@chrysb/alphaclaw 0.9.18 → 0.9.20

package/README.md

@@ -157,6 +157,9 @@ The built-in watchdog monitors gateway health and recovers from failures automat
 | `WATCHDOG_NOTIFICATIONS_DISABLED` | Optional | Disable watchdog notifications (`true`/`false`)    |
 | `PORT`                            | Optional | Server port (default `3000`)                       |
 | `ALPHACLAW_ROOT_DIR`              | Optional | Data directory (default `/data`)                   |
+| `ALPHACLAW_SKIP_SYSTEM_CRON_INSTALL` | Optional | Skip writes to `/etc/cron.d` while keeping cron config (`true`/`false`); the managed hourly script still exits when sync is disabled |
+| `ALPHACLAW_GIT_SHIM_PATH`         | Optional | Install the managed git auth shim at this path and prepend its directory to runtime `PATH` (default `/usr/local/bin/git`) |
+| `ALPHACLAW_GIT_ASKPASS_PATH`      | Optional | Install the git askpass helper at this path (default `$TMPDIR/alphaclaw-git-askpass.sh`) |
 | `TRUST_PROXY_HOPS`                | Optional | Trust proxy hop count for correct client IP        |
 | `REMOTE_MCP_URL`                  | Optional | Upstream remote MCP server URL. When set together with `REMOTE_MCP_API_TOKEN`, AlphaClaw writes a managed `mcp.servers.<name>` entry to `openclaw.json` on every gateway start. |
 | `REMOTE_MCP_API_TOKEN`            | Optional | Bearer token for the remote MCP server. Persisted in `openclaw.json` as the `${REMOTE_MCP_API_TOKEN}` reference, never as plaintext. |

package/bin/alphaclaw.js

@@ -4,8 +4,12 @@
 const fs = require("fs");
 const os = require("os");
 const path = require("path");
-const { execSync } = require("child_process");
+const { execFileSync, execSync } = require("child_process");
 const {
+  shouldSkipSystemCronInstall,
+  resolveGitAskPassPath,
+  resolveGitShimPath,
+  prependGitShimDirToPath,
   normalizeGitSyncFilePath,
   validateGitSyncFilePath,
   resolveRealGitPath,
@@ -16,6 +20,9 @@ const {
   restoreMissingOpenclawConfigFromRemote,
 } = require("../lib/cli/openclaw-config-restore");
 const { buildSecretReplacements } = require("../lib/server/helpers");
+const {
+  migrateLegacyTelegramStreamingConfig,
+} = require("../lib/server/openclaw-config-migrations");
 const {
   migrateManagedInternalFiles,
 } = require("../lib/server/internal-files-migration");
@@ -278,7 +285,7 @@ const runGitSync = () => {
   }
 
   const realGitPath = resolveRealGitPath({
-    shimPath: "/usr/local/bin/git",
+    shimPath: resolveGitShimPath(),
   });
   if (!realGitPath) {
     console.error(
@@ -631,7 +638,11 @@ if (fs.existsSync(hourlyGitSyncPath)) {
     }
 
     const cronFilePath = "/etc/cron.d/openclaw-hourly-sync";
-    if (cronEnabled) {
+    if (shouldSkipSystemCronInstall()) {
+      console.log(
+        "[alphaclaw] System cron setup skipped by ALPHACLAW_SKIP_SYSTEM_CRON_INSTALL",
+      );
+    } else if (cronEnabled) {
       const cronContent = [
         "SHELL=/bin/bash",
         "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
@@ -722,6 +733,20 @@ if (fs.existsSync(path.join(openclawDir, ".git"))) {
   }
 }
 
