* feat(ui): redesign Channels page with guided channel setup wizard
Adds wizard.start flow=channels gateway RPC (additive protocol change) that
drives the shared channel-setup wizard (openclaw channels add) over the
session step protocol. Control UI Channels page becomes a card hub with
plugin-art covers, guided per-channel setup modal (WhatsApp QR pairing via
web.login.*, BotFather/Slack/Discord helper links), and a detail overlay
hosting the full schema config form.
* test(ui): cover channel wizard controller; refresh channels view test props
* chore(mock): use non-token-shaped wizard placeholder
* test(gateway): scanner-safe auth local in channels wizard test
* fix(ui): cancel gateway wizard session on channels page disconnect
* fix(ui): adopt browse-all channel pick and guard dirty config before setup
* fix(ui): cancel gateway session created by a stale wizard.start
* fix(ui): adopt multiselect channel picks; drop redundant String()
* fix(ui): track all wizard-adopted channels so WhatsApp QR runs regardless of pick order
* feat(gateway): report configured channels on terminal channel-wizard result
Replaces the Control UI's channel-adoption heuristic with the authoritative
outcome: the channels flow reports its actual selection after config commit,
the wizard session surfaces it as an additive channels field on the terminal
wizard.next result, and the UI keys WhatsApp QR linking off that.
* refactor(ui): align channels hub with the unified settings design language
Hub becomes settings-language rows (44px art tiles, status dots, uppercase
section headings, hairline groups) instead of a card gallery; the detail
overlay hosts the migrated per-channel settings sections with Run setup in
the header. Wizard dialog and tile/cover styles move to spacing tokens.
* chore(i18n): translate channels hub/setup strings; refresh raw-copy baseline
* refactor: satisfy LOC ratchet and dead-export gates
Split mock-dev channel/plugin fixtures into their own modules, move wizard
runner types/defaults to server-methods/wizard.ts, extract the channels page
wizard host and nostr profile HTTP ops, and unexport internal-only types
(incl. the unused config-form SECTION_META barrel re-export).
* chore(i18n): retranslate channels strings on rebased locale bundles
* fix(test): drop redundant String() in channels wizard e2e
* fix: address channel-wizard review findings
- lock wizard cancellation before durable installs/config writes
- report configured channel accounts on the terminal wizard result and
start WhatsApp QR pairing for that account (web.login accountId)
- forward request options through the browser gateway client so wizard
RPC timeouts apply
- render skipped setup as a no-change completion
- keep detail/advanced config reachable for unconfigured channels
- surface the dirty-config warning inside the detail overlay
- adopt the picked channel for wizard title/links in browse-all flows
* fix(ui): local wizard RPC timeout; translate no-change completion strings
Stops the legacy run-log dual-write, auto-imports remaining rows and drops
the table at state-DB open (table-presence guard: self-heals downgrade
round-trips), keeps the newest 2000 terminal runs per job in the ledger,
retires cron.runLog config via doctor, and moves live-run cancellation to
src/cron behind the shared task control seam.
Part 2 of 2 for #106041.
* fix(deepgram): reject malformed and non-http(s) realtime base URL overrides
* fix(deepgram): accept direct ws(s):// realtime base URL overrides
Preserve released behavior: v2026.6.11 passes wss:// (and ws://) base URL
overrides straight through to the WebSocket URL builder. The prior validator
rejected every non-http(s) scheme, breaking custom Deepgram realtime proxies
that use a direct wss:// endpoint. Accept ws:/wss: alongside http(s):, keep
rejecting malformed and unrelated schemes, and preserve a direct ws(s):
override's protocol/path/port through toDeepgramRealtimeWsUrl.
* fix(deepgram): keep secure ws:// -> wss:// upgrade for realtime base URL
A prior change preserved direct ws:/wss: overrides unchanged, which also
stopped upgrading a plaintext ws:// override to wss://. That regressed the
released behavior where every accepted non-http: scheme maps to wss:, so an
existing ws:// endpoint would begin sending Deepgram realtime audio and
provider auth over an unencrypted socket. Restore the release mapping
(http: -> ws:, all others -> wss:), which still preserves a direct wss://
override and keeps the ws:// -> wss:// secure upgrade.
