chore: fix assorted PR #756 review nits - #786

Merged
bussyjd merged 1 commit into
integration/v0.14.0-rc0from
fix/misc-nits
Jul 16, 2026
Merged

chore: fix assorted PR #756 review nits#786
bussyjd merged 1 commit into
integration/v0.14.0-rc0from
fix/misc-nits

Conversation

@bussyjd

@bussyjdbussyjd commented Jul 16, 2026

Copy link
Copy Markdown
Contributor

Small independent nits from the PR #756 review: RemoveAgentIdentityRegistration allocates instead of mutating the caller's backing array; RefreshStorefront no-ops quietly before a persistent tunnel exists; obolup.sh aborts hard on a verified checksum mismatch instead of falling back to a source build in the same attacker-controlled channel; agent --id length bounded to fit the derived k8s prefix; stack init decline stops Init cleanly (a regression where the decline let Init continue past the destroy was caught in review and fixed).

https://claude.ai/code/session_014YjPMViNrZ7zBVgUQzwEKk

@bussyjd
fix: five independent nits (shared-slice mutation, storefront no-op, …
f570810
…checksum-tamper fallback, DNS-label overflow, safety-decline exit code)
1. monetizeapi.RemoveAgentIdentityRegistration: allocate a fresh slice
instead of filtering status.Registrations in place, so a caller passing
an informer-cached object can't have its backing array silently
corrupted.
2. tunnel.RefreshStorefront: no-op quietly when storefrontHostnames has
nothing to report (no persistent tunnel/hostname state yet), instead of
calling CreateStorefront with zero hostnames and surfacing its
"requires at least one hostname" error as a confusing warning on a
normal first `obol sell ... --hostname X --no-register`.
EnsureTunnelForSell reconciles the storefront once the tunnel exists.
3. obolup.sh: verify_release_checksum now returns exit code 2 for a
verified checksum MISMATCH (tamper), distinct from exit code 1 for
"couldn't verify" (SHA256SUMS unpublished / no sha tool / no checksum
entry). download_release propagates the distinction, and
install_obol_binary hard-aborts on a mismatch instead of falling back to
`git clone` over the same (potentially compromised) channel. Also fixes
the misleading "Release not found" message on a mismatch.
4. agentruntime.MaxIDLength + openclaw/hermes Onboard: bound the deployment
id to (63 - the runtime's DNS-label prefix/suffix) at the two Onboard
call sites, so "openclaw-<id>" / "hermes-<id>" / "hermes-<id>-ui" can't
exceed the 63-char DNS label limit and fail later with an opaque k8s
error. validate.Name itself is untouched for other callers.
5. stack.destroyOldBackendIfSwitching: a declined backend-switch prompt
during `stack init --force` now returns nil (clean exit 0), matching
Down/Purge's behavior for the same ConfirmRunningServicesLoss decline.
Previously it returned errSafetyAborted, whose doc comment claimed
cmd/obol/stack.go handled it specially — it never did. Comment fixed to
reflect that nothing consumes the sentinel today.
Deviation: no automated test for (5)'s behavior change — reaching the
declined-prompt branch requires ui.UI.IsTTY()==true, which has no
test-injectable seam (isTTY is unexported, set from a real
isatty.IsTerminal check, no pty dependency in the repo). Verified by
inspection + go build/vet/test instead; the change is a single-line
return-value swap in an already-covered function.
Claude-Session: https://claude.ai/code/session_014YjPMViNrZ7zBVgUQzwEKk
@bussyjd
bussyjd merged commit c2d5c58 into integration/v0.14.0-rc0Jul 16, 2026
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@bussyjd
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
chore: fix assorted PR #756 review nits - #786
Merged
bussyjd merged 1 commit into
integration/v0.14.0-rc0from 
fix/misc-nits
Jul 16, 2026
Merged
chore: fix assorted PR #756 review nits#786
bussyjd merged 1 commit into
integration/v0.14.0-rc0from 
fix/misc-nits
Conversation
@bussyjd
@bussyjdbussyjd
commented
Jul 16, 2026

