@chrysb/alphaclaw 0.8.3-beta.5 → 0.8.4-beta.0

package/lib/server/routes/nodes.js

@@ -1,7 +1,10 @@
-const path = require("path");
 const crypto = require("crypto");
 const { parseJsonObjectFromNoisyOutput } = require("../utils/json");
 const { quoteShellArg } = require("../utils/shell");
+const {
+  readExecApprovalsConfig,
+  writeExecApprovalsConfig,
+} = require("../exec-defaults-config");
 
 const kAllowedExecHosts = new Set(["gateway", "node"]);
 const kAllowedExecSecurity = new Set(["deny", "allowlist", "full"]);
@@ -81,23 +84,6 @@ const parseNodeBrowserStatus = (stdout) => {
   return decodedResult && typeof decodedResult === "object" ? decodedResult : null;
 };
 
-const readExecApprovalsFile = ({ fsModule, openclawDir }) => {
-  const filePath = path.join(openclawDir, "exec-approvals.json");
-  try {
-    const raw = fsModule.readFileSync(filePath, "utf8");
-    const parsed = JSON.parse(raw);
-    return parsed && typeof parsed === "object" ? parsed : { version: 1 };
-  } catch {
-    return { version: 1 };
-  }
-};
-
-const writeExecApprovalsFile = ({ fsModule, openclawDir, file }) => {
-  const filePath = path.join(openclawDir, "exec-approvals.json");
-  fsModule.mkdirSync(path.dirname(filePath), { recursive: true });
-  fsModule.writeFileSync(filePath, JSON.stringify(file, null, 2) + "\n", "utf8");
-};
-
 const ensureWildcardAgent = (file) => {
   const agents = file.agents && typeof file.agents === "object" ? file.agents : {};
   const wildcard =
@@ -372,7 +358,7 @@ const registerNodeRoutes = ({
 
   app.get("/api/nodes/exec-approvals", (_req, res) => {
     const approvals = ensureWildcardAgent(
-      readExecApprovalsFile({ fsModule, openclawDir }),
+      readExecApprovalsConfig({ fsModule, openclawDir }),
     );
     const allowlist = approvals?.agents?.["*"]?.allowlist || [];
     return res.json({
@@ -388,7 +374,7 @@ const registerNodeRoutes = ({
       return res.status(400).json({ ok: false, error: "pattern is required" });
     }
     const approvals = ensureWildcardAgent(
-      readExecApprovalsFile({ fsModule, openclawDir }),
+      readExecApprovalsConfig({ fsModule, openclawDir }),
     );
     const allowlist = approvals.agents["*"].allowlist;
     const existing = allowlist.find(
@@ -403,7 +389,7 @@ const registerNodeRoutes = ({
       lastUsedAt: Date.now(),
     };
     approvals.agents["*"].allowlist = [...allowlist, entry];
-    writeExecApprovalsFile({ fsModule, openclawDir, file: approvals });
+    writeExecApprovalsConfig({ fsModule, openclawDir, file: approvals });
     return res.json({ ok: true, entry });
   });
 
@@ -413,7 +399,7 @@ const registerNodeRoutes = ({
       return res.status(400).json({ ok: false, error: "id is required" });
     }
     const approvals = ensureWildcardAgent(
-      readExecApprovalsFile({ fsModule, openclawDir }),
+      readExecApprovalsConfig({ fsModule, openclawDir }),
     );
     const allowlist = approvals.agents["*"].allowlist;
     const nextAllowlist = allowlist.filter((entry) => String(entry?.id || "") !== id);
@@ -421,7 +407,7 @@ const registerNodeRoutes = ({
       return res.status(404).json({ ok: false, error: "Allowlist entry not found" });
     }
     approvals.agents["*"].allowlist = nextAllowlist;
-    writeExecApprovalsFile({ fsModule, openclawDir, file: approvals });
+    writeExecApprovalsConfig({ fsModule, openclawDir, file: approvals });
     return res.json({ ok: true });
   });
 };

package/lib/server/slack-api.js

@@ -233,6 +233,72 @@ const createSlackApi = (getToken) => {
     });
   };
 
