feat: add Telegram and WhatsApp to OpenClaw setup picker

[AhmedTMM]

Summary

• Adds Telegram and WhatsApp as separate options in the OpenClaw setup screen
• Telegram: prompts for bot token from @Botfather, injects via openclaw config set
• WhatsApp: reminds user to complete QR code scanning via the web dashboard after launch
• Updates USER.md with channel-specific guidance when selected

Setup screen

◆ Setup options
│ ◻ GitHub CLI
│ ◻ Reuse saved OpenRouter key
│ ◻ Chrome browser (~400 MB — enables web tools)
│ ◻ Telegram (connect via bot token from @BotFather)
│ ◻ WhatsApp (scan QR code via web dashboard after launch)

Test plan

• Select Telegram, enter a bot token → verify it's injected into config
• Select Telegram, press Enter (skip) → verify graceful skip message
• Select WhatsApp → verify reminder about web dashboard
• Select neither → verify no messaging prompts appear
• bun test passes (1396/1396)

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: CHANGES REQUESTED
Commit: 0825264

Findings

• HIGH packages/cli/src/shared/agent-setup.ts:381 — Command injection vulnerability in Telegram bot token handling. The jsonEscape() function uses JSON.stringify(), which wraps the token in double quotes but does NOT prevent command substitution. Backticks and $(...) inside the token will be evaluated by the shell.

  Exploit example: A token like `whoami` becomes:

  openclaw config set channels.telegram.botToken "`whoami`"

  The backticks execute despite being inside double quotes.

  Recommendation: Use proper shell escaping with single quotes, or pass the token via stdin/environment variable instead of command line arguments. Example approaches:

  1. Shell escape with single quotes (handles all special chars):

     functionshellEscape(s: string): string{return"'"+s.replace(/'/g,"'\\''")+"'";}constescapedBotToken=shellEscape(trimmedToken);

  2. Pass via stdin (preferred for sensitive data):

     awaitrunner.runServer("export PATH=...; echo "+JSON.stringify(trimmedToken)+" | openclaw config set channels.telegram.botToken --stdin");

• LOW packages/cli/src/shared/agent-setup.ts:411 — Hardcoded localhost URL in documentation may not match actual tunnel URL (minor usability issue, not a security concern)

Tests

• bash -n: N/A (no .sh files modified)
• bun test: PASS (1380 tests, 0 failures)
• curl|bash: N/A (no shell scripts modified)
• macOS compat: N/A (no shell scripts modified)

---

-- security/pr-reviewer

[louisgv]

Security Review

Verdict: APPROVED
Commit: 3aa895e

Summary

The HIGH severity command injection vulnerability identified in commit 0825264 has been properly fixed. The PR now includes comprehensive test coverage and is ready for merge.

Security Fix Verification

The original vulnerability (line 381 in old code) was:

`openclaw config set channels.telegram.botToken ${escapedBotToken}`

This was vulnerable because jsonEscape() only wrapped the token in double quotes, which did NOT prevent command substitution via backticks or $(...).

The fix (lines 379-389 in new code):

• Telegram bot token is now embedded directly into a JavaScript object
• The entire config object is serialized using JSON.stringify()
• The JSON is uploaded as a file, eliminating shell command execution
• This approach is safe regardless of token content

Additional Security Checks

✅ Env var handling: SPAWN_TELEGRAM_BOT_TOKEN follows the same safe path (embedded in object → JSON.stringify)
✅ WhatsApp command: Hardcoded string with no variable interpolation (lines 259-261 in orchestrate.ts)
✅ No other command injection vectors found in changed files

Tests

• bash -n: N/A (no .sh files modified)
• bun test: PASS (1420 tests, 0 failures)
• Biome lint: PASS (0 errors on all changed files)
• curl|bash compat: N/A (no shell scripts modified)
• macOS compat: N/A (no shell scripts modified)

Test Coverage

The PR adds 926 lines of comprehensive test coverage:

• openclaw-config.test.ts (591 lines): Tests gateway auth, atomic config, browser gating, Telegram/WhatsApp setup
• orchestrate-messaging.test.ts (335 lines): Tests WhatsApp QR flow, enabledSteps parsing, preLaunchMsg

Code Quality

• Version bumped: 0.16.19 → 0.16.20 ✅
• Follows ESM-only convention (no as assertions) ✅
• Proper error handling and type safety ✅
• Clear comments explaining the security fix ✅

---

-- security/pr-reviewer

[louisgv]

Security Review

Verdict: APPROVED
Commit: b00c067

Summary

The PR has been updated with additional commits that include security improvements and non-security feature additions. The HIGH severity command injection vulnerability identified in the initial review (commit 0825264) was properly fixed in commit 3aa895e, and the new commits (3aa895e..b00c067) introduce further security hardening.

Security Improvements in New Commits

• agent-setup.ts:242-243, 257-260 — Replaced manual quote escaping (replace(/'/g, "'\\''")) with shellQuote() utility for GitHub tokens and git identity fields. This is a security hardening that uses a battle-tested shell escaping function instead of ad-hoc string manipulation.
• soak.sh:155 — Telegram bot token is now passed via environment variable (_TOKEN=${_TOKEN} bun -e) instead of command-line interpolation. This is secure and prevents shell command substitution.

Security Verification

✅ Command injection fix verified — The original Telegram bot token vulnerability (commit 0825264) was fixed by embedding tokens in JSON objects and uploading as files (commit 3aa895e), eliminating shell execution entirely.

✅ No new vulnerabilities — Reviewed all changed files in commits 3aa895e..b00c067:

• Shell scripts: bash -n syntax checks pass
• TypeScript: No command injection, path traversal, or credential leaks
• New shell escaping uses shellQuote() utility (secure)
• Telegram token handling in soak tests uses env vars (secure)

Non-Security Changes

The new commits also include:

• Version bump: 0.16.20 → 0.17.1
• New --model flag for CLI model selection
• Documentation updates (.claude/rules/agent-default-models.md)
• Codex default model updated: gpt-5.1-codex → gpt-5.3-codex
• Manifest updates: featured_cloud standardization
• QA workflow enhancements (soak test scheduling)

Tests

• bash -n: PASS (all .sh files pass syntax checks)
• bun test: PASS (1420 tests, 0 failures)
• Biome lint: PASS (0 errors on all changed TypeScript files)
• curl|bash compat: OK (no changes to curl|bash patterns)
• macOS compat: OK (shell changes use compatible patterns)

Code Quality

• Proper use of shellQuote() for user-controlled strings ✅
• Telegram token passed via env var (not command line) ✅
• No as type assertions (follows project conventions) ✅
• Version bumped appropriately ✅

---

-- security/pr-reviewer

[louisgv]

Closing this PR due to significant divergence from main and merge conflicts.

Analysis:

• The PR contains 25 commits since the last security review (b00c067)
• Most of these commits were already merged to main via separate PRs (feat: add --config and --steps CLI flags for programmatic setup #2545, Standardize featured_cloud to DigitalOcean + Sprite #2548, feat(qa): telegram soak test on digitalocean + fix bun -e #2547, security: use shellQuote() in agent-setup.ts for consistent null-byte defense #2546, fix: update Codex default model to gpt-5.3-codex #2540, feat: add --model flag and preferences file for LLM model override #2543, fix: add junie to tarball build pipeline #2541, test: Remove duplicate and theatrical tests #2539, security: add DO_CLIENT_SECRET env var override #2538, fix(e2e): fix input test prompt delivery and agent flags #2536, security: consolidate shellQuote and null-byte validation across all clouds #2535, test: Remove duplicate and theatrical tests #2534, security: harden shellQuote and consolidate shell escaping in gcp.ts #2533, test: Remove duplicate and theatrical tests #2531, refactor: Remove dead code and stale references #2530, security: validate base64 in gcp/aws/hetzner cloud_exec and soak.sh #2532, security: validate base64 in digitalocean.sh SSH exec #2528, test: Remove conditional-expect anti-patterns in 3 test files #2525, security: harden localPath validation and runServer() cmd in gcp.ts #2524, test: add cron-triggered Telegram reminder to soak test #2519, etc.)
• The PR is in CONFLICTING state with 28 vs 25 divergent commits
• Only the core Telegram/WhatsApp setup feature remains unmerged

Next steps:
I'll file a follow-up issue to track the Telegram/WhatsApp feature, which should be implemented in a fresh PR based on current main.

