OPENCLAW_CONTROL_UI_I18N_PROVIDER: ${{ secrets.ANTHROPIC_API_KEY != '' && 'anthropic' || 'openai' }}

OPENCLAW_CONTROL_UI_I18N_MODEL: ${{ secrets.ANTHROPIC_API_KEY != '' && 'claude-opus-4-6' || vars.OPENCLAW_CI_OPENAI_MODEL_BARE }}

OPENCLAW_CONTROL_UI_I18N_THINKING: low

OPENCLAW_CONTROL_UI_I18N_AUTH_OPTIONAL: "1"

LOCALE: ${{ matrix.locale }}

run: node --import tsx scripts/control-ui-i18n.ts sync --locale "${LOCALE}" --write

- Canvas: return not found for malformed percent-encoded Canvas/A2UI/document asset paths and keep decoded parent traversal blocked before path normalization.

- Telegram: allow trusted local Bot API media files whose filenames start with dots instead of falling back to remote download.

- Agents/Codex app-server: remap injected context files under dot-dot-prefixed workspace directories when a run switches to an effective sandbox workspace.

- Control UI/i18n: use the installed workspace pi runtime for locale refreshes, update the fallback package pin, and prefer the Anthropic CI provider when available, restoring the scheduled locale refresh workflow.

- Control UI/i18n: use the installed workspace pi runtime for locale refreshes, update the fallback package pin, and skip scheduled refreshes with invalid provider credentials instead of failing main.

- Plugins: preserve installed package metadata and persisted registry freshness checks for plugin package paths under dot-dot-prefixed directories.

- Agents: allow dot-dot-prefixed filenames such as `..note.txt` through sandbox FS bridge, remote sandbox reads, and apply_patch summaries without mistaking the name for parent traversal.

- CLI/migrate: hide per-item source/plugin hints on non-conflicting Codex skill and plugin selection prompts, keeping the hint text reserved for rows that actually need attention. Thanks @sjf.

const ENV_PI_PACKAGE_VERSION = "OPENCLAW_CONTROL_UI_I18N_PI_PACKAGE_VERSION";

const ENV_BATCH_CHAR_BUDGET = "OPENCLAW_CONTROL_UI_I18N_BATCH_CHAR_BUDGET";

const ENV_PROMPT_TIMEOUT = "OPENCLAW_CONTROL_UI_I18N_PROMPT_TIMEOUT";

const ENV_AUTH_OPTIONAL = "OPENCLAW_CONTROL_UI_I18N_AUTH_OPTIONAL";

const LOCALE_ENTRIES: readonly LocaleEntry[] = [

{ locale: "zh-CN", fileName: "zh-CN.ts", exportName: "zh_CN", languageKey: "zhCN" },

return error.message.toLowerCase().includes("timed out");

}

export function isProviderAuthError(error: Error): boolean {

const message = error.message.toLowerCase();

return (

message.includes("401") ||

message.includes("authentication_error") ||

message.includes("incorrect api key") ||

message.includes("invalid x-api-key")

);

}

function isProviderAuthOptional(): boolean {

const raw = process.env[ENV_AUTH_OPTIONAL]?.trim().toLowerCase();

return raw === "1" || raw === "true" || raw === "yes";

}

function resolvePromptTimeoutMs(): number {

const raw = process.env[ENV_PROMPT_TIMEOUT]?.trim();

if (!raw) {

});

}

}

} catch (error) {

const failure = error instanceof Error ? error : new Error(String(error));

if (isProviderAuthOptional() && isProviderAuthError(failure)) {

logProgress(`${localeLabel}: translation provider auth failed; skipping refresh`);

return {

changed: false,

fallbackCount: previousMeta?.fallbackKeys.length ?? 0,

locale: entry.locale,

wrote: false,

} satisfies SyncOutcome;

}

throw failure;

} finally {

await clientAccess.resetClient();

}

import {

DEFAULT_PI_PACKAGE_VERSION,

findPlaceholderMismatches,

isProviderAuthError,

resolveLocalPiCommand,

} from "../../scripts/control-ui-i18n.ts";

}

});

});

describe("control-ui-i18n provider auth errors", () => {

it("recognizes OpenAI and Anthropic authentication failures", () => {

expect(isProviderAuthError(new Error("401 Incorrect API key provided"))).toBe(true);

expect(

isProviderAuthError(

new Error(

'401 {"type":"error","error":{"type":"authentication_error","message":"invalid x-api-key"}}',

),

),

).toBe(true);

expect(isProviderAuthError(new Error("model timed out"))).toBe(false);

});

});