refactor: remove trash sweeper, stuck-run status, zombie auto-abort, and background timers

Streamline the plugin to focus on its core purpose:
- Session affinity (session_id, sticky_key metadata injection)
- X-Session-Id transport header
- Requester runtime metadata (sanitized for TaaS proxy)
- Autorouter response-header capture + taas.autorouter.lastRoute gateway RPC
- Add activation.onStartup for reliable plugin loading

Removed dead-end features that belong in the TaaS proxy layer, not
the OpenClaw plugin:
- Trash sweeper (periodic run-directory cleanup)
- Stuck-run status writer (JSON status files)
- Zombie auto-abort (detect idle runs, emit chat.abort)
- Background timer scheduler (setInterval orchestration)

These features were either no-ops (zombie abort had no SDK dispatch
capability) or redundant with the TaaS proxy's own lifecycle management.

Author: cloudsigma

README.md

@@ -1,50 +1,57 @@
-# openclaw-token-cache-optimizer
+# openclaw-taas-affinity
 
-An [OpenClaw](https://openclaw.ai) provider plugin that maximises prompt-cache hit rates when using [CloudSigma TaaS](https://www.cloudsigma.com) as your LLM provider.
+CloudSigma TaaS affinity provider hook for OpenClaw.
 
-It injects a stable, per-conversation session ID into every outbound request so TaaS can pin your conversation to the same upstream slot (OAuth token, Bedrock region, or Claude Code node) from the very first turn — giving you consistent prompt-cache reuse instead of cold starts on every message.
+This plugin is intentionally narrow after the Claude Code Direction-2 lane update. It does **not** lease requester bridges, poll for bridge work, invoke requester-local tools, rewrite OpenAI tool payloads, or run OpenClaw maintenance sidecars.
 
-The plugin is intentionally narrow: requester-side tool execution is handled by Claude Code, TaaS, and the OpenClaw gateway Direction-2 path. This plugin does **not** lease requester bridges, poll for bridge work, invoke local tools, or alter OpenAI tool payloads.
+## What it does
 
----
+For requests routed through the `cloudsigma` or `cloudsigma-staging` provider IDs, the plugin:
 
-## The problem it solves
+- derives a stable affinity session ID with the form `oc:<sha256-prefix>`
+- injects `metadata.session_id` when absent
+- injects `metadata.sticky_key` when absent
+- injects a sanitized `metadata.requester_runtime` envelope when absent
+- injects transport header `X-Session-Id`
+- captures TaaS autorouter response headers
+- exposes the latest route capture via gateway method `taas.autorouter.lastRoute`
 
-TaaS routes LLM requests across a pool of upstream slots. Without a session signal, it uses heuristics to guess which requests belong to the same conversation:
+## Startup compatibility
 
-| Method | Confidence | Works when |
-|---|---:|---|
-| Tool-use ID chain | 1.0 | Tool-result follow-up turns only |
-| Structural inference | 0.85 | Mid-conversation, after a few turns |
-| New session fallback | 0.30 | First turn — no prior context |
-
-That **0.30 confidence on turn 1** means the first message in every conversation is likely routed to a random slot, breaking prompt-cache continuity right from the start.
+The manifest explicitly asks OpenClaw to import the plugin at gateway startup:
 
-This plugin passes a stable `session_id` derived from your OpenClaw workspace so TaaS short-circuits heuristic matching and achieves **confidence 1.0 from turn 1**.
+```json
+{
+  "activation": {
+    "onStartup": true,
+    "onProviders": ["cloudsigma", "cloudsigma-staging"]
+  }
+}
+```
 
----
+This is required because gateway RPC handlers must be attached during gateway startup. Provider/lazy activation is not enough for `taas.autorouter.lastRoute` to be present in the live gateway dispatch table.
 