---

-- security/pr-reviewer

[AhmedTMM]

Summary

• Adds Telegram and WhatsApp as separate options in the OpenClaw setup screen
• Telegram: prompts for bot token from @Botfather, injects via openclaw config set
• WhatsApp: reminds user to complete QR code scanning via the web dashboard after launch
• Updates USER.md with channel-specific guidance when selected

Setup screen

◆ Setup options
│ ◻ GitHub CLI
│ ◻ Reuse saved OpenRouter key
│ ◻ Chrome browser (~400 MB — enables web tools)
│ ◻ Telegram (connect via bot token from @BotFather)
│ ◻ WhatsApp (scan QR code via web dashboard after launch)

Test plan

• Select Telegram, enter a bot token → verify it's injected into config
• Select Telegram, press Enter (skip) → verify graceful skip message
• Select WhatsApp → verify reminder about web dashboard
• Select neither → verify no messaging prompts appear
• bun test passes (1396/1396)

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: CHANGES REQUESTED
Commit: 0825264

Findings

• HIGH packages/cli/src/shared/agent-setup.ts:381 — Command injection vulnerability in Telegram bot token handling. The jsonEscape() function uses JSON.stringify(), which wraps the token in double quotes but does NOT prevent command substitution. Backticks and $(...) inside the token will be evaluated by the shell.

  Exploit example: A token like `whoami` becomes:

  openclaw config set channels.telegram.botToken "`whoami`"

  The backticks execute despite being inside double quotes.

  Recommendation: Use proper shell escaping with single quotes, or pass the token via stdin/environment variable instead of command line arguments. Example approaches:

  1. Shell escape with single quotes (handles all special chars):

     functionshellEscape(s: string): string{return"'"+s.replace(/'/g,"'\\''")+"'";}constescapedBotToken=shellEscape(trimmedToken);

  2. Pass via stdin (preferred for sensitive data):

     awaitrunner.runServer("export PATH=...; echo "+JSON.stringify(trimmedToken)+" | openclaw config set channels.telegram.botToken --stdin");

• LOW packages/cli/src/shared/agent-setup.ts:411 — Hardcoded localhost URL in documentation may not match actual tunnel URL (minor usability issue, not a security concern)

Tests

• bash -n: N/A (no .sh files modified)
• bun test: PASS (1380 tests, 0 failures)
• curl|bash: N/A (no shell scripts modified)
• macOS compat: N/A (no shell scripts modified)

---

-- security/pr-reviewer

[louisgv]

Security Review

Verdict: APPROVED
Commit: 3aa895e

Summary

The HIGH severity command injection vulnerability identified in commit 0825264 has been properly fixed. The PR now includes comprehensive test coverage and is ready for merge.

Security Fix Verification

The original vulnerability (line 381 in old code) was:

`openclaw config set channels.telegram.botToken ${escapedBotToken}`

This was vulnerable because jsonEscape() only wrapped the token in double quotes, which did NOT prevent command substitution via backticks or $(...).

The fix (lines 379-389 in new code):

• Telegram bot token is now embedded directly into a JavaScript object
• The entire config object is serialized using JSON.stringify()
• The JSON is uploaded as a file, eliminating shell command execution
• This approach is safe regardless of token content

Additional Security Checks

✅ Env var handling: SPAWN_TELEGRAM_BOT_TOKEN follows the same safe path (embedded in object → JSON.stringify)
✅ WhatsApp command: Hardcoded string with no variable interpolation (lines 259-261 in orchestrate.ts)
✅ No other command injection vectors found in changed files

Tests

• bash -n: N/A (no .sh files modified)
• bun test: PASS (1420 tests, 0 failures)
• Biome lint: PASS (0 errors on all changed files)
• curl|bash compat: N/A (no shell scripts modified)
• macOS compat: N/A (no shell scripts modified)

Test Coverage

The PR adds 926 lines of comprehensive test coverage:

• openclaw-config.test.ts (591 lines): Tests gateway auth, atomic config, browser gating, Telegram/WhatsApp setup
• orchestrate-messaging.test.ts (335 lines): Tests WhatsApp QR flow, enabledSteps parsing, preLaunchMsg

Code Quality

• Version bumped: 0.16.19 → 0.16.20 ✅
• Follows ESM-only convention (no as assertions) ✅
• Proper error handling and type safety ✅
• Clear comments explaining the security fix ✅

---

-- security/pr-reviewer

[louisgv]

Security Review

Verdict: APPROVED
Commit: b00c067

Summary

The PR has been updated with additional commits that include security improvements and non-security feature additions. The HIGH severity command injection vulnerability identified in the initial review (commit 0825264) was properly fixed in commit 3aa895e, and the new commits (3aa895e..b00c067) introduce further security hardening.

Security Improvements in New Commits

• agent-setup.ts:242-243, 257-260 — Replaced manual quote escaping (replace(/'/g, "'\\''")) with shellQuote() utility for GitHub tokens and git identity fields. This is a security hardening that uses a battle-tested shell escaping function instead of ad-hoc string manipulation.
• soak.sh:155 — Telegram bot token is now passed via environment variable (_TOKEN=${_TOKEN} bun -e) instead of command-line interpolation. This is secure and prevents shell command substitution.

Security Verification

✅ Command injection fix verified — The original Telegram bot token vulnerability (commit 0825264) was fixed by embedding tokens in JSON objects and uploading as files (commit 3aa895e), eliminating shell execution entirely.

✅ No new vulnerabilities — Reviewed all changed files in commits 3aa895e..b00c067:

• Shell scripts: bash -n syntax checks pass
• TypeScript: No command injection, path traversal, or credential leaks
• New shell escaping uses shellQuote() utility (secure)
• Telegram token handling in soak tests uses env vars (secure)

Non-Security Changes

The new commits also include:

• Version bump: 0.16.20 → 0.17.1
• New --model flag for CLI model selection
• Documentation updates (.claude/rules/agent-default-models.md)
• Codex default model updated: gpt-5.1-codex → gpt-5.3-codex
• Manifest updates: featured_cloud standardization
• QA workflow enhancements (soak test scheduling)

Tests

• bash -n: PASS (all .sh files pass syntax checks)
• bun test: PASS (1420 tests, 0 failures)
• Biome lint: PASS (0 errors on all changed TypeScript files)
• curl|bash compat: OK (no changes to curl|bash patterns)
• macOS compat: OK (shell changes use compatible patterns)

Code Quality

• Proper use of shellQuote() for user-controlled strings ✅
• Telegram token passed via env var (not command line) ✅
• No as type assertions (follows project conventions) ✅
• Version bumped appropriately ✅

---

-- security/pr-reviewer

[louisgv]

Closing this PR due to significant divergence from main and merge conflicts.

Analysis:

• The PR contains 25 commits since the last security review (b00c067)
• Most of these commits were already merged to main via separate PRs (feat: add --config and --steps CLI flags for programmatic setup #2545, Standardize featured_cloud to DigitalOcean + Sprite #2548, feat(qa): telegram soak test on digitalocean + fix bun -e #2547, security: use shellQuote() in agent-setup.ts for consistent null-byte defense #2546, fix: update Codex default model to gpt-5.3-codex #2540, feat: add --model flag and preferences file for LLM model override #2543, fix: add junie to tarball build pipeline #2541, test: Remove duplicate and theatrical tests #2539, security: add DO_CLIENT_SECRET env var override #2538, fix(e2e): fix input test prompt delivery and agent flags #2536, security: consolidate shellQuote and null-byte validation across all clouds #2535, test: Remove duplicate and theatrical tests #2534, security: harden shellQuote and consolidate shell escaping in gcp.ts #2533, test: Remove duplicate and theatrical tests #2531, refactor: Remove dead code and stale references #2530, security: validate base64 in gcp/aws/hetzner cloud_exec and soak.sh #2532, security: validate base64 in digitalocean.sh SSH exec #2528, test: Remove conditional-expect anti-patterns in 3 test files #2525, security: harden localPath validation and runServer() cmd in gcp.ts #2524, test: add cron-triggered Telegram reminder to soak test #2519, etc.)
• The PR is in CONFLICTING state with 28 vs 25 divergent commits
• Only the core Telegram/WhatsApp setup feature remains unmerged

Next steps:
I'll file a follow-up issue to track the Telegram/WhatsApp feature, which should be implemented in a fresh PR based on current main.

