun's 2026-07-17 live free-model re-probe (blockrun PR #257, landed hours before v0.12.227 was cut against the older 07-11 map) and the flat $0.002/tx settlement fee introduced upstream on 2026-07-14.

---

npm install -g @blockrun/clawrouter@0.12.228

v0.12.227

v0.12.227 — July 17, 2026

The picker and every user-facing surface now match the advertised blockrun.ai catalog (verified against the live /v1/models on 2026-07-17, mirroring the same alignment shipped in hermes-plugin-clawrouter 0.3.10).

Changed — top-models picker aligned with the advertised catalog

• src/top-models.json goes 47 → 44 entries. Removed the 7 ids no longer advertised by the gateway: xai/grok-4-0709, xai/grok-4-1-fast-reasoning, xai/grok-3, free/gpt-oss-120b, free/gpt-oss-20b, free/qwen3.5-122b-a10b, free/llama-4-maverick. Added the 4 newly advertised free models: free/mistral-nemotron, free/step-3.7-flash, free/nemotron-nano-9b-v2, free/nemotron-nano-12b-v2-vl — the free block now equals the live 8-model NVIDIA tier exactly.
• Router internals are untouched on purpose: the removed ids stay hidden-but-routable at the gateway (verified against blockrun source — catalog available:true, hidden:true, or MODEL_REDIRECTS to a successor), so existing fallback chains and pinned users keep working. This only changes what pickers advertise. The allowlist sync in index.ts/update.sh prunes the stale blockrun/* keys from users' configs on next start.
• top-models.test.ts sentinels re-pinned (grok-4.5, claude-fable-5, free/step-3.7-flash in; retired ids asserted out).

Fixed — image aliases pointed at models the gateway can no longer serve

• dalle/dall-e/dall-e-3 aliases (models.ts + /cr-imagegen) targeted openai/dall-e-3, which the gateway 400s ("Delisted 2026-05-25: OpenAI removed dall-e-3 from the API"). They now route to the successor openai/gpt-image-2. flux/flux-pro targeted black-forest/flux-1.1-pro, which has no gateway entry at all — removed.
• New aliases for the current image catalog: gpt-image-2, seedream (→ bytedance/seedream-5-pro), and /cr-imagegen parity aliases for grok-imagine/grok-imagine-pro/cogview. IMAGE_PRICING drops the two dead entries and adds bytedance/seedream-5-pro ($0.045 base / $0.09 at 2K-class, matching blockrun's IMAGE_MODELS). The images usage-log fallback model is now google/nano-banana (the real /cr-imagegen default) instead of dead dall-e-3.

Changed — README + skills refreshed to the current catalog

• README: free-tier references switch from retired nvidia/gpt-oss-120b to free/mistral-large-3-675b (the new default free model); the free pricing block lists the live 8; grok-4.5 gets a pricing row ($2.50/$9.00, 500K); rows for grok-4-0709/grok-4-1-fast-reasoning/grok-3/grok-3-mini removed; kimi-k2.6 → kimi-k2.7; routing-tier examples use advertised models only; image table now shows gpt-image-2 + seedream; ~38 → ~44 model-count mentions.
• skills/clawrouter/SKILL.md: the "7 free" vs "8 free" contradiction is fixed (it's 8), Available Models adds claude-fable-5 + grok-4.5 and drops retired ids, image tool row updated.
• skills/imagegen/SKILL.md: dalle/flux rows replaced with gpt-image-2 + seedream (with the legacy-alias note), triggers and size guidance updated.

---

v0.12.220 — direct Polymarket betting (blockrun_polymarket)

v0.12.220 — July 10, 2026

Direct Polymarket betting — ported from blockrun-mcp v0.30.0's blockrun_polymarket tool. ClawRouter could already read prediction-market odds (blockrun_predexon_*); now it can place, manage, and redeem real-money bets on Polymarket (CLOB V2, Polygon), signed locally by the same wallet that pays for LLM calls.

