@chrysb/alphaclaw 0.4.1-beta.0 → 0.4.1-beta.1

package/lib/public/js/components/google/index.js

@@ -1,5 +1,10 @@
 import { h } from "https://esm.sh/preact";
-import { useCallback, useEffect, useMemo, useState } from "https://esm.sh/preact/hooks";
+import {
+  useCallback,
+  useEffect,
+  useMemo,
+  useState,
+} from "https://esm.sh/preact/hooks";
 import htm from "https://esm.sh/htm";
 import {
   checkGoogleApis,
@@ -34,12 +39,8 @@ export const Google = ({
   onRestartRequired = () => {},
   onOpenGmailWebhook = () => {},
 }) => {
-  const {
-    accounts,
-    loading,
-    hasCompanyCredentials,
-    refreshAccounts,
-  } = useGoogleAccounts({ gatewayStatus });
+  const { accounts, loading, hasCompanyCredentials, refreshAccounts } =
+    useGoogleAccounts({ gatewayStatus });
   const [expandedAccountId, setExpandedAccountId] = useState("");
   const [scopesByAccountId, setScopesByAccountId] = useState({});
   const [savedScopesByAccountId, setSavedScopesByAccountId] = useState({});
@@ -90,12 +91,16 @@ export const Google = ({
   );
 
   const ensureScopesForAccount = useCallback((account) => {
-    const nextScopes = Array.isArray(account.activeScopes) && account.activeScopes.length
-      ? account.activeScopes
-      : Array.isArray(account.services) && account.services.length
-        ? account.services
-        : getDefaultScopes();
-    setSavedScopesByAccountId((prev) => ({ ...prev, [account.id]: [...nextScopes] }));
+    const nextScopes =
+      Array.isArray(account.activeScopes) && account.activeScopes.length
+        ? account.activeScopes
+        : Array.isArray(account.services) && account.services.length
+          ? account.services
+          : getDefaultScopes();
+    setSavedScopesByAccountId((prev) => ({
+      ...prev,
+      [account.id]: [...nextScopes],
+    }));
     setScopesByAccountId((prev) => {
       const current = prev[account.id];
       if (!current || !hasScopesChanged(current, nextScopes)) {
@@ -125,7 +130,10 @@ export const Google = ({
     (accountId) => {
       const account = getAccountById(accountId);
       if (!account) return;
-      const scopes = scopesByAccountId[accountId] || account.activeScopes || getDefaultScopes();
+      const scopes =
+        scopesByAccountId[accountId] ||
+        account.activeScopes ||
+        getDefaultScopes();
       if (!scopes.length) {
         window.alert("Select at least one service");
         return;
@@ -160,7 +168,10 @@ export const Google = ({
     try {
       const data = await checkGoogleApis(accountId);
       if (data.results) {
-        setApiStatusByAccountId((prev) => ({ ...prev, [accountId]: data.results }));
+        setApiStatusByAccountId((prev) => ({
+          ...prev,
+          [accountId]: data.results,
+        }));
       }
     } finally {
       setCheckingByAccountId((prev) => {
@@ -184,7 +195,10 @@ export const Google = ({
           await handleCheckApis(accountId);
         }
       } else if (event.data?.google === "error") {
-        showToast(`✗ Google auth failed: ${event.data.message || "unknown"}`, "error");
+        showToast(
+          `✗ Google auth failed: ${event.data.message || "unknown"}`,
+          "error",
+        );
       }
     };
     window.addEventListener("message", handler);
@@ -249,6 +263,9 @@ export const Google = ({
   };
 
   const handleCredentialsSaved = async (account) => {
+    if (account?.id) {
+      setExpandedAccountId(account.id);
+    }
     await refreshAccounts();
     if (account?.id) startAuth(account.id);
   };
@@ -267,6 +284,9 @@ export const Google = ({
         return;
       }
       setAddCompanyModalOpen(false);
+      if (data.accountId) {
+        setExpandedAccountId(data.accountId);
+      }
       await refreshAccounts();
       if (data.accountId) startAuth(data.accountId);
     } finally {
@@ -304,7 +324,7 @@ export const Google = ({
     const account = getAccountById(accountId);
     if (!account) return;
     const personal = isPersonalAccount(account);
-    const client = personal ? "personal" : (account.client || "default");
+    const client = personal ? "personal" : account.client || "default";
     let credentialValues = {};
     try {
       const credentialResponse = await fetchGoogleCredentials({
@@ -390,22 +410,23 @@ export const Google = ({
   };
 