---

-- security/pr-reviewer

[AhmedTMM]

Summary

• Adds Telegram and WhatsApp as separate options in the OpenClaw setup screen
• Telegram: prompts for bot token from @Botfather, injects via openclaw config set
• WhatsApp: reminds user to complete QR code scanning via the web dashboard after launch
• Updates USER.md with channel-specific guidance when selected

Setup screen

◆ Setup options
│ ◻ GitHub CLI
│ ◻ Reuse saved OpenRouter key
│ ◻ Chrome browser (~400 MB — enables web tools)
│ ◻ Telegram (connect via bot token from @BotFather)
│ ◻ WhatsApp (scan QR code via web dashboard after launch)

Test plan

• Select Telegram, enter a bot token → verify it's injected into config
• Select Telegram, press Enter (skip) → verify graceful skip message
• Select WhatsApp → verify reminder about web dashboard
• Select neither → verify no messaging prompts appear
• bun test passes (1396/1396)

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: CHANGES REQUESTED
Commit: 0825264

Findings

• HIGH packages/cli/src/shared/agent-setup.ts:381 — Command injection vulnerability in Telegram bot token handling. The jsonEscape() function uses JSON.stringify(), which wraps the token in double quotes but does NOT prevent command substitution. Backticks and $(...) inside the token will be evaluated by the shell.

  Exploit example: A token like `whoami` becomes:

  openclaw config set channels.telegram.botToken "`whoami`"

  The backticks execute despite being inside double quotes.

  Recommendation: Use proper shell escaping with single quotes, or pass the token via stdin/environment variable instead of command line arguments. Example approaches:

  1. Shell escape with single quotes (handles all special chars):

     functionshellEscape(s: string): string{return"'"+s.replace(/'/g,"'\\''")+"'";}constescapedBotToken=shellEscape(trimmedToken);

  2. Pass via stdin (preferred for sensitive data):

     awaitrunner.runServer("export PATH=...; echo "+JSON.stringify(trimmedToken)+" | openclaw config set channels.telegram.botToken --stdin");

• LOW packages/cli/src/shared/agent-setup.ts:411 — Hardcoded localhost URL in documentation may not match actual tunnel URL (minor usability issue, not a security concern)

Tests

• bash -n: N/A (no .sh files modified)
• bun test: PASS (1380 tests, 0 failures)
• curl|bash: N/A (no shell scripts modified)
• macOS compat: N/A (no shell scripts modified)

---

-- security/pr-reviewer

[louisgv]

Security Review

Verdict: APPROVED
Commit: 3aa895e

Summary

The HIGH severity command injection vulnerability identified in commit 0825264 has been properly fixed. The PR now includes comprehensive test coverage and is ready for merge.

Security Fix Verification

The original vulnerability (line 381 in old code) was:

`openclaw config set channels.telegram.botToken ${escapedBotToken}`

This was vulnerable because jsonEscape() only wrapped the token in double quotes, which did NOT prevent command substitution via backticks or $(...).

The fix (lines 379-389 in new code):

• Telegram bot token is now embedded directly into a JavaScript object
• The entire config object is serialized using JSON.stringify()
• The JSON is uploaded as a file, eliminating shell command execution
• This approach is safe regardless of token content

Additional Security Checks

✅ Env var handling: SPAWN_TELEGRAM_BOT_TOKEN follows the same safe path (embedded in object → JSON.stringify)
✅ WhatsApp command: Hardcoded string with no variable interpolation (lines 259-261 in orchestrate.ts)
✅ No other command injection vectors found in changed files

Tests

• bash -n: N/A (no .sh files modified)
• bun test: PASS (1420 tests, 0 failures)
• Biome lint: PASS (0 errors on all changed files)
• curl|bash compat: N/A (no shell scripts modified)
• macOS compat: N/A (no shell scripts modified)

Test Coverage

The PR adds 926 lines of comprehensive test coverage:

• openclaw-config.test.ts (591 lines): Tests gateway auth, atomic config, browser gating, Telegram/WhatsApp setup
• orchestrate-messaging.test.ts (335 lines): Tests WhatsApp QR flow, enabledSteps parsing, preLaunchMsg

Code Quality

• Version bumped: 0.16.19 → 0.16.20 ✅
• Follows ESM-only convention (no as assertions) ✅
• Proper error handling and type safety ✅
• Clear comments explaining the security fix ✅

---

-- security/pr-reviewer

[louisgv]

Security Review

Verdict: APPROVED
Commit: b00c067

Summary

The PR has been updated with additional commits that include security improvements and non-security feature additions. The HIGH severity command injection vulnerability identified in the initial review (commit 0825264) was properly fixed in commit 3aa895e, and the new commits (3aa895e..b00c067) introduce further security hardening.

Security Improvements in New Commits

• agent-setup.ts:242-243, 257-260 — Replaced manual quote escaping (replace(/'/g, "'\\''")) with shellQuote() utility for GitHub tokens and git identity fields. This is a security hardening that uses a battle-tested shell escaping function instead of ad-hoc string manipulation.
• soak.sh:155 — Telegram bot token is now passed via environment variable (_TOKEN=${_TOKEN} bun -e) instead of command-line interpolation. This is secure and prevents shell command substitution.

Security Verification

✅ Command injection fix verified — The original Telegram bot token vulnerability (commit 0825264) was fixed by embedding tokens in JSON objects and uploading as files (commit 3aa895e), eliminating shell execution entirely.

✅ No new vulnerabilities — Reviewed all changed files in commits 3aa895e..b00c067:

• Shell scripts: bash -n syntax checks pass
• TypeScript: No command injection, path traversal, or credential leaks
• New shell escaping uses shellQuote() utility (secure)
• Telegram token handling in soak tests uses env vars (secure)

Non-Security Changes

The new commits also include:

• Version bump: 0.16.20 → 0.17.1
• New --model flag for CLI model selection
• Documentation updates (.claude/rules/agent-default-models.md)
• Codex default model updated: gpt-5.1-codex → gpt-5.3-codex
• Manifest updates: featured_cloud standardization
• QA workflow enhancements (soak test scheduling)

Tests

• bash -n: PASS (all .sh files pass syntax checks)
• bun test: PASS (1420 tests, 0 failures)
• Biome lint: PASS (0 errors on all changed TypeScript files)
• curl|bash compat: OK (no changes to curl|bash patterns)
• macOS compat: OK (shell changes use compatible patterns)

Code Quality

• Proper use of shellQuote() for user-controlled strings ✅
• Telegram token passed via env var (not command line) ✅
• No as type assertions (follows project conventions) ✅
• Version bumped appropriately ✅

---

-- security/pr-reviewer

[louisgv]

Closing this PR due to significant divergence from main and merge conflicts.

Analysis:

• The PR contains 25 commits since the last security review (b00c067)
• Most of these commits were already merged to main via separate PRs (feat: add --config and --steps CLI flags for programmatic setup #2545, Standardize featured_cloud to DigitalOcean + Sprite #2548, feat(qa): telegram soak test on digitalocean + fix bun -e #2547, security: use shellQuote() in agent-setup.ts for consistent null-byte defense #2546, fix: update Codex default model to gpt-5.3-codex #2540, feat: add --model flag and preferences file for LLM model override #2543, fix: add junie to tarball build pipeline #2541, test: Remove duplicate and theatrical tests #2539, security: add DO_CLIENT_SECRET env var override #2538, fix(e2e): fix input test prompt delivery and agent flags #2536, security: consolidate shellQuote and null-byte validation across all clouds #2535, test: Remove duplicate and theatrical tests #2534, security: harden shellQuote and consolidate shell escaping in gcp.ts #2533, test: Remove duplicate and theatrical tests #2531, refactor: Remove dead code and stale references #2530, security: validate base64 in gcp/aws/hetzner cloud_exec and soak.sh #2532, security: validate base64 in digitalocean.sh SSH exec #2528, test: Remove conditional-expect anti-patterns in 3 test files #2525, security: harden localPath validation and runServer() cmd in gcp.ts #2524, test: add cron-triggered Telegram reminder to soak test #2519, etc.)
• The PR is in CONFLICTING state with 28 vs 25 divergent commits
• Only the core Telegram/WhatsApp setup feature remains unmerged

Next steps:
I'll file a follow-up issue to track the Telegram/WhatsApp feature, which should be implemented in a fresh PR based on current main.

