feat(qa): telegram soak test on digitalocean + fix bun -e

[la14-1]

Summary

Soak test — now runs on DigitalOcean:

• soak.sh: SOAK_CLOUD env var makes the cloud configurable (default: sprite). Set to digitalocean via /etc/spawn-qa-auth.env on the QA VM.
• qa.sh: loads TELEGRAM_BOT_TOKEN, TELEGRAM_TEST_CHAT_ID, SOAK_CLOUD from /etc/spawn-qa-auth.env in soak mode
• qa.yml: adds weekly Monday 3am UTC scheduled soak trigger; detects via github.event.schedule to avoid conflicting with the 4-hour quality sweep

Bug fix — bun eval is not a valid command:
bun eval '...' fails with "Script not found eval" in bun 1.3.9. The correct form is bun -e '...'. Fixed across:

• soak.sh (the active soak test path, was causing injection to fail every run)
• key-request.sh (jq fallback paths — jq is present on QA VM so this wasn't triggered)
• github-auth.sh (jq fallback)
• shell-scripts.md (rule doc updated)

Also fixed: _TOKEN is now passed via env var prefix (_TOKEN=${_TOKEN} bun -e '...') so process.env._TOKEN is available inside the bun inline script.

Live test results (DigitalOcean, 120s smoke test)

✅ DigitalOcean credentials validated
✅ Provisioned openclaw (e2e-digitalocean-openclaw-...)
✅ All verify checks passed (binary, gateway, auto-restart)
✅ Telegram config injected (bun -e fix working)
✅ Cron scheduled at +30s, confirmed in cron list
✅ getMe — @spawnqabot token valid
✅ sendMessage — message delivered to chat
✅ getWebhookInfo — OK
⚠️ Cron delivery — cron fired and self-deleted (--delete-after-run confirmed)
but Claude session needs ~5 min to compose+send; requires full 55-min window

Setup on QA VM (already done)

/etc/spawn-qa-auth.env now contains:

TELEGRAM_BOT_TOKEN=...
TELEGRAM_TEST_CHAT_ID=6026269127
SOAK_CLOUD=digitalocean

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED
Commit: e96cdd8

Findings

No security issues found.

Changes Reviewed

1. Documentation: Changed bun eval to bun -e (correct flag usage)
2. QA soak mode: Added Telegram credential loading with proper validation
3. Soak test library: Added configurable cloud support, fixed env var handling
4. Helper scripts: Updated to use bun -e consistently

Security Controls Verified

• Input validation: TELEGRAM_TEST_CHAT_ID numeric check, timeout value validation
• Credential handling: Base64 encoding for tokens, safe env var passing
• Command injection protection: All inputs validated before use
• No unsafe eval or shell expansion patterns
• Defense-in-depth patterns intact

Tests

• bash -n: PASS (all shell scripts)
• bun test: N/A (module resolution in worktree, baseline has unrelated merge conflict)
• curl|bash: OK (no changes to remote fetch patterns)
• macOS compat: OK (bun -e works on all platforms)

---

-- security/pr-reviewer

[la14-1]

Summary

Soak test — now runs on DigitalOcean:

• soak.sh: SOAK_CLOUD env var makes the cloud configurable (default: sprite). Set to digitalocean via /etc/spawn-qa-auth.env on the QA VM.
• qa.sh: loads TELEGRAM_BOT_TOKEN, TELEGRAM_TEST_CHAT_ID, SOAK_CLOUD from /etc/spawn-qa-auth.env in soak mode
• qa.yml: adds weekly Monday 3am UTC scheduled soak trigger; detects via github.event.schedule to avoid conflicting with the 4-hour quality sweep

Bug fix — bun eval is not a valid command:
bun eval '...' fails with "Script not found eval" in bun 1.3.9. The correct form is bun -e '...'. Fixed across:

• soak.sh (the active soak test path, was causing injection to fail every run)
• key-request.sh (jq fallback paths — jq is present on QA VM so this wasn't triggered)
• github-auth.sh (jq fallback)
• shell-scripts.md (rule doc updated)

Also fixed: _TOKEN is now passed via env var prefix (_TOKEN=${_TOKEN} bun -e '...') so process.env._TOKEN is available inside the bun inline script.

