@chrysb/alphaclaw 0.9.17 → 0.9.19

package/lib/server/gateway.js

@@ -11,7 +11,12 @@ const {
   kOnboardingMarkerPath,
   kRootDir,
 } = require("./constants");
+const {
+  normalizeChannelAccountId,
+  readPairedCountsByAccount,
+} = require("./agents/shared");
 const { withOpenclawStartupEnv } = require("./openclaw-runtime-env");
+const { isOpenAiCompatApiEnabled } = require("./alphaclaw-config");
 
 let gatewayChild = null;
 let gatewayExitHandler = null;
@@ -202,18 +207,6 @@ const getGatewayPort = () => {
 
 const getGatewayUrl = () => `http://${GATEWAY_HOST}:${getGatewayPort()}`;
 
-const normalizeChannelAccountId = (value) => String(value || "").trim() || "default";
-
-const resolveCredentialPairingAccountId = ({ channel, fileName }) => {
-  const prefix = `${String(channel || "").trim()}-`;
-  const suffix = "-allowFrom.json";
-  if (!String(fileName || "").startsWith(prefix) || !String(fileName || "").endsWith(suffix)) {
-    return "";
-  }
-  const rawAccountId = String(fileName || "").slice(prefix.length, -suffix.length);
-  return normalizeChannelAccountId(rawAccountId);
-};
-
 const isGatewayRunning = () =>
   new Promise((resolve) => {
     const sock = net.createConnection(getGatewayPort(), GATEWAY_HOST);
@@ -505,6 +498,31 @@ const ensureGatewayProxyConfig = (origin) => {
     if (!cfg.gateway) cfg.gateway = {};
     let changed = false;
 
+    if (isOpenAiCompatApiEnabled({ fsModule: fs, openclawDir: OPENCLAW_DIR })) {
+      if (!cfg.gateway.http) cfg.gateway.http = {};
+      if (!cfg.gateway.http.endpoints) cfg.gateway.http.endpoints = {};
+
+      const chatCompletions = cfg.gateway.http.endpoints.chatCompletions || {};
+      if (chatCompletions.enabled !== true) {
+        cfg.gateway.http.endpoints.chatCompletions = {
+          ...chatCompletions,
+          enabled: true,
+        };
+        console.log("[alphaclaw] Enabled gateway OpenAI chat completions endpoint");
+        changed = true;
+      }
+
+      const responses = cfg.gateway.http.endpoints.responses || {};
+      if (responses.enabled !== true) {
+        cfg.gateway.http.endpoints.responses = {
+          ...responses,
+          enabled: true,
+        };
+        console.log("[alphaclaw] Enabled gateway OpenResponses endpoint");
+        changed = true;
+      }
+    }
+
     if (!Array.isArray(cfg.gateway.trustedProxies)) {
       cfg.gateway.trustedProxies = [];
     }
@@ -526,8 +544,144 @@ const ensureGatewayProxyConfig = (origin) => {
       }
     }
 