New blockrun_polymarket tool (REAL MONEY)

• Unlike every other ClawRouter tool it is not an HTTP-proxy wrapper — it runs a local trading engine (src/polymarket/, ~2,650 lines ported from blockrun-mcp) that signs CLOB V2 orders (EIP-712) and posts them to Polymarket through BlockRun's Tokyo egress relay by default (so it works out of the box in geoblocked regions; every order is still signed locally, the relay can't move funds).
• One multiplexed tool, action: = setup / fund / buy / sell / cancel / orders / positions / redeem / withdraw.
• Signer = ClawRouter's own EVM wallet (~/.openclaw/blockrun/wallet.key, or BLOCKRUN_WALLET_KEY) — the same key that pays x402 LLM fees. A chain-agnostic private key pays API fees on Base and authorizes bets on Polygon. This is the one real adaptation from the blockrun-mcp source (which used ~/.blockrun/.session); everything else is a faithful port. Polymarket state (L2/builder creds, deposit-wallet vault) is stored under ~/.openclaw/blockrun/ alongside the wallet.
• Funds: bets spend pUSD in a gasless Polygon deposit-wallet vault; action:"fund" moves the user's Base USDC → pUSD gaslessly (x402 POST /v1/polymarket/fund, $0.01 fee, non-custodial via the Polymarket bridge); winnings withdraw back to native USDC on Base.
• Safety (unchanged from source): confirm:true is hard-required to place/sign anything (omit → dry-run preview); per-order cap POLYMARKET_MAX_BET_USD (default $25, fail-closed on garbage), optional POLYMARKET_MAX_SESSION_USD. Betting is deliberately NOT gated on the x402 API budget ledger — bets are the user's own pUSD, a different asset in a different chain.

Wiring, deps, docs

• Registered in src/index.ts alongside the partner tools via api.registerTool() (a local-execute tool, not a proxy entry). New blockrun_predexon_* → blockrun_polymarket discover-then-trade loop.
• New deps: @polymarket/clob-client-v2@1.0.8, @polymarket/builder-relayer-client, @polymarket/builder-signing-sdk, axios, https-proxy-agent, @blockrun/llm (for the gasless funding path). @solana/kit stayed deduped at v5.5.1 (no version split).
• New polymarket-trading skill (golden rules, mental model, end-to-end flow) + a "Prediction-Market Trading" section in the headline clawrouter skill.
• 12 new tests (tool shape, fail-closed cap parsing, underscore-header proxy bridge, no-network trade-gating). Full suite: 667 passing.

v0.12.219 — GPT-5.6 Sol/Terra/Luna; route generic aliases to stable Terra (#202)

v0.12.219 — July 10, 2026

Add OpenAI's GPT-5.6 family (GA 2026-07-09) — three fixed tiers Sol/Terra/Luna — and route generic aliases to the stable Terra tier rather than the flaky Sol tier (#202, thanks @0xCheetah1).

GPT-5.6 Sol / Terra / Luna registered

• Added openai/gpt-5.6-sol ($5/$30, deepest-reasoning flagship), openai/gpt-5.6-terra ($2.50/$15, balanced everyday tier), and openai/gpt-5.6-luna ($1/$6, cost-efficient/latency tier) to BLOCKRUN_MODELS, mirroring BlockRun's source-of-truth models.ts. All three are 1M context / 128K output. Previously reachable only via raw passthrough of the full model ID.
• All three added to top-models.json (Terra first) so they appear in the /model picker and the default-model allowlist.

Generic aliases resolve to Terra, not Sol (#202)

• Issue: openai/gpt-5.6-sol requests failed with upstream server_error / HTTP 500 after very long (~250s) waits during the GA window — the deepest-reasoning tier is unstable under long-horizon load. Because callers pinned Sol explicitly, ClawRouter (correctly) retried Sol rather than substituting a different model, burning ~251s per attempt.
• Fix: the generic shorthands gpt5, gpt-5.6, and openai/gpt-5.6 now resolve to the stable Terra tier. Explicit tier pins (gpt-5.6-sol, gpt-5.6-terra, gpt-5.6-luna) stay exact, so Sol remains reachable for callers who want the deepest tier and accept the risk. gpt5 was bumped off gpt-5.5 to the newer 5.6 generation.
• Router: openai/gpt-5.6-terra inserted into the COMPLEX fallback chains of the auto, premium, and agentic profiles (ahead of gpt-5.5). Sol is deliberately kept out of all auto-routing — it is opt-in only. No tier primaries changed (promotion needs benchmarks we don't have).
• Not a ClawRouter bug: GPT-5.6's tools-require-reasoning_effort:"none" rule is already handled server-side in BlockRun's openai-passthrough.ts (requiresReasoningEffortNoneWithTools), so no client-side param rewriting was needed. The 500s are genuine upstream instability, which the alias/routing choices route around.

v0.12.218 — ERC-8021 builder-code attribution (#198, #200) + picker order fix (#201)

v0.12.218 — July 9, 2026

ERC-8021 builder-code attribution on x402 payments (with a preserve-existing-codes fix from the OpenClaw side), plus the /model picker now honors top-models.json order.