+if (fs.existsSync(configPath)) {
+  try {
+    execFileSync(process.execPath, [
+      path.join(__dirname, "..", "lib", "scripts", "migrate-openclaw-codex.js"),
+    ], {
+      env: process.env,
+      stdio: "inherit",
+      timeout: 60_000,
+    });
+  } catch (error) {
+    console.error(`[alphaclaw] Codex migration process failed: ${error.message}`);
+  }
+}
+
 if (fs.existsSync(configPath)) {
   console.log("[alphaclaw] Config exists, reconciling channels...");
 
@@ -732,7 +757,10 @@ if (fs.existsSync(configPath)) {
     if (!cfg.plugins.load) cfg.plugins.load = {};
     if (!Array.isArray(cfg.plugins.load.paths)) cfg.plugins.load.paths = [];
     if (!cfg.plugins.entries) cfg.plugins.entries = {};
-    let changed = false;
+    let changed = migrateLegacyTelegramStreamingConfig(cfg);
+    if (changed) {
+      console.log("[alphaclaw] Migrated legacy Telegram streaming config");
+    }
 
     if (process.env.TELEGRAM_BOT_TOKEN && !cfg.channels.telegram) {
       cfg.channels.telegram = {
@@ -819,11 +847,17 @@ try {
 
 try {
   const gitAskPassSrc = path.join(__dirname, "..", "lib", "scripts", "git-askpass");
-  const gitAskPassDest = "/tmp/alphaclaw-git-askpass.sh";
+  const gitAskPassDest = resolveGitAskPassPath({
+    tmpDir: os.tmpdir(),
+  });
   const gitShimTemplatePath = path.join(__dirname, "..", "lib", "scripts", "git");
-  const gitShimDest = "/usr/local/bin/git";
+  const gitShimDest = resolveGitShimPath();
+  process.env.PATH = prependGitShimDirToPath({
+    shimPath: gitShimDest,
+  });
 
   if (fs.existsSync(gitAskPassSrc)) {
+    fs.mkdirSync(path.dirname(gitAskPassDest), { recursive: true });
     fs.copyFileSync(gitAskPassSrc, gitAskPassDest);
     fs.chmodSync(gitAskPassDest, 0o755);
   }
@@ -837,7 +871,9 @@ try {
     const gitShimTemplate = fs.readFileSync(gitShimTemplatePath, "utf8");
     const gitShimContent = gitShimTemplate
       .replace("@@REAL_GIT@@", realGitPath)
-      .replace("@@OPENCLAW_REPO_ROOT@@", openclawDir);
+      .replace("@@OPENCLAW_REPO_ROOT@@", openclawDir)
+      .replace("@@ASKPASS_PATH@@", gitAskPassDest);
+    fs.mkdirSync(path.dirname(gitShimDest), { recursive: true });
     fs.writeFileSync(gitShimDest, gitShimContent, { mode: 0o755 });
     console.log("[alphaclaw] git auth shim installed");
   }

package/lib/cli/git-runtime.js

@@ -2,6 +2,43 @@ const fs = require("fs");
 const path = require("path");
 const { execSync } = require("child_process");
 