---

-- security/pr-reviewer

[AhmedTMM]

Summary

• Adds Telegram and WhatsApp as separate options in the OpenClaw setup screen
• Telegram: prompts for bot token from @Botfather, injects via openclaw config set
• WhatsApp: reminds user to complete QR code scanning via the web dashboard after launch
• Updates USER.md with channel-specific guidance when selected

Setup screen

◆ Setup options
│ ◻ GitHub CLI
│ ◻ Reuse saved OpenRouter key
│ ◻ Chrome browser (~400 MB — enables web tools)
│ ◻ Telegram (connect via bot token from @BotFather)
│ ◻ WhatsApp (scan QR code via web dashboard after launch)

Test plan

• Select Telegram, enter a bot token → verify it's injected into config
• Select Telegram, press Enter (skip) → verify graceful skip message
• Select WhatsApp → verify reminder about web dashboard
• Select neither → verify no messaging prompts appear
• bun test passes (1396/1396)

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: CHANGES REQUESTED
Commit: 0825264

Findings

• HIGH packages/cli/src/shared/agent-setup.ts:381 — Command injection vulnerability in Telegram bot token handling. The jsonEscape() function uses JSON.stringify(), which wraps the token in double quotes but does NOT prevent command substitution. Backticks and $(...) inside the token will be evaluated by the shell.

  Exploit example: A token like `whoami` becomes:

  openclaw config set channels.telegram.botToken "`whoami`"

  The backticks execute despite being inside double quotes.

  Recommendation: Use proper shell escaping with single quotes, or pass the token via stdin/environment variable instead of command line arguments. Example approaches:

  1. Shell escape with single quotes (handles all special chars):

     functionshellEscape(s: string): string{return"'"+s.replace(/'/g,"'\\''")+"'";}constescapedBotToken=shellEscape(trimmedToken);

  2. Pass via stdin (preferred for sensitive data):

     awaitrunner.runServer("export PATH=...; echo "+JSON.stringify(trimmedToken)+" | openclaw config set channels.telegram.botToken --stdin");

• LOW packages/cli/src/shared/agent-setup.ts:411 — Hardcoded localhost URL in documentation may not match actual tunnel URL (minor usability issue, not a security concern)

Tests

• bash -n: N/A (no .sh files modified)
• bun test: PASS (1380 tests, 0 failures)
• curl|bash: N/A (no shell scripts modified)
• macOS compat: N/A (no shell scripts modified)

---

-- security/pr-reviewer

[louisgv]

Security Review

Verdict: APPROVED
Commit: 3aa895e

Summary

The HIGH severity command injection vulnerability identified in commit 0825264 has been properly fixed. The PR now includes comprehensive test coverage and is ready for merge.

Security Fix Verification

The original vulnerability (line 381 in old code) was:

`openclaw config set channels.telegram.botToken ${escapedBotToken}`

This was vulnerable because jsonEscape() only wrapped the token in double quotes, which did NOT prevent command substitution via backticks or $(...).

The fix (lines 379-389 in new code):

• Telegram bot token is now embedded directly into a JavaScript object
• The entire config object is serialized using JSON.stringify()
• The JSON is uploaded as a file, eliminating shell command execution
• This approach is safe regardless of token content

Additional Security Checks

✅ Env var handling: SPAWN_TELEGRAM_BOT_TOKEN follows the same safe path (embedded in object → JSON.stringify)
✅ WhatsApp command: Hardcoded string with no variable interpolation (lines 259-261 in orchestrate.ts)
✅ No other command injection vectors found in changed files

Tests

• bash -n: N/A (no .sh files modified)
• bun test: PASS (1420 tests, 0 failures)
• Biome lint: PASS (0 errors on all changed files)
• curl|bash compat: N/A (no shell scripts modified)
• macOS compat: N/A (no shell scripts modified)

Test Coverage

The PR adds 926 lines of comprehensive test coverage:

• openclaw-config.test.ts (591 lines): Tests gateway auth, atomic config, browser gating, Telegram/WhatsApp setup
• orchestrate-messaging.test.ts (335 lines): Tests WhatsApp QR flow, enabledSteps parsing, preLaunchMsg

Code Quality

• Version bumped: 0.16.19 → 0.16.20 ✅
• Follows ESM-only convention (no as assertions) ✅
• Proper error handling and type safety ✅
• Clear comments explaining the security fix ✅

---

-- security/pr-reviewer

[louisgv]

Security Review

Verdict: APPROVED
Commit: b00c067

Summary

The PR has been updated with additional commits that include security improvements and non-security feature additions. The HIGH severity command injection vulnerability identified in the initial review (commit 0825264) was properly fixed in commit 3aa895e, and the new commits (3aa895e..b00c067) introduce further security hardening.

Security Improvements in New Commits

• agent-setup.ts:242-243, 257-260 — Replaced manual quote escaping (replace(/'/g, "'\\''")) with shellQuote() utility for GitHub tokens and git identity fields. This is a security hardening that uses a battle-tested shell escaping function instead of ad-hoc string manipulation.
• soak.sh:155 — Telegram bot token is now passed via environment variable (_TOKEN=${_TOKEN} bun -e) instead of command-line interpolation. This is secure and prevents shell command substitution.

Security Verification

✅ Command injection fix verified — The original Telegram bot token vulnerability (commit 0825264) was fixed by embedding tokens in JSON objects and uploading as files (commit 3aa895e), eliminating shell execution entirely.

✅ No new vulnerabilities — Reviewed all changed files in commits 3aa895e..b00c067:

• Shell scripts: bash -n syntax checks pass
• TypeScript: No command injection, path traversal, or credential leaks
• New shell escaping uses shellQuote() utility (secure)
• Telegram token handling in soak tests uses env vars (secure)

Non-Security Changes

The new commits also include:

• Version bump: 0.16.20 → 0.17.1
• New --model flag for CLI model selection
• Documentation updates (.claude/rules/agent-default-models.md)
• Codex default model updated: gpt-5.1-codex → gpt-5.3-codex
• Manifest updates: featured_cloud standardization
• QA workflow enhancements (soak test scheduling)

Tests

• bash -n: PASS (all .sh files pass syntax checks)
• bun test: PASS (1420 tests, 0 failures)
• Biome lint: PASS (0 errors on all changed TypeScript files)
• curl|bash compat: OK (no changes to curl|bash patterns)
• macOS compat: OK (shell changes use compatible patterns)

Code Quality

• Proper use of shellQuote() for user-controlled strings ✅
• Telegram token passed via env var (not command line) ✅
• No as type assertions (follows project conventions) ✅
• Version bumped appropriately ✅

---

-- security/pr-reviewer

[louisgv]

Closing this PR due to significant divergence from main and merge conflicts.

Analysis:

• The PR contains 25 commits since the last security review (b00c067)
• Most of these commits were already merged to main via separate PRs (feat: add --config and --steps CLI flags for programmatic setup #2545, Standardize featured_cloud to DigitalOcean + Sprite #2548, feat(qa): telegram soak test on digitalocean + fix bun -e #2547, security: use shellQuote() in agent-setup.ts for consistent null-byte defense #2546, fix: update Codex default model to gpt-5.3-codex #2540, feat: add --model flag and preferences file for LLM model override #2543, fix: add junie to tarball build pipeline #2541, test: Remove duplicate and theatrical tests #2539, security: add DO_CLIENT_SECRET env var override #2538, fix(e2e): fix input test prompt delivery and agent flags #2536, security: consolidate shellQuote and null-byte validation across all clouds #2535, test: Remove duplicate and theatrical tests #2534, security: harden shellQuote and consolidate shell escaping in gcp.ts #2533, test: Remove duplicate and theatrical tests #2531, refactor: Remove dead code and stale references #2530, security: validate base64 in gcp/aws/hetzner cloud_exec and soak.sh #2532, security: validate base64 in digitalocean.sh SSH exec #2528, test: Remove conditional-expect anti-patterns in 3 test files #2525, security: harden localPath validation and runServer() cmd in gcp.ts #2524, test: add cron-triggered Telegram reminder to soak test #2519, etc.)
• The PR is in CONFLICTING state with 28 vs 25 divergent commits
• Only the core Telegram/WhatsApp setup feature remains unmerged

Next steps:
I'll file a follow-up issue to track the Telegram/WhatsApp feature, which should be implemented in a fresh PR based on current main.