+    // Managed remote MCP server entry. Env-driven so any AlphaClaw operator
+    // (Render, Fly, fly.io-style PaaS, plain VPS) can wire OpenClaw to a
+    // remote MCP server without hand-editing /data/.openclaw/openclaw.json.
+    //
+    //   REMOTE_MCP_URL         upstream MCP endpoint (streamable-http).
+    //   REMOTE_MCP_API_TOKEN   Bearer token the remote MCP expects. Persisted
+    //                          as the ${REMOTE_MCP_API_TOKEN} reference, not
+    //                          raw, so the openclaw.json that gets
+    //                          git-committed never holds the plaintext.
+    //   REMOTE_MCP_NAME        Key under mcp.servers.<name>. Default "remote".
+    //   REMOTE_MCP_PROXY_URL   When set, OpenClaw connects here instead of
+    //                          REMOTE_MCP_URL. Intended for a same-host
+    //                          scanning proxy (e.g. `pipelock mcp proxy
+    //                          --listen ... --upstream <REMOTE_MCP_URL>`),
+    //                          but the implementation is proxy-agnostic.
+    //                          The supervisor that starts that proxy is
+    //                          responsible for unsetting this env var when
+    //                          the proxy is not running, so AlphaClaw never
+    //                          points OpenClaw at a dead listener.
+    const remoteMcpUrl = String(process.env.REMOTE_MCP_URL || "").trim();
+    const remoteMcpToken = String(
+      process.env.REMOTE_MCP_API_TOKEN || "",
+    ).trim();
+    const remoteMcpProxyUrl = String(
+      process.env.REMOTE_MCP_PROXY_URL || "",
+    ).trim();
+    const remoteMcpNameRaw = String(process.env.REMOTE_MCP_NAME || "").trim();
+    // Constrain the managed key. OpenClaw sanitizes names later for tool
+    // prefixes, but the config-key itself must be safe to use as an object
+    // key and to read back in `openclaw mcp` CLI commands. Reject names
+    // with prototype-pollution shapes, spaces, or path-like names; fall
+    // back to "remote" with a warning so a typo doesn't silently misroute.
+    const kRemoteMcpNamePattern = /^[A-Za-z0-9_-]{1,64}$/;
+    const kReservedRemoteMcpNames = new Set([
+      "__proto__",
+      "constructor",
+      "prototype",
+    ]);
+    let remoteMcpName = "remote";
+    if (remoteMcpNameRaw) {
+      if (
+        kRemoteMcpNamePattern.test(remoteMcpNameRaw) &&
+        !kReservedRemoteMcpNames.has(remoteMcpNameRaw)
+      ) {
+        remoteMcpName = remoteMcpNameRaw;
+      } else {
+        console.warn(
+          `[alphaclaw] REMOTE_MCP_NAME=${JSON.stringify(remoteMcpNameRaw)} is invalid (must match ${kRemoteMcpNamePattern} and not be a reserved key); falling back to "remote"`,
+        );
+      }
+    }
+    const placeholderAuth = "Bearer ${REMOTE_MCP_API_TOKEN}";
+    const desiredAuth = `Bearer ${remoteMcpToken}`;
+    const kManagedMarker = "_alphaclawManaged";
+    let mcpChanged = false;
+
+    // Clean up any managed entries left over from a prior REMOTE_MCP_NAME
+    // value. Without this, renaming REMOTE_MCP_NAME from "sure" to "notion"
+    // would leave the old "sure" entry behind, duplicating MCP tools or
+    // routing callbacks to a stale target. The marker scopes the cleanup so
+    // user-managed entries (no marker) are never touched.
+    if (cfg.mcp?.servers) {
+      for (const [key, entry] of Object.entries(cfg.mcp.servers)) {
+        if (
+          entry &&
+          typeof entry === "object" &&
+          entry[kManagedMarker] === true &&
+          key !== remoteMcpName
+        ) {
+          delete cfg.mcp.servers[key];
+          mcpChanged = true;
+          console.log(
+            `[alphaclaw] Removed stale managed MCP server "${key}" (REMOTE_MCP_NAME is now "${remoteMcpName}")`,
+          );
+        }
+      }
+    }
+
+    if (remoteMcpUrl && remoteMcpToken) {
+      if (!cfg.mcp) cfg.mcp = {};
+      if (!cfg.mcp.servers) cfg.mcp.servers = {};
+      const existing = cfg.mcp.servers[remoteMcpName] || {};
+      const effectiveUrl = remoteMcpProxyUrl || remoteMcpUrl;
+      const existingHeaders = existing.headers || {};
+      const existingAuth = existingHeaders.Authorization;
+      // Only the placeholder counts as "already sanitized". A plaintext
+      // Bearer (even one that matches the current desiredAuth) must trigger a
+      // rewrite so the substitution loop below scrubs it back to the
+      // ${REMOTE_MCP_API_TOKEN} reference.
+      const authIsPlaceholder = existingAuth === placeholderAuth;
+      const hasManagedMarker = existing[kManagedMarker] === true;
+      if (
+        existing.url !== effectiveUrl ||
+        existing.transport !== "streamable-http" ||
+        !authIsPlaceholder ||
+        !hasManagedMarker
+      ) {
+        cfg.mcp.servers[remoteMcpName] = {
+          ...existing,
+          url: effectiveUrl,
+          transport: "streamable-http",
+          headers: {
+            ...existingHeaders,
+            Authorization: desiredAuth,
+          },
+          [kManagedMarker]: true,
+        };
+        mcpChanged = true;
+        console.log(
+          `[alphaclaw] Configured remote MCP server "${remoteMcpName}" (url=${effectiveUrl}, via_proxy=${Boolean(remoteMcpProxyUrl)})`,
+        );
+      }
+    } else if (
+      cfg.mcp?.servers?.[remoteMcpName] &&
+      cfg.mcp.servers[remoteMcpName][kManagedMarker] === true
+    ) {
+      delete cfg.mcp.servers[remoteMcpName];
+      mcpChanged = true;
+      console.log(
+        `[alphaclaw] Removed remote MCP server "${remoteMcpName}" entry (REMOTE_MCP_URL / REMOTE_MCP_API_TOKEN unset)`,
+      );
+    }
+    if (cfg.mcp?.servers && Object.keys(cfg.mcp.servers).length === 0) {
+      delete cfg.mcp.servers;
+    }
+    if (cfg.mcp && Object.keys(cfg.mcp).length === 0) {
+      delete cfg.mcp;
+    }
+    if (mcpChanged) changed = true;
+
     if (changed) {
-      fs.writeFileSync(configPath, JSON.stringify(cfg, null, 2));
+      let content = JSON.stringify(cfg, null, 2);
+      if (remoteMcpToken) {
+        const jsonValue = JSON.stringify(desiredAuth);
+        const jsonPlaceholder = JSON.stringify(placeholderAuth);
+        content = content.split(jsonValue).join(jsonPlaceholder);
+      }
+      fs.writeFileSync(configPath, content);
     }
     return changed;
   } catch (e) {
@@ -619,32 +773,6 @@ const getChannelStatus = () => {
     );
     const credDir = `${OPENCLAW_DIR}/credentials`;
     const channels = {};
-    const hasImplicitWhatsAppSelfPairing = ({ accountId, accountConfig }) => {
-      if (!accountConfig || typeof accountConfig !== "object") return false;
-      if (accountConfig.selfChatMode === false) return false;
-      if (String(accountConfig.dmPolicy || "").trim().toLowerCase() === "disabled") {
-        return false;
-      }
-      const candidatePaths = [
-        `${credDir}/whatsapp/${accountId}/creds.json`,
-        ...(accountId === "default" ? [`${credDir}/creds.json`] : []),
-      ];
-      const matches = candidatePaths.map((targetPath) => {
-        try {
-          return {
-            path: targetPath,
-            exists: !!String(fs.readFileSync(targetPath, "utf8") || "").trim(),
-          };
-        } catch (error) {
-          return {
-            path: targetPath,
-            exists: false,
-            error: String(error?.message || error || "read failed"),
-          };
-        }
-      });
-      return matches.some((entry) => entry.exists);
-    };
 