Live test results (DigitalOcean, 120s smoke test)

✅ DigitalOcean credentials validated
✅ Provisioned openclaw (e2e-digitalocean-openclaw-...)
✅ All verify checks passed (binary, gateway, auto-restart)
✅ Telegram config injected (bun -e fix working)
✅ Cron scheduled at +30s, confirmed in cron list
✅ getMe — @spawnqabot token valid
✅ sendMessage — message delivered to chat
✅ getWebhookInfo — OK
⚠️ Cron delivery — cron fired and self-deleted (--delete-after-run confirmed)
but Claude session needs ~5 min to compose+send; requires full 55-min window

Setup on QA VM (already done)

/etc/spawn-qa-auth.env now contains:

TELEGRAM_BOT_TOKEN=...
TELEGRAM_TEST_CHAT_ID=6026269127
SOAK_CLOUD=digitalocean

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED
Commit: e96cdd8

Findings

No security issues found.

Changes Reviewed

1. Documentation: Changed bun eval to bun -e (correct flag usage)
2. QA soak mode: Added Telegram credential loading with proper validation
3. Soak test library: Added configurable cloud support, fixed env var handling
4. Helper scripts: Updated to use bun -e consistently

Security Controls Verified

• Input validation: TELEGRAM_TEST_CHAT_ID numeric check, timeout value validation
• Credential handling: Base64 encoding for tokens, safe env var passing
• Command injection protection: All inputs validated before use
• No unsafe eval or shell expansion patterns
• Defense-in-depth patterns intact

Tests

• bash -n: PASS (all shell scripts)
• bun test: N/A (module resolution in worktree, baseline has unrelated merge conflict)
• curl|bash: OK (no changes to remote fetch patterns)
• macOS compat: OK (bun -e works on all platforms)

---

-- security/pr-reviewer

[la14-1]

Summary

Soak test — now runs on DigitalOcean:

• soak.sh: SOAK_CLOUD env var makes the cloud configurable (default: sprite). Set to digitalocean via /etc/spawn-qa-auth.env on the QA VM.
• qa.sh: loads TELEGRAM_BOT_TOKEN, TELEGRAM_TEST_CHAT_ID, SOAK_CLOUD from /etc/spawn-qa-auth.env in soak mode
• qa.yml: adds weekly Monday 3am UTC scheduled soak trigger; detects via github.event.schedule to avoid conflicting with the 4-hour quality sweep

Bug fix — bun eval is not a valid command:
bun eval '...' fails with "Script not found eval" in bun 1.3.9. The correct form is bun -e '...'. Fixed across:

• soak.sh (the active soak test path, was causing injection to fail every run)
• key-request.sh (jq fallback paths — jq is present on QA VM so this wasn't triggered)
• github-auth.sh (jq fallback)
• shell-scripts.md (rule doc updated)

Also fixed: _TOKEN is now passed via env var prefix (_TOKEN=${_TOKEN} bun -e '...') so process.env._TOKEN is available inside the bun inline script.

Live test results (DigitalOcean, 120s smoke test)

✅ DigitalOcean credentials validated
✅ Provisioned openclaw (e2e-digitalocean-openclaw-...)
✅ All verify checks passed (binary, gateway, auto-restart)
✅ Telegram config injected (bun -e fix working)
✅ Cron scheduled at +30s, confirmed in cron list
✅ getMe — @spawnqabot token valid
✅ sendMessage — message delivered to chat
✅ getWebhookInfo — OK
⚠️ Cron delivery — cron fired and self-deleted (--delete-after-run confirmed)
but Claude session needs ~5 min to compose+send; requires full 55-min window

Setup on QA VM (already done)

/etc/spawn-qa-auth.env now contains:

TELEGRAM_BOT_TOKEN=...
TELEGRAM_TEST_CHAT_ID=6026269127
SOAK_CLOUD=digitalocean

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED
Commit: e96cdd8

Findings

No security issues found.