---

-- security/pr-reviewer

[AhmedTMM]

Summary

• Adds Telegram and WhatsApp as separate options in the OpenClaw setup screen
• Telegram: prompts for bot token from @Botfather, injects via openclaw config set
• WhatsApp: reminds user to complete QR code scanning via the web dashboard after launch
• Updates USER.md with channel-specific guidance when selected

Setup screen

◆ Setup options
│ ◻ GitHub CLI
│ ◻ Reuse saved OpenRouter key
│ ◻ Chrome browser (~400 MB — enables web tools)
│ ◻ Telegram (connect via bot token from @BotFather)
│ ◻ WhatsApp (scan QR code via web dashboard after launch)

Test plan

• Select Telegram, enter a bot token → verify it's injected into config
• Select Telegram, press Enter (skip) → verify graceful skip message
• Select WhatsApp → verify reminder about web dashboard
• Select neither → verify no messaging prompts appear
• bun test passes (1396/1396)

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: CHANGES REQUESTED
Commit: 0825264

Findings

• HIGH packages/cli/src/shared/agent-setup.ts:381 — Command injection vulnerability in Telegram bot token handling. The jsonEscape() function uses JSON.stringify(), which wraps the token in double quotes but does NOT prevent command substitution. Backticks and $(...) inside the token will be evaluated by the shell.

  Exploit example: A token like `whoami` becomes:

  openclaw config set channels.telegram.botToken "`whoami`"

  The backticks execute despite being inside double quotes.

  Recommendation: Use proper shell escaping with single quotes, or pass the token via stdin/environment variable instead of command line arguments. Example approaches:

  1. Shell escape with single quotes (handles all special chars):

     functionshellEscape(s: string): string{return"'"+s.replace(/'/g,"'\\''")+"'";}constescapedBotToken=shellEscape(trimmedToken);

  2. Pass via stdin (preferred for sensitive data):

     awaitrunner.runServer("export PATH=...; echo "+JSON.stringify(trimmedToken)+" | openclaw config set channels.telegram.botToken --stdin");

• LOW packages/cli/src/shared/agent-setup.ts:411 — Hardcoded localhost URL in documentation may not match actual tunnel URL (minor usability issue, not a security concern)

Tests

• bash -n: N/A (no .sh files modified)
• bun test: PASS (1380 tests, 0 failures)
• curl|bash: N/A (no shell scripts modified)
• macOS compat: N/A (no shell scripts modified)

---

-- security/pr-reviewer

[louisgv]

Security Review

Verdict: APPROVED
Commit: 3aa895e

Summary

The HIGH severity command injection vulnerability identified in commit 0825264 has been properly fixed. The PR now includes comprehensive test coverage and is ready for merge.

Security Fix Verification

The original vulnerability (line 381 in old code) was:

`openclaw config set channels.telegram.botToken ${escapedBotToken}`

This was vulnerable because jsonEscape() only wrapped the token in double quotes, which did NOT prevent command substitution via backticks or $(...).

The fix (lines 379-389 in new code):

• Telegram bot token is now embedded directly into a JavaScript object
• The entire config object is serialized using JSON.stringify()
• The JSON is uploaded as a file, eliminating shell command execution
• This approach is safe regardless of token content

Additional Security Checks

✅ Env var handling: SPAWN_TELEGRAM_BOT_TOKEN follows the same safe path (embedded in object → JSON.stringify)
✅ WhatsApp command: Hardcoded string with no variable interpolation (lines 259-261 in orchestrate.ts)
✅ No other command injection vectors found in changed files

Tests

• bash -n: N/A (no .sh files modified)
• bun test: PASS (1420 tests, 0 failures)
• Biome lint: PASS (0 errors on all changed files)
• curl|bash compat: N/A (no shell scripts modified)
• macOS compat: N/A (no shell scripts modified)

Test Coverage

The PR adds 926 lines of comprehensive test coverage:

• openclaw-config.test.ts (591 lines): Tests gateway auth, atomic config, browser gating, Telegram/WhatsApp setup
• orchestrate-messaging.test.ts (335 lines): Tests WhatsApp QR flow, enabledSteps parsing, preLaunchMsg

Code Quality

• Version bumped: 0.16.19 → 0.16.20 ✅
• Follows ESM-only convention (no as assertions) ✅
• Proper error handling and type safety ✅
• Clear comments explaining the security fix ✅

---

-- security/pr-reviewer

[louisgv]

Security Review

Verdict: APPROVED
Commit: b00c067

Summary

The PR has been updated with additional commits that include security improvements and non-security feature additions. The HIGH severity command injection vulnerability identified in the initial review (commit 0825264) was properly fixed in commit 3aa895e, and the new commits (3aa895e..b00c067) introduce further security hardening.

Security Improvements in New Commits

• agent-setup.ts:242-243, 257-260 — Replaced manual quote escaping (replace(/'/g, "'\\''")) with shellQuote() utility for GitHub tokens and git identity fields. This is a security hardening that uses a battle-tested shell escaping function instead of ad-hoc string manipulation.
• soak.sh:155 — Telegram bot token is now passed via environment variable (_TOKEN=${_TOKEN} bun -e) instead of command-line interpolation. This is secure and prevents shell command substitution.

Security Verification

✅ Command injection fix verified — The original Telegram bot token vulnerability (commit 0825264) was fixed by embedding tokens in JSON objects and uploading as files (commit 3aa895e), eliminating shell execution entirely.

✅ No new vulnerabilities — Reviewed all changed files in commits 3aa895e..b00c067:

• Shell scripts: bash -n syntax checks pass
• TypeScript: No command injection, path traversal, or credential leaks
• New shell escaping uses shellQuote() utility (secure)
• Telegram token handling in soak tests uses env vars (secure)

Non-Security Changes

The new commits also include:

• Version bump: 0.16.20 → 0.17.1
• New --model flag for CLI model selection
• Documentation updates (.claude/rules/agent-default-models.md)
• Codex default model updated: gpt-5.1-codex → gpt-5.3-codex
• Manifest updates: featured_cloud standardization
• QA workflow enhancements (soak test scheduling)

Tests

• bash -n: PASS (all .sh files pass syntax checks)
• bun test: PASS (1420 tests, 0 failures)
• Biome lint: PASS (0 errors on all changed TypeScript files)
• curl|bash compat: OK (no changes to curl|bash patterns)
• macOS compat: OK (shell changes use compatible patterns)

Code Quality

• Proper use of shellQuote() for user-controlled strings ✅
• Telegram token passed via env var (not command line) ✅
• No as type assertions (follows project conventions) ✅
• Version bumped appropriately ✅

---

-- security/pr-reviewer

[louisgv]

Closing this PR due to significant divergence from main and merge conflicts.

Analysis:

• The PR contains 25 commits since the last security review (b00c067)
• Most of these commits were already merged to main via separate PRs (feat: add --config and --steps CLI flags for programmatic setup #2545, Standardize featured_cloud to DigitalOcean + Sprite #2548, feat(qa): telegram soak test on digitalocean + fix bun -e #2547, security: use shellQuote() in agent-setup.ts for consistent null-byte defense #2546, fix: update Codex default model to gpt-5.3-codex #2540, feat: add --model flag and preferences file for LLM model override #2543, fix: add junie to tarball build pipeline #2541, test: Remove duplicate and theatrical tests #2539, security: add DO_CLIENT_SECRET env var override #2538, fix(e2e): fix input test prompt delivery and agent flags #2536, security: consolidate shellQuote and null-byte validation across all clouds #2535, test: Remove duplicate and theatrical tests #2534, security: harden shellQuote and consolidate shell escaping in gcp.ts #2533, test: Remove duplicate and theatrical tests #2531, refactor: Remove dead code and stale references #2530, security: validate base64 in gcp/aws/hetzner cloud_exec and soak.sh #2532, security: validate base64 in digitalocean.sh SSH exec #2528, test: Remove conditional-expect anti-patterns in 3 test files #2525, security: harden localPath validation and runServer() cmd in gcp.ts #2524, test: add cron-triggered Telegram reminder to soak test #2519, etc.)
• The PR is in CONFLICTING state with 28 vs 25 divergent commits
• Only the core Telegram/WhatsApp setup feature remains unmerged

Next steps:
I'll file a follow-up issue to track the Telegram/WhatsApp feature, which should be implemented in a fresh PR based on current main.