+  /**
+   * Update an existing message
+   * @param {string} channel - Channel ID
+   * @param {string} timestamp - Message timestamp
+   * @param {string} text - New message text
+   * @returns {Promise<object>} Update response
+   * @requires chat:write OAuth scope
+   */
+  const updateMessage = (channel, timestamp, text) => {
+    return call("chat.update", {
+      channel,
+      ts: timestamp,
+      text: String(text || ""),
+    });
+  };
+
+  /**
+   * Delete a message
+   * @param {string} channel - Channel ID
+   * @param {string} timestamp - Message timestamp
+   * @requires chat:write OAuth scope
+   */
+  const deleteMessage = (channel, timestamp) => {
+    return call("chat.delete", { channel, ts: timestamp });
+  };
+
+  /**
+   * Pin a message to a channel
+   * @param {string} channel - Channel ID
+   * @param {string} timestamp - Message timestamp
+   * @requires pins:write OAuth scope
+   */
+  const pinMessage = (channel, timestamp) => {
+    return call("pins.add", { channel, timestamp });
+  };
+
+  /**
+   * Unpin a message from a channel
+   * @param {string} channel - Channel ID
+   * @param {string} timestamp - Message timestamp
+   * @requires pins:write OAuth scope
+   */
+  const unpinMessage = (channel, timestamp) => {
+    return call("pins.remove", { channel, timestamp });
+  };
+
+  /**
+   * Get user information
+   * @param {string} userId - User ID
+   * @returns {Promise<object>} User info (name, real_name, email, etc.)
+   * @requires users:read OAuth scope
+   */
+  const getUserInfo = (userId) => {
+    return call("users.info", { user: userId });
+  };
+
+  /**
+   * Get channel information
+   * @param {string} channelId - Channel ID
+   * @returns {Promise<object>} Channel info (name, topic, purpose, etc.)
+   * @requires channels:read or groups:read OAuth scope (depending on channel type)
+   */
+  const getChannelInfo = (channelId) => {
+    return call("conversations.info", { channel: channelId });
+  };
+
   return {
     authTest,
     postMessage,
@@ -241,6 +307,12 @@ const createSlackApi = (getToken) => {
     removeReaction,
     uploadFile,
     uploadTextSnippet,
+    updateMessage,
+    deleteMessage,
+    pinMessage,
+    unpinMessage,
+    getUserInfo,
+    getChannelInfo,
   };
 };
 

package/lib/server/startup.js

@@ -1,4 +1,5 @@
 const runOnboardedBootSequence = ({
+  ensureManagedExecDefaults,
   ensureUsageTrackerPluginConfig,
   doSyncPromptFiles,
   reloadEnv,
@@ -10,6 +11,13 @@ const runOnboardedBootSequence = ({
   watchdog,
   gmailWatchService,
 }) => {
+  try {
+    ensureManagedExecDefaults();
+  } catch (error) {
+    console.error(
+      `[alphaclaw] Failed to ensure managed exec defaults on boot: ${error.message}`,
+    );
+  }
   try {
     ensureUsageTrackerPluginConfig();
   } catch (error) {

package/lib/server/watchdog-notify.js

@@ -1,35 +1,95 @@
 const fs = require("fs");
 const path = require("path");
 const { OPENCLAW_DIR } = require("./constants");
+const { createSlackApi } = require("./slack-api");
 
