* fix(memory-core): clear pending-update wait timer after update settles
* test(memory-core): wrap setImmediate Promise executor in block body
`oxlint(no-promise-executor-return)` (enabled in the bundled-extension
config used by `pnpm lint:extensions:bundled` /`check-lint` /
`check-additional-extension-bundled`) flags the implicit return from
`new Promise((resolve) => setImmediate(resolve))`. The arrow function
is expression-bodied and returns the Immediate handle, which the rule
treats as a return inside a Promise executor.
Switch both occurrences in the regression guard to block bodies so the
executor callback does not return a value. Behavior is unchanged:
setImmediate still fires resolve on the next macrotask; the regression
assertion (process.getActiveResourcesInfo() delta) still passes.
* test(memory-core): track pending wait timer cleanup
* refactor(memory-core): keep timer cleanup LOC-neutral
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
Co-authored-by: Peter Steinberger <peter@steipete.me>
* fix(sdk): add prototype-pollution guard to migration config merge
mergeMigrationConfigValue and writeMigrationConfigPath had no
isBlockedObjectKey guard, allowing __proto__/constructor/prototype
keys from imported config files to trigger prototype pollution.
Add the same guard used by the sibling config-path writer
(setConfigValueAtPath/parseConfigPath) to reject blocked object
keys before they reach a bracket assignment.
Fixes#103059
* fix(sdk): harden migration config patches
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
70ab6b324d dropped the last literal "@clawdbot/lobster" mention from the
runner while keeping the join-built dynamic import, so the unused-direct-
dependency contract started failing on main. Document the join trick with
the literal package path so the contract sees the dependency again.
* feat(ui): redesign Channels page with guided channel setup wizard
Adds wizard.start flow=channels gateway RPC (additive protocol change) that
drives the shared channel-setup wizard (openclaw channels add) over the
session step protocol. Control UI Channels page becomes a card hub with
plugin-art covers, guided per-channel setup modal (WhatsApp QR pairing via
web.login.*, BotFather/Slack/Discord helper links), and a detail overlay
hosting the full schema config form.
* test(ui): cover channel wizard controller; refresh channels view test props
* chore(mock): use non-token-shaped wizard placeholder
* test(gateway): scanner-safe auth local in channels wizard test
* fix(ui): cancel gateway wizard session on channels page disconnect
* fix(ui): adopt browse-all channel pick and guard dirty config before setup
* fix(ui): cancel gateway session created by a stale wizard.start
* fix(ui): adopt multiselect channel picks; drop redundant String()
* fix(ui): track all wizard-adopted channels so WhatsApp QR runs regardless of pick order
* feat(gateway): report configured channels on terminal channel-wizard result
Replaces the Control UI's channel-adoption heuristic with the authoritative
outcome: the channels flow reports its actual selection after config commit,
the wizard session surfaces it as an additive channels field on the terminal
wizard.next result, and the UI keys WhatsApp QR linking off that.
* refactor(ui): align channels hub with the unified settings design language
Hub becomes settings-language rows (44px art tiles, status dots, uppercase
section headings, hairline groups) instead of a card gallery; the detail
overlay hosts the migrated per-channel settings sections with Run setup in
the header. Wizard dialog and tile/cover styles move to spacing tokens.
* chore(i18n): translate channels hub/setup strings; refresh raw-copy baseline
* refactor: satisfy LOC ratchet and dead-export gates
Split mock-dev channel/plugin fixtures into their own modules, move wizard
runner types/defaults to server-methods/wizard.ts, extract the channels page
wizard host and nostr profile HTTP ops, and unexport internal-only types
(incl. the unused config-form SECTION_META barrel re-export).
* chore(i18n): retranslate channels strings on rebased locale bundles
* fix(test): drop redundant String() in channels wizard e2e
* fix: address channel-wizard review findings
- lock wizard cancellation before durable installs/config writes
- report configured channel accounts on the terminal wizard result and
start WhatsApp QR pairing for that account (web.login accountId)
- forward request options through the browser gateway client so wizard
RPC timeouts apply
- render skipped setup as a no-change completion
- keep detail/advanced config reachable for unconfigured channels
- surface the dirty-config warning inside the detail overlay
- adopt the picked channel for wizard title/links in browse-all flows
* fix(ui): local wizard RPC timeout; translate no-change completion strings
* fix(deepgram): reject malformed and non-http(s) realtime base URL overrides
* fix(deepgram): accept direct ws(s):// realtime base URL overrides
Preserve released behavior: v2026.6.11 passes wss:// (and ws://) base URL
overrides straight through to the WebSocket URL builder. The prior validator
rejected every non-http(s) scheme, breaking custom Deepgram realtime proxies
that use a direct wss:// endpoint. Accept ws:/wss: alongside http(s):, keep
rejecting malformed and unrelated schemes, and preserve a direct ws(s):
override's protocol/path/port through toDeepgramRealtimeWsUrl.
