profile: openclaw-check

provider: aws

class: beast

class: standard

capacity:

market: spot

strategy: most-available

fallback: on-demand-after-120s

hints: true

regions:

- eu-west-1

- eu-west-2

- eu-central-1

- us-east-1

- us-west-2

actions:

workflow: .github/workflows/crabbox-hydrate.yml

job: hydrate

## Real behavior proof (required for external PRs)

External contributors must show after-fix evidence from a real OpenClaw setup. Unit tests, mocks, lint, typechecks, snapshots, and CI are supplemental only. Screenshots are encouraged even for CLI, console, text, or log changes; terminal screenshots and copied live output count.

External contributors must show after-fix evidence from a real OpenClaw setup. Unit tests, mocks, lint, typechecks, snapshots, and CI are supplemental only. Screenshots are encouraged even for CLI, console, text, or log changes; terminal screenshots and copied live output count. Be mindful of private information like IP addresses, API keys, phone numbers, non-public endpoints, or other private details when providing evidence.

- Behavior or issue addressed:

- Real environment tested:

const groupAllowContext =

params.groupAllowContext ??

(await resolveTelegramGroupAllowFromContext({

chatId: params.chatId,

cfg,

chatId: params.chatId,

accountId,

senderId: params.senderId,

isGroup: params.isGroup,

const senderId = msg.from?.id ? String(msg.from.id) : "";

const senderUsername = msg.from?.username ?? "";

const groupAllowContext = await resolveTelegramGroupAllowFromContext({

chatId,

cfg,

chatId,

accountId,

senderId,

isGroup,

import type { OpenClawConfig } from "openclaw/plugin-sdk/config-types";

import { describe, expect, it } from "vitest";

import { resolveTelegramStreamMode } from "./bot/helpers.js";

import { resolveTelegramGroupAllowFromContext, resolveTelegramStreamMode } from "./bot/helpers.js";

import { resolveTelegramDraftStreamingChunking } from "./draft-chunking.js";

describe("resolveTelegramStreamMode", () => {

});

});

describe("resolveTelegramGroupAllowFromContext", () => {

it("expands Telegram access groups before normalizing allowFrom entries", async () => {

const cfg: OpenClawConfig = {

accessGroups: {

maintainers: {

type: "message.senders",

members: {

telegram: ["12345"],

},

},

},

};

const context = await resolveTelegramGroupAllowFromContext({

cfg,

chatId: -100123,

accountId: "default",

senderId: "12345",

isGroup: true,

groupAllowFrom: ["accessGroup:maintainers"],

readChannelAllowFromStore: async () => [],

resolveTelegramGroupConfig: () => ({}),

});

expect(context.effectiveGroupAllow.entries).toEqual(["12345"]);

expect(context.effectiveGroupAllow.invalidEntries).toEqual([]);

});

});

describe("resolveTelegramDraftStreamingChunking", () => {

it("uses smaller defaults than block streaming", () => {

const chunking = resolveTelegramDraftStreamingChunking(undefined, "default");

}

export async function resolveTelegramGroupAllowFromContext(params: {

chatId: string | number;

cfg?: OpenClawConfig;

chatId: string | number;

accountId?: string;

senderId?: string;

isGroup?: boolean;

export { isBuildRelevantRunNodePath, isRestartRelevantRunNodePath, runNodeWatchedPaths };

const buildScript = "scripts/tsdown-build.mjs";

const bundledPluginAssetsScript = "scripts/bundled-plugin-assets.mjs";

const compilerArgs = [buildScript, "--no-clean"];

const bundledPluginAssetBuildArgs = [bundledPluginAssetsScript, "--phase", "build"];

const runtimePostBuildWatchedPaths = [

"scripts/copy-bundled-plugin-metadata.mjs",

`Building TypeScript (dist is stale: ${lockedBuildRequirement.reason} - ${formatBuildReason(lockedBuildRequirement.reason)}).`,

deps,

);

logRunner("Building bundled plugin assets.", deps);

const buildCmd = deps.execPath;

const assetBuild = deps.spawn(buildCmd, bundledPluginAssetBuildArgs, {

cwd: deps.cwd,

env: deps.env,

stdio: deps.outputTee ? ["inherit", "pipe", "pipe"] : "inherit",

});

pipeSpawnedOutput(assetBuild, deps);

const assetBuildRes = await waitForSpawnedProcess(assetBuild, deps);

const assetBuildInterruptedExitCode = getInterruptedSpawnExitCode(assetBuildRes);

if (assetBuildInterruptedExitCode !== null) {

return assetBuildInterruptedExitCode;

}

if (assetBuildRes.exitCode !== 0 && assetBuildRes.exitCode !== null) {

return assetBuildRes.exitCode;

}

const buildArgs = compilerArgs;

const build = deps.spawn(buildCmd, buildArgs, {

cwd: deps.cwd,

});

});

test("stores capabilities per plugin-owned surface scope", () => {

const client = makeClient();

setClientPluginNodeCapability({

client,

surface: { surface: "canvas", scopeKey: "canvas-plugin:canvas" },

capability: "canvas-token",

expiresAtMs: 100,

});

setClientPluginNodeCapability({

client,

surface: { surface: "canvas", scopeKey: "other-plugin:canvas" },

capability: "other-token",

expiresAtMs: 200,

});

expect(client.pluginNodeCapabilities).toEqual({

"canvas\u0000canvas-plugin:canvas": { capability: "canvas-token", expiresAtMs: 100 },