-const getPairedIds = (channel) => {
+const kSlackBotEnvKey = "SLACK_BOT_TOKEN";
+
+const normalizeAccountId = (value) =>
+  String(value || "").trim().toLowerCase() || "default";
+
+const resolveCredentialPairingAccountId = ({ channel, fileName }) => {
+  const prefix = `${String(channel || "").trim().toLowerCase()}-`;
+  const suffix = "-allowFrom.json";
+  const rawFileName = String(fileName || "").trim();
+  if (!rawFileName.startsWith(prefix) || !rawFileName.endsWith(suffix)) {
+    return "";
+  }
+  return normalizeAccountId(rawFileName.slice(prefix.length, -suffix.length));
+};
+
+const deriveSlackBotEnvKey = (accountId = "default") => {
+  const normalizedAccountId = normalizeAccountId(accountId);
+  if (normalizedAccountId === "default") return kSlackBotEnvKey;
+  return `${kSlackBotEnvKey}_${normalizedAccountId.replace(/-/g, "_").toUpperCase()}`;
+};
+
+const getPairedTargetsByAccount = ({
+  channel,
+  fsImpl = fs,
+  openclawDir = OPENCLAW_DIR,
+}) => {
   const safeChannel = String(channel || "").trim().toLowerCase();
-  if (!safeChannel) return [];
-  const credentialsDir = path.join(OPENCLAW_DIR, "credentials");
-  if (!fs.existsSync(credentialsDir)) return [];
-  const ids = new Set();
+  if (!safeChannel) return new Map();
+  const credentialsDir = path.join(openclawDir, "credentials");
+  if (!fsImpl.existsSync(credentialsDir)) return new Map();
+  const idsByAccount = new Map();
   try {
-    const files = fs
+    const files = fsImpl
       .readdirSync(credentialsDir)
       .filter(
         (fileName) =>
           fileName.startsWith(`${safeChannel}-`) && fileName.endsWith("-allowFrom.json"),
       );
     for (const fileName of files) {
+      const accountId = resolveCredentialPairingAccountId({
+        channel: safeChannel,
+        fileName,
+      });
+      if (!accountId) continue;
       const filePath = path.join(credentialsDir, fileName);
-      const raw = fs.readFileSync(filePath, "utf8");
+      const raw = fsImpl.readFileSync(filePath, "utf8");
       const parsed = JSON.parse(raw);
       const allowFrom = Array.isArray(parsed?.allowFrom) ? parsed.allowFrom : [];
+      const ids =
+        idsByAccount.get(accountId) instanceof Set
+          ? idsByAccount.get(accountId)
+          : new Set();
       for (const id of allowFrom) {
         if (id == null) continue;
         const value = String(id).trim();
         if (!value) continue;
         ids.add(value);
       }
+      idsByAccount.set(accountId, ids);
     }
   } catch (err) {
     console.error(`[watchdog] could not resolve ${safeChannel} allowFrom IDs: ${err.message}`);
   }
+  return new Map(
+    Array.from(idsByAccount.entries()).map(([accountId, ids]) => [
+      accountId,
+      Array.from(ids),
+    ]),
+  );
+};
+
+const getPairedIds = ({
+  channel,
+  fsImpl = fs,
+  openclawDir = OPENCLAW_DIR,
+}) => {
+  const ids = new Set();
+  const idsByAccount = getPairedTargetsByAccount({
+    channel,
+    fsImpl,
+    openclawDir,
+  });
+  for (const accountIds of idsByAccount.values()) {
+    for (const id of accountIds) {
+      ids.add(id);
+    }
+  }
   return Array.from(ids);
 };
 
@@ -38,18 +98,30 @@ const formatDiscordMessage = (message) =>
 
 /**
  * Track thread state for Slack notifications
- * Key: userId, Value: { threadTs, lastEvent }
+ * Key: accountId:userId, Value: { threadTs, lastEvent }
  */
 const slackThreads = new Map();
 
-const createWatchdogNotifier = ({ telegramApi, discordApi, slackApi }) => {
+const createWatchdogNotifier = ({
+  telegramApi,
+  discordApi,
+  slackApi,
+  readEnvFile = () => [],
+  createSlackApi: createSlackApiFactory = createSlackApi,
+  fsImpl = fs,
+  openclawDir = OPENCLAW_DIR,
+}) => {
   const notify = async (message, opts = {}) => {
     const summary = {
       telegram: { sent: 0, failed: 0, skipped: false, targets: 0 },
       discord: { sent: 0, failed: 0, skipped: false, targets: 0 },
       slack: { sent: 0, failed: 0, skipped: false, targets: 0 },
     };
-    const telegramTargets = getPairedIds("telegram");
+    const telegramTargets = getPairedIds({
+      channel: "telegram",
+      fsImpl,
+      openclawDir,
+    });
     summary.telegram.targets = telegramTargets.length;
     if (!telegramApi?.sendMessage || !process.env.TELEGRAM_BOT_TOKEN || telegramTargets.length === 0) {
       summary.telegram.skipped = true;
@@ -67,7 +139,11 @@ const createWatchdogNotifier = ({ telegramApi, discordApi, slackApi }) => {
       }
     }
 
-    const discordTargets = getPairedIds("discord");
+    const discordTargets = getPairedIds({
+      channel: "discord",
+      fsImpl,
+      openclawDir,
+    });
     summary.discord.targets = discordTargets.length;
     if (!discordApi?.sendDirectMessage || !process.env.DISCORD_BOT_TOKEN || discordTargets.length === 0) {
       summary.discord.skipped = true;
@@ -85,61 +161,102 @@ const createWatchdogNotifier = ({ telegramApi, discordApi, slackApi }) => {
     }
 