+const isEnabledEnvFlag = (value) =>
+  ["1", "true", "yes", "on"].includes(
+    String(value || "").trim().toLowerCase(),
+  );
+
+const shouldSkipSystemCronInstall = ({ env = process.env } = {}) =>
+  isEnabledEnvFlag(env.ALPHACLAW_SKIP_SYSTEM_CRON_INSTALL);
+
+const resolveGitAskPassPath = ({ env = process.env, tmpDir = "/tmp" } = {}) => {
+  const explicitPath = String(env.ALPHACLAW_GIT_ASKPASS_PATH || "").trim();
+  if (explicitPath) return explicitPath;
+
+  const runtimeTmpDir =
+    String(env.TMPDIR || "").trim() || String(tmpDir || "").trim() || "/tmp";
+  return path.join(runtimeTmpDir, "alphaclaw-git-askpass.sh");
+};
+
+const resolveGitShimPath = ({ env = process.env } = {}) => {
+  const explicitPath = String(env.ALPHACLAW_GIT_SHIM_PATH || "").trim();
+  return explicitPath || "/usr/local/bin/git";
+};
+
+const prependGitShimDirToPath = ({
+  env = process.env,
+  shimPath = resolveGitShimPath({ env }),
+} = {}) => {
+  if (!String(env.ALPHACLAW_GIT_SHIM_PATH || "").trim()) {
+    return env.PATH || process.env.PATH || "";
+  }
+  const shimDir = path.dirname(String(shimPath || "").trim());
+  if (!shimDir || shimDir === ".") return env.PATH || process.env.PATH || "";
+  const pathEntries = String(env.PATH || process.env.PATH || "")
+    .split(path.delimiter)
+    .filter((entry) => entry && entry !== shimDir);
+  return [shimDir, ...pathEntries].join(path.delimiter);
+};
+
 const normalizeGitSyncFilePath = (requestedFilePath) => {
   const rawPath = String(requestedFilePath || "").trim();
   if (!rawPath) return "";
@@ -90,6 +127,10 @@ const shouldRefreshHourlyGitSyncScript = ({
 };
 
 module.exports = {
+  shouldSkipSystemCronInstall,
+  resolveGitAskPassPath,
+  resolveGitShimPath,
+  prependGitShimDirToPath,
   normalizeGitSyncFilePath,
   validateGitSyncFilePath,
   resolveRealGitPath,

package/lib/cli/openclaw-config-restore.js

@@ -27,7 +27,7 @@ const resolveCurrentBranch = ({ execSyncImpl, openclawDir }) => {
 
 const createGitEnv = ({ fsModule, osModule, env, processId }) => {
   const githubToken = String(env.GITHUB_TOKEN || "").trim();
-  const gitEnv = { ...env };
+  const gitEnv = { ...env, PATH: env.PATH || process.env.PATH };
   if (!githubToken) {
     return { gitEnv, askPassPath: "" };
   }

package/lib/scripts/git

@@ -4,7 +4,7 @@
 
 REAL_GIT_HINT="@@REAL_GIT@@"
 OPENCLAW_REPO_ROOT="@@OPENCLAW_REPO_ROOT@@"
-ASKPASS_PATH="/tmp/alphaclaw-git-askpass.sh"
+ASKPASS_PATH="@@ASKPASS_PATH@@"
 
 same_path() {
   local left_path right_path

package/lib/scripts/migrate-openclaw-codex.js

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+
+const { migrateLegacyCodexState } = require("../server/openclaw-codex-migration");
+
+migrateLegacyCodexState()
+  .then((result) => {
+    if (result.changed) {
+      console.log("[alphaclaw] Migrated legacy OpenAI Codex model and auth state");
+    }
+    for (const warning of result.warnings) {
+      console.warn(`[alphaclaw] Codex migration warning: ${warning}`);
+    }
+  })
+  .catch((error) => {
+    console.error(`[alphaclaw] Codex migration failed: ${error.message}`);
+    process.exitCode = 1;
+  });