-## How it works
+## Request metadata
 
-OpenClaw's `wrapStreamFn` hook intercepts the outbound request payload before it is sent to TaaS. The plugin adds session affinity fields plus a small sanitized requester runtime envelope:
+Example injected metadata:
 
 ```json
 {
   "metadata": {
-    "session_id": "oc:edebc39a82a8a041",
-    "sticky_key": "oc:edebc39a82a8a041",
+    "session_id": "oc:0123456789abcdef",
+    "sticky_key": "oc:0123456789abcdef",
     "requester_runtime": {
-      "schema_version": "2026-06-03",
-      "source": "openclaw-token-cache-optimizer",
-      "session_key": "oc:edebc39a82a8a041",
-      "openclaw_session_id": "oc:edebc39a82a8a041",
+      "schema_version": "2026-06-04",
+      "source": "openclaw-taas-affinity",
+      "session_key": "oc:0123456789abcdef",
+      "openclaw_session_id": "oc:0123456789abcdef",
       "requester_host_id": "host:1a2b3c4d5e6f7890",
-      "repo_name": "my-repo",
+      "repo_name": "example-repo",
       "git_branch_hint": "dev",
       "git_dirty_hint": false,
       "provider": "cloudsigma",
       "model_id": "cloudsigma/auto",
-      "session_source_hint": "source:4ae2870a2e73027c",
+      "session_source_hint": "source:1a2b3c4d5e6f7890",
       "tool_execution": "direction_2_gateway",
       "metadata_classification": {
         "identifiers": "hashed",
@@ -57,231 +64,121 @@ OpenClaw's `wrapStreamFn` hook intercepts the outbound request payload before it
 }
 ```
 
-- `session_id` — read by TaaS's OpenAI and Codex affinity paths.
-- `sticky_key` — additionally read by the Anthropic substrate routing layer.
-- `requester_runtime` — safe advisory hints for downstream routing and diagnostics.
-- `X-Session-Id` — injected by `resolveTransportTurnState` for transports that support per-turn native headers.
-
-All metadata fields are no-overwrite: if the caller already supplied `metadata.session_id`, `metadata.sticky_key`, or `metadata.requester_runtime`, the plugin leaves them intact.
+All metadata fields are no-overwrite. If the caller already supplied `metadata.session_id`, `metadata.sticky_key`, or `metadata.requester_runtime`, the plugin leaves them intact.
 
-### Requester runtime metadata
+The plugin does not include raw local paths (`workspace_dir`, `agent_dir`, `repo_root_hint`), environment variables, tokens, git remotes, full git status output, diffs, or arbitrary provider `extraParams`.
 
-The runtime envelope is intentionally small and sanitized. By default it contains:
+## Direction-2 tool handling
 
-- required affinity/session fields: `session_key`, `openclaw_session_id`
-- hashed identifiers: `requester_host_id`, `session_source_hint`
-- bounded repo hints when available: `repo_name`, `git_branch_hint`, `git_dirty_hint`
-- provider/model hints when available: `provider`, `model_id`
-- explicit execution-mode marker: `tool_execution: "direction_2_gateway"`
-- metadata classification and redaction policy
+Requester-side tool execution is handled outside this plugin by the Claude Code / TaaS / OpenClaw Direction-2 path.
 
-It does **not** include raw local paths (`workspace_dir`, `agent_dir`, `repo_root_hint`) by default. It also never includes environment variables, tokens, git remotes, full status output, diffs, or arbitrary provider `extraParams`. Git probes are bounded with a short timeout.
+The plugin intentionally leaves these payload structures untouched:
 
-### Tool execution model: Direction-2
+- OpenAI `tools`
+- `tool_choice`
+- assistant `tool_calls`
+- `role: "tool"` continuation messages
 
-Requester-side tools are handled outside this plugin by Claude Code / TaaS / OpenClaw gateway Direction-2. Consequently this plugin:
+It also does not inject:
 
