fix: write openclaw config atomically to preserve dashboard auth - #2542

Closed
AhmedTMM wants to merge 7 commits into
OpenRouterLabs:mainfrom
AhmedTMM:fix/dashboard-auth-token
Closed

fix: write openclaw config atomically to preserve dashboard auth#2542
AhmedTMM wants to merge 7 commits into
OpenRouterLabs:mainfrom
AhmedTMM:fix/dashboard-auth-token

Conversation

@AhmedTMM

@AhmedTMMAhmedTMM commented Mar 12, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • Fixes the "Unauthorized" dashboard page introduced by feat: add Telegram and WhatsApp to OpenClaw setup picker #2523
  • The openclaw config set calls for browser and Telegram settings were re-serializing openclaw.json and dropping the gateway.auth.token field
  • Now all config (gateway auth, browser, channels) is built as a single JSON object and written once via uploadConfigFile

Test plan

  • Run spawn openclaw <cloud> — dashboard should open without "Unauthorized"
  • Select Telegram, enter a bot token — verify it appears in ~/.openclaw/openclaw.json
  • Select browser option — verify browser config appears in the same JSON file
  • bun test passes (1380/1380)

🤖 Generated with Claude Code

AhmedTMMand others added 7 commits March 12, 2026 00:49
@AhmedTMM@claude
feat: add Telegram and WhatsApp options to OpenClaw setup picker
49ff7a2
Adds separate "Telegram" and "WhatsApp" checkboxes to the OpenClaw
setup screen:
- Telegram: prompts for bot token from @Botfather, injects into
OpenClaw config via `openclaw config set`
- WhatsApp: reminds user to scan QR code via the web dashboard
after launch (no CLI setup possible)
Updates USER.md with channel-specific guidance when either is selected.
Bump CLI version to 0.16.16.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@AhmedTMM
Merge branch 'main' into feat/messaging-setup
ff9f558
@AhmedTMM@claude
feat: run WhatsApp QR scan interactively before TUI launch
024dab4
Instead of punting WhatsApp setup to "after launch", runs
`openclaw channels login --channel whatsapp` as an interactive SSH
session between gateway start and TUI launch. The user scans the
QR code with their phone during provisioning setup.
Flow: gateway starts → tunnel set up → WhatsApp QR scan → TUI launch
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@AhmedTMM@claude
fix: update WhatsApp hint to reflect pre-TUI QR scanning
49c9930
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@AhmedTMM
Merge branch 'main' into feat/messaging-setup
0825264
Signed-off-by: Ahmed Abushagur <ahmed@abushagur.com>
@AhmedTMM@claude
fix: write openclaw config atomically to preserve gateway auth token
e1f80f4
The `openclaw config set` calls for browser and Telegram settings were
re-serializing openclaw.json and dropping the gateway.auth.token field,
causing the dashboard to show "Unauthorized" when auto-opened via tunnel.
Now all config (gateway auth, browser, channels) is built as a single
JSON object and written once via uploadConfigFile.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@AhmedTMM@claude
test: add OpenClaw config, messaging, and tunnel test coverage
3aa895e
Adds 40 new tests across 2 files:
openclaw-config.test.ts (30 tests):
- Gateway auth token written correctly and matches browserUrl
- Atomic config write (no `openclaw config set` commands)
- Browser config gated by enabledSteps
- Telegram bot token included/omitted based on input
- USER.md messaging channel content
- Tunnel config targeting port 18791
orchestrate-messaging.test.ts (10 tests):
- SPAWN_ENABLED_STEPS parsing and threading
- WhatsApp QR scan session triggered before agent launch
- GitHub auth gated by enabledSteps
- preLaunchMsg output behavior
Also adds SPAWN_TELEGRAM_BOT_TOKEN env var override for
non-interactive/CI Telegram setup (avoids prompt in tests).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
louisgv
louisgv approved these changes Mar 12, 2026
View reviewed changes

@louisgvlouisgv left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security Review

Verdict: APPROVED
Commit: 3aa895e

Findings

No security issues found. This PR improves security by fixing the race condition where the gateway auth token was being dropped during config updates.

Positive changes:

  • [SECURITY FIX] Atomic config write prevents token loss (agent-setup.ts:388-389)
  • [GOOD] Credential handling uses JSON.stringify (no injection risk) (agent-setup.ts:388)
  • [GOOD] User input (Telegram token) properly sanitized via trim() (agent-setup.ts:341)
  • [GOOD] WhatsApp command is static string (no interpolation) (orchestrate.ts:259-261)
  • [GOOD] 40 new test cases verify token preservation and atomic writes

Tests

  • bash -n: N/A (no shell scripts changed)
  • bun test: PASS (40/40 tests passing)
  • Lint: PASS (0 errors from biome)
  • macOS compat: N/A (no shell changes)

Summary

This PR addresses issue #2489 by writing all OpenClaw config atomically in a single JSON upload, preventing the gateway auth token from being clobbered by subsequent openclaw config set calls. The implementation is secure with no injection risks, and comprehensive test coverage validates the fix.

-- security/pr-reviewer

@louisgvlouisgv added the security-approved Security review approved label Mar 12, 2026
@AhmedTMM

AhmedTMM commented Mar 12, 2026

Copy link
Copy Markdown
CollaboratorAuthor

Fix merged directly into #2523 instead.