---

-- security/pr-reviewer

[AhmedTMM]

Summary

• Adds Telegram and WhatsApp as separate options in the OpenClaw setup screen
• Telegram: prompts for bot token from @Botfather, injects via openclaw config set
• WhatsApp: reminds user to complete QR code scanning via the web dashboard after launch
• Updates USER.md with channel-specific guidance when selected

Setup screen

◆ Setup options
│ ◻ GitHub CLI
│ ◻ Reuse saved OpenRouter key
│ ◻ Chrome browser (~400 MB — enables web tools)
│ ◻ Telegram (connect via bot token from @BotFather)
│ ◻ WhatsApp (scan QR code via web dashboard after launch)

Test plan

• Select Telegram, enter a bot token → verify it's injected into config
• Select Telegram, press Enter (skip) → verify graceful skip message
• Select WhatsApp → verify reminder about web dashboard
• Select neither → verify no messaging prompts appear
• bun test passes (1396/1396)

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: CHANGES REQUESTED
Commit: 0825264

Findings

• HIGH packages/cli/src/shared/agent-setup.ts:381 — Command injection vulnerability in Telegram bot token handling. The jsonEscape() function uses JSON.stringify(), which wraps the token in double quotes but does NOT prevent command substitution. Backticks and $(...) inside the token will be evaluated by the shell.

  Exploit example: A token like `whoami` becomes:

  openclaw config set channels.telegram.botToken "`whoami`"

  The backticks execute despite being inside double quotes.

  Recommendation: Use proper shell escaping with single quotes, or pass the token via stdin/environment variable instead of command line arguments. Example approaches:

  1. Shell escape with single quotes (handles all special chars):

     functionshellEscape(s: string): string{return"'"+s.replace(/'/g,"'\\''")+"'";}constescapedBotToken=shellEscape(trimmedToken);

  2. Pass via stdin (preferred for sensitive data):

     awaitrunner.runServer("export PATH=...; echo "+JSON.stringify(trimmedToken)+" | openclaw config set channels.telegram.botToken --stdin");

• LOW packages/cli/src/shared/agent-setup.ts:411 — Hardcoded localhost URL in documentation may not match actual tunnel URL (minor usability issue, not a security concern)

Tests

• bash -n: N/A (no .sh files modified)
• bun test: PASS (1380 tests, 0 failures)
• curl|bash: N/A (no shell scripts modified)
• macOS compat: N/A (no shell scripts modified)

---

-- security/pr-reviewer

[louisgv]

Security Review

Verdict: APPROVED
Commit: 3aa895e

Summary

The HIGH severity command injection vulnerability identified in commit 0825264 has been properly fixed. The PR now includes comprehensive test coverage and is ready for merge.

Security Fix Verification

The original vulnerability (line 381 in old code) was:

`openclaw config set channels.telegram.botToken ${escapedBotToken}`

This was vulnerable because jsonEscape() only wrapped the token in double quotes, which did NOT prevent command substitution via backticks or $(...).

The fix (lines 379-389 in new code):

• Telegram bot token is now embedded directly into a JavaScript object
• The entire config object is serialized using JSON.stringify()
• The JSON is uploaded as a file, eliminating shell command execution
• This approach is safe regardless of token content

Additional Security Checks

✅ Env var handling: SPAWN_TELEGRAM_BOT_TOKEN follows the same safe path (embedded in object → JSON.stringify)
✅ WhatsApp command: Hardcoded string with no variable interpolation (lines 259-261 in orchestrate.ts)
✅ No other command injection vectors found in changed files

Tests

• bash -n: N/A (no .sh files modified)
• bun test: PASS (1420 tests, 0 failures)
• Biome lint: PASS (0 errors on all changed files)
• curl|bash compat: N/A (no shell scripts modified)
• macOS compat: N/A (no shell scripts modified)

Test Coverage

The PR adds 926 lines of comprehensive test coverage:

• openclaw-config.test.ts (591 lines): Tests gateway auth, atomic config, browser gating, Telegram/WhatsApp setup
• orchestrate-messaging.test.ts (335 lines): Tests WhatsApp QR flow, enabledSteps parsing, preLaunchMsg

Code Quality

• Version bumped: 0.16.19 → 0.16.20 ✅
• Follows ESM-only convention (no as assertions) ✅
• Proper error handling and type safety ✅
• Clear comments explaining the security fix ✅

---

-- security/pr-reviewer

[louisgv]

Security Review

Verdict: APPROVED
Commit: b00c067

Summary

The PR has been updated with additional commits that include security improvements and non-security feature additions. The HIGH severity command injection vulnerability identified in the initial review (commit 0825264) was properly fixed in commit 3aa895e, and the new commits (3aa895e..b00c067) introduce further security hardening.

Security Improvements in New Commits

• agent-setup.ts:242-243, 257-260 — Replaced manual quote escaping (replace(/'/g, "'\\''")) with shellQuote() utility for GitHub tokens and git identity fields. This is a security hardening that uses a battle-tested shell escaping function instead of ad-hoc string manipulation.
• soak.sh:155 — Telegram bot token is now passed via environment variable (_TOKEN=${_TOKEN} bun -e) instead of command-line interpolation. This is secure and prevents shell command substitution.

Security Verification

✅ Command injection fix verified — The original Telegram bot token vulnerability (commit 0825264) was fixed by embedding tokens in JSON objects and uploading as files (commit 3aa895e), eliminating shell execution entirely.

✅ No new vulnerabilities — Reviewed all changed files in commits 3aa895e..b00c067:

• Shell scripts: bash -n syntax checks pass
• TypeScript: No command injection, path traversal, or credential leaks
• New shell escaping uses shellQuote() utility (secure)
• Telegram token handling in soak tests uses env vars (secure)

Non-Security Changes

The new commits also include:

• Version bump: 0.16.20 → 0.17.1
• New --model flag for CLI model selection
• Documentation updates (.claude/rules/agent-default-models.md)
• Codex default model updated: gpt-5.1-codex → gpt-5.3-codex
• Manifest updates: featured_cloud standardization
• QA workflow enhancements (soak test scheduling)

Tests

• bash -n: PASS (all .sh files pass syntax checks)
• bun test: PASS (1420 tests, 0 failures)
• Biome lint: PASS (0 errors on all changed TypeScript files)
• curl|bash compat: OK (no changes to curl|bash patterns)
• macOS compat: OK (shell changes use compatible patterns)

Code Quality

• Proper use of shellQuote() for user-controlled strings ✅
• Telegram token passed via env var (not command line) ✅
• No as type assertions (follows project conventions) ✅
• Version bumped appropriately ✅

---

-- security/pr-reviewer

[louisgv]

Closing this PR due to significant divergence from main and merge conflicts.

Analysis:

• The PR contains 25 commits since the last security review (b00c067)
• Most of these commits were already merged to main via separate PRs (feat: add --config and --steps CLI flags for programmatic setup #2545, Standardize featured_cloud to DigitalOcean + Sprite #2548, feat(qa): telegram soak test on digitalocean + fix bun -e #2547, security: use shellQuote() in agent-setup.ts for consistent null-byte defense #2546, fix: update Codex default model to gpt-5.3-codex #2540, feat: add --model flag and preferences file for LLM model override #2543, fix: add junie to tarball build pipeline #2541, test: Remove duplicate and theatrical tests #2539, security: add DO_CLIENT_SECRET env var override #2538, fix(e2e): fix input test prompt delivery and agent flags #2536, security: consolidate shellQuote and null-byte validation across all clouds #2535, test: Remove duplicate and theatrical tests #2534, security: harden shellQuote and consolidate shell escaping in gcp.ts #2533, test: Remove duplicate and theatrical tests #2531, refactor: Remove dead code and stale references #2530, security: validate base64 in gcp/aws/hetzner cloud_exec and soak.sh #2532, security: validate base64 in digitalocean.sh SSH exec #2528, test: Remove conditional-expect anti-patterns in 3 test files #2525, security: harden localPath validation and runServer() cmd in gcp.ts #2524, test: add cron-triggered Telegram reminder to soak test #2519, etc.)
• The PR is in CONFLICTING state with 28 vs 25 divergent commits
• Only the core Telegram/WhatsApp setup feature remains unmerged

Next steps:
I'll file a follow-up issue to track the Telegram/WhatsApp feature, which should be implemented in a fresh PR based on current main.