Copy link


Copy Markdown

Contributor
Small independent nits from the PR #756 review: RemoveAgentIdentityRegistration allocates instead of mutating the caller's backing array; RefreshStorefront no-ops quietly before a persistent tunnel exists; obolup.sh aborts hard on a verified checksum mismatch instead of falling back to a source build in the same attacker-controlled channel; agent --id length bounded to fit the derived k8s prefix; stack init decline stops Init cleanly (a regression where the decline let Init continue past the destroy was caught in review and fixed).
https://claude.ai/code/session_014YjPMViNrZ7zBVgUQzwEKk
@bussyjd
fix: five independent nits (shared-slice mutation, storefront no-op, …
f570810
…checksum-tamper fallback, DNS-label overflow, safety-decline exit code)
1. monetizeapi.RemoveAgentIdentityRegistration: allocate a fresh slice
instead of filtering status.Registrations in place, so a caller passing
an informer-cached object can't have its backing array silently
corrupted.
2. tunnel.RefreshStorefront: no-op quietly when storefrontHostnames has
nothing to report (no persistent tunnel/hostname state yet), instead of
calling CreateStorefront with zero hostnames and surfacing its
"requires at least one hostname" error as a confusing warning on a
normal first `obol sell ... --hostname X --no-register`.
EnsureTunnelForSell reconciles the storefront once the tunnel exists.
3. obolup.sh: verify_release_checksum now returns exit code 2 for a
verified checksum MISMATCH (tamper), distinct from exit code 1 for
"couldn't verify" (SHA256SUMS unpublished / no sha tool / no checksum
entry). download_release propagates the distinction, and
install_obol_binary hard-aborts on a mismatch instead of falling back to
`git clone` over the same (potentially compromised) channel. Also fixes
the misleading "Release not found" message on a mismatch.
4. agentruntime.MaxIDLength + openclaw/hermes Onboard: bound the deployment
id to (63 - the runtime's DNS-label prefix/suffix) at the two Onboard
call sites, so "openclaw-<id>" / "hermes-<id>" / "hermes-<id>-ui" can't
exceed the 63-char DNS label limit and fail later with an opaque k8s
error. validate.Name itself is untouched for other callers.
5. stack.destroyOldBackendIfSwitching: a declined backend-switch prompt
during `stack init --force` now returns nil (clean exit 0), matching
Down/Purge's behavior for the same ConfirmRunningServicesLoss decline.
Previously it returned errSafetyAborted, whose doc comment claimed
cmd/obol/stack.go handled it specially — it never did. Comment fixed to
reflect that nothing consumes the sentinel today.
Deviation: no automated test for (5)'s behavior change — reaching the
declined-prompt branch requires ui.UI.IsTTY()==true, which has no
test-injectable seam (isTTY is unexported, set from a real
isatty.IsTerminal check, no pty dependency in the repo). Verified by
inspection + go build/vet/test instead; the change is a single-line
return-value swap in an already-covered function.
Claude-Session: https://claude.ai/code/session_014YjPMViNrZ7zBVgUQzwEKk
@bussyjd
bussyjd
merged commit c2d5c58
into
integration/v0.14.0-rc0Jul 16, 2026
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@bussyjd

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore: fix assorted PR #756 review nits - #786
Merged
bussyjd merged 1 commit into
integration/v0.14.0-rc0from 
fix/misc-nits
Jul 16, 2026
Merged
chore: fix assorted PR #756 review nits#786
bussyjd merged 1 commit into
integration/v0.14.0-rc0from 
fix/misc-nits
Conversation
@bussyjd
@bussyjdbussyjd
commented
Jul 16, 2026