     // Enhanced Slack notifications with threading and reactions
-    const slackTargets = getPairedIds("slack");
-    summary.slack.targets = slackTargets.length;
-    if (!slackApi?.postMessage || !process.env.SLACK_BOT_TOKEN || slackTargets.length === 0) {
+    const slackTargetsByAccount = getPairedTargetsByAccount({
+      channel: "slack",
+      fsImpl,
+      openclawDir,
+    });
+    summary.slack.targets = Array.from(slackTargetsByAccount.values()).reduce(
+      (total, targets) => total + targets.length,
+      0,
+    );
+    if (summary.slack.targets === 0) {
       summary.slack.skipped = true;
     } else {
       const eventType = opts.eventType || "info"; // crash, recovery, health, info
-      
-      for (const userId of slackTargets) {
-        try {
-          let threadTs = null;
-          let shouldCreateNewThread = true;
-
-          // Check if we have an active thread for this user
-          const existingThread = slackThreads.get(userId);
-          if (existingThread && existingThread.lastEvent === "crash" && eventType === "recovery") {
-            // Recovery message goes in the crash thread
-            threadTs = existingThread.threadTs;
-            shouldCreateNewThread = false;
+      const envVars = typeof readEnvFile === "function" ? readEnvFile() : [];
+
+      const envMap = new Map(
+        (Array.isArray(envVars) ? envVars : [])
+          .map((entry) => [
+            String(entry?.key || "").trim(),
+            String(entry?.value || "").trim(),
+          ])
+          .filter(([key]) => key),
+      );
+
+      for (const [accountId, slackTargets] of slackTargetsByAccount.entries()) {
+        if (!slackTargets.length) continue;
+        const envKey = deriveSlackBotEnvKey(accountId);
+        const botToken = String(envMap.get(envKey) || process.env[envKey] || "").trim();
+        if (!botToken) {
+          summary.slack.failed += slackTargets.length;
+          for (const userId of slackTargets) {
+            console.error(
+              `[watchdog] slack notification failed for ${accountId}/${userId}: missing ${envKey}`,
+            );
           }
+          continue;
+        }
 
-          // Send message (in thread if continuing conversation)
-          const result = await slackApi.postMessage(userId, String(message || ""), {
-            thread_ts: threadTs,
-            mrkdwn: true,
-          });
+        const accountSlackApi =
+          accountId === "default" &&
+          slackApi?.postMessage &&
+          botToken === String(process.env.SLACK_BOT_TOKEN || "").trim()
+            ? slackApi
+            : createSlackApiFactory(() => botToken);
+
+        for (const userId of slackTargets) {
+          try {
+            let threadTs = null;
+            let shouldCreateNewThread = true;
+            const threadKey = `${accountId}:${userId}`;
+
+            const existingThread = slackThreads.get(threadKey);
+            if (existingThread && existingThread.lastEvent === "crash" && eventType === "recovery") {
+              threadTs = existingThread.threadTs;
+              shouldCreateNewThread = false;
+            }
 
-          // Store thread for future related messages
-          if (shouldCreateNewThread && result.ts) {
-            slackThreads.set(userId, {
-              threadTs: result.ts,
-              lastEvent: eventType,
+            const result = await accountSlackApi.postMessage(userId, String(message || ""), {
+              thread_ts: threadTs,
+              mrkdwn: true,
             });
-          }
 
-          // Add reactions based on event type
-          // Use result.channel (the actual conversation/DM ID) instead of userId
-          if (result.ts && result.channel && slackApi.addReaction) {
-            try {
-              if (eventType === "crash") {
-                await slackApi.addReaction(result.channel, result.ts, "x");
-              } else if (eventType === "recovery") {
-                await slackApi.addReaction(result.channel, result.ts, "white_check_mark");
-              } else if (eventType === "health") {
-                await slackApi.addReaction(result.channel, result.ts, "heart");
+            if (shouldCreateNewThread && result.ts) {
+              slackThreads.set(threadKey, {
+                threadTs: result.ts,
+                lastEvent: eventType,
+              });
+            }
+
+            if (result.ts && result.channel && accountSlackApi.addReaction) {
+              try {
+                if (eventType === "crash") {
+                  await accountSlackApi.addReaction(result.channel, result.ts, "x");
+                } else if (eventType === "recovery") {
+                  await accountSlackApi.addReaction(
+                    result.channel,
+                    result.ts,
+                    "white_check_mark",
+                  );
+                } else if (eventType === "health") {
+                  await accountSlackApi.addReaction(result.channel, result.ts, "heart");
+                }
+              } catch (reactionErr) {
+                console.error(
+                  `[watchdog] slack reaction failed for ${accountId}/${userId}: ${reactionErr.message}`,
+                );
               }
-            } catch (reactionErr) {
-              // Reactions are nice-to-have, don't fail the whole notification
-              console.error(`[watchdog] slack reaction failed for ${userId}: ${reactionErr.message}`);
             }
-          }
 
