@chrysb/alphaclaw 0.6.0-beta.1 → 0.6.0-beta.3

package/lib/server/routes/pairings.js

@@ -3,6 +3,11 @@ const path = require("path");
 const { OPENCLAW_DIR } = require("../constants");
 const { buildManagedPaths } = require("../internal-files-migration");
 const { parseJsonObjectFromNoisyOutput } = require("../utils/json");
+const { quoteShellArg } = require("../utils/shell");
+
+const kAllowedPairingChannels = new Set(["telegram", "discord"]);
+const kSafePairingArgPattern = /^[\w\-:.]+$/;
+const quoteCliArg = (value) => quoteShellArg(value, { strategy: "single" });
 
 const resolvePairingStorePath = ({ openclawDir, channel }) =>
   path.join(openclawDir, "credentials", `${String(channel).trim().toLowerCase()}-pairing.json`);
@@ -133,11 +138,32 @@ const registerPairingRoutes = ({ app, clawCmd, isOnboarded, fsModule = fs, openc
   });
 
   app.post("/api/pairings/:id/approve", async (req, res) => {
-    const channel = req.body.channel || "telegram";
+    const channel = String(req.body?.channel || "telegram")
+      .trim()
+      .toLowerCase();
     const accountId = String(req.body?.accountId || "").trim();
+    const pairingId = String(req.params.id || "").trim();
+    if (!kAllowedPairingChannels.has(channel)) {
+      return res.status(400).json({
+        ok: false,
+        error: `Unsupported pairing channel "${channel}"`,
+      });
+    }
+    if (!pairingId || !kSafePairingArgPattern.test(pairingId)) {
+      return res.status(400).json({
+        ok: false,
+        error: "Invalid pairing id",
+      });
+    }
+    if (accountId && !kSafePairingArgPattern.test(accountId)) {
+      return res.status(400).json({
+        ok: false,
+        error: "Invalid account id",
+      });
+    }
     const approveCmd = accountId
-      ? `pairing approve --channel ${channel} --account ${accountId} ${req.params.id}`
-      : `pairing approve ${channel} ${req.params.id}`;
+      ? `pairing approve --channel ${quoteCliArg(channel)} --account ${quoteCliArg(accountId)} ${quoteCliArg(pairingId)}`
+      : `pairing approve ${quoteCliArg(channel)} ${quoteCliArg(pairingId)}`;
     const result = await clawCmd(approveCmd);
     res.json(result);
   });

package/lib/server/routes/system.js

@@ -1,5 +1,6 @@
 const { buildManagedPaths } = require("../internal-files-migration");
 const { readOpenclawConfig } = require("../openclaw-config");
+const { hasScopedBindingFields } = require("../utils/channels");
 
 const registerSystemRoutes = ({
   app,
@@ -80,12 +81,6 @@ const registerSystemRoutes = ({
       .filter(Boolean)
       .map((part) => part.charAt(0).toUpperCase() + part.slice(1))
       .join(" ");
-  const hasScopedBindingFields = (match = {}) =>
-    !!match.peer ||
-    !!match.parentPeer ||
-    !!String(match.guildId || "").trim() ||
-    !!String(match.teamId || "").trim() ||
-    (Array.isArray(match.roles) && match.roles.length > 0);
   const resolveTelegramAccountIdForAgent = ({ config, agentId }) => {
     const normalizedAgentId = String(agentId || "").trim();
     if (!normalizedAgentId) return "default";

package/lib/server/routes/telegram.js

@@ -1,7 +1,15 @@
 const fs = require("fs");
 const { OPENCLAW_DIR } = require("../constants");
 const { isDebugEnabled } = require("../helpers");
+const {
+  readOpenclawConfig,
+  writeOpenclawConfig,
+} = require("../openclaw-config");
 const { parseBooleanValue } = require("../utils/boolean");
+const {
+  hasScopedBindingFields,
+  normalizeAccountId,
+} = require("../utils/channels");
 const { quoteShellArg } = require("../utils/shell");
 const topicRegistry = require("../topic-registry");
 const { syncConfigForTelegram } = require("../telegram-workspace");
@@ -54,7 +62,6 @@ const buildTelegramGitSyncCommand = (action, target = "") => {
 const { createTelegramApi } = require("../telegram-api");
 