Copy link


Copy Markdown

Contributor
Small independent nits from the PR #756 review: RemoveAgentIdentityRegistration allocates instead of mutating the caller's backing array; RefreshStorefront no-ops quietly before a persistent tunnel exists; obolup.sh aborts hard on a verified checksum mismatch instead of falling back to a source build in the same attacker-controlled channel; agent --id length bounded to fit the derived k8s prefix; stack init decline stops Init cleanly (a regression where the decline let Init continue past the destroy was caught in review and fixed).
https://claude.ai/code/session_014YjPMViNrZ7zBVgUQzwEKk
@bussyjd
fix: five independent nits (shared-slice mutation, storefront no-op, …
f570810
…checksum-tamper fallback, DNS-label overflow, safety-decline exit code)
1. monetizeapi.RemoveAgentIdentityRegistration: allocate a fresh slice
instead of filtering status.Registrations in place, so a caller passing
an informer-cached object can't have its backing array silently
corrupted.
2. tunnel.RefreshStorefront: no-op quietly when storefrontHostnames has
nothing to report (no persistent tunnel/hostname state yet), instead of
calling CreateStorefront with zero hostnames and surfacing its
"requires at least one hostname" error as a confusing warning on a
normal first `obol sell ... --hostname X --no-register`.
EnsureTunnelForSell reconciles the storefront once the tunnel exists.
3. obolup.sh: verify_release_checksum now returns exit code 2 for a
verified checksum MISMATCH (tamper), distinct from exit code 1 for
"couldn't verify" (SHA256SUMS unpublished / no sha tool / no checksum
entry). download_release propagates the distinction, and
install_obol_binary hard-aborts on a mismatch instead of falling back to
`git clone` over the same (potentially compromised) channel. Also fixes
the misleading "Release not found" message on a mismatch.
4. agentruntime.MaxIDLength + openclaw/hermes Onboard: bound the deployment
id to (63 - the runtime's DNS-label prefix/suffix) at the two Onboard
call sites, so "openclaw-<id>" / "hermes-<id>" / "hermes-<id>-ui" can't
exceed the 63-char DNS label limit and fail later with an opaque k8s
error. validate.Name itself is untouched for other callers.
5. stack.destroyOldBackendIfSwitching: a declined backend-switch prompt
during `stack init --force` now returns nil (clean exit 0), matching
Down/Purge's behavior for the same ConfirmRunningServicesLoss decline.
Previously it returned errSafetyAborted, whose doc comment claimed
cmd/obol/stack.go handled it specially — it never did. Comment fixed to
reflect that nothing consumes the sentinel today.
Deviation: no automated test for (5)'s behavior change — reaching the
declined-prompt branch requires ui.UI.IsTTY()==true, which has no
test-injectable seam (isTTY is unexported, set from a real
isatty.IsTerminal check, no pty dependency in the repo). Verified by
inspection + go build/vet/test instead; the change is a single-line
return-value swap in an already-covered function.
Claude-Session: https://claude.ai/code/session_014YjPMViNrZ7zBVgUQzwEKk
@bussyjd
bussyjd
merged commit c2d5c58
into
integration/v0.14.0-rc0Jul 16, 2026
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@bussyjd

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore: fix assorted PR #756 review nits - #786
Merged
bussyjd merged 1 commit into
integration/v0.14.0-rc0from 
fix/misc-nits
Jul 16, 2026
Merged
chore: fix assorted PR #756 review nits#786
bussyjd merged 1 commit into
integration/v0.14.0-rc0from 
fix/misc-nits
Conversation
@bussyjd
@bussyjdbussyjd
commented
Jul 16, 2026

