docs: changelog for MS Teams scopes (#1507) (thanks @Evizero)

The @microsoft/agents-hosting SDK's MsalTokenProvider automatically
appends `/.default` to all scope strings in its token acquisition
methods (acquireAccessTokenViaSecret, acquireAccessTokenViaFIC,
acquireAccessTokenViaWID, acquireTokenWithCertificate in
msalTokenProvider.ts). This is consistent SDK behavior, not a recent
change.

Our code was including `.default` in scope URLs, resulting in invalid
double suffixes like `https://graph.microsoft.com/.default/.default`.

This was confirmed to cause Graph API authentication errors. Removing
the `.default` suffix from our scope strings allows the SDK to append
it correctly, resolving the issue.

Before: we pass `.default` -> SDK appends -> double `.default` (broken)
After:  we pass base URL  -> SDK appends -> single `.default` (works)

AGENTS.md

@@ -7,7 +7,6 @@
 - Tests: colocated `*.test.ts`.
 - Docs: `docs/` (images, queue, Pi config). Built output lives in `dist/`.
 - Plugins/extensions: live under `extensions/*` (workspace packages). Keep plugin-only deps in the extension `package.json`; do not add them to the root `package.json` unless core uses them.
-- Plugins: install runs `npm install --omit=dev` in plugin dir; runtime deps must live in `dependencies`. Avoid `workspace:*` in `dependencies` (npm install breaks); put `clawdbot` in `devDependencies` or `peerDependencies` instead (runtime resolves `clawdbot/plugin-sdk` via jiti alias).
 - Installers served from `https://clawd.bot/*`: live in the sibling repo `../clawd.bot` (`public/install.sh`, `public/install-cli.sh`, `public/install.ps1`).
 - Messaging channels: always consider **all** built-in + extension channels when refactoring shared logic (routing, allowlists, pairing, command gating, onboarding, docs).
   - Core channel docs: `docs/channels/`

CHANGELOG.md

@@ -8,19 +8,15 @@ Docs: https://docs.clawd.bot
 - CLI: restart the gateway by default after `clawdbot update`; add `--no-restart` to skip it.
 - CLI: add live auth probes to `clawdbot models status` for per-profile verification.
 - Markdown: add per-channel table conversion (bullets for Signal/WhatsApp, code blocks elsewhere). (#1495) Thanks @odysseus0.
-- Docs: remove the misplaced Google Docs Editor entry from the showcase. (#1547) Thanks @aj47.
 
 ### Fixes
 - Voice wake: auto-save wake words on blur/submit across iOS/Android and align limits with macOS.
-- Tailscale: retry serve/funnel with sudo only for permission errors and keep original failure details. (#1551) Thanks @sweepies.
 - Discord: limit autoThread mention bypass to bot-owned threads; keep ack reactions mention-gated. (#1511) Thanks @pvoo.
 - Gateway: accept null optional fields in exec approval requests. (#1511) Thanks @pvoo.
 - TUI: forward unknown slash commands (for example, `/context`) to the Gateway.
 - TUI: include Gateway slash commands in autocomplete and `/help`.
 - CLI: skip usage lines in `clawdbot models status` when provider usage is unavailable.
 - CLI: suppress diagnostic session/run noise during auth probes.
-- CLI: hide auth probe timeout warnings from embedded runs.
-- CLI: render auth probe results as a table in `clawdbot models status`.
 - Linux: include env-configured user bin roots in systemd PATH and align PATH audits. (#1512) Thanks @robbyczgw-cla.
 - TUI: render Gateway slash-command replies as system output (for example, `/context`).
 - Media: preserve PNG alpha when possible; fall back to JPEG when still over size cap. (#1491) Thanks @robbyczgw-cla.

docs/start/showcase.md

@@ -331,6 +331,12 @@ Full setup walkthrough (28m) by VelvetShark.
   Multi-lingual audio transcription via OpenRouter (Gemini, etc). Available on ClawdHub.
 </Card>
 
+<Card title="Google Docs Editor" icon="file-word">
+  **Community** • `docs` `editing` `skill`
+  
+  Rich-text Google Docs editing skill. Built rapidly with Claude Code.
+</Card>
+
 </CardGroup>
 