-          summary.slack.sent += 1;
-        } catch (err) {
-          summary.slack.failed += 1;
-          console.error(`[watchdog] slack notification failed for ${userId}: ${err.message}`);
+            summary.slack.sent += 1;
+          } catch (err) {
+            summary.slack.failed += 1;
+            console.error(
+              `[watchdog] slack notification failed for ${accountId}/${userId}: ${err.message}`,
+            );
+          }
         }
       }
     }

package/lib/server.js

@@ -138,6 +138,9 @@ const {
 const {
   ensureUsageTrackerPluginConfig,
 } = require("./server/usage-tracker-config");
+const {
+  ensureManagedExecDefaults,
+} = require("./server/exec-defaults-config");
 
 const { PORT, kTrustProxyHops, SETUP_API_PREFIXES } = constants;
 
@@ -223,7 +226,12 @@ const webhookMiddleware = createWebhookMiddleware({
 const telegramApi = createTelegramApi(() => process.env.TELEGRAM_BOT_TOKEN);
 const discordApi = createDiscordApi(() => process.env.DISCORD_BOT_TOKEN);
 const slackApi = createSlackApi(() => process.env.SLACK_BOT_TOKEN);
-const watchdogNotifier = createWatchdogNotifier({ telegramApi, discordApi, slackApi });
+const watchdogNotifier = createWatchdogNotifier({
+  telegramApi,
+  discordApi,
+  slackApi,
+  readEnvFile,
+});
 const watchdog = createWatchdog({
   clawCmd,
   launchGatewayProcess,
@@ -379,6 +387,11 @@ startServerLifecycle({
   PORT,
   isOnboarded,
   runOnboardedBootSequence,
+  ensureManagedExecDefaults: () =>
+    ensureManagedExecDefaults({
+      fsModule: fs,
+      openclawDir: constants.OPENCLAW_DIR,
+    }),
   ensureUsageTrackerPluginConfig: () =>
     ensureUsageTrackerPluginConfig({
       fsModule: fs,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrysb/alphaclaw",
-  "version": "0.8.3-beta.5",
+  "version": "0.8.4-beta.0",
   "publishConfig": {
     "access": "public"
   },
@@ -36,7 +36,7 @@
   "dependencies": {
     "express": "^4.21.0",
     "http-proxy": "^1.18.1",
-    "openclaw": "^2026.3.28",
+    "openclaw": "2026.4.1",
     "patch-package": "^8.0.1",
     "ws": "^8.19.0"
   },

package/patches/openclaw+2026.4.1.patch

@@ -0,0 +1,13 @@
+diff --git a/node_modules/openclaw/dist/gateway-cli-6Ksv5U_O.js b/node_modules/openclaw/dist/gateway-cli-6Ksv5U_O.js
+index 4c742cee..bb87239b 100644
+--- a/node_modules/openclaw/dist/gateway-cli-6Ksv5U_O.js
++++ b/node_modules/openclaw/dist/gateway-cli-6Ksv5U_O.js
+@@ -26669,7 +26669,7 @@ function attachGatewayWsMessageHandler(params) {
+ 					close(1008, truncateCloseReason(authMessage));
+ 				};
+ 				const clearUnboundScopes = () => {
+-					if (scopes.length > 0) {
++					if (scopes.length > 0 && !sharedAuthOk) {
+ 						scopes = [];
+ 						connectParams.scopes = scopes;
+ 					}