-- does not call `/internal/requester-bridges/leases`
-- does not inject `requester_runtime.available_bridges`
-- does not set `capture_mode: "bridge_capable"`
-- does not poll `/internal/requester-bridges/poll` or post `/internal/requester-bridges/results`
-- does not invoke requester-local `/tools/invoke`
-- does not intercept OpenAI `tools`, `tool_calls`, or `role: "tool"` messages
+- `requester_runtime.available_bridges`
+- `capture_mode: "bridge_capable"`
+- bridge operation names such as `requester.tool.invoke`, `openclaw.tool.invoke`, `bridge.ping`, or `bridge.echo`
 
-### Session ID derivation
+## Autorouter route capture
 
-The ID is a SHA-256 hash of the session source, truncated to 16 hex chars and prefixed `oc:`. The plugin walks through a tier list to find the best available source:
+TaaS may return response headers such as:
 
-| Tier | Source | Notes |
-|---|---|---|
-| 1 | `ctx.workspaceDir` (explicit) | Best signal — populated for main agent and many subagents |
-| 2 | `globalThis[pluginRegistryState].workspaceDir` | Parent agent workspace via plugin registry |
-| 3 | `process.env.OPENCLAW_SESSION_ID` | If OpenClaw sets this env var for sub-agents in future |
-| 4 | `process.env.OPENCLAW_AGENT_ID` / `OPENCLAW_RUN_ID` | Any stable per-agent env var |
-| 5 | `OPENCLAW_STATE_DIR` hash | Per-installation fallback — least specific |
+- `X-TaaS-Autorouted: true`
+- `X-TaaS-Autorouter-Model`
+- `X-TaaS-Autorouter-Mode`
+- `X-TaaS-Autorouter-Algorithm-Source`
+- `X-TaaS-Thinking-Applied`
+- `X-TaaS-Routed-Context-Window`
 
-| Property | Detail |
-|---|---|
-| **Stable** | Same value for every API turn within one conversation |
-| **Unique** | Different workspaces / env vars → different IDs |
-| **Resets on `/new`** | New conversation = new workspace = new ID |
-| **Namespaced** | `oc:` prefix avoids collision with Claude Code and other TaaS clients |
+The plugin stores the latest bounded capture per affinity session and per derived OpenClaw agent ID.
 
-### Autorouter capture
+Query latest route by agent:
 
-The wrapper captures TaaS `X-TaaS-*` response headers for autorouted requests and exposes the most recent route via the gateway RPC:
-
-```text
-taas.autorouter.lastRoute
+```bash
+openclaw gateway call taas.autorouter.lastRoute \
+  --params '{"agentId":"new-agent-2"}' \
+  --json
 ```
 
-Callers can query by `workspaceDir`, direct `sessionId`, or `agentId`. Captured values include the autorouted model, algorithm/mode, algorithm source, thinking level applied, and routed context window.
-
-### Sub-agent behaviour
-
-OpenClaw sub-agents run in isolated processes and may not receive a `workspaceDir` in their `wrapStreamFn` context. The tier fallback system ensures sub-agents always get a deterministic session ID:
-
-1. **If the sub-agent has a workspace** (Tier 1) — derives a unique ID from it.
-2. **If the parent agent workspace is visible** via globalThis (Tier 2) — reuses the parent's ID.
-3. **If OpenClaw injects env vars** (Tiers 3–4) — uses those for a stable per-agent ID.
-4. **Last resort** (Tier 5) — falls back to the state dir hash.
-
-#### Debug logging
-
-Set `OPENCLAW_DEBUG=1` (or `NODE_ENV=development`) to emit the session ID source on each request:
+Query by explicit affinity session ID:
 
-```text
-[taas-affinity] wrapStreamFn sessionId=oc:edebc39a82a8a041 source=workspaceDir:/home/user/.openclaw/...
-[taas-affinity] resolveTransportTurnState sessionId=oc:edebc39a82a8a041 source=workspaceDir:... turnId=abc attempt=1
+```bash
+openclaw gateway call taas.autorouter.lastRoute \
+  --params '{"sessionId":"oc:0123456789abcdef"}' \
+  --json
 ```
 