@AhmedTMM
AhmedTMM deleted the fix/dashboard-auth-token branch April 7, 2026 00:41
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@louisgvlouisgvlouisgv approved these changes

Assignees

No one assigned

Labels

security-approvedSecurity review approved

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@AhmedTMM@louisgv
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
fix: write openclaw config atomically to preserve dashboard auth - #2542
Closed
AhmedTMM wants to merge 7 commits into
OpenRouterLabs:mainfrom 
AhmedTMM:fix/dashboard-auth-token
Closed
fix: write openclaw config atomically to preserve dashboard auth#2542
AhmedTMM wants to merge 7 commits into
OpenRouterLabs:mainfrom 
AhmedTMM:fix/dashboard-auth-token
Conversation
@AhmedTMM
@AhmedTMMAhmedTMM
commented
Mar 12, 2026

Copy link


Copy Markdown

Collaborator
Summary
  • Fixes the "Unauthorized" dashboard page introduced by feat: add Telegram and WhatsApp to OpenClaw setup picker #2523
  • The openclaw config set calls for browser and Telegram settings were re-serializing openclaw.json and dropping the gateway.auth.token field
  • Now all config (gateway auth, browser, channels) is built as a single JSON object and written once via uploadConfigFile
Test plan
  •  Run spawn openclaw <cloud> — dashboard should open without "Unauthorized"
  •  Select Telegram, enter a bot token — verify it appears in ~/.openclaw/openclaw.json
  •  Select browser option — verify browser config appears in the same JSON file
  • bun test passes (1380/1380)
🤖 Generated with Claude Code
AhmedTMMand others
added 7 commits
March 12, 2026 00:49
@AhmedTMM@claude
feat: add Telegram and WhatsApp options to OpenClaw setup picker
49ff7a2
Adds separate "Telegram" and "WhatsApp" checkboxes to the OpenClaw
setup screen:
- Telegram: prompts for bot token from @Botfather, injects into
OpenClaw config via `openclaw config set`
- WhatsApp: reminds user to scan QR code via the web dashboard
after launch (no CLI setup possible)
Updates USER.md with channel-specific guidance when either is selected.
Bump CLI version to 0.16.16.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@AhmedTMM
Merge branch 'main' into feat/messaging-setup
ff9f558
@AhmedTMM@claude
feat: run WhatsApp QR scan interactively before TUI launch
024dab4
Instead of punting WhatsApp setup to "after launch", runs
`openclaw channels login --channel whatsapp` as an interactive SSH
session between gateway start and TUI launch. The user scans the
QR code with their phone during provisioning setup.
Flow: gateway starts → tunnel set up → WhatsApp QR scan → TUI launch
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@AhmedTMM@claude
fix: update WhatsApp hint to reflect pre-TUI QR scanning
49c9930
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@AhmedTMM
Merge branch 'main' into feat/messaging-setup
0825264
Signed-off-by: Ahmed Abushagur <ahmed@abushagur.com>
@AhmedTMM@claude
fix: write openclaw config atomically to preserve gateway auth token
e1f80f4
The `openclaw config set` calls for browser and Telegram settings were
re-serializing openclaw.json and dropping the gateway.auth.token field,
causing the dashboard to show "Unauthorized" when auto-opened via tunnel.
Now all config (gateway auth, browser, channels) is built as a single
JSON object and written once via uploadConfigFile.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@AhmedTMM@claude
test: add OpenClaw config, messaging, and tunnel test coverage
3aa895e
Adds 40 new tests across 2 files:
openclaw-config.test.ts (30 tests):
- Gateway auth token written correctly and matches browserUrl
- Atomic config write (no `openclaw config set` commands)
- Browser config gated by enabledSteps
- Telegram bot token included/omitted based on input
- USER.md messaging channel content
- Tunnel config targeting port 18791
orchestrate-messaging.test.ts (10 tests):
- SPAWN_ENABLED_STEPS parsing and threading
- WhatsApp QR scan session triggered before agent launch
- GitHub auth gated by enabledSteps
- preLaunchMsg output behavior
Also adds SPAWN_TELEGRAM_BOT_TOKEN env var override for
non-interactive/CI Telegram setup (avoids prompt in tests).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
louisgv
louisgv
approved these changes
Mar 12, 2026
View reviewed changes
@louisgvlouisgv
left a comment


Copy link


Copy Markdown

Collaborator
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security Review
Verdict: APPROVED
Commit: 3aa895e
Findings
No security issues found. This PR improves security by fixing the race condition where the gateway auth token was being dropped during config updates.
Positive changes:
  • [SECURITY FIX] Atomic config write prevents token loss (agent-setup.ts:388-389)
  • [GOOD] Credential handling uses JSON.stringify (no injection risk) (agent-setup.ts:388)
  • [GOOD] User input (Telegram token) properly sanitized via trim() (agent-setup.ts:341)
  • [GOOD] WhatsApp command is static string (no interpolation) (orchestrate.ts:259-261)
  • [GOOD] 40 new test cases verify token preservation and atomic writes
Tests
  • bash -n: N/A (no shell scripts changed)
  • bun test: PASS (40/40 tests passing)
  • Lint: PASS (0 errors from biome)
  • macOS compat: N/A (no shell changes)
Summary
This PR addresses issue #2489 by writing all OpenClaw config atomically in a single JSON upload, preventing the gateway auth token from being clobbered by subsequent openclaw config set calls. The implementation is secure with no injection risks, and comprehensive test coverage validates the fix.
-- security/pr-reviewer
@louisgvlouisgv
added
the 
security-approved
Security review approved
label
Mar 12, 2026
@AhmedTMM
AhmedTMM
commented
Mar 12, 2026

Copy link


Copy Markdown

CollaboratorAuthor
Fix merged directly into #2523 instead.
@AhmedTMM
AhmedTMM
deleted the

fix/dashboard-auth-token

branch
April 7, 2026 00:41
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@louisgvlouisgvlouisgv approved these changes

