test: guard ui session storage access in node runs

ui/src/ui/storage.node.test.ts

@@ -76,6 +76,32 @@ describe("loadSettings default gateway URL derivation", () => {
     expect(loadSettings().gatewayUrl).toBe(expectedGatewayUrl("/apps/openclaw"));
   });
 
+  it("skips node sessionStorage accessors that warn without a storage file", async () => {
+    vi.resetModules();
+    vi.unstubAllGlobals();
+    vi.stubGlobal("localStorage", createStorageMock());
+    vi.stubGlobal("navigator", { language: "en-US" } as Navigator);
+    setTestLocation({
+      protocol: "https:",
+      host: "gateway.example:8443",
+      pathname: "/",
+    });
+    setControlUiBasePath(undefined);
+    const warningSpy = vi.spyOn(process, "emitWarning").mockImplementation(() => undefined);
+
+    const { loadSettings } = await import("./storage.ts");
+
+    expect(loadSettings()).toMatchObject({
+      gatewayUrl: expectedGatewayUrl(""),
+      token: "",
+    });
+    expect(warningSpy).not.toHaveBeenCalledWith(
+      "`--localstorage-file` was provided without a valid path",
+      expect.anything(),
+      expect.anything(),
+    );
+  });
+
   it("ignores and scrubs legacy persisted tokens", async () => {
     setTestLocation({
       protocol: "https:",

ui/src/ui/storage.ts

@@ -21,7 +21,7 @@ type PersistedUiSettings = Omit<UiSettings, "token" | "sessionKey" | "lastActive
 };
 
 import { isSupportedLocale } from "../i18n/index.ts";
-import { getSafeLocalStorage } from "../local-storage.ts";
+import { getSafeLocalStorage, getSafeSessionStorage } from "../local-storage.ts";
 import { inferBasePathFromPathname, normalizeBasePath } from "./navigation.ts";
 import { parseThemeSelection, type ThemeMode, type ThemeName } from "./theme.ts";
 
@@ -89,13 +89,7 @@ function deriveDefaultGatewayUrl(): { pageUrl: string; effectiveUrl: string } {
 }
 
 function getSessionStorage(): Storage | null {
-  if (typeof window !== "undefined" && window.sessionStorage) {
-    return window.sessionStorage;
-  }
-  if (typeof sessionStorage !== "undefined") {
-    return sessionStorage;
-  }
-  return null;
+  return getSafeSessionStorage();
 }
 
 function normalizeGatewayTokenScope(gatewayUrl: string): string {