----
-
-## Requirements
-
-- **OpenClaw** ≥ 2026.4.27
-  - Requires the provider plugin hooks exposed via `openclaw/plugin-sdk/core`, including `wrapStreamFn`, `hookAliases`, and `resolveTransportTurnState`.
-- **Node.js** 22+
-- **TaaS** with session-affinity short-circuit support (commit `61a9960`+, April 2026)
-- A CloudSigma account with TaaS access
-
-Older OpenClaw builds may fail to load the plugin or may load it without applying the transport/header hook. Upgrade OpenClaw before deploying this plugin to production instances.
-
----
-
-## Installation
-
-### Option 1 - npm install
+Query by workspace path, deriving the same affinity session ID as the wrapper:
 
 ```bash
-openclaw plugins install openclaw-token-cache-optimizer
-openclaw gateway restart
+openclaw gateway call taas.autorouter.lastRoute \
+  --params '{"workspaceDir":"/home/cloudsigma/.openclaw/workspace-new-agent-2"}' \
+  --json
 ```
 
-The published npm package ships pre-built JavaScript in `dist/` and works on OpenClaw `2026.4.27` and later.
-
-### Option 2 - manual install from source
+## Install / update from checkout
 
 ```bash
-git clone https://github.com/cloudsigma/openclaw-token-cache-optimizer \
-  ~/.openclaw/extensions/openclaw-token-cache-optimizer
-cd ~/.openclaw/extensions/openclaw-token-cache-optimizer
-git checkout dev
+cd /home/cloudsigma/openclaw-taas-affinity
 npm ci
+npm test
 npm run build
-openclaw gateway restart
+rsync -a --delete \
+  --exclude '.git' \
+  --exclude 'node_modules' \
+  --exclude 'package-lock.json' \
+  ./ ~/.openclaw/extensions/openclaw-taas-affinity/
+cd ~/.openclaw/extensions/openclaw-taas-affinity
+npm ci --omit=dev --ignore-scripts
 ```
 
-`npm ci` runs the `prepare` lifecycle script, which compiles TypeScript to `dist/index.js`. Re-run `npm run build` after pulling new source changes.
+Then restart the managed gateway service during a controlled window:
 
-No `openclaw.json` changes are required - the plugin auto-activates for all requests to the `cloudsigma` and `cloudsigma-staging` providers.
+```bash
+systemctl --user restart openclaw-gateway.service
+```
 
-### Verify it loaded
+Verify:
 
 ```bash
 openclaw gateway status
 openclaw plugins info openclaw-taas-affinity
+openclaw gateway call taas.autorouter.lastRoute --params '{"agentId":"new-agent-2"}' --json
 ```
 
-You should see `Status: loaded` and the source pointing at `dist/index.js`.
-
----
-
-## Compatibility
-
-| OpenClaw gateway | Status | Notes |
-|---|---|---|
-| >= 2026.5.x | Supported | Loads compiled `dist/index.js` |
-| 2026.4.27 - 2026.4.x | Supported | Loads compiled `dist/index.js`; transport/header support depends on gateway hook availability |
-| < 2026.4.27 | Not supported | Hooks the plugin relies on are not exposed |
-
----
-
-## Verification
-
-### Local validation
-
-For repository/CI validation, install dev dependencies and run the test suite:
+## Development
 
 ```bash
-npm ci
+npm run typecheck
+npm run smoke
+npm run unit
 npm test
 npm run build
 ```
 
-This runs:
-
-- `npm run typecheck` — validates the TypeScript source against the OpenClaw plugin SDK and Node typings
-- `npm run smoke` — imports the plugin, registers the provider hook, and verifies payload/header injection plus autorouter capture
-- `npm run unit` — validates sweeper/status/auto-abort behaviour and Direction-2 regressions
-
-Direction-2 regression coverage includes:
-
-- requester bridge lease endpoint is not called
-- `available_bridges` and bridge capture metadata are not injected
-- OpenAI `tools` pass through untouched
-- assistant `tool_calls` and `role: "tool"` messages are not intercepted
-- existing metadata fields are not overwritten
+Current tests cover:
 