     for (const ch of Object.keys(kChannelDefs)) {
       const channelConfig =
@@ -674,55 +802,14 @@ const getChannelStatus = () => {
       });
       if (!hasConfiguredToken) continue;
 
-      const pairedByAccount = new Map(
-        Array.from(configuredAccountIds).map((accountId) => [accountId, 0]),
-      );
-      try {
-        if (ch !== "whatsapp") {
-          const files = fs
-            .readdirSync(credDir)
-            .filter(
-              (f) => f.startsWith(`${ch}-`) && f.endsWith("-allowFrom.json"),
-            );
-          for (const file of files) {
-            const accountId = resolveCredentialPairingAccountId({
-              channel: ch,
-              fileName: file,
-            });
-            if (!accountId || !configuredAccountIds.has(accountId)) continue;
-            const data = JSON.parse(
-              fs.readFileSync(`${credDir}/${file}`, "utf8"),
-            );
-            const nextCount =
-              Number(pairedByAccount.get(accountId) || 0)
-              + (Array.isArray(data.allowFrom) ? data.allowFrom.length : 0);
-            pairedByAccount.set(accountId, nextCount);
-          }
-        }
-      } catch {}
-      for (const [accountId, accountConfig] of accountEntries) {
-        if (ch === "whatsapp") continue;
-        const inlineAllowFrom = accountConfig?.allowFrom;
-        if (!Array.isArray(inlineAllowFrom)) continue;
-        const normalizedAccountId = normalizeChannelAccountId(accountId);
-        const nextCount =
-          Number(pairedByAccount.get(normalizedAccountId) || 0) + inlineAllowFrom.length;
-        pairedByAccount.set(normalizedAccountId, nextCount);
-      }
-      if (ch === "whatsapp") {
-        for (const [accountId, accountConfig] of accountEntries) {
-          const normalizedAccountId = normalizeChannelAccountId(accountId);
-          if (Number(pairedByAccount.get(normalizedAccountId) || 0) > 0) continue;
-          if (
-            hasImplicitWhatsAppSelfPairing({
-              accountId: normalizedAccountId,
-              accountConfig,
-            })
-          ) {
-            pairedByAccount.set(normalizedAccountId, 1);
-          }
-        }
-      }
+      const pairedByAccount = readPairedCountsByAccount({
+        fsImpl: fs,
+        OPENCLAW_DIR,
+        channelId: ch,
+        accountIds: Array.from(configuredAccountIds),
+        config: channelConfig,
+      });
+
       const accounts = Object.fromEntries(
         Array.from(pairedByAccount.entries()).map(([accountId, paired]) => [
           accountId,