Copy link


Copy Markdown

Contributor
Small independent nits from the PR #756 review: RemoveAgentIdentityRegistration allocates instead of mutating the caller's backing array; RefreshStorefront no-ops quietly before a persistent tunnel exists; obolup.sh aborts hard on a verified checksum mismatch instead of falling back to a source build in the same attacker-controlled channel; agent --id length bounded to fit the derived k8s prefix; stack init decline stops Init cleanly (a regression where the decline let Init continue past the destroy was caught in review and fixed).
https://claude.ai/code/session_014YjPMViNrZ7zBVgUQzwEKk
@bussyjd
fix: five independent nits (shared-slice mutation, storefront no-op, …
f570810
…checksum-tamper fallback, DNS-label overflow, safety-decline exit code)
1. monetizeapi.RemoveAgentIdentityRegistration: allocate a fresh slice
instead of filtering status.Registrations in place, so a caller passing
an informer-cached object can't have its backing array silently
corrupted.
2. tunnel.RefreshStorefront: no-op quietly when storefrontHostnames has
nothing to report (no persistent tunnel/hostname state yet), instead of
calling CreateStorefront with zero hostnames and surfacing its
"requires at least one hostname" error as a confusing warning on a
normal first `obol sell ... --hostname X --no-register`.
EnsureTunnelForSell reconciles the storefront once the tunnel exists.
3. obolup.sh: verify_release_checksum now returns exit code 2 for a
verified checksum MISMATCH (tamper), distinct from exit code 1 for
"couldn't verify" (SHA256SUMS unpublished / no sha tool / no checksum
entry). download_release propagates the distinction, and
install_obol_binary hard-aborts on a mismatch instead of falling back to
`git clone` over the same (potentially compromised) channel. Also fixes
the misleading "Release not found" message on a mismatch.
4. agentruntime.MaxIDLength + openclaw/hermes Onboard: bound the deployment
id to (63 - the runtime's DNS-label prefix/suffix) at the two Onboard
call sites, so "openclaw-<id>" / "hermes-<id>" / "hermes-<id>-ui" can't
exceed the 63-char DNS label limit and fail later with an opaque k8s
error. validate.Name itself is untouched for other callers.
5. stack.destroyOldBackendIfSwitching: a declined backend-switch prompt
during `stack init --force` now returns nil (clean exit 0), matching
Down/Purge's behavior for the same ConfirmRunningServicesLoss decline.
Previously it returned errSafetyAborted, whose doc comment claimed
cmd/obol/stack.go handled it specially — it never did. Comment fixed to
reflect that nothing consumes the sentinel today.
Deviation: no automated test for (5)'s behavior change — reaching the
declined-prompt branch requires ui.UI.IsTTY()==true, which has no
test-injectable seam (isTTY is unexported, set from a real
isatty.IsTerminal check, no pty dependency in the repo). Verified by
inspection + go build/vet/test instead; the change is a single-line
return-value swap in an already-covered function.
Claude-Session: https://claude.ai/code/session_014YjPMViNrZ7zBVgUQzwEKk
@bussyjd
bussyjd
merged commit c2d5c58
into
integration/v0.14.0-rc0Jul 16, 2026
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@bussyjd

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
chore: fix assorted PR #756 review nits - #786
Merged
bussyjd merged 1 commit into
integration/v0.14.0-rc0from 
fix/misc-nits
Jul 16, 2026
Merged
chore: fix assorted PR #756 review nits#786
bussyjd merged 1 commit into
integration/v0.14.0-rc0from 
fix/misc-nits
Conversation
@bussyjd
@bussyjdbussyjd
commented
Jul 16, 2026

Copy link


Copy Markdown

Contributor
Small independent nits from the PR #756 review: RemoveAgentIdentityRegistration allocates instead of mutating the caller's backing array; RefreshStorefront no-ops quietly before a persistent tunnel exists; obolup.sh aborts hard on a verified checksum mismatch instead of falling back to a source build in the same attacker-controlled channel; agent --id length bounded to fit the derived k8s prefix; stack init decline stops Init cleanly (a regression where the decline let Init continue past the destroy was caught in review and fixed).
https://claude.ai/code/session_014YjPMViNrZ7zBVgUQzwEKk
@bussyjd
fix: five independent nits (shared-slice mutation, storefront no-op, …
f570810
…checksum-tamper fallback, DNS-label overflow, safety-decline exit code)
1. monetizeapi.RemoveAgentIdentityRegistration: allocate a fresh slice
instead of filtering status.Registrations in place, so a caller passing
an informer-cached object can't have its backing array silently
corrupted.
2. tunnel.RefreshStorefront: no-op quietly when storefrontHostnames has
nothing to report (no persistent tunnel/hostname state yet), instead of
calling CreateStorefront with zero hostnames and surfacing its
"requires at least one hostname" error as a confusing warning on a
normal first `obol sell ... --hostname X --no-register`.
EnsureTunnelForSell reconciles the storefront once the tunnel exists.
3. obolup.sh: verify_release_checksum now returns exit code 2 for a
verified checksum MISMATCH (tamper), distinct from exit code 1 for
"couldn't verify" (SHA256SUMS unpublished / no sha tool / no checksum
entry). download_release propagates the distinction, and
install_obol_binary hard-aborts on a mismatch instead of falling back to
`git clone` over the same (potentially compromised) channel. Also fixes
the misleading "Release not found" message on a mismatch.
4. agentruntime.MaxIDLength + openclaw/hermes Onboard: bound the deployment
id to (63 - the runtime's DNS-label prefix/suffix) at the two Onboard
call sites, so "openclaw-<id>" / "hermes-<id>" / "hermes-<id>-ui" can't
exceed the 63-char DNS label limit and fail later with an opaque k8s
error. validate.Name itself is untouched for other callers.
5. stack.destroyOldBackendIfSwitching: a declined backend-switch prompt
during `stack init --force` now returns nil (clean exit 0), matching
Down/Purge's behavior for the same ConfirmRunningServicesLoss decline.
Previously it returned errSafetyAborted, whose doc comment claimed
cmd/obol/stack.go handled it specially — it never did. Comment fixed to
reflect that nothing consumes the sentinel today.
Deviation: no automated test for (5)'s behavior change — reaching the
declined-prompt branch requires ui.UI.IsTTY()==true, which has no
test-injectable seam (isTTY is unexported, set from a real
isatty.IsTerminal check, no pty dependency in the repo). Verified by
inspection + go build/vet/test instead; the change is a single-line
return-value swap in an already-covered function.
Claude-Session: https://claude.ai/code/session_014YjPMViNrZ7zBVgUQzwEKk
@bussyjd
bussyjd
merged commit c2d5c58
into
integration/v0.14.0-rc0Jul 16, 2026
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@bussyjd