"canvas\u0000other-plugin:canvas": { capability: "other-token", expiresAtMs: 200 },

});

});

test("indexes plugin capability surfaces with shortest ttl per surface", () => {

expect(

indexPluginNodeCapabilitySurfaces([

).toBe(false);

});

test("does not authorize the same surface token for a different plugin scope", () => {

const client = makeClient({

pluginNodeCapabilities: {

"canvas\u0000canvas-plugin:canvas": { capability: "canvas-token", expiresAtMs: 1_500 },

},

});

const clients = new Set([client]);

expect(

hasAuthorizedPluginNodeCapability({

clients,

surface: { surface: "canvas", scopeKey: "other-plugin:canvas" },

capability: "canvas-token",

nowMs: 1_000,

}),

).toBe(false);

expect(

hasAuthorizedPluginNodeCapability({

clients,

surface: { surface: "canvas", scopeKey: "canvas-plugin:canvas", ttlMs: 100 },

capability: "canvas-token",

nowMs: 1_000,

}),

).toBe(true);

});

test("rejects expired capabilities", () => {

const client = makeClient({

pluginNodeCapabilities: {

export type PluginNodeCapabilitySurface = {

surface: string;

ttlMs?: number;

scopeKey?: string;

};

export type PluginNodeCapabilityClient = {

return trimmed ? trimmed : undefined;

}

function resolvePluginNodeCapabilityStorageKey(surface: PluginNodeCapabilitySurface) {

const normalizedSurface = normalizeSurface(surface.surface);

if (!normalizedSurface) {

return undefined;

}

const scopeKey = surface.scopeKey?.trim();

return scopeKey ? `${normalizedSurface}\0${scopeKey}` : normalizedSurface;

}

export function resolvePluginNodeCapabilityTtlMs(surface: PluginNodeCapabilitySurface) {

return surface.ttlMs && surface.ttlMs > 0 ? surface.ttlMs : DEFAULT_PLUGIN_NODE_CAPABILITY_TTL_MS;

}

expiresAtMs: number;

}) {

const surface = normalizeSurface(params.surface.surface);

if (!surface) {

const storageKey = resolvePluginNodeCapabilityStorageKey(params.surface);

if (!surface || !storageKey) {

return;

}

params.client.pluginNodeCapabilities ??= {};

params.client.pluginNodeCapabilities[surface] = {

params.client.pluginNodeCapabilities[storageKey] = {

capability: params.capability,

expiresAtMs: params.expiresAtMs,

};

nowMs?: number;

}) {

const surface = normalizeSurface(params.surface.surface);

if (!surface) {

const storageKey = resolvePluginNodeCapabilityStorageKey(params.surface);

if (!surface || !storageKey) {

return false;

}

const nowMs = params.nowMs ?? Date.now();

const ttlMs = resolvePluginNodeCapabilityTtlMs(params.surface);

for (const client of params.clients) {

const entry = client.pluginNodeCapabilities?.[surface];

const entry = client.pluginNodeCapabilities?.[storageKey];

if (!entry || entry.expiresAtMs <= nowMs) {

continue;

}

httpServer: HttpServer;

wss: WebSocketServer;

handlePluginUpgrade?: PluginHttpUpgradeHandler;

shouldEnforcePluginGatewayAuth?: (pathContext: PluginRoutePathContext) => boolean;

resolvePluginNodeCapabilityRoute?: ResolvePluginNodeCapabilityRoute;

clients: Set<GatewayWsClient>;

preauthConnectionBudget: PreauthConnectionBudget;

httpServer,

wss,

handlePluginUpgrade,

shouldEnforcePluginGatewayAuth,

resolvePluginNodeCapabilityRoute,

clients,

preauthConnectionBudget,

}

}

if (handlePluginUpgrade) {

let pluginGatewayAuthSatisfied = false;

let pluginGatewayRequestAuth: AuthorizedGatewayHttpRequest | undefined;

let pluginGatewayRequestOperatorScopes: string[] | undefined;

const enforcePluginGatewayAuth = (

shouldEnforcePluginGatewayAuth ?? shouldEnforceDefaultPluginGatewayAuth

)(pathContext);

if (

enforcePluginGatewayAuth &&

!(await getCachedPluginGatewayAuthBypassPaths(configSnapshot)).has(url.pathname)

) {

const { checkGatewayHttpRequestAuth } = await getHttpAuthUtilsModule();

const authCheck = await checkGatewayHttpRequestAuth({

req,

auth: resolvedAuth,

trustedProxies,

allowRealIpFallback,

rateLimiter,

cfg: configSnapshot,

});

if (!authCheck.ok) {

writeUpgradeAuthFailure(socket, authCheck.authResult);

socket.destroy();

return;

}

pluginGatewayAuthSatisfied = true;

pluginGatewayRequestAuth = authCheck.requestAuth;

const { resolvePluginRouteRuntimeOperatorScopes } =

await getPluginRouteRuntimeScopesModule();

pluginGatewayRequestOperatorScopes = resolvePluginRouteRuntimeOperatorScopes(

req,

authCheck.requestAuth,

);

}

if (

await handlePluginUpgrade(req, socket, head, pathContext, {

gatewayAuthSatisfied: false,

gatewayAuthSatisfied: pluginGatewayAuthSatisfied,

gatewayRequestAuth: pluginGatewayRequestAuth,

gatewayRequestOperatorScopes: pluginGatewayRequestOperatorScopes,

})

) {

return;