-### TaaS logs
+- manifest startup activation
+- provider hook registration for `cloudsigma` and `cloudsigma-staging`
+- metadata/header injection
+- no-overwrite behavior
+- absence of requester bridge descriptors
+- OpenAI tool payload pass-through
+- autorouter capture and lookup by workspace/session/agent
 
-After installing, the first turn of every new conversation should show:
-
-```text
-match_reason: "external_id_new"   ← first turn (new session in Redis)
-match_reason: "external_id"       ← subsequent turns (known session)
-```
-
-Previously turn 1 would show `match_reason: "new"` with `confidence: 0.30`.
-
-### Redis (from a TaaS pod)
-
-```bash
-redis-cli -h redis.taas.svc.cluster.local get "anth:session:oc:edebc39a82a8a041"
-```
-
-Replace the ID with your actual session ID. A non-null response confirms TaaS has bound the session to a slot.
-
----
-
-## Behaviour by session type
-
-| Session type | ID scope |
-|---|---|
-| Main agent | Own stable ID for the conversation lifetime |
-| Spawned subagent | Own ID when a separate `workspaceDir` is present; otherwise tier fallback |
-| Cron / isolated run | Own ID when an isolated workspace/env source exists |
-| New conversation (`/new`, `/reset`) | New workspace → new ID |
-| Parallel conversations | Each gets a separate ID when OpenClaw supplies separate workspaces/env sources |
-
----
-
-## Configuration
-
-None required for standard CloudSigma TaaS use.
-
-Supported environment variables:
+## Environment variables
 
 | Variable | Default | Purpose |
-|---|---|---|
+|---|---:|---|
 | `OPENCLAW_DEBUG` | unset | Emit debug logs for session source and autorouter capture |
-| `OPENCLAW_SESSION_ID` | unset | Optional session source fallback |
-| `OPENCLAW_AGENT_ID` / `OPENCLAW_RUN_ID` | unset | Optional per-agent session source fallback |
-| `OPENCLAW_STATE_DIR` | `~/.openclaw` | Last-resort stable source for fallback session ID |
-| `TAAS_AFFINITY_SWEEP_INTERVAL_MS` | `3600000` | Background trash sweeper interval |
-| `TAAS_AFFINITY_SWEEP_STALE_DAYS` | `7` | Age threshold for stale `.deleted` agent directories |
-| `TAAS_AFFINITY_RUNS_STATUS_PATH` | `~/.openclaw/alien-studio/runs-status.json` | Stuck-run status JSON path |
-| `TAAS_AFFINITY_AUTO_ABORT_ZOMBIES` | `false` | Opt-in zombie run auto-abort check |
-| `TAAS_AFFINITY_AUTO_ABORT_DRY_RUN` | `false` | Log zombie abort candidates without aborting |
+| `OPENCLAW_SESSION_ID` | unset | Preferred stable session source when supplied by OpenClaw |
+| `OPENCLAW_AGENT_ID` / `OPENCLAW_RUN_ID` | unset | Fallback stable agent/session source |
+| `OPENCLAW_STATE_DIR` | `~/.openclaw` | Last-resort stable fallback source |
 
 Requester bridge variables such as `TAAS_REQUESTER_BRIDGE_PLUGIN_ENABLED`, `TAAS_REQUESTER_BRIDGE_LEASE_URL`, and `TAAS_REQUESTER_BRIDGE_POLL_INTERVAL_MS` are obsolete and ignored by this plugin version.
-
----
-
-## Contributing
-
-Issues and PRs welcome. The core logic lives in [`index.ts`](./index.ts).
-
-## License
-
-MIT — see [LICENSE](./LICENSE).