Assignees


No one assigned


Labels

security-approvedSecurity review approved

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@AhmedTMM@louisgv

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix: write openclaw config atomically to preserve dashboard auth - #2542
Closed
AhmedTMM wants to merge 7 commits into
OpenRouterLabs:mainfrom 
AhmedTMM:fix/dashboard-auth-token
Closed
fix: write openclaw config atomically to preserve dashboard auth#2542
AhmedTMM wants to merge 7 commits into
OpenRouterLabs:mainfrom 
AhmedTMM:fix/dashboard-auth-token
Conversation
@AhmedTMM
@AhmedTMMAhmedTMM
commented
Mar 12, 2026

Copy link


Copy Markdown

Collaborator
Summary
  • Fixes the "Unauthorized" dashboard page introduced by feat: add Telegram and WhatsApp to OpenClaw setup picker #2523
  • The openclaw config set calls for browser and Telegram settings were re-serializing openclaw.json and dropping the gateway.auth.token field
  • Now all config (gateway auth, browser, channels) is built as a single JSON object and written once via uploadConfigFile
Test plan
  •  Run spawn openclaw <cloud> — dashboard should open without "Unauthorized"
  •  Select Telegram, enter a bot token — verify it appears in ~/.openclaw/openclaw.json
  •  Select browser option — verify browser config appears in the same JSON file
  • bun test passes (1380/1380)
🤖 Generated with Claude Code
AhmedTMMand others
added 7 commits
March 12, 2026 00:49
@AhmedTMM@claude
feat: add Telegram and WhatsApp options to OpenClaw setup picker
49ff7a2
Adds separate "Telegram" and "WhatsApp" checkboxes to the OpenClaw
setup screen:
- Telegram: prompts for bot token from @Botfather, injects into
OpenClaw config via `openclaw config set`
- WhatsApp: reminds user to scan QR code via the web dashboard
after launch (no CLI setup possible)
Updates USER.md with channel-specific guidance when either is selected.
Bump CLI version to 0.16.16.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@AhmedTMM
Merge branch 'main' into feat/messaging-setup
ff9f558
@AhmedTMM@claude
feat: run WhatsApp QR scan interactively before TUI launch
024dab4
Instead of punting WhatsApp setup to "after launch", runs
`openclaw channels login --channel whatsapp` as an interactive SSH
session between gateway start and TUI launch. The user scans the
QR code with their phone during provisioning setup.
Flow: gateway starts → tunnel set up → WhatsApp QR scan → TUI launch
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@AhmedTMM@claude
fix: update WhatsApp hint to reflect pre-TUI QR scanning
49c9930
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@AhmedTMM
Merge branch 'main' into feat/messaging-setup
0825264
Signed-off-by: Ahmed Abushagur <ahmed@abushagur.com>
@AhmedTMM@claude
fix: write openclaw config atomically to preserve gateway auth token
e1f80f4
The `openclaw config set` calls for browser and Telegram settings were
re-serializing openclaw.json and dropping the gateway.auth.token field,
causing the dashboard to show "Unauthorized" when auto-opened via tunnel.
Now all config (gateway auth, browser, channels) is built as a single
JSON object and written once via uploadConfigFile.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@AhmedTMM@claude
test: add OpenClaw config, messaging, and tunnel test coverage
3aa895e
Adds 40 new tests across 2 files:
openclaw-config.test.ts (30 tests):
- Gateway auth token written correctly and matches browserUrl
- Atomic config write (no `openclaw config set` commands)
- Browser config gated by enabledSteps
- Telegram bot token included/omitted based on input
- USER.md messaging channel content
- Tunnel config targeting port 18791
orchestrate-messaging.test.ts (10 tests):
- SPAWN_ENABLED_STEPS parsing and threading
- WhatsApp QR scan session triggered before agent launch
- GitHub auth gated by enabledSteps
- preLaunchMsg output behavior
Also adds SPAWN_TELEGRAM_BOT_TOKEN env var override for
non-interactive/CI Telegram setup (avoids prompt in tests).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
louisgv
louisgv
approved these changes
Mar 12, 2026
View reviewed changes
@louisgvlouisgv
left a comment


Copy link


Copy Markdown

Collaborator
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security Review
Verdict: APPROVED
Commit: 3aa895e
Findings
No security issues found. This PR improves security by fixing the race condition where the gateway auth token was being dropped during config updates.
Positive changes:
  • [SECURITY FIX] Atomic config write prevents token loss (agent-setup.ts:388-389)
  • [GOOD] Credential handling uses JSON.stringify (no injection risk) (agent-setup.ts:388)
  • [GOOD] User input (Telegram token) properly sanitized via trim() (agent-setup.ts:341)
  • [GOOD] WhatsApp command is static string (no interpolation) (orchestrate.ts:259-261)
  • [GOOD] 40 new test cases verify token preservation and atomic writes
Tests
  • bash -n: N/A (no shell scripts changed)
  • bun test: PASS (40/40 tests passing)
  • Lint: PASS (0 errors from biome)
  • macOS compat: N/A (no shell changes)
Summary
This PR addresses issue #2489 by writing all OpenClaw config atomically in a single JSON upload, preventing the gateway auth token from being clobbered by subsequent openclaw config set calls. The implementation is secure with no injection risks, and comprehensive test coverage validates the fix.
-- security/pr-reviewer
@louisgvlouisgv
added
the 
security-approved
Security review approved
label
Mar 12, 2026
@AhmedTMM
AhmedTMM
commented
Mar 12, 2026

Copy link


Copy Markdown

CollaboratorAuthor
Fix merged directly into #2523 instead.
@AhmedTMM
AhmedTMM
deleted the

fix/dashboard-auth-token

branch
April 7, 2026 00:41
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@louisgvlouisgvlouisgv approved these changes