package/lib/setup/core-prompts/UI-DRY-OPPORTUNITIES.md

@@ -1,50 +0,0 @@
-### Prioritized Implementation Order
-
-1. **[P0 | S] Unify toast type mapping in one place so callers consistently use semantic levels.**
-   - [x] Update `lib/public/js/components/toast.js` (`showToast`, `ToastContainer`) to normalize legacy values.
-   - [x] Normalize highest-impact callers first: `lib/public/js/components/providers.js`, `lib/public/js/components/models.js`, `lib/public/js/components/google.js`, `lib/public/js/components/gateway.js`, `lib/public/js/components/envars.js`, `lib/public/js/components/webhooks.js`.
-   - Current inconsistency snapshot:
-     - Legacy color callers: `lib/public/js/components/providers.js`, `lib/public/js/components/models.js`, `lib/public/js/components/google.js`.
-     - Semantic callers: `lib/public/js/components/envars.js`, `lib/public/js/components/webhooks.js`, `lib/public/js/components/gateway.js`, `lib/public/js/components/telegram-workspace.js`.
-
-2. **[P0 | M] Add a shared restart banner component (and/or restart hook) for restart-required flows.**
-   - [x] Extract shared banner + handler state from: `lib/public/js/components/envars.js`, `lib/public/js/components/providers.js`, `lib/public/js/components/webhooks.js`.
-   - [x] Keep `restartGateway` integration aligned with existing gateway action UI in `lib/public/js/components/gateway.js`.
-   - Current inconsistency snapshot:
-     - Duplicate banner + state + handler logic in the same 3 files above.
-
-3. **[P1 | S] Add a small shared loading spinner component to replace repeated inline SVG.**
-   - [x] Replace inline spinners in: `lib/public/js/app.js`, `lib/public/js/components/providers.js`, `lib/public/js/components/models.js`, `lib/public/js/components/onboarding/welcome-setup-step.js`.
-   - [x] Evaluate whether `lib/public/js/components/update-action-button.js` should consume the shared spinner as well.
-   - Current inconsistency snapshot:
-     - Spinner markup shape and sizing differ slightly by file.
-
-4. **[P1 | M] Standardize button styles around `ac-btn-*` + common disabled treatment.**
-   - [x] Convert ad-hoc utility button patterns in: `lib/public/js/components/pairings.js` (Reject), `lib/public/js/components/device-pairings.js` (Reject), `lib/public/js/components/webhooks.js` (Create/Delete), `lib/public/js/components/google.js` (disconnect action), `lib/public/js/components/providers.js` (Codex reconnect/disconnect/restart).
-   - [x] Align onboarding variants in: `lib/public/js/components/onboarding/welcome-setup-step.js`, `lib/public/js/components/onboarding/welcome-form-step.js`, `lib/public/js/components/onboarding/welcome-pairing-step.js`.
-   - Current inconsistency snapshot:
-     - Mixed custom classes vs ad-hoc border utility buttons.
-
-5. **[P1 | S] Normalize disabled opacity usage to one convention.**
-   - [x] Standardize `opacity-50` vs `opacity-60` in:
-     - `lib/public/js/components/envars.js`
-     - `lib/public/js/components/providers.js`
-     - `lib/public/js/components/webhooks.js`
-     - `lib/public/js/components/telegram-workspace.js`
-     - `lib/public/js/components/onboarding/welcome-setup-step.js`
-     - `lib/public/js/components/onboarding/welcome-pairing-step.js`
-   - Current inconsistency snapshot:
-     - `opacity-50` and `opacity-60` both used for disabled states.
-
-6. **[P2 | M] Consider a shared action button wrapper for common save/create/delete states.**
-   - [x] Evaluate extraction points in: `lib/public/js/components/envars.js`, `lib/public/js/components/providers.js`, `lib/public/js/components/webhooks.js`, `lib/public/js/components/models.js`, `lib/public/js/components/pairings.js`, `lib/public/js/components/device-pairings.js`.
-   - Current inconsistency snapshot:
-     - Repeated action-label + loading-label + disabled-guard patterns.
-
-7. **[P2 | M] Extract a shared modal shell wrapper for non-confirm custom modals.**
-   - [x] Factor shared overlay/panel shell from:
-     - `lib/public/js/components/webhooks.js` (`CreateWebhookModal`)
-     - `lib/public/js/components/credentials-modal.js`
-   - [x] Keep parity with `lib/public/js/components/confirm-dialog.js` behavior (overlay click + Escape semantics).
-   - Current inconsistency snapshot:
-     - Same modal shell classes/structure repeated with minor differences.

package/patches/openclaw+2026.3.28.patch

@@ -1,13 +0,0 @@
-diff --git a/node_modules/openclaw/dist/gateway-cli-DlnlX7IW.js b/node_modules/openclaw/dist/gateway-cli-DlnlX7IW.js
-index ca48b932..c12478c4 100644
---- a/node_modules/openclaw/dist/gateway-cli-DlnlX7IW.js
-+++ b/node_modules/openclaw/dist/gateway-cli-DlnlX7IW.js
-@@ -25935,7 +25935,7 @@ function attachGatewayWsMessageHandler(params) {
- 					close(1008, truncateCloseReason(authMessage));
- 				};
- 				const clearUnboundScopes = () => {
--					if (scopes.length > 0) {
-+					if (scopes.length > 0 && !sharedAuthOk) {
- 						scopes = [];
- 						connectParams.scopes = scopes;
- 					}