* fix(deepgram): preserve custom websocket transport
Co-authored-by: dwc1997 <du.wenchi@xydigit.com>
* test(deepgram): use placeholder credential fixture
* test(deepgram): clarify loopback callbacks
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
CI caught two real PR1 regressions. (1) Wiring the cron-run-logs migration
into state-db open transitively pulled agents/sandbox via the run-log error
codec, breaking ~13 tests that mock config/paths without STATE_DIR: split the
event->entry write codec into task-run-event-codec.ts and dependency-inject
the failover reason resolver so live run-log reads keep recompute while the
ledger read + migration stay dependency-light. (2) cron/service/task-runs.ts
reached into task-registry internals: route through the task-executor facade.
Known bounded limitation documented in the migration: legacy rows lacking a
stored errorReason are imported without a recomputed one (write-time authoring
is canonical going forward).
check-dependencies (knip) flagged run-log read exports left unused after the
reader flip plus test-only ledger/migration exports. Baseline the genuine
test-only/transitional exports; remove the redundant state-migrations barrel
re-export (state-db imports the migration from the sibling module directly).
The cron import test was extracted into its own file during rebase; it
triggers the migration via openOpenClawStateDatabase, so the direct
migrateLegacyCronRunLogsToTaskRuns import was unused (check-lint) and the
hand-written header needed oxfmt (check-docs).
Cron executions now write full-fidelity task_runs rows (detail_json column,
store-key scoped) and cron.runs/CLI/task-maintenance read from the ledger;
legacy cron_run_logs dual-write stays as a revert safety net. Existing
history auto-imports at first state-DB open (verified against a production
DB copy: 2750/2750 rows, byte-identical parity, idempotent). Startup crash
recovery restores finished runs from finalized ledger rows instead of
reporting synthetic interruptions.
Part 1 of 2 for #106041.
The stalled-acknowledgement error now names seq/runId/ackedSeq/previousAck/
buffered so an operator can tell a gateway backpressure stall from a real
protocol bug without reproducing.
* fix(ai): reject noncanonical array indices in local schema refs
* test(ai): harden local schema ref indices
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
The bundle install verifier walks the staged tree and compares its hash to
the expected bundle hash. Two live-E2E bugs: (1) it never walked vendor/,
so vendored workspace packages failed the hash; (2) npm install ran before
the check, so node_modules (intentionally hash-excluded) polluted the tree.
Verify the pristine bundle including vendor/, then run the production
npm install. Proven locally: VERIFY_INSTALL_JS returns 0 on the extracted
tarball and the worker entry resolves every module post-install.
* feat(ui): redesign Settings About with Clawd hero and community links
* fix(ui): route About hero product name through i18n
* chore(i18n): translate About page keys, resync raw-copy baseline
* fix(ui): keep About brand icons in a local module (LOC ratchet)
* chore(i18n): resync About locale bundles after rebase
tsdown's never-bundle list keeps @openclaw/ai external of dist, but it is a
workspace:* dependency, so the pruned worker package.json dropped it and the
leased box failed with "Cannot find package '@openclaw/ai'" after
npm install --omit=dev.
The bundle producer now scans the staged dist/openclaw.mjs bytes for quoted
@openclaw/<pkg> import specifiers, intersects them with workspace: deps in
the original root manifest, and stages each referenced package (pruned
package.json, built dist/, npm-shrinkwrap.json when present) under
vendor/<scope-flattened>/ through the same hardened O_NOFOLLOW staging path.
The shipped root package.json rewrites those deps to file:./vendor/<dir> so
the box install resolves them offline; unreferenced workspace deps stay
dropped. All vendored files are manifest entries, so the bundle hash covers
them. Staging/vendoring moved to bundle-staging.ts to keep bundle.ts bounded.
Proven locally: produced a bundle from a built worktree, extracted it, ran
npm install --ignore-scripts --omit=dev, and the worker entry reached
"invalid worker launch descriptor" (all modules resolved).