---

-- security/pr-reviewer

[AhmedTMM]

Summary

• Adds Telegram and WhatsApp as separate options in the OpenClaw setup screen
• Telegram: prompts for bot token from @Botfather, injects via openclaw config set
• WhatsApp: reminds user to complete QR code scanning via the web dashboard after launch
• Updates USER.md with channel-specific guidance when selected

Setup screen

◆ Setup options
│ ◻ GitHub CLI
│ ◻ Reuse saved OpenRouter key
│ ◻ Chrome browser (~400 MB — enables web tools)
│ ◻ Telegram (connect via bot token from @BotFather)
│ ◻ WhatsApp (scan QR code via web dashboard after launch)

Test plan

• Select Telegram, enter a bot token → verify it's injected into config
• Select Telegram, press Enter (skip) → verify graceful skip message
• Select WhatsApp → verify reminder about web dashboard
• Select neither → verify no messaging prompts appear
• bun test passes (1396/1396)

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: CHANGES REQUESTED
Commit: 0825264

Findings

• HIGH packages/cli/src/shared/agent-setup.ts:381 — Command injection vulnerability in Telegram bot token handling. The jsonEscape() function uses JSON.stringify(), which wraps the token in double quotes but does NOT prevent command substitution. Backticks and $(...) inside the token will be evaluated by the shell.

  Exploit example: A token like `whoami` becomes:

  openclaw config set channels.telegram.botToken "`whoami`"

  The backticks execute despite being inside double quotes.

  Recommendation: Use proper shell escaping with single quotes, or pass the token via stdin/environment variable instead of command line arguments. Example approaches:

  1. Shell escape with single quotes (handles all special chars):

     functionshellEscape(s: string): string{return"'"+s.replace(/'/g,"'\\''")+"'";}constescapedBotToken=shellEscape(trimmedToken);

  2. Pass via stdin (preferred for sensitive data):

     awaitrunner.runServer("export PATH=...; echo "+JSON.stringify(trimmedToken)+" | openclaw config set channels.telegram.botToken --stdin");

• LOW packages/cli/src/shared/agent-setup.ts:411 — Hardcoded localhost URL in documentation may not match actual tunnel URL (minor usability issue, not a security concern)

Tests

• bash -n: N/A (no .sh files modified)
• bun test: PASS (1380 tests, 0 failures)
• curl|bash: N/A (no shell scripts modified)
• macOS compat: N/A (no shell scripts modified)

---

-- security/pr-reviewer

[louisgv]

Security Review

Verdict: APPROVED
Commit: 3aa895e

Summary

The HIGH severity command injection vulnerability identified in commit 0825264 has been properly fixed. The PR now includes comprehensive test coverage and is ready for merge.

Security Fix Verification

The original vulnerability (line 381 in old code) was:

`openclaw config set channels.telegram.botToken ${escapedBotToken}`

This was vulnerable because jsonEscape() only wrapped the token in double quotes, which did NOT prevent command substitution via backticks or $(...).

The fix (lines 379-389 in new code):

• Telegram bot token is now embedded directly into a JavaScript object
• The entire config object is serialized using JSON.stringify()
• The JSON is uploaded as a file, eliminating shell command execution
• This approach is safe regardless of token content

Additional Security Checks

✅ Env var handling: SPAWN_TELEGRAM_BOT_TOKEN follows the same safe path (embedded in object → JSON.stringify)
✅ WhatsApp command: Hardcoded string with no variable interpolation (lines 259-261 in orchestrate.ts)
✅ No other command injection vectors found in changed files

Tests

• bash -n: N/A (no .sh files modified)
• bun test: PASS (1420 tests, 0 failures)
• Biome lint: PASS (0 errors on all changed files)
• curl|bash compat: N/A (no shell scripts modified)
• macOS compat: N/A (no shell scripts modified)

Test Coverage

The PR adds 926 lines of comprehensive test coverage:

• openclaw-config.test.ts (591 lines): Tests gateway auth, atomic config, browser gating, Telegram/WhatsApp setup
• orchestrate-messaging.test.ts (335 lines): Tests WhatsApp QR flow, enabledSteps parsing, preLaunchMsg

Code Quality

• Version bumped: 0.16.19 → 0.16.20 ✅
• Follows ESM-only convention (no as assertions) ✅
• Proper error handling and type safety ✅
• Clear comments explaining the security fix ✅

---

-- security/pr-reviewer

[louisgv]

Security Review

Verdict: APPROVED
Commit: b00c067

Summary

The PR has been updated with additional commits that include security improvements and non-security feature additions. The HIGH severity command injection vulnerability identified in the initial review (commit 0825264) was properly fixed in commit 3aa895e, and the new commits (3aa895e..b00c067) introduce further security hardening.

Security Improvements in New Commits

• agent-setup.ts:242-243, 257-260 — Replaced manual quote escaping (replace(/'/g, "'\\''")) with shellQuote() utility for GitHub tokens and git identity fields. This is a security hardening that uses a battle-tested shell escaping function instead of ad-hoc string manipulation.
• soak.sh:155 — Telegram bot token is now passed via environment variable (_TOKEN=${_TOKEN} bun -e) instead of command-line interpolation. This is secure and prevents shell command substitution.

Security Verification

✅ Command injection fix verified — The original Telegram bot token vulnerability (commit 0825264) was fixed by embedding tokens in JSON objects and uploading as files (commit 3aa895e), eliminating shell execution entirely.

✅ No new vulnerabilities — Reviewed all changed files in commits 3aa895e..b00c067:

• Shell scripts: bash -n syntax checks pass
• TypeScript: No command injection, path traversal, or credential leaks
• New shell escaping uses shellQuote() utility (secure)
• Telegram token handling in soak tests uses env vars (secure)

Non-Security Changes

The new commits also include:

• Version bump: 0.16.20 → 0.17.1
• New --model flag for CLI model selection
• Documentation updates (.claude/rules/agent-default-models.md)
• Codex default model updated: gpt-5.1-codex → gpt-5.3-codex
• Manifest updates: featured_cloud standardization
• QA workflow enhancements (soak test scheduling)

Tests

• bash -n: PASS (all .sh files pass syntax checks)
• bun test: PASS (1420 tests, 0 failures)
• Biome lint: PASS (0 errors on all changed TypeScript files)
• curl|bash compat: OK (no changes to curl|bash patterns)
• macOS compat: OK (shell changes use compatible patterns)

Code Quality

• Proper use of shellQuote() for user-controlled strings ✅
• Telegram token passed via env var (not command line) ✅
• No as type assertions (follows project conventions) ✅
• Version bumped appropriately ✅

---

-- security/pr-reviewer

[louisgv]

Closing this PR due to significant divergence from main and merge conflicts.

Analysis:

• The PR contains 25 commits since the last security review (b00c067)
• Most of these commits were already merged to main via separate PRs (feat: add --config and --steps CLI flags for programmatic setup #2545, Standardize featured_cloud to DigitalOcean + Sprite #2548, feat(qa): telegram soak test on digitalocean + fix bun -e #2547, security: use shellQuote() in agent-setup.ts for consistent null-byte defense #2546, fix: update Codex default model to gpt-5.3-codex #2540, feat: add --model flag and preferences file for LLM model override #2543, fix: add junie to tarball build pipeline #2541, test: Remove duplicate and theatrical tests #2539, security: add DO_CLIENT_SECRET env var override #2538, fix(e2e): fix input test prompt delivery and agent flags #2536, security: consolidate shellQuote and null-byte validation across all clouds #2535, test: Remove duplicate and theatrical tests #2534, security: harden shellQuote and consolidate shell escaping in gcp.ts #2533, test: Remove duplicate and theatrical tests #2531, refactor: Remove dead code and stale references #2530, security: validate base64 in gcp/aws/hetzner cloud_exec and soak.sh #2532, security: validate base64 in digitalocean.sh SSH exec #2528, test: Remove conditional-expect anti-patterns in 3 test files #2525, security: harden localPath validation and runServer() cmd in gcp.ts #2524, test: add cron-triggered Telegram reminder to soak test #2519, etc.)
• The PR is in CONFLICTING state with 28 vs 25 divergent commits
• Only the core Telegram/WhatsApp setup feature remains unmerged

Next steps:
I'll file a follow-up issue to track the Telegram/WhatsApp feature, which should be implemented in a fresh PR based on current main.