Assignees


No one assigned


Labels

security-approvedSecurity review approved

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@AhmedTMM@louisgv

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix: write openclaw config atomically to preserve dashboard auth - #2542
Closed
AhmedTMM wants to merge 7 commits into
OpenRouterLabs:mainfrom 
AhmedTMM:fix/dashboard-auth-token
Closed
fix: write openclaw config atomically to preserve dashboard auth#2542
AhmedTMM wants to merge 7 commits into
OpenRouterLabs:mainfrom 
AhmedTMM:fix/dashboard-auth-token
Conversation
@AhmedTMM
@AhmedTMMAhmedTMM
commented
Mar 12, 2026

Copy link


Copy Markdown

Collaborator
Summary
  • Fixes the "Unauthorized" dashboard page introduced by feat: add Telegram and WhatsApp to OpenClaw setup picker #2523
  • The openclaw config set calls for browser and Telegram settings were re-serializing openclaw.json and dropping the gateway.auth.token field
  • Now all config (gateway auth, browser, channels) is built as a single JSON object and written once via uploadConfigFile
Test plan
  •  Run spawn openclaw <cloud> — dashboard should open without "Unauthorized"
  •  Select Telegram, enter a bot token — verify it appears in ~/.openclaw/openclaw.json
  •  Select browser option — verify browser config appears in the same JSON file
  • bun test passes (1380/1380)
🤖 Generated with Claude Code
AhmedTMMand others
added 7 commits
March 12, 2026 00:49
@AhmedTMM@claude
feat: add Telegram and WhatsApp options to OpenClaw setup picker
49ff7a2
Adds separate "Telegram" and "WhatsApp" checkboxes to the OpenClaw
setup screen:
- Telegram: prompts for bot token from @Botfather, injects into
OpenClaw config via `openclaw config set`
- WhatsApp: reminds user to scan QR code via the web dashboard
after launch (no CLI setup possible)
Updates USER.md with channel-specific guidance when either is selected.
Bump CLI version to 0.16.16.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@AhmedTMM
Merge branch 'main' into feat/messaging-setup
ff9f558
@AhmedTMM@claude
feat: run WhatsApp QR scan interactively before TUI launch
024dab4
Instead of punting WhatsApp setup to "after launch", runs
`openclaw channels login --channel whatsapp` as an interactive SSH
session between gateway start and TUI launch. The user scans the
QR code with their phone during provisioning setup.
Flow: gateway starts → tunnel set up → WhatsApp QR scan → TUI launch
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@AhmedTMM@claude
fix: update WhatsApp hint to reflect pre-TUI QR scanning
49c9930
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@AhmedTMM
Merge branch 'main' into feat/messaging-setup
0825264
Signed-off-by: Ahmed Abushagur <ahmed@abushagur.com>
@AhmedTMM@claude
fix: write openclaw config atomically to preserve gateway auth token
e1f80f4
The `openclaw config set` calls for browser and Telegram settings were
re-serializing openclaw.json and dropping the gateway.auth.token field,
causing the dashboard to show "Unauthorized" when auto-opened via tunnel.
Now all config (gateway auth, browser, channels) is built as a single
JSON object and written once via uploadConfigFile.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@AhmedTMM@claude
test: add OpenClaw config, messaging, and tunnel test coverage
3aa895e
Adds 40 new tests across 2 files:
openclaw-config.test.ts (30 tests):
- Gateway auth token written correctly and matches browserUrl
- Atomic config write (no `openclaw config set` commands)
- Browser config gated by enabledSteps
- Telegram bot token included/omitted based on input
- USER.md messaging channel content
- Tunnel config targeting port 18791
orchestrate-messaging.test.ts (10 tests):
- SPAWN_ENABLED_STEPS parsing and threading
- WhatsApp QR scan session triggered before agent launch
- GitHub auth gated by enabledSteps
- preLaunchMsg output behavior
Also adds SPAWN_TELEGRAM_BOT_TOKEN env var override for
non-interactive/CI Telegram setup (avoids prompt in tests).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
louisgv
louisgv
approved these changes
Mar 12, 2026
View reviewed changes
@louisgvlouisgv
left a comment


Copy link


Copy Markdown

Collaborator
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security Review
Verdict: APPROVED
Commit: 3aa895e
Findings
No security issues found. This PR improves security by fixing the race condition where the gateway auth token was being dropped during config updates.
Positive changes:
  • [SECURITY FIX] Atomic config write prevents token loss (agent-setup.ts:388-389)
  • [GOOD] Credential handling uses JSON.stringify (no injection risk) (agent-setup.ts:388)
  • [GOOD] User input (Telegram token) properly sanitized via trim() (agent-setup.ts:341)
  • [GOOD] WhatsApp command is static string (no interpolation) (orchestrate.ts:259-261)
  • [GOOD] 40 new test cases verify token preservation and atomic writes
Tests
  • bash -n: N/A (no shell scripts changed)
  • bun test: PASS (40/40 tests passing)
  • Lint: PASS (0 errors from biome)
  • macOS compat: N/A (no shell changes)
Summary
This PR addresses issue #2489 by writing all OpenClaw config atomically in a single JSON upload, preventing the gateway auth token from being clobbered by subsequent openclaw config set calls. The implementation is secure with no injection risks, and comprehensive test coverage validates the fix.
-- security/pr-reviewer
@louisgvlouisgv
added
the 
security-approved
Security review approved
label
Mar 12, 2026
@AhmedTMM
AhmedTMM
commented
Mar 12, 2026

Copy link


Copy Markdown

CollaboratorAuthor
Fix merged directly into #2523 instead.
@AhmedTMM
AhmedTMM
deleted the

fix/dashboard-auth-token

branch
April 7, 2026 00:41
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@louisgvlouisgvlouisgv approved these changes