   const renderEmptyState = () => html`
-    <div class="text-center space-y-2 py-1">
+    <div class="text-center space-y-2 pt-3">
       <div class="rounded-lg border border-border bg-black/20 px-3 py-5">
-        <div class="flex flex-col items-center justify-center gap-1.5">
+        <div class="flex flex-col items-center justify-center gap-3">
           <img
             src=${kGoogleIconPath}
             alt="Google logo"
-            class="h-4 w-4 shrink-0"
+            class="h-5 w-5 shrink-0"
             loading="lazy"
             decoding="async"
           />
           <p class="text-xs text-gray-500">
-            Connect Gmail, Calendar, Contacts, Drive, Sheets, Tasks, Docs, and Meet.
+            Connect Gmail, Calendar, Contacts, Drive, Sheets, Tasks, Docs, and
+            Meet.
           </p>
         </div>
       </div>
-      <div class="grid grid-cols-1 sm:grid-cols-2 gap-2">
+      <div class="grid grid-cols-1 sm:grid-cols-2 gap-2 pt-2">
         <${ActionButton}
           onClick=${handleAddCompanyClick}
           tone="primary"
@@ -469,34 +490,46 @@ export const Google = ({
         `}
       />
       ${loading
-        ? html`<div class="text-gray-500 text-sm text-center py-2">Loading...</div>`
+        ? html`<div class="text-gray-500 text-sm text-center py-2">
+            Loading...
+          </div>`
         : accounts.length
           ? html`
               <div class="space-y-2 mt-3">
-                ${accounts.map((account) =>
-                  html`<${GoogleAccountRow}
-                    key=${account.id}
-                    account=${account}
-                    personal=${isPersonalAccount(account)}
-                    expanded=${expandedAccountId === account.id}
-                    onToggleExpanded=${(accountId) =>
-                      setExpandedAccountId((prev) => (prev === accountId ? "" : accountId))}
-                    scopes=${scopesByAccountId[account.id] || account.activeScopes || getDefaultScopes()}
-                    savedScopes=${savedScopesByAccountId[account.id] || account.activeScopes || getDefaultScopes()}
-                    apiStatus=${apiStatusByAccountId[account.id] || {}}
-                    checkingApis=${expandedAccountId === account.id && Boolean(checkingByAccountId[account.id])}
-                    onToggleScope=${handleToggleScope}
-                    onCheckApis=${handleCheckApis}
-                    onUpdatePermissions=${(accountId) => startAuth(accountId)}
-                    onEditCredentials=${handleEditCredentials}
-                    onDisconnect=${(accountId) => setDisconnectAccountId(accountId)}
-                    gmailWatchStatus=${watchByAccountId.get(account.id) || null}
-                    gmailWatchBusy=${Boolean(busyByAccountId[account.id])}
-                    onEnableGmailWatch=${handleEnableGmailWatch}
-                    onDisableGmailWatch=${handleDisableGmailWatch}
-                    onOpenGmailSetup=${openGmailSetupWizard}
-                    onOpenGmailWebhook=${onOpenGmailWebhook}
-                  />`,
+                ${accounts.map(
+                  (account) =>
+                    html`<${GoogleAccountRow}
+                      key=${account.id}
+                      account=${account}
+                      personal=${isPersonalAccount(account)}
+                      expanded=${expandedAccountId === account.id}
+                      onToggleExpanded=${(accountId) =>
+                        setExpandedAccountId((prev) =>
+                          prev === accountId ? "" : accountId,
+                        )}
+                      scopes=${scopesByAccountId[account.id] ||
+                      account.activeScopes ||
+                      getDefaultScopes()}
+                      savedScopes=${savedScopesByAccountId[account.id] ||
+                      account.activeScopes ||
+                      getDefaultScopes()}
+                      apiStatus=${apiStatusByAccountId[account.id] || {}}
+                      checkingApis=${expandedAccountId === account.id &&
+                      Boolean(checkingByAccountId[account.id])}
+                      onToggleScope=${handleToggleScope}
+                      onCheckApis=${handleCheckApis}
+                      onUpdatePermissions=${(accountId) => startAuth(accountId)}
+                      onEditCredentials=${handleEditCredentials}
+                      onDisconnect=${(accountId) =>
+                        setDisconnectAccountId(accountId)}
+                      gmailWatchStatus=${watchByAccountId.get(account.id) ||
+                      null}
+                      gmailWatchBusy=${Boolean(busyByAccountId[account.id])}
+                      onEnableGmailWatch=${handleEnableGmailWatch}
+                      onDisableGmailWatch=${handleDisableGmailWatch}
+                      onOpenGmailSetup=${openGmailSetupWizard}
+                      onOpenGmailWebhook=${onOpenGmailWebhook}
+                    />`,
                 )}
               </div>
             `
@@ -528,7 +561,9 @@ export const Google = ({
       visible=${gmailWizardState.visible}
       account=${getAccountById(gmailWizardState.accountId)}
       clientConfig=${clientConfigByClient.get(
-        String(getAccountById(gmailWizardState.accountId)?.client || "default").trim() || "default",
+        String(
+          getAccountById(gmailWizardState.accountId)?.client || "default",
+        ).trim() || "default",
       ) || null}
       saving=${savingClient || gmailLoading}
       onClose=${closeGmailSetupWizard}