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore: fix assorted PR #756 review nits - #786
Merged
bussyjd merged 1 commit into
integration/v0.14.0-rc0from 
fix/misc-nits
Jul 16, 2026
Merged
chore: fix assorted PR #756 review nits#786
bussyjd merged 1 commit into
integration/v0.14.0-rc0from 
fix/misc-nits
Conversation
@bussyjd
@bussyjdbussyjd
commented
Jul 16, 2026

Copy link


Copy Markdown

Contributor
Small independent nits from the PR #756 review: RemoveAgentIdentityRegistration allocates instead of mutating the caller's backing array; RefreshStorefront no-ops quietly before a persistent tunnel exists; obolup.sh aborts hard on a verified checksum mismatch instead of falling back to a source build in the same attacker-controlled channel; agent --id length bounded to fit the derived k8s prefix; stack init decline stops Init cleanly (a regression where the decline let Init continue past the destroy was caught in review and fixed).
https://claude.ai/code/session_014YjPMViNrZ7zBVgUQzwEKk
@bussyjd
fix: five independent nits (shared-slice mutation, storefront no-op, …
f570810
…checksum-tamper fallback, DNS-label overflow, safety-decline exit code)
1. monetizeapi.RemoveAgentIdentityRegistration: allocate a fresh slice
instead of filtering status.Registrations in place, so a caller passing
an informer-cached object can't have its backing array silently
corrupted.
2. tunnel.RefreshStorefront: no-op quietly when storefrontHostnames has
nothing to report (no persistent tunnel/hostname state yet), instead of
calling CreateStorefront with zero hostnames and surfacing its
"requires at least one hostname" error as a confusing warning on a
normal first `obol sell ... --hostname X --no-register`.
EnsureTunnelForSell reconciles the storefront once the tunnel exists.
3. obolup.sh: verify_release_checksum now returns exit code 2 for a
verified checksum MISMATCH (tamper), distinct from exit code 1 for
"couldn't verify" (SHA256SUMS unpublished / no sha tool / no checksum
entry). download_release propagates the distinction, and
install_obol_binary hard-aborts on a mismatch instead of falling back to
`git clone` over the same (potentially compromised) channel. Also fixes
the misleading "Release not found" message on a mismatch.
4. agentruntime.MaxIDLength + openclaw/hermes Onboard: bound the deployment
id to (63 - the runtime's DNS-label prefix/suffix) at the two Onboard
call sites, so "openclaw-<id>" / "hermes-<id>" / "hermes-<id>-ui" can't
exceed the 63-char DNS label limit and fail later with an opaque k8s
error. validate.Name itself is untouched for other callers.
5. stack.destroyOldBackendIfSwitching: a declined backend-switch prompt
during `stack init --force` now returns nil (clean exit 0), matching
Down/Purge's behavior for the same ConfirmRunningServicesLoss decline.
Previously it returned errSafetyAborted, whose doc comment claimed
cmd/obol/stack.go handled it specially — it never did. Comment fixed to
reflect that nothing consumes the sentinel today.
Deviation: no automated test for (5)'s behavior change — reaching the
declined-prompt branch requires ui.UI.IsTTY()==true, which has no
test-injectable seam (isTTY is unexported, set from a real
isatty.IsTerminal check, no pty dependency in the repo). Verified by
inspection + go build/vet/test instead; the change is a single-line
return-value swap in an already-covered function.
Claude-Session: https://claude.ai/code/session_014YjPMViNrZ7zBVgUQzwEKk
@bussyjd
bussyjd
merged commit c2d5c58
into
integration/v0.14.0-rc0Jul 16, 2026
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@bussyjd