Changes Reviewed

1. Documentation: Changed bun eval to bun -e (correct flag usage)
2. QA soak mode: Added Telegram credential loading with proper validation
3. Soak test library: Added configurable cloud support, fixed env var handling
4. Helper scripts: Updated to use bun -e consistently

Security Controls Verified

• Input validation: TELEGRAM_TEST_CHAT_ID numeric check, timeout value validation
• Credential handling: Base64 encoding for tokens, safe env var passing
• Command injection protection: All inputs validated before use
• No unsafe eval or shell expansion patterns
• Defense-in-depth patterns intact

Tests

• bash -n: PASS (all shell scripts)
• bun test: N/A (module resolution in worktree, baseline has unrelated merge conflict)
• curl|bash: OK (no changes to remote fetch patterns)
• macOS compat: OK (bun -e works on all platforms)

---

-- security/pr-reviewer

[la14-1]

Summary

Soak test — now runs on DigitalOcean:

• soak.sh: SOAK_CLOUD env var makes the cloud configurable (default: sprite). Set to digitalocean via /etc/spawn-qa-auth.env on the QA VM.
• qa.sh: loads TELEGRAM_BOT_TOKEN, TELEGRAM_TEST_CHAT_ID, SOAK_CLOUD from /etc/spawn-qa-auth.env in soak mode
• qa.yml: adds weekly Monday 3am UTC scheduled soak trigger; detects via github.event.schedule to avoid conflicting with the 4-hour quality sweep

Bug fix — bun eval is not a valid command:
bun eval '...' fails with "Script not found eval" in bun 1.3.9. The correct form is bun -e '...'. Fixed across:

• soak.sh (the active soak test path, was causing injection to fail every run)
• key-request.sh (jq fallback paths — jq is present on QA VM so this wasn't triggered)
• github-auth.sh (jq fallback)
• shell-scripts.md (rule doc updated)

Also fixed: _TOKEN is now passed via env var prefix (_TOKEN=${_TOKEN} bun -e '...') so process.env._TOKEN is available inside the bun inline script.

Live test results (DigitalOcean, 120s smoke test)

✅ DigitalOcean credentials validated
✅ Provisioned openclaw (e2e-digitalocean-openclaw-...)
✅ All verify checks passed (binary, gateway, auto-restart)
✅ Telegram config injected (bun -e fix working)
✅ Cron scheduled at +30s, confirmed in cron list
✅ getMe — @spawnqabot token valid
✅ sendMessage — message delivered to chat
✅ getWebhookInfo — OK
⚠️ Cron delivery — cron fired and self-deleted (--delete-after-run confirmed)
but Claude session needs ~5 min to compose+send; requires full 55-min window

Setup on QA VM (already done)

/etc/spawn-qa-auth.env now contains:

TELEGRAM_BOT_TOKEN=...
TELEGRAM_TEST_CHAT_ID=6026269127
SOAK_CLOUD=digitalocean

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED
Commit: e96cdd8

Findings

No security issues found.

Changes Reviewed

1. Documentation: Changed bun eval to bun -e (correct flag usage)
2. QA soak mode: Added Telegram credential loading with proper validation
3. Soak test library: Added configurable cloud support, fixed env var handling
4. Helper scripts: Updated to use bun -e consistently

Security Controls Verified

• Input validation: TELEGRAM_TEST_CHAT_ID numeric check, timeout value validation
• Credential handling: Base64 encoding for tokens, safe env var passing
• Command injection protection: All inputs validated before use
• No unsafe eval or shell expansion patterns
• Defense-in-depth patterns intact

Tests

• bash -n: PASS (all shell scripts)
• bun test: N/A (module resolution in worktree, baseline has unrelated merge conflict)
• curl|bash: OK (no changes to remote fetch patterns)
• macOS compat: OK (bun -e works on all platforms)