package/lib/server/init/register-server-routes.js

@@ -42,6 +42,8 @@ const registerServerRoutes = ({
   resolveGithubRepoUrl,
   resolveModelProvider,
   ensureGatewayProxyConfig,
+  isOpenAiCompatApiEnabled,
+  openAiCompatApiThrottle,
   getBaseUrl,
   startGateway,
   ensureManagedExecDefaults,
@@ -133,6 +135,8 @@ const registerServerRoutes = ({
     authProfiles,
     watchdog,
     doctorService,
+    ensureGatewayProxyConfig,
+    getBaseUrl,
   });
   registerBrowseRoutes({
     app,
@@ -274,6 +278,10 @@ const registerServerRoutes = ({
     app,
     proxy,
     getGatewayUrl,
+    getGatewayToken: () =>
+      process.env.OPENCLAW_GATEWAY_TOKEN || constants.GATEWAY_TOKEN || "",
+    isOpenAiCompatApiEnabled,
+    openAiCompatApiThrottle,
     SETUP_API_PREFIXES,
     requireAuth,
     oauthCallbackMiddleware,

package/lib/server/login-throttle.js

@@ -11,6 +11,7 @@ const {
 } = require("./constants");
 
 const kGlobalStateKey = "global:login";
+const kLoginThrottleScope = "login";
 
 const createLoginAttemptState = (now) => ({
   attempts: 0,
@@ -48,8 +49,15 @@ const createMemoryLoginThrottleStore = () => {
   };
 };
 
-const getClientStateKey = (clientKey) =>
-  `client:${String(clientKey || "unknown")}`;
+const getClientStateKey = (clientKey, scope = kLoginThrottleScope) => {
+  const normalizedClientKey = String(clientKey || "unknown");
+  return scope === kLoginThrottleScope
+    ? `client:${normalizedClientKey}`
+    : `client:${scope}:${normalizedClientKey}`;
+};
+
+const getGlobalStateKey = (scope = kLoginThrottleScope) =>
+  scope === kLoginThrottleScope ? kGlobalStateKey : `global:${scope}`;
 
 const getOrCreateState = (store, stateKey, now) => {
   const existing = store.get(stateKey);
@@ -153,6 +161,16 @@ const chooseFailureResult = (...results) => {
 
 const createLoginThrottle = ({
   store = createMemoryLoginThrottleStore(),
+  scope = kLoginThrottleScope,
+  windowMs = kLoginWindowMs,
+  maxAttempts = kLoginMaxAttempts,
+  baseLockMs = kLoginBaseLockMs,
+  maxLockMs = kLoginMaxLockMs,
+  globalWindowMs = kLoginGlobalWindowMs,
+  globalMaxAttempts = kLoginGlobalMaxAttempts,
+  globalBaseLockMs = kLoginGlobalBaseLockMs,
+  globalMaxLockMs = kLoginGlobalMaxLockMs,
+  stateTtlMs = kLoginStateTtlMs,
 } = {}) => {
   const runExclusive =
     typeof store.runExclusive === "function"
@@ -161,13 +179,14 @@ const createLoginThrottle = ({
 
   const getOrCreateLoginAttemptState = (clientKey, now) =>
     runExclusive(() => {
-      const clientStateKey = getClientStateKey(clientKey);
+      const clientStateKey = getClientStateKey(clientKey, scope);
+      const globalStateKey = getGlobalStateKey(scope);
       return {
         clientKey,
         clientStateKey,
-        globalStateKey: kGlobalStateKey,
+        globalStateKey,
         client: getOrCreateState(store, clientStateKey, now),
-        global: getOrCreateState(store, kGlobalStateKey, now),
+        global: getOrCreateState(store, globalStateKey, now),
       };
     });
 