Builder-code service attribution on every x402 payment (#198, thanks @KillerQueen-Z)

• New src/builder-code.ts: every x402 payment ClawRouter signs is stamped with BlockRun's CDP-registered ERC-8021 Schema 2 service code (builder-code.info.s: ["bc_5hucoh0l"]) via an onAfterPaymentCreation hook in proxy.ts, so BlockRun-originated traffic is attributed on-chain. The CDP facilitator reads builder-code.info.s from the payload and encodes it into settlement calldata — no CBOR/encoding client-side. Any app code (a) the server echoes back in its 402 is preserved. Safe to stamp post-creation: the EIP-712 signature covers the authorization, not the extensions.
• Note: this feature merged to main on July 5 but was not in the npm v0.12.217 package (that release shipped from the sonnet-5 branch before #198 landed) — v0.12.218 is the first npm release that stamps builder codes.

Preserve pre-existing service codes when stamping (#199 → #200, thanks @steipete)

• Bug (caught pre-npm-release): withBuilderCodeServiceCode() replaced any existing builder-code.info.s array with [BLOCKRUN_SERVICE_CODE]. ERC-8021 defines s as an array of related service codes — if another layer (e.g. OpenClaw itself) had already added its attribution, ClawRouter erased it before settlement. Found by Peter Steinberger while validating the ClawRouter bump in openclaw/crabpot.
• Fix: valid pre-existing string entries in info.s are retained (non-string junk filtered out), BlockRun's code is appended only when absent, and the function still returns a fresh array without mutating the payment challenge. 3 regression tests added (existing attribution retained, partially malformed array, idempotent re-stamp).

/model picker now follows top-models.json order (#201, thanks @0xCheetah1)

• VISIBLE_OPENCLAW_MODELS was built by filtering OPENCLAW_MODELS through the top-models.json set, so the picker showed registry declaration order, not the curated order. It is now built by mapping top-models.json → registry entries, so src/top-models.json alone controls both membership and order.
• Curated list reordered: routing profiles first (auto, premium, eco, free), then flagship paid models grouped by vendor (Anthropic → OpenAI → Google → xAI → Z.AI → MiniMax → Moonshot → DeepSeek), free NVIDIA models last. Merge resolution keeps v0.12.217's anthropic/claude-sonnet-5 in the Anthropic block (after the Opus pair, before Sonnet 4.6).
• New regression test asserts the visible picker IDs match top-models.json exactly (length + element order), which also guards against dangling IDs in the JSON that have no registry entry.

Full suite 654 passed, typecheck + lint + Prettier + build clean.

v0.12.217 — add anthropic/claude-sonnet-5

v0.12.217 — June 30, 2026

Model registry alignment: add anthropic/claude-sonnet-5, BlockRun's newest Sonnet — near-Opus coding/agentic quality at Sonnet cost.

New model: Claude Sonnet 5

• BlockRun added anthropic/claude-sonnet-5 (source-of-truth blockrun/src/lib/models.ts): $3/$15 — identical to Sonnet 4.6 but with 1M context / 128K output / adaptive thinking / vision, described as "near-Opus coding/agentic quality at Sonnet cost." BlockRun routes it direct-Anthropic with fallbackModel: claude-sonnet-4.6.
• ClawRouter (src/models.ts): added to BLOCKRUN_MODELS (flows into OPENCLAW_MODELS automatically) and to the /model picker (src/top-models.json).
• Aliases: explicit sonnet-5 / sonnet-5.0 / sonnet-5-0 shorthands added. Bare sonnet / claude deliberately stay on Sonnet 4.6 — Sonnet 5 is opt-in, mirroring BlockRun's own alias map (which does not repoint the shorthand) and the v0.12.167 "add-distinct, don't silently upgrade the bare alias" precedent.
• Routing (src/router/config.ts): inserted as an in-family fallback wherever Sonnet 4.6 appears (auto COMPLEX quality fallback, gpt-5.3-codex MEDIUM, opus COMPLEX, plus the three Sonnet-primary chains — auto REASONING, agentic COMPLEX, agentic REASONING). No primaries promoted — promotion awaits benchmarks (Sonnet 5 is brand-new, not yet in BlockRun's Bedrock map), matching the v0.12.168 gpt-5.5 fallback-only pattern. Cost-neutral in every chain ($3/$15 = Sonnet 4.6).
• README pricing table + skills/clawrouter/SKILL.md model list refreshed. All 645 tests pass.

