### Fixes

- LINE: acknowledge signed webhook events before agent processing so slow model replies do not cause LINE `request_timeout` delivery failures. Fixes #65375. Thanks @myericho.

- Codex/Lossless: keep Codex explicit compaction on native app-server threads while allowing Lossless through the context-engine slot; `openclaw doctor --fix` now migrates legacy `compaction.provider: "lossless-claw"` config to `plugins.slots.contextEngine`.

- Gateway/approvals: treat `turnSourceTo` as optional in `canBridgeNoDeviceChatApprovalFromBackend`, matching the existing optional handling of `turnSourceAccountId` and `turnSourceThreadId`. Channels without a recipient concept (webchat, control-ui) leave `turnSourceTo` null on both the approval snapshot and the replay params, so the prior required-string check rejected every backend replay with `APPROVAL_CLIENT_MISMATCH`. Cross-channel replay is still gated by the required `turnSourceChannel` and `sessionKey` checks. Fixes #82132. (#82136) Thanks @ottodeng.

- Cron: load runtime plugins before isolated cron model and delivery resolution so external channels can be selected for scheduled runs. (#82111) Thanks @medns.

https://gateway-host/line/webhook

```

The gateway responds to LINE's webhook verification (GET) and inbound events (POST).

The gateway responds to LINE's webhook verification (GET) and acknowledges signed

inbound events (POST) immediately after signature and payload validation; agent

processing continues asynchronously.

If you need a custom path, set `channels.line.webhookPath` or

`channels.line.accounts.<id>.webhookPath` and update the URL accordingly.

);

});

it("declares receive ack policies for deferred LINE webhook acknowledgement", async () => {

it("declares receive ack policies for immediate LINE webhook acknowledgement", async () => {

const proofResults = await verifyChannelMessageReceiveAckPolicyAdapterProofs({

adapterName: "line",

adapter: linePlugin.message!,

proofs: {

after_receive_record: () => {

expect(linePlugin.message?.receive?.defaultAckPolicy).toBe("after_receive_record");

expect(linePlugin.message?.receive?.supportedAckPolicies).toContain(

"after_receive_record",

);

},

after_agent_dispatch: () => {

expect(linePlugin.message?.receive?.defaultAckPolicy).toBe("after_agent_dispatch");

},

},

});

expect(proofResults.find((result) => result.policy === "after_receive_record")?.status).toBe(

"verified",

);

expect(proofResults.find((result) => result.policy === "after_agent_dispatch")?.status).toBe(

"verified",

"not_declared",

);

});

});

secondMonitor.stop();

});

it("acknowledges shared-path POST requests before matched event processing completes", async () => {

const monitor = await monitorLineProvider({

channelAccessToken: "token",

channelSecret: "secret", // pragma: allowlist secret

accountId: "default",

config: {} as OpenClawConfig,

runtime: {} as RuntimeEnv,

});

let releaseWebhook: (() => void) | undefined;

const bot = createLineBotMock.mock.results[0]?.value as {

handleWebhook: ReturnType<typeof vi.fn>;

};

bot.handleWebhook.mockImplementation(

async () =>

await new Promise<void>((resolve) => {

releaseWebhook = resolve;

}),

);

const route = requireRegisteredRoute();

const payload = JSON.stringify({ events: [{ type: "message" }] });

const signature = crypto.createHmac("SHA256", "secret").update(payload).digest("base64");

const req = Object.assign(createMockIncomingRequest([payload]), {

method: "POST",

headers: { "x-line-signature": signature },

}) as unknown as IncomingMessage;

const res = createRouteResponse();

await route.handler(req, res);

expect(res.statusCode).toBe(200);

expect(res.headersSent).toBe(true);

expect(bot.handleWebhook).toHaveBeenCalledTimes(1);

if (!releaseWebhook) {

throw new Error("expected pending LINE webhook handler");

}

releaseWebhook();

monitor.stop();

});

it("rejects ambiguous shared-path webhook signatures", async () => {

const firstMonitor = await monitorLineProvider({

channelAccessToken: "first-token",

}

requestLifecycle.release();

res.statusCode = 200;

res.setHeader("Content-Type", "application/json");

res.end(JSON.stringify({ status: "ok" }));

if (body.events && body.events.length > 0) {

logVerbose(`line: received ${body.events.length} webhook events`);

await match.target.bot.handleWebhook(body);

void Promise.resolve()

.then(() => match.target.bot.handleWebhook(body))

.catch((err) => {

match.target.runtime.error?.(

danger(`line webhook dispatch failed: ${String(err)}`),

);

});

}

res.statusCode = 200;

res.setHeader("Content-Type", "application/json");

res.end(JSON.stringify({ status: "ok" }));

} catch (err) {