* fix(deepgram): keep secure ws:// -> wss:// upgrade for realtime base URL
A prior change preserved direct ws:/wss: overrides unchanged, which also
stopped upgrading a plaintext ws:// override to wss://. That regressed the
released behavior where every accepted non-http: scheme maps to wss:, so an
existing ws:// endpoint would begin sending Deepgram realtime audio and
provider auth over an unencrypted socket. Restore the release mapping
(http: -> ws:, all others -> wss:), which still preserves a direct wss://
override and keeps the ws:// -> wss:// secure upgrade.
* fix(deepgram): preserve custom websocket transport
Co-authored-by: dwc1997 <du.wenchi@xydigit.com>
* test(deepgram): use placeholder credential fixture
* test(deepgram): clarify loopback callbacks
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(discord): inherit default_auto_archive_duration in createThreadDiscord
When createThreadForBinding hardcoded autoArchiveMinutes: 60, the
parent channel's default_auto_archive_duration (configured by
operators at 1440, 4320, or 10080) was silently overridden. This is
the same pattern fixed in #103033 for sendMessageDiscord's implicit
forum thread creation.
- Move the auto_archive_duration set after the channel fetch in
createThreadDiscord so channel.default_auto_archive_duration can
serve as a fallback when autoArchiveMinutes is not provided.
- Remove the hardcoded autoArchiveMinutes: 60 from
createThreadForBinding so it inherits the channel default for
forum/media channels and omits the field for text channels
(preserving Discord's server-side default).
- Explicit autoArchiveMinutes from callers (thread-create action,
auto-thread config) still take priority via the ?? operator.
Co-Authored-By: Claude <noreply@anthropic.com>
* refactor(discord): preserve parent thread archive defaults
Co-authored-by: 陈志强0668000989 <chen.zhiqiang1@xydigit.com>
* docs(changelog): credit Discord archive default fix
Co-authored-by: 陈志强0668000989 <chen.zhiqiang1@xydigit.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* feat(codex): read the account email with app-server usage
The Codex-harness usage snapshot now carries the account identity: the
usage fetch runs account/rateLimits/read and account/read over one
app-server session (new withCodexAppServerJsonClient seam, which the
single-request helper now delegates to), so the email is guaranteed to
belong to the same account as the windows. Identity stays best-effort;
rate limits survive an account read failure.
* style(test): scanner-safe app-server marker fixture
* test(codex): keep scanner-neutral hunks around app-server marker literals
* fix(codex): bound the best-effort account read within the usage deadline
Review P2: account/read shared the outer usage deadline, so a slow or hung
identity read could reject the whole snapshot with a timeout instead of
returning the already-fetched rate-limit windows. Race the account read
against a local timer bounded to min(4s, usageTimeoutMs/3) and drop the
identity on timeout; a regression test hangs account/read and asserts the
windows still return.
* fix(codex): send account/read params and bound identity by the remaining deadline
Second review round: account/read (GetAccount) requires a params object per
the app-server protocol, so send an empty {} (refreshToken defaults false);
without it a real app-server rejects the request. Bound the best-effort
identity read by the time left before the shared usage deadline (minus a
margin) instead of the original budget, so a slow rate-limit read can no
longer let the identity read trip the outer timeout and discard the
already-fetched windows.
* fix(codex): reserve the isolated shutdown budget in the usage deadline
Third review round: withCodexAppServerJsonClient awaits the isolated
client's closeAndWait inside the outer timeout, so a hung account/read
could reach the deadline during force-kill/exit cleanup and discard the
already-fetched windows. The usage read now passes a cheap isolatedShutdown
(force-kill 200ms + exit 300ms) and the identity bound reserves that plus a
250ms margin (750ms) of the remaining deadline, so cleanup always finishes
before the outer timeout.
* style(codex): rename scoped-request generic to avoid shadowing
crabbox run rsyncs the invoking repo by default, which blew the setup
budget when the gateway provisioned from a source checkout. Workspace
transfer is owned by the worker tunnel, so setup passes --no-sync.