v0.12.216 — clear all 22 Dependabot alerts (0 vulnerabilities)

v0.12.216 — June 30, 2026

Security + dependency hygiene: clear all 22 Dependabot alerts (npm audit → 0 vulnerabilities) and fix a latent missing-dependency bug in the upstream-proxy feature.

undici is now a declared dependency (fixes the upstream-proxy feature for clean installs)

• Latent bug: src/upstream-proxy.ts lazy-imports undici (await import("undici")) to honor BLOCKRUN_UPSTREAM_PROXY / HTTPS_PROXY / ALL_PROXY, but undici was never declared in dependencies — it only resolved because openclaw (a dev/peer dependency) hoisted undici to the install root. npm ls undici --omit=dev confirmed no shipped runtime dep provides it, so a clean npm install -g @blockrun/clawrouter could leave the proxy feature unable to load undici (caught + warned, then connecting directly). Fix: declare undici@^8.5.0 (the patched version) as a direct dependency — the proxy feature now works regardless of hoisting, and the undici advisories are resolved at the source.

Dependency updates

• openclaw dev/peer dependency bumped 2026.5.7 → 2026.6.10 (in range), clearing all openclaw and transitive @mariozechner/pi-*, markdown-it, tar, undici advisories.
• esbuild pinned to ^0.28.1 via overrides (joining the existing basic-ftp / ws / postcss pins), clearing GHSA-g7r4-m6w7-qqqr (dev-server arbitrary file read, Windows-only — not reachable here, but pinned for cleanliness).
• All alerts were dev-time/lockfile-only — the published runtime footprint had no vulnerable deps; this commit makes the lockfile and dependency declarations honest.

Test fix

• test/integration/security-scanner.test.ts located openclaw's scanner chunk by the skill-scanner-*.js name; openclaw 2026.6.10 renamed it to scanner-*.js. Broadened the filter to match both prefixes (the loader already disambiguates by the scanDirectoryWithSummary export). Full suite 645 passed, lint + typecheck + build clean.

v0.12.215 — recover GPT-5.4 plain-text tool calls (#193)

v0.12.215 — June 30, 2026

Recover tool calls that GPT 5.4 emits as plain JSON / function-call-looking text instead of structured tool_calls (#193, thanks @0xCheetah1).

GPT-5.4 plain-text tool calls now become real tool calls

• Symptom: through the OpenAI-compatible path, GPT 5.4 sometimes emits a tool call as assistant text instead of structured tool_calls — e.g. {"type":"function","name":"terminal","parameters":{"cmd":"ls -alh /home/Blockrun"}}, {"name":"session_search","parameters":{…}}, read_file(parameters={"path":"…"}), or a terminal\nCOMMAND\n[/terminal] block. Downstream chat surfaces (seen in Chermes/Telegram) then displayed the raw text to the user instead of dispatching the tool — the same class of failure as the Gemini #189/#190 fix, but with GPT-specific shapes.
• Fix: added a fourth recognizer to src/textual-tool-calls.ts (which already synthesizes structured calls from OpenClaw <tool_call>, Anthropic <function_calls>, and Gemini [Called function …] text shapes). The GPT extractor recovers: whole-content {"name":…,"parameters":…}, whole-content {"type":"function",…} (incl. pretty-printed), whole-content NAME(parameters={…}), a trailing JSON object after prose only when "type":"function" is explicit, and the terminal\n…\n[/terminal] block. Guardrails: prose JSON examples only fire when the whole content is a call; an incomplete terminal block or a non-function type (e.g. a JSON schema "type":"object") is rejected; the terminal cmd arg is mirrored to command (preserving cmd) for OpenClaw's terminal tool. It runs only when the tag-based extractors find nothing, so it can't interfere with tagged content. Both call sites — streaming and non-streaming in proxy.ts — share this function.
• Tests: 14 new cases in src/textual-tool-calls.test.ts (all five shapes plus no-mis-fire on prose examples, missing parameters, incomplete terminal block, non-function type, and cmd→command normalization). Full suite 645 passed, lint + typecheck + prettier + build clean.