package/lib/public/js/components/sidebar.js

@@ -12,7 +12,7 @@ const kBrowseBottomPanelUiSettingKey = "browseBottomPanelHeightPx";
 const kBrowsePanelMinHeightPx = 120;
 const kBrowseBottomMinHeightPx = 120;
 const kBrowseResizerHeightPx = 6;
-const kDefaultBrowseBottomPanelHeightPx = 160;
+const kDefaultBrowseBottomPanelHeightPx = 260;
 
 const readStoredBrowseBottomPanelHeight = () => {
   try {

package/lib/public/js/components/telegram-workspace/onboarding.js

@@ -116,7 +116,7 @@ export const CreateGroupStep = ({ onNext, onBack }) => html`
       <p class="text-xs font-medium text-gray-300">Create the group</p>
       <ol class="text-xs text-gray-400 space-y-2 list-decimal list-inside">
         <li>
-          Open Telegram and create a
+          Open Telegram and create a${" "}
           <span class="text-gray-300">new group</span>
         </li>
         <li>

package/lib/public/js/components/webhooks.js

@@ -232,7 +232,7 @@ export const Webhooks = ({
     selectedWebhook?.fullUrl || `.../hooks/${selectedHookName}`;
   const webhookUrlWithQueryToken =
     selectedWebhook?.queryStringUrl ||
-    `${webhookUrl}${webhookUrl.includes("?") ? "&" : "?"}token=<OPENCLAW_HOOKS_TOKEN>`;
+    `${webhookUrl}${webhookUrl.includes("?") ? "&" : "?"}token=<WEBHOOK_TOKEN>`;
   const derivedTokenFromQuery = (() => {
     try {
       const parsed = new URL(webhookUrlWithQueryToken);
@@ -245,7 +245,7 @@ export const Webhooks = ({
     selectedWebhook?.authHeaderValue ||
     (derivedTokenFromQuery
       ? `Authorization: Bearer ${derivedTokenFromQuery}`
-      : "Authorization: Bearer <OPENCLAW_HOOKS_TOKEN>");
+      : "Authorization: Bearer <WEBHOOK_TOKEN>");
   const bearerTokenValue = authHeaderValue.startsWith("Authorization: ")
     ? authHeaderValue.slice("Authorization: ".length)
     : authHeaderValue;

package/lib/server/constants.js

@@ -147,7 +147,6 @@ const kLogMaxBytes = parsePositiveIntEnv(
 
 const kSystemVars = new Set([
   "WEBHOOK_TOKEN",
-  "OPENCLAW_HOOKS_TOKEN",
   "OPENCLAW_GATEWAY_TOKEN",
   "SETUP_PASSWORD",
   "PORT",

package/lib/server/gmail-serve.js

@@ -110,7 +110,7 @@ const createGmailServeManager = ({
     }
     const token = String(webhookToken || "").trim();
     if (!token) {
-      throw new Error("OPENCLAW_HOOKS_TOKEN is required to start Gmail watch serve");
+      throw new Error("WEBHOOK_TOKEN is required to start Gmail watch serve");
     }
 
     const args = buildArgs({ account, port: normalizedPort, webhookToken: token });

package/lib/server/gmail-watch.js

@@ -203,39 +203,19 @@ const createGmailWatchService = ({
   };
 