 ## 🏗️ Infrastructure & Deployment

src/agents/pi-embedded-runner/run.ts

@@ -79,7 +79,6 @@ export async function runEmbeddedPiAgent(
         ? "markdown"
         : "plain"
       : "markdown");
-  const isProbeSession = params.sessionId?.startsWith("probe-") ?? false;
 
   return enqueueCommandInLane(sessionLane, () =>
     enqueueGlobal(async () => {
@@ -456,7 +455,7 @@ export async function runEmbeddedPiAgent(
                 cfg: params.config,
                 agentDir: params.agentDir,
               });
-              if (timedOut && !isProbeSession) {
+              if (timedOut) {
                 log.warn(
                   `Profile ${lastProfileId} timed out (possible rate limit). Trying next account...`,
                 );

src/agents/pi-embedded-runner/run/attempt.ts

@@ -595,23 +595,18 @@ export async function runEmbeddedAttempt(
       setActiveEmbeddedRun(params.sessionId, queueHandle);
 
       let abortWarnTimer: NodeJS.Timeout | undefined;
-      const isProbeSession = params.sessionId?.startsWith("probe-") ?? false;
       const abortTimer = setTimeout(
         () => {
-          if (!isProbeSession) {
+          log.warn(
-            log.warn(
+            `embedded run timeout: runId=${params.runId} sessionId=${params.sessionId} timeoutMs=${params.timeoutMs}`,
-              `embedded run timeout: runId=${params.runId} sessionId=${params.sessionId} timeoutMs=${params.timeoutMs}`,
+          );
-            );
-          }
           abortRun(true);
           if (!abortWarnTimer) {
             abortWarnTimer = setTimeout(() => {
               if (!activeSession.isStreaming) return;
-              if (!isProbeSession) {
+              log.warn(
-                log.warn(
+                `embedded run abort still streaming: runId=${params.runId} sessionId=${params.sessionId}`,
-                  `embedded run abort still streaming: runId=${params.runId} sessionId=${params.sessionId}`,
+              );
-                );
-              }
             }, 10_000);
           }
         },

src/commands/models/list.status-command.ts

@@ -28,7 +28,6 @@ import {
 } from "../../infra/provider-usage.js";
 import type { RuntimeEnv } from "../../runtime.js";
 import { colorize, theme } from "../../terminal/theme.js";
-import { renderTable } from "../../terminal/table.js";
 import { formatCliCommand } from "../../cli/command-format.js";
 import { shortenHomePath } from "../../utils.js";
 import { resolveProviderAuthOverview } from "./list.auth-overview.js";
@@ -36,6 +35,7 @@ import { isRich } from "./list.format.js";
 import {
   describeProbeSummary,
   formatProbeLatency,
+  groupProbeResults,
   runAuthProbes,
   sortProbeResults,
   type AuthProbeSummary,
@@ -571,8 +571,7 @@ export async function modelsStatusCommand(
     if (probeSummary.results.length === 0) {
       runtime.log(colorize(rich, theme.muted, "- none"));
     } else {
-      const tableWidth = Math.max(60, (process.stdout.columns ?? 120) - 1);
+      const grouped = groupProbeResults(sortProbeResults(probeSummary.results));
-      const sorted = sortProbeResults(probeSummary.results);
       const statusColor = (status: string) => {
         if (status === "ok") return theme.success;
         if (status === "rate_limit") return theme.warn;
@@ -581,33 +580,29 @@ export async function modelsStatusCommand(
         if (status === "no_model") return theme.muted;
         return theme.muted;
       };
-      const rows = sorted.map((result) => {
+      for (const [provider, results] of grouped) {
-        const status = colorize(rich, statusColor(result.status), result.status);
+        const modelLabel = results.find((r) => r.model)?.model ?? "-";
-        const latency = formatProbeLatency(result.latencyMs);
+        runtime.log(
-        const detail = result.error ? colorize(rich, theme.muted, result.error) : "";
+          `- ${theme.heading(provider)}${colorize(
-        const modelLabel = result.model ?? `${result.provider}/-`;
+            rich,
-        const modeLabel = result.mode ? ` ${colorize(rich, theme.muted, `(${result.mode})`)}` : "";
+            theme.muted,
-        const profile = `${colorize(rich, theme.accent, result.label)}${modeLabel}`;
+            modelLabel ? ` (model: ${modelLabel})` : "",
-        const statusLabel = `${status}${colorize(rich, theme.muted, ` · ${latency}`)}`;
+          )}`,
-        return {
+        );
-          Model: colorize(rich, theme.heading, modelLabel),
+        for (const result of results) {
-          Profile: profile,
+          const status = colorize(rich, statusColor(result.status), result.status);
-          Status: statusLabel,
+          const latency = formatProbeLatency(result.latencyMs);
-          Detail: detail,
+          const mode = result.mode ? ` (${result.mode})` : "";
-        };
+          const detail = result.error ? colorize(rich, theme.muted, ` - ${result.error}`) : "";
-      });
+          runtime.log(
-      runtime.log(
+            `  - ${colorize(rich, theme.accent, result.label)}${mode} ${status} ${colorize(
-        renderTable({
+              rich,
-          width: tableWidth,
+              theme.muted,
-          columns: [
+              latency,
-            { key: "Model", header: "Model", minWidth: 18 },
+            )}${detail}`,
-            { key: "Profile", header: "Profile", minWidth: 24 },
+          );
-            { key: "Status", header: "Status", minWidth: 12 },
+        }
-            { key: "Detail", header: "Detail", minWidth: 16, flex: true },
+      }
-          ],
-          rows,
-        }).trimEnd(),
-      );
       runtime.log(colorize(rich, theme.muted, describeProbeSummary(probeSummary)));
     }
   }