Assignees


No one assigned


Labels

security-approvedSecurity review approved

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@AhmedTMM@louisgv

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
fix: write openclaw config atomically to preserve dashboard auth - #2542
Closed
AhmedTMM wants to merge 7 commits into
OpenRouterLabs:mainfrom 
AhmedTMM:fix/dashboard-auth-token
Closed
fix: write openclaw config atomically to preserve dashboard auth#2542
AhmedTMM wants to merge 7 commits into
OpenRouterLabs:mainfrom 
AhmedTMM:fix/dashboard-auth-token
Conversation
@AhmedTMM
@AhmedTMMAhmedTMM
commented
Mar 12, 2026

Copy link


Copy Markdown

Collaborator
Summary
  • Fixes the "Unauthorized" dashboard page introduced by feat: add Telegram and WhatsApp to OpenClaw setup picker #2523
  • The openclaw config set calls for browser and Telegram settings were re-serializing openclaw.json and dropping the gateway.auth.token field
  • Now all config (gateway auth, browser, channels) is built as a single JSON object and written once via uploadConfigFile
Test plan
  •  Run spawn openclaw <cloud> — dashboard should open without "Unauthorized"
  •  Select Telegram, enter a bot token — verify it appears in ~/.openclaw/openclaw.json
  •  Select browser option — verify browser config appears in the same JSON file
  • bun test passes (1380/1380)
🤖 Generated with Claude Code
AhmedTMMand others
added 7 commits
March 12, 2026 00:49
@AhmedTMM@claude
feat: add Telegram and WhatsApp options to OpenClaw setup picker
49ff7a2
Adds separate "Telegram" and "WhatsApp" checkboxes to the OpenClaw
setup screen:
- Telegram: prompts for bot token from @Botfather, injects into
OpenClaw config via `openclaw config set`
- WhatsApp: reminds user to scan QR code via the web dashboard
after launch (no CLI setup possible)
Updates USER.md with channel-specific guidance when either is selected.
Bump CLI version to 0.16.16.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@AhmedTMM
Merge branch 'main' into feat/messaging-setup
ff9f558
@AhmedTMM@claude
feat: run WhatsApp QR scan interactively before TUI launch
024dab4
Instead of punting WhatsApp setup to "after launch", runs
`openclaw channels login --channel whatsapp` as an interactive SSH
session between gateway start and TUI launch. The user scans the
QR code with their phone during provisioning setup.
Flow: gateway starts → tunnel set up → WhatsApp QR scan → TUI launch
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@AhmedTMM@claude
fix: update WhatsApp hint to reflect pre-TUI QR scanning
49c9930
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@AhmedTMM
Merge branch 'main' into feat/messaging-setup
0825264
Signed-off-by: Ahmed Abushagur <ahmed@abushagur.com>
@AhmedTMM@claude
fix: write openclaw config atomically to preserve gateway auth token
e1f80f4
The `openclaw config set` calls for browser and Telegram settings were
re-serializing openclaw.json and dropping the gateway.auth.token field,
causing the dashboard to show "Unauthorized" when auto-opened via tunnel.
Now all config (gateway auth, browser, channels) is built as a single
JSON object and written once via uploadConfigFile.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@AhmedTMM@claude
test: add OpenClaw config, messaging, and tunnel test coverage
3aa895e
Adds 40 new tests across 2 files:
openclaw-config.test.ts (30 tests):
- Gateway auth token written correctly and matches browserUrl
- Atomic config write (no `openclaw config set` commands)
- Browser config gated by enabledSteps
- Telegram bot token included/omitted based on input
- USER.md messaging channel content
- Tunnel config targeting port 18791
orchestrate-messaging.test.ts (10 tests):
- SPAWN_ENABLED_STEPS parsing and threading
- WhatsApp QR scan session triggered before agent launch
- GitHub auth gated by enabledSteps
- preLaunchMsg output behavior
Also adds SPAWN_TELEGRAM_BOT_TOKEN env var override for
non-interactive/CI Telegram setup (avoids prompt in tests).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
louisgv
louisgv
approved these changes
Mar 12, 2026
View reviewed changes
@louisgvlouisgv
left a comment


Copy link


Copy Markdown

Collaborator
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security Review
Verdict: APPROVED
Commit: 3aa895e
Findings
No security issues found. This PR improves security by fixing the race condition where the gateway auth token was being dropped during config updates.
Positive changes:
  • [SECURITY FIX] Atomic config write prevents token loss (agent-setup.ts:388-389)
  • [GOOD] Credential handling uses JSON.stringify (no injection risk) (agent-setup.ts:388)
  • [GOOD] User input (Telegram token) properly sanitized via trim() (agent-setup.ts:341)
  • [GOOD] WhatsApp command is static string (no interpolation) (orchestrate.ts:259-261)
  • [GOOD] 40 new test cases verify token preservation and atomic writes
Tests
  • bash -n: N/A (no shell scripts changed)
  • bun test: PASS (40/40 tests passing)
  • Lint: PASS (0 errors from biome)
  • macOS compat: N/A (no shell changes)
Summary
This PR addresses issue #2489 by writing all OpenClaw config atomically in a single JSON upload, preventing the gateway auth token from being clobbered by subsequent openclaw config set calls. The implementation is secure with no injection risks, and comprehensive test coverage validates the fix.
-- security/pr-reviewer
@louisgvlouisgv
added
the 
security-approved
Security review approved
label
Mar 12, 2026
@AhmedTMM
AhmedTMM
commented
Mar 12, 2026

Copy link


Copy Markdown

CollaboratorAuthor
Fix merged directly into #2523 instead.
@AhmedTMM
AhmedTMM
deleted the

fix/dashboard-auth-token

branch
April 7, 2026 00:41
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@louisgvlouisgvlouisgv approved these changes