@@ -175,19 +194,19 @@ const createLoginThrottle = ({
     runExclusive(() => {
       const clientStateKey =
         stateBundle?.clientStateKey ||
-        getClientStateKey(stateBundle?.clientKey);
-      const globalStateKey = stateBundle?.globalStateKey || kGlobalStateKey;
+        getClientStateKey(stateBundle?.clientKey, scope);
+      const globalStateKey = stateBundle?.globalStateKey || getGlobalStateKey(scope);
       const clientResult = evaluateState({
         store,
         stateKey: clientStateKey,
         now,
-        windowMs: kLoginWindowMs,
+        windowMs,
       });
       const globalResult = evaluateState({
         store,
         stateKey: globalStateKey,
         now,
-        windowMs: kLoginGlobalWindowMs,
+        windowMs: globalWindowMs,
       });
       if (stateBundle) {
         stateBundle.client = clientResult.state;
@@ -200,25 +219,25 @@ const createLoginThrottle = ({
     runExclusive(() => {
       const clientStateKey =
         stateBundle?.clientStateKey ||
-        getClientStateKey(stateBundle?.clientKey);
-      const globalStateKey = stateBundle?.globalStateKey || kGlobalStateKey;
+        getClientStateKey(stateBundle?.clientKey, scope);
+      const globalStateKey = stateBundle?.globalStateKey || getGlobalStateKey(scope);
       const clientResult = recordStateFailure({
         store,
         stateKey: clientStateKey,
         now,
-        windowMs: kLoginWindowMs,
-        maxAttempts: kLoginMaxAttempts,
-        baseLockMs: kLoginBaseLockMs,
-        maxLockMs: kLoginMaxLockMs,
+        windowMs,
+        maxAttempts,
+        baseLockMs,
+        maxLockMs,
       });
       const globalResult = recordStateFailure({
         store,
         stateKey: globalStateKey,
         now,
-        windowMs: kLoginGlobalWindowMs,
-        maxAttempts: kLoginGlobalMaxAttempts,
-        baseLockMs: kLoginGlobalBaseLockMs,
-        maxLockMs: kLoginGlobalMaxLockMs,
+        windowMs: globalWindowMs,
+        maxAttempts: globalMaxAttempts,
+        baseLockMs: globalBaseLockMs,
+        maxLockMs: globalMaxLockMs,
       });
       if (stateBundle) {
         stateBundle.client = clientResult.state;
@@ -230,8 +249,8 @@ const createLoginThrottle = ({
   const recordLoginSuccess = (clientKey) => {
     if (!clientKey) return;
     runExclusive(() => {
-      store.delete(getClientStateKey(clientKey));
-      store.delete(kGlobalStateKey);
+      store.delete(getClientStateKey(clientKey, scope));
+      store.delete(getGlobalStateKey(scope));
     });
   };
 
@@ -245,7 +264,7 @@ const createLoginThrottle = ({
         }
         const state = normalizeState(rawState, now);
         if (state.lockUntil > now) continue;
-        if (now - state.lastSeenAt > kLoginStateTtlMs) {
+        if (now - state.lastSeenAt > stateTtlMs) {
           store.delete(stateKey);
         }
       }

package/lib/server/onboarding/cron.js

@@ -1,6 +1,7 @@
 const path = require("path");
 const { kSetupDir } = require("../constants");
 const { buildManagedPaths } = require("../internal-files-migration");
+const { shouldSkipSystemCronInstall } = require("../../cli/git-runtime");
 
 const kHourlyGitSyncTemplatePath = path.join(kSetupDir, "hourly-git-sync.sh");
 const kSystemCronPath = "/etc/cron.d/openclaw-hourly-sync";
@@ -37,6 +38,13 @@ const installHourlyGitSyncCron = async ({ fs, openclawDir }) => {
     fs.mkdirSync(configDir, { recursive: true });
     fs.writeFileSync(configPath, JSON.stringify(config, null, 2));
 