package/lib/server/agents/shared.js

@@ -505,12 +505,16 @@ const readPairedCountsByAccount = ({
   } catch {}
 
   for (const accountId of counts.keys()) {
-    if (String(channelId || "").trim() === "whatsapp") continue;
     const accountConfig =
       accountId === "default" &&
       !(config.accounts && typeof config.accounts === "object")
         ? config
         : config.accounts?.[accountId] || {};
+    if (String(channelId || "").trim() === "whatsapp") {
+      if (!hasSavedWhatsAppCredentials({ fsImpl, OPENCLAW_DIR, accountId })) {
+        continue;
+      }
+    }
     const inlineAllowFrom = accountConfig?.allowFrom;
     if (!Array.isArray(inlineAllowFrom)) continue;
     counts.set(
@@ -616,7 +620,15 @@ const listConfiguredChannelAccounts = ({ fsImpl, OPENCLAW_DIR, cfg }) => {
             status:
               Number(pairedCounts.get(accountId) || 0) > 0
                 ? "paired"
-                : "configured",
+                : hasImplicitWhatsAppSelfPairing({
+                    fsImpl,
+                    OPENCLAW_DIR,
+                    channelId,
+                    accountId,
+                    accountConfig,
+                  })
+                  ? "paired"
+                  : "configured",
           };
         }),
       };
@@ -764,6 +776,10 @@ module.exports = {
   resolveCredentialsDirPath,
   resolveWhatsAppCredentialCandidatePaths,
   hasSavedWhatsAppCredentials,
+  normalizeChannelAccountId,
+  resolveCredentialPairingAccountId,
+  hasImplicitWhatsAppSelfPairing,
+  readPairedCountsByAccount,
   resolveAgentWorkspacePath,
   loadConfig,
   saveConfig,

package/lib/server/auth-profiles.js

@@ -281,7 +281,12 @@ const createAuthProfiles = () => {
 
   // ── Legacy Codex-specific wrappers ──
 
-  const listCodexProfiles = () => listProfilesByProvider("openai-codex");
+  const listCodexProfiles = () =>
+    listProfiles().filter(
+      (profile) =>
+        profile.type === "oauth" &&
+        (profile.provider === "openai" || profile.provider === "openai-codex"),
+    );
 
   const getCodexProfile = () => {
     const profiles = listCodexProfiles();
@@ -299,7 +304,7 @@ const createAuthProfiles = () => {
   const upsertCodexProfile = ({ access, refresh, expires, accountId }) => {
     upsertProfile(CODEX_PROFILE_ID, {
       type: "oauth",
-      provider: "openai-codex",
+      provider: "openai",
       access,
       refresh,
       expires,
@@ -311,7 +316,10 @@ const createAuthProfiles = () => {
     const store = loadAuthStore();
     let changed = false;
     for (const [id, cred] of Object.entries(store.profiles || {})) {
-      if (cred?.provider === "openai-codex") {
+      if (
+        cred?.type === "oauth" &&
+        (cred.provider === "openai" || cred.provider === "openai-codex")
+      ) {
         delete store.profiles[id];
         changed = true;
       }
@@ -321,7 +329,10 @@ const createAuthProfiles = () => {
       if (!canSyncOpenclawAuthReferences()) return changed;
       let cfg = loadOpenclawConfig();
       for (const [id, cred] of Object.entries(cfg.auth?.profiles || {})) {
-        if (cred?.provider === "openai-codex") {
+        if (
+          cred?.mode === "oauth" &&
+          (cred.provider === "openai" || cred.provider === "openai-codex")
+        ) {
           cfg = removeConfigAuthReference(cfg, id);
         }
       }

package/lib/server/constants.js

@@ -28,7 +28,7 @@ const AUTH_PROFILES_PATH = path.join(
   "agent",
   "auth-profiles.json",
 );
-const CODEX_PROFILE_ID = "openai-codex:codex-cli";
+const CODEX_PROFILE_ID = "openai:codex-cli";
 const CODEX_OAUTH_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 const CODEX_OAUTH_AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize";
 const CODEX_OAUTH_TOKEN_URL = "https://auth.openai.com/oauth/token";

package/lib/server/env.js

@@ -1,21 +1,48 @@
 const fs = require("fs");
 const { ENV_FILE_PATH, kKnownVars } = require("./constants");
 