---

-- security/pr-reviewer

[la14-1]

Summary

Soak test — now runs on DigitalOcean:

• soak.sh: SOAK_CLOUD env var makes the cloud configurable (default: sprite). Set to digitalocean via /etc/spawn-qa-auth.env on the QA VM.
• qa.sh: loads TELEGRAM_BOT_TOKEN, TELEGRAM_TEST_CHAT_ID, SOAK_CLOUD from /etc/spawn-qa-auth.env in soak mode
• qa.yml: adds weekly Monday 3am UTC scheduled soak trigger; detects via github.event.schedule to avoid conflicting with the 4-hour quality sweep

Bug fix — bun eval is not a valid command:
bun eval '...' fails with "Script not found eval" in bun 1.3.9. The correct form is bun -e '...'. Fixed across:

• soak.sh (the active soak test path, was causing injection to fail every run)
• key-request.sh (jq fallback paths — jq is present on QA VM so this wasn't triggered)
• github-auth.sh (jq fallback)
• shell-scripts.md (rule doc updated)

Also fixed: _TOKEN is now passed via env var prefix (_TOKEN=${_TOKEN} bun -e '...') so process.env._TOKEN is available inside the bun inline script.

Live test results (DigitalOcean, 120s smoke test)

✅ DigitalOcean credentials validated
✅ Provisioned openclaw (e2e-digitalocean-openclaw-...)
✅ All verify checks passed (binary, gateway, auto-restart)
✅ Telegram config injected (bun -e fix working)
✅ Cron scheduled at +30s, confirmed in cron list
✅ getMe — @spawnqabot token valid
✅ sendMessage — message delivered to chat
✅ getWebhookInfo — OK
⚠️ Cron delivery — cron fired and self-deleted (--delete-after-run confirmed)
but Claude session needs ~5 min to compose+send; requires full 55-min window

Setup on QA VM (already done)

/etc/spawn-qa-auth.env now contains:

TELEGRAM_BOT_TOKEN=...
TELEGRAM_TEST_CHAT_ID=6026269127
SOAK_CLOUD=digitalocean

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED
Commit: e96cdd8

Findings

No security issues found.

Changes Reviewed

1. Documentation: Changed bun eval to bun -e (correct flag usage)
2. QA soak mode: Added Telegram credential loading with proper validation
3. Soak test library: Added configurable cloud support, fixed env var handling
4. Helper scripts: Updated to use bun -e consistently

Security Controls Verified

• Input validation: TELEGRAM_TEST_CHAT_ID numeric check, timeout value validation
• Credential handling: Base64 encoding for tokens, safe env var passing
• Command injection protection: All inputs validated before use
• No unsafe eval or shell expansion patterns
• Defense-in-depth patterns intact

Tests

• bash -n: PASS (all shell scripts)
• bun test: N/A (module resolution in worktree, baseline has unrelated merge conflict)
• curl|bash: OK (no changes to remote fetch patterns)
• macOS compat: OK (bun -e works on all platforms)

---

-- security/pr-reviewer

[la14-1]

Summary

Soak test — now runs on DigitalOcean:

• soak.sh: SOAK_CLOUD env var makes the cloud configurable (default: sprite). Set to digitalocean via /etc/spawn-qa-auth.env on the QA VM.
• qa.sh: loads TELEGRAM_BOT_TOKEN, TELEGRAM_TEST_CHAT_ID, SOAK_CLOUD from /etc/spawn-qa-auth.env in soak mode
• qa.yml: adds weekly Monday 3am UTC scheduled soak trigger; detects via github.event.schedule to avoid conflicting with the 4-hour quality sweep

Bug fix — bun eval is not a valid command:
bun eval '...' fails with "Script not found eval" in bun 1.3.9. The correct form is bun -e '...'. Fixed across:

• soak.sh (the active soak test path, was causing injection to fail every run)
• key-request.sh (jq fallback paths — jq is present on QA VM so this wasn't triggered)
• github-auth.sh (jq fallback)
• shell-scripts.md (rule doc updated)

Also fixed: _TOKEN is now passed via env var prefix (_TOKEN=${_TOKEN} bun -e '...') so process.env._TOKEN is available inside the bun inline script.