+    if (shouldSkipSystemCronInstall()) {
+      console.log(
+        "[onboard] System cron install skipped by ALPHACLAW_SKIP_SYSTEM_CRON_INSTALL",
+      );
+      return false;
+    }
+
     const cronContent = buildSystemCronFile({
       schedule: config.schedule,
       scriptPath: hourlyGitSyncPath,

package/lib/server/onboarding/openclaw.js

@@ -4,6 +4,7 @@ const {
   ensurePluginAllowed,
   ensureUsageTrackerPluginEntry,
 } = require("../usage-tracker-config");
+const { isOpenAiCompatApiEnabled } = require("../alphaclaw-config");
 
 const kDefaultToolsProfile = "full";
 const kBootstrapExtraFiles = [
@@ -133,16 +134,29 @@ const buildOnboardArgs = ({
   return onboardArgs;
 };
 
-const ensureManagedConfigShell = (cfg) => {
+const ensureManagedConfigShell = (cfg, { openAiCompatApiEnabled = false } = {}) => {
   if (!cfg.channels) cfg.channels = {};
   ensurePluginsShell(cfg);
   if (!cfg.commands) cfg.commands = {};
   if (!cfg.tools) cfg.tools = {};
+  if (!cfg.gateway) cfg.gateway = {};
   if (!cfg.hooks) cfg.hooks = {};
   if (!cfg.hooks.internal) cfg.hooks.internal = {};
   if (!cfg.hooks.internal.entries) cfg.hooks.internal.entries = {};
   cfg.commands.restart = true;
   cfg.tools.profile = kDefaultToolsProfile;
+  if (openAiCompatApiEnabled) {
+    if (!cfg.gateway.http) cfg.gateway.http = {};
+    if (!cfg.gateway.http.endpoints) cfg.gateway.http.endpoints = {};
+    cfg.gateway.http.endpoints.chatCompletions = {
+      ...(cfg.gateway.http.endpoints.chatCompletions || {}),
+      enabled: true,
+    };
+    cfg.gateway.http.endpoints.responses = {
+      ...(cfg.gateway.http.endpoints.responses || {}),
+      enabled: true,
+    };
+  }
   cfg.hooks.internal.enabled = true;
   cfg.hooks.internal.entries["bootstrap-extra-files"] = {
     ...(cfg.hooks.internal.entries["bootstrap-extra-files"] || {}),
@@ -224,7 +238,12 @@ const writeSanitizedOpenclawConfig = ({
 }) => {
   const configPath = `${openclawDir}/openclaw.json`;
   const cfg = JSON.parse(fs.readFileSync(configPath, "utf8"));
-  ensureManagedConfigShell(cfg);
+  ensureManagedConfigShell(cfg, {
+    openAiCompatApiEnabled: isOpenAiCompatApiEnabled({
+      fsModule: fs,
+      openclawDir,
+    }),
+  });
   applyFreshOnboardingChannels({
     cfg,
     varMap,
@@ -256,7 +275,12 @@ const writeManagedImportOpenclawConfig = ({
 }) => {
   const configPath = `${openclawDir}/openclaw.json`;
   const cfg = JSON.parse(fs.readFileSync(configPath, "utf8"));
-  ensureManagedConfigShell(cfg);
+  ensureManagedConfigShell(cfg, {
+    openAiCompatApiEnabled: isOpenAiCompatApiEnabled({
+      fsModule: fs,
+      openclawDir,
+    }),
+  });
 
   ensureUsageTrackerPluginEntry(cfg);
 