+const kSensitiveEnvKeyPattern = /token|key|password/i;
+const kEnvWatchDebounceMs = 250;
+let envWatchDebounceTimer = null;
+let lastLoadedEnvSignature = null;
+let pendingSelfWriteSignature = null;
+
+const normalizeEnvVars = (vars) => {
+  const byKey = new Map();
+  for (const entry of vars || []) {
+    const key = String(entry?.key || "").trim();
+    if (!key) continue;
+    if (byKey.has(key)) byKey.delete(key);
+    byKey.set(key, {
+      key,
+      value: String(entry?.value || ""),
+    });
+  }
+  return Array.from(byKey.values());
+};
+
+const buildEnvSignature = (vars) =>
+  JSON.stringify(normalizeEnvVars(vars).map(({ key, value }) => [key, value]));
+
+const readRawEnvFile = () => {
+  const content = fs.readFileSync(ENV_FILE_PATH, "utf8");
+  const vars = [];
+  for (const line of content.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const eqIdx = trimmed.indexOf("=");
+    if (eqIdx === -1) continue;
+    vars.push({
+      key: trimmed.slice(0, eqIdx).trim(),
+      value: trimmed.slice(eqIdx + 1),
+    });
+  }
+  return vars;
+};
+
 const readEnvFile = () => {
   try {
-    const content = fs.readFileSync(ENV_FILE_PATH, "utf8");
-    const vars = [];
-    for (const line of content.split("\n")) {
-      const trimmed = line.trim();
-      if (!trimmed || trimmed.startsWith("#")) continue;
-      const eqIdx = trimmed.indexOf("=");
-      if (eqIdx === -1) continue;
-      vars.push({
-        key: trimmed.slice(0, eqIdx),
-        value: trimmed.slice(eqIdx + 1),
-      });
-    }
-    return vars;
+    return normalizeEnvVars(readRawEnvFile());
   } catch {
     return [];
   }
@@ -23,22 +50,24 @@ const readEnvFile = () => {
 
 const writeEnvFile = (vars) => {
   const lines = [];
-  for (const { key, value } of vars || []) {
-    if (!key) continue;
+  const normalizedVars = normalizeEnvVars(vars);
+  for (const { key, value } of normalizedVars) {
     lines.push(`${key}=${String(value || "")}`);
   }
   fs.writeFileSync(ENV_FILE_PATH, lines.join("\n"));
+  pendingSelfWriteSignature = buildEnvSignature(normalizedVars);
 };
 
 const reloadEnv = () => {
   const vars = readEnvFile();
+  const signature = buildEnvSignature(vars);
   const fileKeys = new Set(vars.map((v) => v.key));
   let changed = false;
 
   for (const { key, value } of vars) {
     if (value && value !== process.env[key]) {
       console.log(
-        `[alphaclaw] Env updated: ${key}=${key.toLowerCase().includes("token") || key.toLowerCase().includes("key") || key.toLowerCase().includes("password") ? "***" : value}`,
+        `[alphaclaw] Env updated: ${key}=${kSensitiveEnvKeyPattern.test(key) ? "***" : value}`,
       );
       process.env[key] = value;
       changed = true;
@@ -58,21 +87,43 @@ const reloadEnv = () => {
     }
   }
 
+  lastLoadedEnvSignature = signature;
   return changed;
 };
 
+const readEnvFileSignature = () => {
+  try {
+    return buildEnvSignature(readRawEnvFile());
+  } catch {
+    return null;
+  }
+};
+
 const startEnvWatcher = () => {
   try {
     fs.watchFile(ENV_FILE_PATH, { interval: 2000 }, () => {
-      console.log(
-        `[alphaclaw] ${ENV_FILE_PATH} changed externally, reloading...`,
-      );
-      reloadEnv();
+      if (envWatchDebounceTimer) clearTimeout(envWatchDebounceTimer);
+      envWatchDebounceTimer = setTimeout(() => {
+        envWatchDebounceTimer = null;
+        const signature = readEnvFileSignature();
+        if (signature && signature === pendingSelfWriteSignature) {
+          pendingSelfWriteSignature = null;
+          lastLoadedEnvSignature = signature;
+          return;
+        }
+        pendingSelfWriteSignature = null;
+        if (signature && signature === lastLoadedEnvSignature) return;
+        console.log(
+          `[alphaclaw] ${ENV_FILE_PATH} changed externally, reloading...`,
+        );
+        reloadEnv();
+      }, kEnvWatchDebounceMs);
     });
   } catch {}
 };
 