src/gateway/server-methods/sessions.ts

@@ -251,10 +251,6 @@ export const sessionsHandlers: GatewayRequestHandlers = {
         lastChannel: entry?.lastChannel,
         lastTo: entry?.lastTo,
         skillsSnapshot: entry?.skillsSnapshot,
-        // Reset token counts to 0 on session reset (#1523)
-        inputTokens: 0,
-        outputTokens: 0,
-        totalTokens: 0,
       };
       store[primaryKey] = nextEntry;
       return nextEntry;

src/infra/tailscale.test.ts

@@ -1,21 +1,8 @@
-import { afterEach, describe, expect, it, vi } from "vitest";
+import { describe, expect, it, vi } from "vitest";
 
-import * as tailscale from "./tailscale.js";
+import { ensureGoInstalled, ensureTailscaledInstalled, getTailnetHostname } from "./tailscale.js";
-
-const {
-  ensureGoInstalled,
-  ensureTailscaledInstalled,
-  getTailnetHostname,
-  enableTailscaleServe,
-  disableTailscaleServe,
-  ensureFunnel,
-} = tailscale;
 
 describe("tailscale helpers", () => {
-  afterEach(() => {
-    vi.restoreAllMocks();
-  });
-
   it("parses DNS name from tailscale status", async () => {
     const exec = vi.fn().mockResolvedValue({
       stdout: JSON.stringify({
@@ -61,139 +48,4 @@ describe("tailscale helpers", () => {
     await ensureTailscaledInstalled(exec as never, prompt, runtime);
     expect(exec).toHaveBeenCalledWith("brew", ["install", "tailscale"]);
   });
-
-  it("enableTailscaleServe attempts normal first, then sudo", async () => {
-    // 1. First attempt fails
-    // 2. Second attempt (sudo) succeeds
-    const exec = vi
-      .fn()
-      .mockRejectedValueOnce(new Error("permission denied"))
-      .mockResolvedValueOnce({ stdout: "" });
-
-    await enableTailscaleServe(3000, exec as never);
-
-    expect(exec).toHaveBeenNthCalledWith(
-      1,
-      expect.stringMatching(/tailscale$/),
-      expect.arrayContaining(["serve", "--bg", "--yes", "3000"]),
-      expect.any(Object),
-    );
-
-    expect(exec).toHaveBeenNthCalledWith(
-      2,
-      "sudo",
-      expect.arrayContaining([
-        "-n",
-        expect.stringMatching(/tailscale$/),
-        "serve",
-        "--bg",
-        "--yes",
-        "3000",
-      ]),
-      expect.any(Object),
-    );
-  });
-
-  it("enableTailscaleServe does NOT use sudo if first attempt succeeds", async () => {
-    const exec = vi.fn().mockResolvedValue({ stdout: "" });
-
-    await enableTailscaleServe(3000, exec as never);
-
-    expect(exec).toHaveBeenCalledTimes(1);
-    expect(exec).toHaveBeenCalledWith(
-      expect.stringMatching(/tailscale$/),
-      expect.arrayContaining(["serve", "--bg", "--yes", "3000"]),
-      expect.any(Object),
-    );
-  });
-
-  it("disableTailscaleServe uses fallback", async () => {
-    const exec = vi
-      .fn()
-      .mockRejectedValueOnce(new Error("permission denied"))
-      .mockResolvedValueOnce({ stdout: "" });
-
-    await disableTailscaleServe(exec as never);
-
-    expect(exec).toHaveBeenCalledTimes(2);
-    expect(exec).toHaveBeenNthCalledWith(
-      2,
-      "sudo",
-      expect.arrayContaining(["-n", expect.stringMatching(/tailscale$/), "serve", "reset"]),
-      expect.any(Object),
-    );
-  });
-
-  it("ensureFunnel uses fallback for enabling", async () => {
-    // Mock exec:
-    // 1. status (success)
-    // 2. enable (fails)
-    // 3. enable sudo (success)
-    const exec = vi
-      .fn()
-      .mockResolvedValueOnce({ stdout: JSON.stringify({ BackendState: "Running" }) }) // status
-      .mockRejectedValueOnce(new Error("permission denied")) // enable normal
-      .mockResolvedValueOnce({ stdout: "" }); // enable sudo
-
-    const runtime = {
-      error: vi.fn(),
-      log: vi.fn(),
-      exit: vi.fn() as unknown as (code: number) => never,
-    };
-    const prompt = vi.fn();
-
-    await ensureFunnel(8080, exec as never, runtime, prompt);
-
-    // 1. status