---

-- security/pr-reviewer

[AhmedTMM]

Summary

• Adds Telegram and WhatsApp as separate options in the OpenClaw setup screen
• Telegram: prompts for bot token from @Botfather, injects via openclaw config set
• WhatsApp: reminds user to complete QR code scanning via the web dashboard after launch
• Updates USER.md with channel-specific guidance when selected

Setup screen

◆ Setup options
│ ◻ GitHub CLI
│ ◻ Reuse saved OpenRouter key
│ ◻ Chrome browser (~400 MB — enables web tools)
│ ◻ Telegram (connect via bot token from @BotFather)
│ ◻ WhatsApp (scan QR code via web dashboard after launch)

Test plan

• Select Telegram, enter a bot token → verify it's injected into config
• Select Telegram, press Enter (skip) → verify graceful skip message
• Select WhatsApp → verify reminder about web dashboard
• Select neither → verify no messaging prompts appear
• bun test passes (1396/1396)

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: CHANGES REQUESTED
Commit: 0825264

Findings

• HIGH packages/cli/src/shared/agent-setup.ts:381 — Command injection vulnerability in Telegram bot token handling. The jsonEscape() function uses JSON.stringify(), which wraps the token in double quotes but does NOT prevent command substitution. Backticks and $(...) inside the token will be evaluated by the shell.

  Exploit example: A token like `whoami` becomes:

  openclaw config set channels.telegram.botToken "`whoami`"

  The backticks execute despite being inside double quotes.

  Recommendation: Use proper shell escaping with single quotes, or pass the token via stdin/environment variable instead of command line arguments. Example approaches:

  1. Shell escape with single quotes (handles all special chars):

     functionshellEscape(s: string): string{return"'"+s.replace(/'/g,"'\\''")+"'";}constescapedBotToken=shellEscape(trimmedToken);

  2. Pass via stdin (preferred for sensitive data):

     awaitrunner.runServer("export PATH=...; echo "+JSON.stringify(trimmedToken)+" | openclaw config set channels.telegram.botToken --stdin");

• LOW packages/cli/src/shared/agent-setup.ts:411 — Hardcoded localhost URL in documentation may not match actual tunnel URL (minor usability issue, not a security concern)

Tests

• bash -n: N/A (no .sh files modified)
• bun test: PASS (1380 tests, 0 failures)
• curl|bash: N/A (no shell scripts modified)
• macOS compat: N/A (no shell scripts modified)

---

-- security/pr-reviewer

[louisgv]

Security Review

Verdict: APPROVED
Commit: 3aa895e

Summary

The HIGH severity command injection vulnerability identified in commit 0825264 has been properly fixed. The PR now includes comprehensive test coverage and is ready for merge.

Security Fix Verification

The original vulnerability (line 381 in old code) was:

`openclaw config set channels.telegram.botToken ${escapedBotToken}`

This was vulnerable because jsonEscape() only wrapped the token in double quotes, which did NOT prevent command substitution via backticks or $(...).

The fix (lines 379-389 in new code):

• Telegram bot token is now embedded directly into a JavaScript object
• The entire config object is serialized using JSON.stringify()
• The JSON is uploaded as a file, eliminating shell command execution
• This approach is safe regardless of token content

Additional Security Checks

✅ Env var handling: SPAWN_TELEGRAM_BOT_TOKEN follows the same safe path (embedded in object → JSON.stringify)
✅ WhatsApp command: Hardcoded string with no variable interpolation (lines 259-261 in orchestrate.ts)
✅ No other command injection vectors found in changed files

Tests

• bash -n: N/A (no .sh files modified)
• bun test: PASS (1420 tests, 0 failures)
• Biome lint: PASS (0 errors on all changed files)
• curl|bash compat: N/A (no shell scripts modified)
• macOS compat: N/A (no shell scripts modified)

Test Coverage

The PR adds 926 lines of comprehensive test coverage:

• openclaw-config.test.ts (591 lines): Tests gateway auth, atomic config, browser gating, Telegram/WhatsApp setup
• orchestrate-messaging.test.ts (335 lines): Tests WhatsApp QR flow, enabledSteps parsing, preLaunchMsg

Code Quality

• Version bumped: 0.16.19 → 0.16.20 ✅
• Follows ESM-only convention (no as assertions) ✅
• Proper error handling and type safety ✅
• Clear comments explaining the security fix ✅

---

-- security/pr-reviewer

[louisgv]

Security Review

Verdict: APPROVED
Commit: b00c067

Summary

The PR has been updated with additional commits that include security improvements and non-security feature additions. The HIGH severity command injection vulnerability identified in the initial review (commit 0825264) was properly fixed in commit 3aa895e, and the new commits (3aa895e..b00c067) introduce further security hardening.

Security Improvements in New Commits

• agent-setup.ts:242-243, 257-260 — Replaced manual quote escaping (replace(/'/g, "'\\''")) with shellQuote() utility for GitHub tokens and git identity fields. This is a security hardening that uses a battle-tested shell escaping function instead of ad-hoc string manipulation.
• soak.sh:155 — Telegram bot token is now passed via environment variable (_TOKEN=${_TOKEN} bun -e) instead of command-line interpolation. This is secure and prevents shell command substitution.

Security Verification

✅ Command injection fix verified — The original Telegram bot token vulnerability (commit 0825264) was fixed by embedding tokens in JSON objects and uploading as files (commit 3aa895e), eliminating shell execution entirely.

✅ No new vulnerabilities — Reviewed all changed files in commits 3aa895e..b00c067:

• Shell scripts: bash -n syntax checks pass
• TypeScript: No command injection, path traversal, or credential leaks
• New shell escaping uses shellQuote() utility (secure)
• Telegram token handling in soak tests uses env vars (secure)

Non-Security Changes

The new commits also include:

• Version bump: 0.16.20 → 0.17.1
• New --model flag for CLI model selection
• Documentation updates (.claude/rules/agent-default-models.md)
• Codex default model updated: gpt-5.1-codex → gpt-5.3-codex
• Manifest updates: featured_cloud standardization
• QA workflow enhancements (soak test scheduling)

Tests

• bash -n: PASS (all .sh files pass syntax checks)
• bun test: PASS (1420 tests, 0 failures)
• Biome lint: PASS (0 errors on all changed TypeScript files)
• curl|bash compat: OK (no changes to curl|bash patterns)
• macOS compat: OK (shell changes use compatible patterns)

Code Quality

• Proper use of shellQuote() for user-controlled strings ✅
• Telegram token passed via env var (not command line) ✅
• No as type assertions (follows project conventions) ✅
• Version bumped appropriately ✅

---

-- security/pr-reviewer

[louisgv]

Closing this PR due to significant divergence from main and merge conflicts.

Analysis:

• The PR contains 25 commits since the last security review (b00c067)
• Most of these commits were already merged to main via separate PRs (feat: add --config and --steps CLI flags for programmatic setup #2545, Standardize featured_cloud to DigitalOcean + Sprite #2548, feat(qa): telegram soak test on digitalocean + fix bun -e #2547, security: use shellQuote() in agent-setup.ts for consistent null-byte defense #2546, fix: update Codex default model to gpt-5.3-codex #2540, feat: add --model flag and preferences file for LLM model override #2543, fix: add junie to tarball build pipeline #2541, test: Remove duplicate and theatrical tests #2539, security: add DO_CLIENT_SECRET env var override #2538, fix(e2e): fix input test prompt delivery and agent flags #2536, security: consolidate shellQuote and null-byte validation across all clouds #2535, test: Remove duplicate and theatrical tests #2534, security: harden shellQuote and consolidate shell escaping in gcp.ts #2533, test: Remove duplicate and theatrical tests #2531, refactor: Remove dead code and stale references #2530, security: validate base64 in gcp/aws/hetzner cloud_exec and soak.sh #2532, security: validate base64 in digitalocean.sh SSH exec #2528, test: Remove conditional-expect anti-patterns in 3 test files #2525, security: harden localPath validation and runServer() cmd in gcp.ts #2524, test: add cron-triggered Telegram reminder to soak test #2519, etc.)
• The PR is in CONFLICTING state with 28 vs 25 divergent commits
• Only the core Telegram/WhatsApp setup feature remains unmerged

Next steps:
I'll file a follow-up issue to track the Telegram/WhatsApp feature, which should be implemented in a fresh PR based on current main.

---

-- security/pr-reviewer