 module.exports = {
+  normalizeEnvVars,
   readEnvFile,
   writeEnvFile,
   reloadEnv,

package/lib/server/gateway.js

@@ -11,6 +11,10 @@ const {
   kOnboardingMarkerPath,
   kRootDir,
 } = require("./constants");
+const {
+  normalizeChannelAccountId,
+  readPairedCountsByAccount,
+} = require("./agents/shared");
 const { withOpenclawStartupEnv } = require("./openclaw-runtime-env");
 const { isOpenAiCompatApiEnabled } = require("./alphaclaw-config");
 
@@ -203,18 +207,6 @@ const getGatewayPort = () => {
 
 const getGatewayUrl = () => `http://${GATEWAY_HOST}:${getGatewayPort()}`;
 
-const normalizeChannelAccountId = (value) => String(value || "").trim() || "default";
-
-const resolveCredentialPairingAccountId = ({ channel, fileName }) => {
-  const prefix = `${String(channel || "").trim()}-`;
-  const suffix = "-allowFrom.json";
-  if (!String(fileName || "").startsWith(prefix) || !String(fileName || "").endsWith(suffix)) {
-    return "";
-  }
-  const rawAccountId = String(fileName || "").slice(prefix.length, -suffix.length);
-  return normalizeChannelAccountId(rawAccountId);
-};
-
 const isGatewayRunning = () =>
   new Promise((resolve) => {
     const sock = net.createConnection(getGatewayPort(), GATEWAY_HOST);
@@ -781,32 +773,6 @@ const getChannelStatus = () => {
     );
     const credDir = `${OPENCLAW_DIR}/credentials`;
     const channels = {};
-    const hasImplicitWhatsAppSelfPairing = ({ accountId, accountConfig }) => {
-      if (!accountConfig || typeof accountConfig !== "object") return false;
-      if (accountConfig.selfChatMode === false) return false;
-      if (String(accountConfig.dmPolicy || "").trim().toLowerCase() === "disabled") {
-        return false;
-      }
-      const candidatePaths = [
-        `${credDir}/whatsapp/${accountId}/creds.json`,
-        ...(accountId === "default" ? [`${credDir}/creds.json`] : []),
-      ];
-      const matches = candidatePaths.map((targetPath) => {
-        try {
-          return {
-            path: targetPath,
-            exists: !!String(fs.readFileSync(targetPath, "utf8") || "").trim(),
-          };
-        } catch (error) {
-          return {
-            path: targetPath,
-            exists: false,
-            error: String(error?.message || error || "read failed"),
-          };
-        }
-      });
-      return matches.some((entry) => entry.exists);
-    };
 
     for (const ch of Object.keys(kChannelDefs)) {
       const channelConfig =
@@ -836,55 +802,14 @@ const getChannelStatus = () => {
       });
       if (!hasConfiguredToken) continue;
 