-    expect(exec).toHaveBeenNthCalledWith(
-      1,
-      expect.stringMatching(/tailscale$/),
-      expect.arrayContaining(["funnel", "status", "--json"]),
-    );
-
-    // 2. enable normal
-    expect(exec).toHaveBeenNthCalledWith(
-      2,
-      expect.stringMatching(/tailscale$/),
-      expect.arrayContaining(["funnel", "--yes", "--bg", "8080"]),
-      expect.any(Object),
-    );
-
-    // 3. enable sudo
-    expect(exec).toHaveBeenNthCalledWith(
-      3,
-      "sudo",
-      expect.arrayContaining([
-        "-n",
-        expect.stringMatching(/tailscale$/),
-        "funnel",
-        "--yes",
-        "--bg",
-        "8080",
-      ]),
-      expect.any(Object),
-    );
-  });
-
-  it("enableTailscaleServe skips sudo on non-permission errors", async () => {
-    const exec = vi.fn().mockRejectedValueOnce(new Error("boom"));
-
-    await expect(enableTailscaleServe(3000, exec as never)).rejects.toThrow("boom");
-
-    expect(exec).toHaveBeenCalledTimes(1);
-  });
-
-  it("enableTailscaleServe rethrows original error if sudo fails", async () => {
-    const originalError = Object.assign(new Error("permission denied"), {
-      stderr: "permission denied",
-    });
-    const exec = vi
-      .fn()
-      .mockRejectedValueOnce(originalError)
-      .mockRejectedValueOnce(new Error("sudo: a password is required"));
-
-    await expect(enableTailscaleServe(3000, exec as never)).rejects.toBe(originalError);
-
-    expect(exec).toHaveBeenCalledTimes(2);
-  });
 });

src/infra/tailscale.ts

@@ -206,64 +206,6 @@ export async function ensureTailscaledInstalled(
   await exec("brew", ["install", "tailscale"]);
 }
 
-type ExecErrorDetails = {
-  stdout?: unknown;
-  stderr?: unknown;
-  message?: unknown;
-  code?: unknown;
-};
-
-function extractExecErrorText(err: unknown) {
-  const errOutput = err as ExecErrorDetails;
-  const stdout = typeof errOutput.stdout === "string" ? errOutput.stdout : "";
-  const stderr = typeof errOutput.stderr === "string" ? errOutput.stderr : "";
-  const message = typeof errOutput.message === "string" ? errOutput.message : "";
-  const code = typeof errOutput.code === "string" ? errOutput.code : "";
-  return { stdout, stderr, message, code };
-}
-
-function isPermissionDeniedError(err: unknown): boolean {
-  const { stdout, stderr, message, code } = extractExecErrorText(err);
-  if (code.toUpperCase() === "EACCES") return true;
-  const combined = `${stdout}\n${stderr}\n${message}`.toLowerCase();
-  return (
-    combined.includes("permission denied") ||
-    combined.includes("access denied") ||
-    combined.includes("operation not permitted") ||
-    combined.includes("not permitted") ||
-    combined.includes("requires root") ||
-    combined.includes("must be run as root") ||
-    combined.includes("must be run with sudo") ||
-    combined.includes("requires sudo") ||
-    combined.includes("need sudo")
-  );
-}
-
-// Helper to attempt a command, and retry with sudo if it fails.
-async function execWithSudoFallback(
-  exec: typeof runExec,
-  bin: string,
-  args: string[],
-  opts: { maxBuffer?: number; timeoutMs?: number },
-): Promise<{ stdout: string; stderr: string }> {
-  try {
-    return await exec(bin, args, opts);
-  } catch (err) {
-    if (!isPermissionDeniedError(err)) {
-      throw err;
-    }
-    logVerbose(`Command failed, retrying with sudo: ${bin} ${args.join(" ")}`);
-    try {
-      return await exec("sudo", ["-n", bin, ...args], opts);
-    } catch (sudoErr) {
-      const { stderr, message } = extractExecErrorText(sudoErr);
-      const detail = (stderr || message).trim();
-      if (detail) logVerbose(`Sudo retry failed: ${detail}`);
-      throw err;
-    }
-  }
-}
-
 export async function ensureFunnel(
   port: number,
   exec: typeof runExec = runExec,
@@ -295,16 +237,10 @@ export async function ensureFunnel(
     }
 