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore: fix assorted PR #756 review nits - #786
Merged
bussyjd merged 1 commit into
integration/v0.14.0-rc0from 
fix/misc-nits
Jul 16, 2026
Merged
chore: fix assorted PR #756 review nits#786
bussyjd merged 1 commit into
integration/v0.14.0-rc0from 
fix/misc-nits
Conversation
@bussyjd
@bussyjdbussyjd
commented
Jul 16, 2026

Copy link


Copy Markdown

Contributor
Small independent nits from the PR #756 review: RemoveAgentIdentityRegistration allocates instead of mutating the caller's backing array; RefreshStorefront no-ops quietly before a persistent tunnel exists; obolup.sh aborts hard on a verified checksum mismatch instead of falling back to a source build in the same attacker-controlled channel; agent --id length bounded to fit the derived k8s prefix; stack init decline stops Init cleanly (a regression where the decline let Init continue past the destroy was caught in review and fixed).
https://claude.ai/code/session_014YjPMViNrZ7zBVgUQzwEKk
@bussyjd
fix: five independent nits (shared-slice mutation, storefront no-op, …
f570810
…checksum-tamper fallback, DNS-label overflow, safety-decline exit code)
1. monetizeapi.RemoveAgentIdentityRegistration: allocate a fresh slice
instead of filtering status.Registrations in place, so a caller passing
an informer-cached object can't have its backing array silently
corrupted.
2. tunnel.RefreshStorefront: no-op quietly when storefrontHostnames has
nothing to report (no persistent tunnel/hostname state yet), instead of
calling CreateStorefront with zero hostnames and surfacing its
"requires at least one hostname" error as a confusing warning on a
normal first `obol sell ... --hostname X --no-register`.
EnsureTunnelForSell reconciles the storefront once the tunnel exists.
3. obolup.sh: verify_release_checksum now returns exit code 2 for a
verified checksum MISMATCH (tamper), distinct from exit code 1 for
"couldn't verify" (SHA256SUMS unpublished / no sha tool / no checksum
entry). download_release propagates the distinction, and
install_obol_binary hard-aborts on a mismatch instead of falling back to
`git clone` over the same (potentially compromised) channel. Also fixes
the misleading "Release not found" message on a mismatch.
4. agentruntime.MaxIDLength + openclaw/hermes Onboard: bound the deployment
id to (63 - the runtime's DNS-label prefix/suffix) at the two Onboard
call sites, so "openclaw-<id>" / "hermes-<id>" / "hermes-<id>-ui" can't
exceed the 63-char DNS label limit and fail later with an opaque k8s
error. validate.Name itself is untouched for other callers.
5. stack.destroyOldBackendIfSwitching: a declined backend-switch prompt
during `stack init --force` now returns nil (clean exit 0), matching
Down/Purge's behavior for the same ConfirmRunningServicesLoss decline.
Previously it returned errSafetyAborted, whose doc comment claimed
cmd/obol/stack.go handled it specially — it never did. Comment fixed to
reflect that nothing consumes the sentinel today.
Deviation: no automated test for (5)'s behavior change — reaching the
declined-prompt branch requires ui.UI.IsTTY()==true, which has no
test-injectable seam (isTTY is unexported, set from a real
isatty.IsTerminal check, no pty dependency in the repo). Verified by
inspection + go build/vet/test instead; the change is a single-line
return-value swap in an already-covered function.
Claude-Session: https://claude.ai/code/session_014YjPMViNrZ7zBVgUQzwEKk
@bussyjd
bussyjd
merged commit c2d5c58
into
integration/v0.14.0-rc0Jul 16, 2026
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@bussyjd