-      const pairedByAccount = new Map(
-        Array.from(configuredAccountIds).map((accountId) => [accountId, 0]),
-      );
-      try {
-        if (ch !== "whatsapp") {
-          const files = fs
-            .readdirSync(credDir)
-            .filter(
-              (f) => f.startsWith(`${ch}-`) && f.endsWith("-allowFrom.json"),
-            );
-          for (const file of files) {
-            const accountId = resolveCredentialPairingAccountId({
-              channel: ch,
-              fileName: file,
-            });
-            if (!accountId || !configuredAccountIds.has(accountId)) continue;
-            const data = JSON.parse(
-              fs.readFileSync(`${credDir}/${file}`, "utf8"),
-            );
-            const nextCount =
-              Number(pairedByAccount.get(accountId) || 0)
-              + (Array.isArray(data.allowFrom) ? data.allowFrom.length : 0);
-            pairedByAccount.set(accountId, nextCount);
-          }
-        }
-      } catch {}
-      for (const [accountId, accountConfig] of accountEntries) {
-        if (ch === "whatsapp") continue;
-        const inlineAllowFrom = accountConfig?.allowFrom;
-        if (!Array.isArray(inlineAllowFrom)) continue;
-        const normalizedAccountId = normalizeChannelAccountId(accountId);
-        const nextCount =
-          Number(pairedByAccount.get(normalizedAccountId) || 0) + inlineAllowFrom.length;
-        pairedByAccount.set(normalizedAccountId, nextCount);
-      }
-      if (ch === "whatsapp") {
-        for (const [accountId, accountConfig] of accountEntries) {
-          const normalizedAccountId = normalizeChannelAccountId(accountId);
-          if (Number(pairedByAccount.get(normalizedAccountId) || 0) > 0) continue;
-          if (
-            hasImplicitWhatsAppSelfPairing({
-              accountId: normalizedAccountId,
-              accountConfig,
-            })
-          ) {
-            pairedByAccount.set(normalizedAccountId, 1);
-          }
-        }
-      }
+      const pairedByAccount = readPairedCountsByAccount({
+        fsImpl: fs,
+        OPENCLAW_DIR,
+        channelId: ch,
+        accountIds: Array.from(configuredAccountIds),
+        config: channelConfig,
+      });
+
       const accounts = Object.fromEntries(
         Array.from(pairedByAccount.entries()).map(([accountId, paired]) => [
           accountId,

package/lib/server/onboarding/cron.js

@@ -1,6 +1,7 @@
 const path = require("path");
 const { kSetupDir } = require("../constants");
 const { buildManagedPaths } = require("../internal-files-migration");
+const { shouldSkipSystemCronInstall } = require("../../cli/git-runtime");
 
 const kHourlyGitSyncTemplatePath = path.join(kSetupDir, "hourly-git-sync.sh");
 const kSystemCronPath = "/etc/cron.d/openclaw-hourly-sync";
@@ -37,6 +38,13 @@ const installHourlyGitSyncCron = async ({ fs, openclawDir }) => {
     fs.mkdirSync(configDir, { recursive: true });
     fs.writeFileSync(configPath, JSON.stringify(config, null, 2));
 
+    if (shouldSkipSystemCronInstall()) {
+      console.log(
+        "[onboard] System cron install skipped by ALPHACLAW_SKIP_SYSTEM_CRON_INSTALL",
+      );
+      return false;
+    }
+
     const cronContent = buildSystemCronFile({
       schedule: config.schedule,
       scriptPath: hourlyGitSyncPath,