     logVerbose(`Enabling funnel on port ${port}…`);
-    // Attempt with fallback
+    const { stdout } = await exec(tailscaleBin, ["funnel", "--yes", "--bg", `${port}`], {
-    const { stdout } = await execWithSudoFallback(
+      maxBuffer: 200_000,
-      exec,
+      timeoutMs: 15_000,
-      tailscaleBin,
+    });
-      ["funnel", "--yes", "--bg", `${port}`],
-      {
-        maxBuffer: 200_000,
-        timeoutMs: 15_000,
-      },
-    );
     if (stdout.trim()) console.log(stdout.trim());
   } catch (err) {
     const errOutput = err as { stdout?: unknown; stderr?: unknown };
@@ -352,7 +288,7 @@ export async function ensureFunnel(
 
 export async function enableTailscaleServe(port: number, exec: typeof runExec = runExec) {
   const tailscaleBin = await getTailscaleBinary();
-  await execWithSudoFallback(exec, tailscaleBin, ["serve", "--bg", "--yes", `${port}`], {
+  await exec(tailscaleBin, ["serve", "--bg", "--yes", `${port}`], {
     maxBuffer: 200_000,
     timeoutMs: 15_000,
   });
@@ -360,7 +296,7 @@ export async function enableTailscaleServe(port: number, exec: typeof runExec =
 
 export async function disableTailscaleServe(exec: typeof runExec = runExec) {
   const tailscaleBin = await getTailscaleBinary();
-  await execWithSudoFallback(exec, tailscaleBin, ["serve", "reset"], {
+  await exec(tailscaleBin, ["serve", "reset"], {
     maxBuffer: 200_000,
     timeoutMs: 15_000,
   });
@@ -368,7 +304,7 @@ export async function disableTailscaleServe(exec: typeof runExec = runExec) {
 
 export async function enableTailscaleFunnel(port: number, exec: typeof runExec = runExec) {
   const tailscaleBin = await getTailscaleBinary();
-  await execWithSudoFallback(exec, tailscaleBin, ["funnel", "--bg", "--yes", `${port}`], {
+  await exec(tailscaleBin, ["funnel", "--bg", "--yes", `${port}`], {
     maxBuffer: 200_000,
     timeoutMs: 15_000,
   });
@@ -376,7 +312,7 @@ export async function enableTailscaleFunnel(port: number, exec: typeof runExec =
 
 export async function disableTailscaleFunnel(exec: typeof runExec = runExec) {
   const tailscaleBin = await getTailscaleBinary();
-  await execWithSudoFallback(exec, tailscaleBin, ["funnel", "reset"], {
+  await exec(tailscaleBin, ["funnel", "reset"], {
     maxBuffer: 200_000,
     timeoutMs: 15_000,
   });

src/tui/tui-command-handlers.ts

@@ -408,12 +408,6 @@ export function createCommandHandlers(context: CommandHandlerContext) {
       case "new":
       case "reset":
         try {
-          // Clear token counts immediately to avoid stale display (#1523)
-          state.sessionInfo.inputTokens = null;
-          state.sessionInfo.outputTokens = null;
-          state.sessionInfo.totalTokens = null;
-          tui.requestRender();
-
           await client.resetSession(state.currentSessionKey);
           chatLog.addSystem(`session ${state.currentSessionKey} reset`);
           await loadHistory();