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
chore: fix assorted PR #756 review nits - #786
Merged
bussyjd merged 1 commit into
integration/v0.14.0-rc0from 
fix/misc-nits
Jul 16, 2026
Merged
chore: fix assorted PR #756 review nits#786
bussyjd merged 1 commit into
integration/v0.14.0-rc0from 
fix/misc-nits
Conversation
@bussyjd
@bussyjdbussyjd
commented
Jul 16, 2026

Copy link


Copy Markdown

Contributor
Small independent nits from the PR #756 review: RemoveAgentIdentityRegistration allocates instead of mutating the caller's backing array; RefreshStorefront no-ops quietly before a persistent tunnel exists; obolup.sh aborts hard on a verified checksum mismatch instead of falling back to a source build in the same attacker-controlled channel; agent --id length bounded to fit the derived k8s prefix; stack init decline stops Init cleanly (a regression where the decline let Init continue past the destroy was caught in review and fixed).
https://claude.ai/code/session_014YjPMViNrZ7zBVgUQzwEKk
@bussyjd
fix: five independent nits (shared-slice mutation, storefront no-op, …
f570810
…checksum-tamper fallback, DNS-label overflow, safety-decline exit code)
1. monetizeapi.RemoveAgentIdentityRegistration: allocate a fresh slice
instead of filtering status.Registrations in place, so a caller passing
an informer-cached object can't have its backing array silently
corrupted.
2. tunnel.RefreshStorefront: no-op quietly when storefrontHostnames has
nothing to report (no persistent tunnel/hostname state yet), instead of
calling CreateStorefront with zero hostnames and surfacing its
"requires at least one hostname" error as a confusing warning on a
normal first `obol sell ... --hostname X --no-register`.
EnsureTunnelForSell reconciles the storefront once the tunnel exists.
3. obolup.sh: verify_release_checksum now returns exit code 2 for a
verified checksum MISMATCH (tamper), distinct from exit code 1 for
"couldn't verify" (SHA256SUMS unpublished / no sha tool / no checksum
entry). download_release propagates the distinction, and
install_obol_binary hard-aborts on a mismatch instead of falling back to
`git clone` over the same (potentially compromised) channel. Also fixes
the misleading "Release not found" message on a mismatch.
4. agentruntime.MaxIDLength + openclaw/hermes Onboard: bound the deployment
id to (63 - the runtime's DNS-label prefix/suffix) at the two Onboard
call sites, so "openclaw-<id>" / "hermes-<id>" / "hermes-<id>-ui" can't
exceed the 63-char DNS label limit and fail later with an opaque k8s
error. validate.Name itself is untouched for other callers.
5. stack.destroyOldBackendIfSwitching: a declined backend-switch prompt
during `stack init --force` now returns nil (clean exit 0), matching
Down/Purge's behavior for the same ConfirmRunningServicesLoss decline.
Previously it returned errSafetyAborted, whose doc comment claimed
cmd/obol/stack.go handled it specially — it never did. Comment fixed to
reflect that nothing consumes the sentinel today.
Deviation: no automated test for (5)'s behavior change — reaching the
declined-prompt branch requires ui.UI.IsTTY()==true, which has no
test-injectable seam (isTTY is unexported, set from a real
isatty.IsTerminal check, no pty dependency in the repo). Verified by
inspection + go build/vet/test instead; the change is a single-line
return-value swap in an already-covered function.
Claude-Session: https://claude.ai/code/session_014YjPMViNrZ7zBVgUQzwEKk
@bussyjd
bussyjd
merged commit c2d5c58
into
integration/v0.14.0-rc0Jul 16, 2026
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@bussyjd