package/lib/server/openclaw-config-migrations.js

@@ -0,0 +1,77 @@
+const isRecord = (value) =>
+  !!value && typeof value === "object" && !Array.isArray(value);
+
+const parseStreamingMode = (value) => {
+  if (typeof value === "boolean") return value ? "partial" : "off";
+  const normalized = String(value || "").trim().toLowerCase();
+  return ["off", "partial", "block", "progress"].includes(normalized)
+    ? normalized
+    : null;
+};
+
+const migrateLegacyTelegramStreamingEntry = (entry) => {
+  if (!isRecord(entry)) return false;
+
+  const legacyStreaming = entry.streaming;
+  const hasLegacyStreaming =
+    typeof legacyStreaming === "boolean" || typeof legacyStreaming === "string";
+  const hasLegacyFields =
+    entry.streamMode !== undefined ||
+    entry.chunkMode !== undefined ||
+    entry.blockStreaming !== undefined ||
+    entry.blockStreamingCoalesce !== undefined ||
+    entry.draftChunk !== undefined;
+  if (!hasLegacyStreaming && !hasLegacyFields) return false;
+
+  const streaming = isRecord(legacyStreaming) ? { ...legacyStreaming } : {};
+  const resolvedMode =
+    parseStreamingMode(isRecord(legacyStreaming) ? legacyStreaming.mode : legacyStreaming) ||
+    parseStreamingMode(entry.streamMode) ||
+    "partial";
+  if (streaming.mode === undefined) streaming.mode = resolvedMode;
+
+  if (entry.chunkMode !== undefined && streaming.chunkMode === undefined) {
+    streaming.chunkMode = entry.chunkMode;
+  }
+  if (entry.draftChunk !== undefined) {
+    const preview = isRecord(streaming.preview) ? { ...streaming.preview } : {};
+    if (preview.chunk === undefined) preview.chunk = entry.draftChunk;
+    streaming.preview = preview;
+  }
+  if (entry.blockStreaming !== undefined || entry.blockStreamingCoalesce !== undefined) {
+    const block = isRecord(streaming.block) ? { ...streaming.block } : {};
+    if (entry.blockStreaming !== undefined && block.enabled === undefined) {
+      block.enabled = entry.blockStreaming;
+    }
+    if (entry.blockStreamingCoalesce !== undefined && block.coalesce === undefined) {
+      block.coalesce = entry.blockStreamingCoalesce;
+    }
+    streaming.block = block;
+  }
+
+  entry.streaming = streaming;
+  delete entry.streamMode;
+  delete entry.chunkMode;
+  delete entry.blockStreaming;
+  delete entry.blockStreamingCoalesce;
+  delete entry.draftChunk;
+  return true;
+};
+
+const migrateLegacyTelegramStreamingConfig = (cfg = {}) => {
+  const telegram = cfg.channels?.telegram;
+  if (!isRecord(telegram)) return false;
+
+  let changed = migrateLegacyTelegramStreamingEntry(telegram);
+  if (isRecord(telegram.accounts)) {
+    for (const account of Object.values(telegram.accounts)) {
+      if (migrateLegacyTelegramStreamingEntry(account)) changed = true;
+    }
+  }
+  return changed;
+};
+
+module.exports = {
+  migrateLegacyTelegramStreamingConfig,
+  migrateLegacyTelegramStreamingEntry,
+};

package/lib/server/openclaw-thinking.js

@@ -27,6 +27,31 @@ const loadThinkingModule = async () => {
   return thinkingModulePromise;
 };
 
+const isNormalizeThinkLevel = (candidate) => {
+  if (typeof candidate !== "function") return false;
+  try {
+    return (
+      candidate("off") === "off" &&
+      candidate("low") === "low" &&
+      candidate("high") === "high"
+    );
+  } catch {
+    return false;
+  }
+};
+
+const resolveNormalizeThinkLevel = (mod) => {
+  const candidates = [
+    mod.normalizeThinkLevel,
+    mod.f,
+    mod.p,
+    ...Object.values(mod),
+  ];
+  const match = candidates.find(isNormalizeThinkLevel);
+  if (!match) throw new Error("OpenClaw normalizeThinkLevel export not found");
+  return match;
+};
+
 const splitModelKey = (modelKey = "") => {
   const normalized = String(modelKey || "").trim();
   const slashIndex = normalized.indexOf("/");
@@ -55,7 +80,7 @@ const resolveThinkingApi = async () => {
   return {
     listThinkingLevelOptions: mod.listThinkingLevelOptions || mod.i,
     resolveThinkingDefaultForModel: mod.resolveThinkingDefaultForModel || mod.s,
-    normalizeThinkLevel: mod.normalizeThinkLevel || mod.p,
+    normalizeThinkLevel: resolveNormalizeThinkLevel(mod),
   };
 };