Assignees


No one assigned


Labels

security-approvedSecurity review approved

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@AhmedTMM@louisgv

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix: write openclaw config atomically to preserve dashboard auth - #2542
Closed
AhmedTMM wants to merge 7 commits into
OpenRouterLabs:mainfrom 
AhmedTMM:fix/dashboard-auth-token
Closed
fix: write openclaw config atomically to preserve dashboard auth#2542
AhmedTMM wants to merge 7 commits into
OpenRouterLabs:mainfrom 
AhmedTMM:fix/dashboard-auth-token
Conversation
@AhmedTMM
@AhmedTMMAhmedTMM
commented
Mar 12, 2026

Copy link


Copy Markdown

Collaborator
Summary
  • Fixes the "Unauthorized" dashboard page introduced by feat: add Telegram and WhatsApp to OpenClaw setup picker #2523
  • The openclaw config set calls for browser and Telegram settings were re-serializing openclaw.json and dropping the gateway.auth.token field
  • Now all config (gateway auth, browser, channels) is built as a single JSON object and written once via uploadConfigFile
Test plan
  •  Run spawn openclaw <cloud> — dashboard should open without "Unauthorized"
  •  Select Telegram, enter a bot token — verify it appears in ~/.openclaw/openclaw.json
  •  Select browser option — verify browser config appears in the same JSON file
  • bun test passes (1380/1380)
🤖 Generated with Claude Code
AhmedTMMand others
added 7 commits
March 12, 2026 00:49
@AhmedTMM@claude
feat: add Telegram and WhatsApp options to OpenClaw setup picker
49ff7a2
Adds separate "Telegram" and "WhatsApp" checkboxes to the OpenClaw
setup screen:
- Telegram: prompts for bot token from @Botfather, injects into
OpenClaw config via `openclaw config set`
- WhatsApp: reminds user to scan QR code via the web dashboard
after launch (no CLI setup possible)
Updates USER.md with channel-specific guidance when either is selected.
Bump CLI version to 0.16.16.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@AhmedTMM
Merge branch 'main' into feat/messaging-setup
ff9f558
@AhmedTMM@claude
feat: run WhatsApp QR scan interactively before TUI launch
024dab4
Instead of punting WhatsApp setup to "after launch", runs
`openclaw channels login --channel whatsapp` as an interactive SSH
session between gateway start and TUI launch. The user scans the
QR code with their phone during provisioning setup.
Flow: gateway starts → tunnel set up → WhatsApp QR scan → TUI launch
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@AhmedTMM@claude
fix: update WhatsApp hint to reflect pre-TUI QR scanning
49c9930
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@AhmedTMM
Merge branch 'main' into feat/messaging-setup
0825264
Signed-off-by: Ahmed Abushagur <ahmed@abushagur.com>
@AhmedTMM@claude
fix: write openclaw config atomically to preserve gateway auth token
e1f80f4
The `openclaw config set` calls for browser and Telegram settings were
re-serializing openclaw.json and dropping the gateway.auth.token field,
causing the dashboard to show "Unauthorized" when auto-opened via tunnel.
Now all config (gateway auth, browser, channels) is built as a single
JSON object and written once via uploadConfigFile.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@AhmedTMM@claude
test: add OpenClaw config, messaging, and tunnel test coverage
3aa895e
Adds 40 new tests across 2 files:
openclaw-config.test.ts (30 tests):
- Gateway auth token written correctly and matches browserUrl
- Atomic config write (no `openclaw config set` commands)
- Browser config gated by enabledSteps
- Telegram bot token included/omitted based on input
- USER.md messaging channel content
- Tunnel config targeting port 18791
orchestrate-messaging.test.ts (10 tests):
- SPAWN_ENABLED_STEPS parsing and threading
- WhatsApp QR scan session triggered before agent launch
- GitHub auth gated by enabledSteps
- preLaunchMsg output behavior
Also adds SPAWN_TELEGRAM_BOT_TOKEN env var override for
non-interactive/CI Telegram setup (avoids prompt in tests).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
louisgv
louisgv
approved these changes
Mar 12, 2026
View reviewed changes
@louisgvlouisgv
left a comment


Copy link


Copy Markdown

Collaborator
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security Review
Verdict: APPROVED
Commit: 3aa895e
Findings
No security issues found. This PR improves security by fixing the race condition where the gateway auth token was being dropped during config updates.
Positive changes:
  • [SECURITY FIX] Atomic config write prevents token loss (agent-setup.ts:388-389)
  • [GOOD] Credential handling uses JSON.stringify (no injection risk) (agent-setup.ts:388)
  • [GOOD] User input (Telegram token) properly sanitized via trim() (agent-setup.ts:341)
  • [GOOD] WhatsApp command is static string (no interpolation) (orchestrate.ts:259-261)
  • [GOOD] 40 new test cases verify token preservation and atomic writes
Tests
  • bash -n: N/A (no shell scripts changed)
  • bun test: PASS (40/40 tests passing)
  • Lint: PASS (0 errors from biome)
  • macOS compat: N/A (no shell changes)
Summary
This PR addresses issue #2489 by writing all OpenClaw config atomically in a single JSON upload, preventing the gateway auth token from being clobbered by subsequent openclaw config set calls. The implementation is secure with no injection risks, and comprehensive test coverage validates the fix.
-- security/pr-reviewer
@louisgvlouisgv
added
the 
security-approved
Security review approved
label
Mar 12, 2026
@AhmedTMM
AhmedTMM
commented
Mar 12, 2026

Copy link


Copy Markdown

CollaboratorAuthor
Fix merged directly into #2523 instead.
@AhmedTMM
AhmedTMM
deleted the

fix/dashboard-auth-token

branch
April 7, 2026 00:41
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@louisgvlouisgvlouisgv approved these changes