if (isRequestBodyLimitError(err, "PAYLOAD_TOO_LARGE")) {

res.statusCode = 413;

},

},

receive: {

defaultAckPolicy: "after_agent_dispatch",

supportedAckPolicies: ["after_receive_record", "after_agent_dispatch"],

defaultAckPolicy: "after_receive_record",

supportedAckPolicies: ["after_receive_record"],

},

});

);

it.each(sharedWebhookPostContractCases)(

"$name returns 500 when event processing fails and does not acknowledge with 200",

"$name acknowledges signed events before failed background processing is logged",

async ({ invoke }) => {

const result = await invoke({

failWith: new Error("transient failure"),

rawBody: JSON.stringify({ events: [{ type: "message" }] }),

signed: true,

});

expect(result.status).toBe(500);

expect(result.body).toEqual({ error: "Internal server error" });

expect(result.status).toBe(200);

expect(result.body).toEqual({ status: "ok" });

expect(result.dispatched).toHaveBeenCalledTimes(1);

expect(result.runtimeError).toHaveBeenCalledTimes(1);

await vi.waitFor(() => {

expect(result.runtimeError).toHaveBeenCalledTimes(1);

});

},

);

});

expect(payload.events).toEqual([{ type: "message" }]);

});

it("releases authenticated requests before event processing completes", async () => {

it("acknowledges signed event requests before event processing completes", async () => {

const rawBody = JSON.stringify({ events: [{ type: "message" }] });

let releaseAuthenticated: (() => void) | undefined;

const bot = {

expect(bot.handleWebhook).toHaveBeenCalledTimes(1);

});

expect(res.headersSent).toBe(false);

await request;

expect(res.statusCode).toBe(200);

expect(res.headersSent).toBe(true);

if (!releaseAuthenticated) {

throw new Error("Expected LINE authenticated request release callback to be initialized");

}

releaseAuthenticated();

await request;

expect(res.statusCode).toBe(200);

});

it("returns 400 for invalid JSON payload even when signature is valid", async () => {

type ReadBodyFn = (req: IncomingMessage, maxBytes: number, timeoutMs?: number) => Promise<string>;

function logLineWebhookDispatchError(runtime: RuntimeEnv | undefined, err: unknown): void {

runtime?.error?.(danger(`line webhook dispatch failed: ${String(err)}`));

}

export function createLineNodeWebhookHandler(params: {

channelSecret: string;

bot: { handleWebhook: (body: webhook.CallbackRequest) => Promise<void> };

id: `${Date.now()}:line:webhook`,

channel: "line",

message: body,

ackPolicy: body.events?.length ? "after_agent_dispatch" : "after_receive_record",

ackPolicy: "after_receive_record",

onAck: () => {

res.statusCode = 200;

res.setHeader("Content-Type", "application/json");

res.end(JSON.stringify({ status: "ok" }));

},

});

if (body.events && body.events.length > 0) {

logVerbose(`line: received ${body.events.length} webhook events`);

await params.bot.handleWebhook(body);

if (receiveContext.shouldAckAfter("receive_record")) {

await receiveContext.ack();

}

const ackStage = body.events?.length ? "agent_dispatch" : "receive_record";

if (receiveContext.shouldAckAfter(ackStage)) {

await receiveContext.ack();

if (body.events && body.events.length > 0) {

logVerbose(`line: received ${body.events.length} webhook events`);

void Promise.resolve()

.then(() => params.bot.handleWebhook(body))

.catch((err) => logLineWebhookDispatchError(params.runtime, err));

}

} catch (err) {

await receiveContext?.nack(err);

return parseLineWebhookBody(rawBody);

}

function logLineWebhookDispatchError(runtime: RuntimeEnv | undefined, err: unknown): void {

runtime?.error?.(danger(`line webhook dispatch failed: ${String(err)}`));

}

export function createLineWebhookMiddleware(

options: LineWebhookOptions,

): (req: Request, res: Response, _next: NextFunction) => Promise<void> {

id: `${Date.now()}:line:webhook`,

channel: "line",

message: body,

ackPolicy: body.events?.length ? "after_agent_dispatch" : "after_receive_record",

ackPolicy: "after_receive_record",

onAck: () => {

res.status(200).json({ status: "ok" });

},

});

if (body.events && body.events.length > 0) {

logVerbose(`line: received ${body.events.length} webhook events`);

await onEvents(body);

if (receiveContext.shouldAckAfter("receive_record")) {

await receiveContext.ack();

}

const ackStage = body.events?.length ? "agent_dispatch" : "receive_record";

if (receiveContext.shouldAckAfter(ackStage)) {

await receiveContext.ack();

if (body.events && body.events.length > 0) {

logVerbose(`line: received ${body.events.length} webhook events`);

void Promise.resolve()

.then(() => onEvents(body))

.catch((err) => logLineWebhookDispatchError(runtime, err));

}

} catch (err) {

await receiveContext?.nack(err);