 const kTelegramEnvKeyBase = "TELEGRAM_BOT_TOKEN";
-const normalizeAccountId = (value) => String(value || "").trim() || "default";
 
 const deriveAccountEnvKey = (accountId) => {
   const normalized = normalizeAccountId(accountId);
@@ -101,13 +108,6 @@ const resolveTelegramConfigForAccount = ({ telegramConfig, accountId }) => {
   };
 };
 
-const hasScopedBindingFields = (match) =>
-  !!match.peer ||
-  !!match.parentPeer ||
-  !!String(match.guildId || "").trim() ||
-  !!String(match.teamId || "").trim() ||
-  (Array.isArray(match.roles) && match.roles.length > 0);
-
 const resolveBoundAgentIdForAccount = ({ cfg, accountId }) => {
   const bindings = Array.isArray(cfg?.bindings) ? cfg.bindings : [];
   const normalizedAccountId = normalizeAccountId(accountId);
@@ -510,8 +510,11 @@ const registerTelegramRoutes = ({
       });
 
       // Save metadata in local topic registry only.
-      const configPath = `${OPENCLAW_DIR}/openclaw.json`;
-      const cfg = JSON.parse(fs.readFileSync(configPath, "utf8"));
+      const cfg = readOpenclawConfig({
+        fsModule: fs,
+        openclawDir: OPENCLAW_DIR,
+        fallback: {},
+      });
       const boundAgentId = resolveBoundAgentIdForAccount({ cfg, accountId });
       topicRegistry.setGroup(groupId, {
         ...(groupName ? { name: groupName } : {}),
@@ -537,8 +540,11 @@ const registerTelegramRoutes = ({
     try {
       const accountId = resolveAccountId(req);
       const debugEnabled = isDebugEnabled();
-      const configPath = `${OPENCLAW_DIR}/openclaw.json`;
-      let cfg = JSON.parse(fs.readFileSync(configPath, "utf8"));
+      let cfg = readOpenclawConfig({
+        fsModule: fs,
+        openclawDir: OPENCLAW_DIR,
+        fallback: {},
+      });
       let telegramConfig = cfg.channels?.telegram || {};
       const { accountConfig } = resolveTelegramConfigForAccount({
         telegramConfig,
@@ -580,7 +586,11 @@ const registerTelegramRoutes = ({
           }
         }
         if (anyRepaired) {
-          cfg = JSON.parse(fs.readFileSync(configPath, "utf8"));
+          cfg = readOpenclawConfig({
+            fsModule: fs,
+            openclawDir: OPENCLAW_DIR,
+            fallback: {},
+          });
           telegramConfig = cfg.channels?.telegram || {};
         }
         const refreshedAccountConfig = resolveTelegramConfigForAccount({
@@ -634,8 +644,11 @@ const registerTelegramRoutes = ({
   app.post("/api/telegram/workspace/reset", async (req, res) => {
     try {
       const accountId = resolveAccountId(req);
-      const configPath = `${OPENCLAW_DIR}/openclaw.json`;
-      const cfg = JSON.parse(fs.readFileSync(configPath, "utf8"));
+      const cfg = readOpenclawConfig({
+        fsModule: fs,
+        openclawDir: OPENCLAW_DIR,
+        fallback: {},
+      });
       const telegramConfig = cfg.channels?.telegram;
       if (!telegramConfig || typeof telegramConfig !== "object") {
         return res.json({ ok: true, syncWarning: null });
@@ -660,7 +673,12 @@ const registerTelegramRoutes = ({
         delete telegramConfig.groups;
         delete telegramConfig.groupAllowFrom;
       }
-      fs.writeFileSync(configPath, JSON.stringify(cfg, null, 2));
+      writeOpenclawConfig({
+        fsModule: fs,
+        openclawDir: OPENCLAW_DIR,
+        config: cfg,
+        spacing: 2,
+      });
 