Assignees


No one assigned


Labels

security-approvedSecurity review approved

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@AhmedTMM@louisgv

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix: write openclaw config atomically to preserve dashboard auth - #2542
Closed
AhmedTMM wants to merge 7 commits into
OpenRouterLabs:mainfrom 
AhmedTMM:fix/dashboard-auth-token
Closed
fix: write openclaw config atomically to preserve dashboard auth#2542
AhmedTMM wants to merge 7 commits into
OpenRouterLabs:mainfrom 
AhmedTMM:fix/dashboard-auth-token
Conversation
@AhmedTMM
@AhmedTMMAhmedTMM
commented
Mar 12, 2026

Copy link


Copy Markdown

Collaborator
Summary
  • Fixes the "Unauthorized" dashboard page introduced by feat: add Telegram and WhatsApp to OpenClaw setup picker #2523
  • The openclaw config set calls for browser and Telegram settings were re-serializing openclaw.json and dropping the gateway.auth.token field
  • Now all config (gateway auth, browser, channels) is built as a single JSON object and written once via uploadConfigFile
Test plan
  •  Run spawn openclaw <cloud> — dashboard should open without "Unauthorized"
  •  Select Telegram, enter a bot token — verify it appears in ~/.openclaw/openclaw.json
  •  Select browser option — verify browser config appears in the same JSON file
  • bun test passes (1380/1380)
🤖 Generated with Claude Code
AhmedTMMand others
added 7 commits
March 12, 2026 00:49
@AhmedTMM@claude
feat: add Telegram and WhatsApp options to OpenClaw setup picker
49ff7a2
Adds separate "Telegram" and "WhatsApp" checkboxes to the OpenClaw
setup screen:
- Telegram: prompts for bot token from @Botfather, injects into
OpenClaw config via `openclaw config set`
- WhatsApp: reminds user to scan QR code via the web dashboard
after launch (no CLI setup possible)
Updates USER.md with channel-specific guidance when either is selected.
Bump CLI version to 0.16.16.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@AhmedTMM
Merge branch 'main' into feat/messaging-setup
ff9f558
@AhmedTMM@claude
feat: run WhatsApp QR scan interactively before TUI launch
024dab4
Instead of punting WhatsApp setup to "after launch", runs
`openclaw channels login --channel whatsapp` as an interactive SSH
session between gateway start and TUI launch. The user scans the
QR code with their phone during provisioning setup.
Flow: gateway starts → tunnel set up → WhatsApp QR scan → TUI launch
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@AhmedTMM@claude
fix: update WhatsApp hint to reflect pre-TUI QR scanning
49c9930
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@AhmedTMM
Merge branch 'main' into feat/messaging-setup
0825264
Signed-off-by: Ahmed Abushagur <ahmed@abushagur.com>
@AhmedTMM@claude
fix: write openclaw config atomically to preserve gateway auth token
e1f80f4
The `openclaw config set` calls for browser and Telegram settings were
re-serializing openclaw.json and dropping the gateway.auth.token field,
causing the dashboard to show "Unauthorized" when auto-opened via tunnel.
Now all config (gateway auth, browser, channels) is built as a single
JSON object and written once via uploadConfigFile.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@AhmedTMM@claude
test: add OpenClaw config, messaging, and tunnel test coverage
3aa895e
Adds 40 new tests across 2 files:
openclaw-config.test.ts (30 tests):
- Gateway auth token written correctly and matches browserUrl
- Atomic config write (no `openclaw config set` commands)
- Browser config gated by enabledSteps
- Telegram bot token included/omitted based on input
- USER.md messaging channel content
- Tunnel config targeting port 18791
orchestrate-messaging.test.ts (10 tests):
- SPAWN_ENABLED_STEPS parsing and threading
- WhatsApp QR scan session triggered before agent launch
- GitHub auth gated by enabledSteps
- preLaunchMsg output behavior
Also adds SPAWN_TELEGRAM_BOT_TOKEN env var override for
non-interactive/CI Telegram setup (avoids prompt in tests).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
louisgv
louisgv
approved these changes
Mar 12, 2026
View reviewed changes
@louisgvlouisgv
left a comment


Copy link


Copy Markdown

Collaborator
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security Review
Verdict: APPROVED
Commit: 3aa895e
Findings
No security issues found. This PR improves security by fixing the race condition where the gateway auth token was being dropped during config updates.
Positive changes:
  • [SECURITY FIX] Atomic config write prevents token loss (agent-setup.ts:388-389)
  • [GOOD] Credential handling uses JSON.stringify (no injection risk) (agent-setup.ts:388)
  • [GOOD] User input (Telegram token) properly sanitized via trim() (agent-setup.ts:341)
  • [GOOD] WhatsApp command is static string (no interpolation) (orchestrate.ts:259-261)
  • [GOOD] 40 new test cases verify token preservation and atomic writes
Tests
  • bash -n: N/A (no shell scripts changed)
  • bun test: PASS (40/40 tests passing)
  • Lint: PASS (0 errors from biome)
  • macOS compat: N/A (no shell changes)
Summary
This PR addresses issue #2489 by writing all OpenClaw config atomically in a single JSON upload, preventing the gateway auth token from being clobbered by subsequent openclaw config set calls. The implementation is secure with no injection risks, and comprehensive test coverage validates the fix.
-- security/pr-reviewer
@louisgvlouisgv
added
the 
security-approved
Security review approved
label
Mar 12, 2026
@AhmedTMM
AhmedTMM
commented
Mar 12, 2026

Copy link


Copy Markdown

CollaboratorAuthor
Fix merged directly into #2523 instead.
@AhmedTMM
AhmedTMM
deleted the

fix/dashboard-auth-token

branch
April 7, 2026 00:41
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@louisgvlouisgvlouisgv approved these changes