Live test results (DigitalOcean, 120s smoke test)

✅ DigitalOcean credentials validated
✅ Provisioned openclaw (e2e-digitalocean-openclaw-...)
✅ All verify checks passed (binary, gateway, auto-restart)
✅ Telegram config injected (bun -e fix working)
✅ Cron scheduled at +30s, confirmed in cron list
✅ getMe — @spawnqabot token valid
✅ sendMessage — message delivered to chat
✅ getWebhookInfo — OK
⚠️ Cron delivery — cron fired and self-deleted (--delete-after-run confirmed)
but Claude session needs ~5 min to compose+send; requires full 55-min window

Setup on QA VM (already done)

/etc/spawn-qa-auth.env now contains:

TELEGRAM_BOT_TOKEN=...
TELEGRAM_TEST_CHAT_ID=6026269127
SOAK_CLOUD=digitalocean

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED
Commit: e96cdd8

Findings

No security issues found.

Changes Reviewed

1. Documentation: Changed bun eval to bun -e (correct flag usage)
2. QA soak mode: Added Telegram credential loading with proper validation
3. Soak test library: Added configurable cloud support, fixed env var handling
4. Helper scripts: Updated to use bun -e consistently

Security Controls Verified

• Input validation: TELEGRAM_TEST_CHAT_ID numeric check, timeout value validation
• Credential handling: Base64 encoding for tokens, safe env var passing
• Command injection protection: All inputs validated before use
• No unsafe eval or shell expansion patterns
• Defense-in-depth patterns intact

Tests

• bash -n: PASS (all shell scripts)
• bun test: N/A (module resolution in worktree, baseline has unrelated merge conflict)
• curl|bash: OK (no changes to remote fetch patterns)
• macOS compat: OK (bun -e works on all platforms)

---

-- security/pr-reviewer

[la14-1]

Summary

Soak test — now runs on DigitalOcean:

• soak.sh: SOAK_CLOUD env var makes the cloud configurable (default: sprite). Set to digitalocean via /etc/spawn-qa-auth.env on the QA VM.
• qa.sh: loads TELEGRAM_BOT_TOKEN, TELEGRAM_TEST_CHAT_ID, SOAK_CLOUD from /etc/spawn-qa-auth.env in soak mode
• qa.yml: adds weekly Monday 3am UTC scheduled soak trigger; detects via github.event.schedule to avoid conflicting with the 4-hour quality sweep

Bug fix — bun eval is not a valid command:
bun eval '...' fails with "Script not found eval" in bun 1.3.9. The correct form is bun -e '...'. Fixed across:

• soak.sh (the active soak test path, was causing injection to fail every run)
• key-request.sh (jq fallback paths — jq is present on QA VM so this wasn't triggered)
• github-auth.sh (jq fallback)
• shell-scripts.md (rule doc updated)

Also fixed: _TOKEN is now passed via env var prefix (_TOKEN=${_TOKEN} bun -e '...') so process.env._TOKEN is available inside the bun inline script.

Live test results (DigitalOcean, 120s smoke test)

✅ DigitalOcean credentials validated
✅ Provisioned openclaw (e2e-digitalocean-openclaw-...)
✅ All verify checks passed (binary, gateway, auto-restart)
✅ Telegram config injected (bun -e fix working)
✅ Cron scheduled at +30s, confirmed in cron list
✅ getMe — @spawnqabot token valid
✅ sendMessage — message delivered to chat
✅ getWebhookInfo — OK
⚠️ Cron delivery — cron fired and self-deleted (--delete-after-run confirmed)
but Claude session needs ~5 min to compose+send; requires full 55-min window

Setup on QA VM (already done)

/etc/spawn-qa-auth.env now contains:

TELEGRAM_BOT_TOKEN=...
TELEGRAM_TEST_CHAT_ID=6026269127
SOAK_CLOUD=digitalocean

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED
Commit: e96cdd8

Findings

No security issues found.