       // Remove corresponding groups from topic registry
       const registry = topicRegistry.readRegistry();

package/lib/server/telegram-workspace.js

@@ -1,8 +1,11 @@
 const kTelegramTopicConcurrencyMultiplier = 3;
 const kAgentConcurrencyFloor = 8;
 const kSubagentConcurrencyFloor = 4;
-
-const normalizeAccountId = (value) => String(value || "").trim() || "default";
+const { normalizeAccountId } = require("./utils/channels");
+const {
+  readOpenclawConfig,
+  writeOpenclawConfig,
+} = require("./openclaw-config");
 
 const resolveTelegramAccountConfig = ({ telegramConfig, accountId }) => {
   const normalizedAccountId = normalizeAccountId(accountId);
@@ -38,8 +41,11 @@ const syncConfigForTelegram = ({
   requireMention = false,
   resolvedUserId = "",
 }) => {
-  const configPath = `${openclawDir}/openclaw.json`;
-  const cfg = JSON.parse(fs.readFileSync(configPath, "utf8"));
+  const cfg = readOpenclawConfig({
+    fsModule: fs,
+    openclawDir,
+    fallback: {},
+  });
 
   // Remove legacy root keys from older setup flow.
   delete cfg.sessions;
@@ -82,8 +88,12 @@ const syncConfigForTelegram = ({
   const promptTopics = {};
   for (const [threadId, topic] of Object.entries(registryTopics)) {
     const systemPrompt = String(topic?.systemInstructions || "").trim();
-    if (!systemPrompt) continue;
-    promptTopics[threadId] = { systemPrompt };
+    const topicAgentId = String(topic?.agentId || "").trim();
+    if (!systemPrompt && !topicAgentId) continue;
+    promptTopics[threadId] = {
+      ...(systemPrompt ? { systemPrompt } : {}),
+      ...(topicAgentId ? { agentId: topicAgentId } : {}),
+    };
   }
   if (Object.keys(promptTopics).length > 0) {
     targetConfig.groups[groupId].topics = promptTopics;
@@ -121,7 +131,12 @@ const syncConfigForTelegram = ({
     kSubagentConcurrencyFloor,
   );
 
-  fs.writeFileSync(configPath, JSON.stringify(cfg, null, 2));
+  writeOpenclawConfig({
+    fsModule: fs,
+    openclawDir,
+    config: cfg,
+    spacing: 2,
+  });
 
   return {
     totalTopics,

package/lib/server/topic-registry.js

@@ -1,13 +1,10 @@
 const fs = require("fs");
 const { WORKSPACE_DIR } = require("./constants");
+const { normalizeAccountId } = require("./utils/channels");
 
 const kRegistryPath = `${WORKSPACE_DIR}/topic-registry.json`;
-const kDefaultAccountId = "default";
 const kDefaultAgentId = "default";
 
-const normalizeAccountId = (value) =>
-  String(value || "").trim() || kDefaultAccountId;
-
 const normalizeGroupAgentId = (value) =>
   String(value || "").trim() || kDefaultAgentId;
 

package/lib/server/utils/channels.js

@@ -0,0 +1,13 @@
+const normalizeAccountId = (value) => String(value || "").trim() || "default";
+
+const hasScopedBindingFields = (match = {}) =>
+  !!match.peer ||
+  !!match.parentPeer ||
+  !!String(match.guildId || "").trim() ||
+  !!String(match.teamId || "").trim() ||
+  (Array.isArray(match.roles) && match.roles.length > 0);
+
+module.exports = {
+  normalizeAccountId,
+  hasScopedBindingFields,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrysb/alphaclaw",
-  "version": "0.6.0-beta.1",
+  "version": "0.6.0-beta.3",
   "publishConfig": {
     "access": "public"
   },