Assignees


No one assigned


Labels

security-approvedSecurity review approved

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@AhmedTMM@louisgv

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
fix: write openclaw config atomically to preserve dashboard auth - #2542
Closed
AhmedTMM wants to merge 7 commits into
OpenRouterLabs:mainfrom 
AhmedTMM:fix/dashboard-auth-token
Closed
fix: write openclaw config atomically to preserve dashboard auth#2542
AhmedTMM wants to merge 7 commits into
OpenRouterLabs:mainfrom 
AhmedTMM:fix/dashboard-auth-token
Conversation
@AhmedTMM
@AhmedTMMAhmedTMM
commented
Mar 12, 2026

Copy link


Copy Markdown

Collaborator
Summary
  • Fixes the "Unauthorized" dashboard page introduced by feat: add Telegram and WhatsApp to OpenClaw setup picker #2523
  • The openclaw config set calls for browser and Telegram settings were re-serializing openclaw.json and dropping the gateway.auth.token field
  • Now all config (gateway auth, browser, channels) is built as a single JSON object and written once via uploadConfigFile
Test plan
  •  Run spawn openclaw <cloud> — dashboard should open without "Unauthorized"
  •  Select Telegram, enter a bot token — verify it appears in ~/.openclaw/openclaw.json
  •  Select browser option — verify browser config appears in the same JSON file
  • bun test passes (1380/1380)
🤖 Generated with Claude Code
AhmedTMMand others
added 7 commits
March 12, 2026 00:49
@AhmedTMM@claude
feat: add Telegram and WhatsApp options to OpenClaw setup picker
49ff7a2
Adds separate "Telegram" and "WhatsApp" checkboxes to the OpenClaw
setup screen:
- Telegram: prompts for bot token from @Botfather, injects into
OpenClaw config via `openclaw config set`
- WhatsApp: reminds user to scan QR code via the web dashboard
after launch (no CLI setup possible)
Updates USER.md with channel-specific guidance when either is selected.
Bump CLI version to 0.16.16.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@AhmedTMM
Merge branch 'main' into feat/messaging-setup
ff9f558
@AhmedTMM@claude
feat: run WhatsApp QR scan interactively before TUI launch
024dab4
Instead of punting WhatsApp setup to "after launch", runs
`openclaw channels login --channel whatsapp` as an interactive SSH
session between gateway start and TUI launch. The user scans the
QR code with their phone during provisioning setup.
Flow: gateway starts → tunnel set up → WhatsApp QR scan → TUI launch
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@AhmedTMM@claude
fix: update WhatsApp hint to reflect pre-TUI QR scanning
49c9930
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@AhmedTMM
Merge branch 'main' into feat/messaging-setup
0825264
Signed-off-by: Ahmed Abushagur <ahmed@abushagur.com>
@AhmedTMM@claude
fix: write openclaw config atomically to preserve gateway auth token
e1f80f4
The `openclaw config set` calls for browser and Telegram settings were
re-serializing openclaw.json and dropping the gateway.auth.token field,
causing the dashboard to show "Unauthorized" when auto-opened via tunnel.
Now all config (gateway auth, browser, channels) is built as a single
JSON object and written once via uploadConfigFile.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@AhmedTMM@claude
test: add OpenClaw config, messaging, and tunnel test coverage
3aa895e
Adds 40 new tests across 2 files:
openclaw-config.test.ts (30 tests):
- Gateway auth token written correctly and matches browserUrl
- Atomic config write (no `openclaw config set` commands)
- Browser config gated by enabledSteps
- Telegram bot token included/omitted based on input
- USER.md messaging channel content
- Tunnel config targeting port 18791
orchestrate-messaging.test.ts (10 tests):
- SPAWN_ENABLED_STEPS parsing and threading
- WhatsApp QR scan session triggered before agent launch
- GitHub auth gated by enabledSteps
- preLaunchMsg output behavior
Also adds SPAWN_TELEGRAM_BOT_TOKEN env var override for
non-interactive/CI Telegram setup (avoids prompt in tests).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
louisgv
louisgv
approved these changes
Mar 12, 2026
View reviewed changes
@louisgvlouisgv
left a comment


Copy link


Copy Markdown

Collaborator
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security Review
Verdict: APPROVED
Commit: 3aa895e
Findings
No security issues found. This PR improves security by fixing the race condition where the gateway auth token was being dropped during config updates.
Positive changes:
  • [SECURITY FIX] Atomic config write prevents token loss (agent-setup.ts:388-389)
  • [GOOD] Credential handling uses JSON.stringify (no injection risk) (agent-setup.ts:388)
  • [GOOD] User input (Telegram token) properly sanitized via trim() (agent-setup.ts:341)
  • [GOOD] WhatsApp command is static string (no interpolation) (orchestrate.ts:259-261)
  • [GOOD] 40 new test cases verify token preservation and atomic writes
Tests
  • bash -n: N/A (no shell scripts changed)
  • bun test: PASS (40/40 tests passing)
  • Lint: PASS (0 errors from biome)
  • macOS compat: N/A (no shell changes)
Summary
This PR addresses issue #2489 by writing all OpenClaw config atomically in a single JSON upload, preventing the gateway auth token from being clobbered by subsequent openclaw config set calls. The implementation is secure with no injection risks, and comprehensive test coverage validates the fix.
-- security/pr-reviewer
@louisgvlouisgv
added
the 
security-approved
Security review approved
label
Mar 12, 2026
@AhmedTMM
AhmedTMM
commented
Mar 12, 2026

Copy link


Copy Markdown

CollaboratorAuthor
Fix merged directly into #2523 instead.
@AhmedTMM
AhmedTMM
deleted the

fix/dashboard-auth-token

branch
April 7, 2026 00:41
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@louisgvlouisgvlouisgv approved these changes

Assignees


No one assigned


Labels

security-approvedSecurity review approved

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@AhmedTMM@louisgv