Changes Reviewed

1. Documentation: Changed bun eval to bun -e (correct flag usage)
2. QA soak mode: Added Telegram credential loading with proper validation
3. Soak test library: Added configurable cloud support, fixed env var handling
4. Helper scripts: Updated to use bun -e consistently

Security Controls Verified

• Input validation: TELEGRAM_TEST_CHAT_ID numeric check, timeout value validation
• Credential handling: Base64 encoding for tokens, safe env var passing
• Command injection protection: All inputs validated before use
• No unsafe eval or shell expansion patterns
• Defense-in-depth patterns intact

Tests

• bash -n: PASS (all shell scripts)
• bun test: N/A (module resolution in worktree, baseline has unrelated merge conflict)
• curl|bash: OK (no changes to remote fetch patterns)
• macOS compat: OK (bun -e works on all platforms)

---

-- security/pr-reviewer

[la14-1]

Summary

Soak test — now runs on DigitalOcean:

• soak.sh: SOAK_CLOUD env var makes the cloud configurable (default: sprite). Set to digitalocean via /etc/spawn-qa-auth.env on the QA VM.
• qa.sh: loads TELEGRAM_BOT_TOKEN, TELEGRAM_TEST_CHAT_ID, SOAK_CLOUD from /etc/spawn-qa-auth.env in soak mode
• qa.yml: adds weekly Monday 3am UTC scheduled soak trigger; detects via github.event.schedule to avoid conflicting with the 4-hour quality sweep

Bug fix — bun eval is not a valid command:
bun eval '...' fails with "Script not found eval" in bun 1.3.9. The correct form is bun -e '...'. Fixed across:

• soak.sh (the active soak test path, was causing injection to fail every run)
• key-request.sh (jq fallback paths — jq is present on QA VM so this wasn't triggered)
• github-auth.sh (jq fallback)
• shell-scripts.md (rule doc updated)

Also fixed: _TOKEN is now passed via env var prefix (_TOKEN=${_TOKEN} bun -e '...') so process.env._TOKEN is available inside the bun inline script.

Live test results (DigitalOcean, 120s smoke test)

✅ DigitalOcean credentials validated
✅ Provisioned openclaw (e2e-digitalocean-openclaw-...)
✅ All verify checks passed (binary, gateway, auto-restart)
✅ Telegram config injected (bun -e fix working)
✅ Cron scheduled at +30s, confirmed in cron list
✅ getMe — @spawnqabot token valid
✅ sendMessage — message delivered to chat
✅ getWebhookInfo — OK
⚠️ Cron delivery — cron fired and self-deleted (--delete-after-run confirmed)
but Claude session needs ~5 min to compose+send; requires full 55-min window

Setup on QA VM (already done)

/etc/spawn-qa-auth.env now contains:

TELEGRAM_BOT_TOKEN=...
TELEGRAM_TEST_CHAT_ID=6026269127
SOAK_CLOUD=digitalocean

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED
Commit: e96cdd8

Findings

No security issues found.

Changes Reviewed

1. Documentation: Changed bun eval to bun -e (correct flag usage)
2. QA soak mode: Added Telegram credential loading with proper validation
3. Soak test library: Added configurable cloud support, fixed env var handling
4. Helper scripts: Updated to use bun -e consistently

Security Controls Verified

• Input validation: TELEGRAM_TEST_CHAT_ID numeric check, timeout value validation
• Credential handling: Base64 encoding for tokens, safe env var passing
• Command injection protection: All inputs validated before use
• No unsafe eval or shell expansion patterns
• Defense-in-depth patterns intact

Tests

• bash -n: PASS (all shell scripts)
• bun test: N/A (module resolution in worktree, baseline has unrelated merge conflict)
• curl|bash: OK (no changes to remote fetch patterns)
• macOS compat: OK (bun -e works on all platforms)

---

-- security/pr-reviewer