   const ensureWebhookToken = () => {
-    const existing = String(
-      process.env.OPENCLAW_HOOKS_TOKEN || process.env.WEBHOOK_TOKEN || "",
-    ).trim();
+    const existing = String(process.env.WEBHOOK_TOKEN || "").trim();
     if (existing) return { token: existing, changed: false };
     const vars = readEnvFile();
-    const tokenFromOpenclawHooks = String(
-      vars.find((entry) => entry.key === "OPENCLAW_HOOKS_TOKEN")?.value || "",
-    ).trim();
-    const tokenFromLegacyWebhook = String(
+    const tokenFromFile = String(
       vars.find((entry) => entry.key === "WEBHOOK_TOKEN")?.value || "",
     ).trim();
-    const tokenFromFile = tokenFromOpenclawHooks || tokenFromLegacyWebhook;
     if (tokenFromFile) {
-      process.env.OPENCLAW_HOOKS_TOKEN = tokenFromFile;
-      if (!process.env.WEBHOOK_TOKEN) {
-        process.env.WEBHOOK_TOKEN = tokenFromFile;
-      }
-      if (!tokenFromOpenclawHooks) {
-        const nextVars = vars.filter(
-          (entry) => entry.key !== "OPENCLAW_HOOKS_TOKEN",
-        );
-        nextVars.push({ key: "OPENCLAW_HOOKS_TOKEN", value: tokenFromFile });
-        writeEnvFile(nextVars);
-        reloadEnv();
-        return { token: tokenFromFile, changed: true };
-      }
+      process.env.WEBHOOK_TOKEN = tokenFromFile;
       return { token: tokenFromFile, changed: false };
     }
     const token = generatePushToken();
-    const nextVars = vars.filter(
-      (entry) => entry.key !== "OPENCLAW_HOOKS_TOKEN",
-    );
-    nextVars.push({ key: "OPENCLAW_HOOKS_TOKEN", value: token });
+    const nextVars = vars.filter((entry) => entry.key !== "WEBHOOK_TOKEN");
+    nextVars.push({ key: "WEBHOOK_TOKEN", value: token });
     writeEnvFile(nextVars);
     reloadEnv();
     return { token, changed: true };
@@ -258,7 +238,7 @@ const createGmailWatchService = ({
       changed = true;
     }
     if (typeof cfg.hooks.token !== "string" || !cfg.hooks.token.trim()) {
-      cfg.hooks.token = "${OPENCLAW_HOOKS_TOKEN}";
+      cfg.hooks.token = "${WEBHOOK_TOKEN}";
       changed = true;
     }
     if (!Array.isArray(cfg.hooks.presets)) {
@@ -337,7 +317,7 @@ const createGmailWatchService = ({
           const watch = getAccountGmailWatch(account || {});
           if (!account || !watch.enabled || !watch.port) return;
           const token = String(
-            process.env.OPENCLAW_HOOKS_TOKEN || process.env.WEBHOOK_TOKEN || "",
+            process.env.WEBHOOK_TOKEN || "",
           ).trim();
           if (!token) return;
           const status = await serveManager.startServe({
@@ -633,7 +613,7 @@ const createGmailWatchService = ({
       try {
         let state = readState();
         const hookToken = String(
-          process.env.OPENCLAW_HOOKS_TOKEN || process.env.WEBHOOK_TOKEN || "",
+          process.env.WEBHOOK_TOKEN || "",
         ).trim();
         const enabled = listWatchEnabledAccounts(state);
         for (const account of enabled) {

package/lib/server/onboarding/openclaw.js

@@ -177,7 +177,15 @@ const writeSanitizedOpenclawConfig = ({ fs, openclawDir, varMap }) => {
   const replacements = buildSecretReplacements(varMap, process.env);
   for (const [secret, envRef] of replacements) {
     if (secret) {
-      content = content.split(secret).join(envRef);
+      // Only replace exact JSON string values so path substrings are never mutated.
+      const secretJson = JSON.stringify(secret);
+      content = content.replace(
+        new RegExp(
+          secretJson.replace(/[-\/\\^$*+?.()|[\]{}]/g, "\\$&"),
+          "g",
+        ),
+        JSON.stringify(envRef),
+      );
     }
   }
   fs.writeFileSync(configPath, content);

package/lib/server/routes/webhooks.js

@@ -52,15 +52,13 @@ const normalizeStatusFilter = (rawStatus) => {
 
 const buildWebhookUrls = ({ baseUrl, name }) => {
   const fullUrl = `${baseUrl}/hooks/${name}`;
-  const token = String(
-    process.env.OPENCLAW_HOOKS_TOKEN || process.env.WEBHOOK_TOKEN || "",
-  ).trim();
+  const token = String(process.env.WEBHOOK_TOKEN || "").trim();
   const queryStringUrl = token
     ? `${fullUrl}?token=${encodeURIComponent(token)}`
-    : `${fullUrl}?token=<OPENCLAW_HOOKS_TOKEN>`;
+    : `${fullUrl}?token=<WEBHOOK_TOKEN>`;
   const authHeaderValue = token
     ? `Authorization: Bearer ${token}`
-    : "Authorization: Bearer <OPENCLAW_HOOKS_TOKEN>";
+    : "Authorization: Bearer <WEBHOOK_TOKEN>";
   return { fullUrl, queryStringUrl, authHeaderValue, hasRuntimeToken: !!token };
 };
 

package/lib/server/webhooks.js

@@ -53,7 +53,7 @@ const ensureHooksRoot = (cfg) => {
   if (typeof cfg.hooks.path !== "string" || !cfg.hooks.path.trim())
     cfg.hooks.path = "/hooks";
   if (typeof cfg.hooks.token !== "string" || !cfg.hooks.token.trim()) {
-    cfg.hooks.token = "${OPENCLAW_HOOKS_TOKEN}";
+    cfg.hooks.token = "${WEBHOOK_TOKEN}";
   }
   if (
     typeof cfg.hooks.defaultSessionKey !== "string" ||

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrysb/alphaclaw",
-  "version": "0.4.1-beta.0",
+  "version": "0.4.1-beta.1",
   "publishConfig": {
     "access": "public"
   },