package/lib/server/openclaw-codex-migration.js

@@ -0,0 +1,78 @@
+const fs = require("fs");
+const path = require("path");
+const { pathToFileURL } = require("url");
+
+const findOpenclawDistModule = (prefix) => {
+  const entryPath = require.resolve("openclaw");
+  const distDir = path.dirname(entryPath);
+  const filename = fs
+    .readdirSync(distDir)
+    .find((name) => name.startsWith(`${prefix}-`) && name.endsWith(".js"));
+  if (!filename) throw new Error(`OpenClaw migration module not found: ${prefix}`);
+  return path.join(distDir, filename);
+};
+
+const writeConfig = (configPath, cfg) => {
+  fs.writeFileSync(configPath, `${JSON.stringify(cfg, null, 2)}\n`, "utf8");
+};
+
+const migrateLegacyCodexState = async ({
+  configPath = process.env.OPENCLAW_CONFIG_PATH,
+  env = process.env,
+} = {}) => {
+  if (!configPath || !fs.existsSync(configPath)) {
+    return { changed: false, changes: [], warnings: [] };
+  }
+
+  const cfg = JSON.parse(fs.readFileSync(configPath, "utf8"));
+  const routeModule = await import(
+    pathToFileURL(findOpenclawDistModule("codex-route-warnings")).href
+  );
+  const authModule = await import(
+    pathToFileURL(findOpenclawDistModule("doctor-auth-flat-profiles")).href
+  );
+
+  const changes = [];
+  const warnings = [];
+  const routeRepair = routeModule.r({ cfg, env, shouldRepair: true });
+  let nextCfg = routeRepair.cfg;
+  changes.push(...routeRepair.changes);
+  warnings.push(...routeRepair.warnings);
+
+  const profileIdMap = authModule.t({ cfg: nextCfg, env });
+  const configAuthRepair = authModule.a(nextCfg, { profileIdMap });
+  nextCfg = configAuthRepair.config;
+  changes.push(...configAuthRepair.changes);
+  warnings.push(...configAuthRepair.warnings);
+
+  if (changes.length > 0) writeConfig(configPath, nextCfg);
+
+  const storeRepair = await authModule.o({ cfg: nextCfg, env });
+  changes.push(...storeRepair.changes);
+  warnings.push(...storeRepair.warnings);
+
+  const sqliteMigration = await authModule.n({
+    cfg: nextCfg,
+    env,
+    prompter: { confirmAutoFix: async () => true },
+  });
+  changes.push(...sqliteMigration.changes);
+  warnings.push(...sqliteMigration.warnings);
+  if (sqliteMigration.configChanged) writeConfig(configPath, nextCfg);
+
+  const sessionRepair = await routeModule.i({
+    cfg: nextCfg,
+    env,
+    shouldRepair: true,
+  });
+  changes.push(...sessionRepair.changes);
+  warnings.push(...sessionRepair.warnings);
+
+  return {
+    changed: changes.length > 0,
+    changes,
+    warnings,
+  };
+};
+
+module.exports = { migrateLegacyCodexState };

package/lib/server/openclaw-config-migrations.js

@@ -0,0 +1,77 @@
+const isRecord = (value) =>
+  !!value && typeof value === "object" && !Array.isArray(value);
+
+const parseStreamingMode = (value) => {
+  if (typeof value === "boolean") return value ? "partial" : "off";
+  const normalized = String(value || "").trim().toLowerCase();
+  return ["off", "partial", "block", "progress"].includes(normalized)
+    ? normalized
+    : null;
+};
+
+const migrateLegacyTelegramStreamingEntry = (entry) => {
+  if (!isRecord(entry)) return false;
+
+  const legacyStreaming = entry.streaming;
+  const hasLegacyStreaming =
+    typeof legacyStreaming === "boolean" || typeof legacyStreaming === "string";
+  const hasLegacyFields =
+    entry.streamMode !== undefined ||
+    entry.chunkMode !== undefined ||
+    entry.blockStreaming !== undefined ||
+    entry.blockStreamingCoalesce !== undefined ||
+    entry.draftChunk !== undefined;
+  if (!hasLegacyStreaming && !hasLegacyFields) return false;
+
+  const streaming = isRecord(legacyStreaming) ? { ...legacyStreaming } : {};
+  const resolvedMode =
+    parseStreamingMode(isRecord(legacyStreaming) ? legacyStreaming.mode : legacyStreaming) ||
+    parseStreamingMode(entry.streamMode) ||
+    "partial";
+  if (streaming.mode === undefined) streaming.mode = resolvedMode;
+
+  if (entry.chunkMode !== undefined && streaming.chunkMode === undefined) {
+    streaming.chunkMode = entry.chunkMode;
+  }
+  if (entry.draftChunk !== undefined) {
+    const preview = isRecord(streaming.preview) ? { ...streaming.preview } : {};
+    if (preview.chunk === undefined) preview.chunk = entry.draftChunk;
+    streaming.preview = preview;
+  }
+  if (entry.blockStreaming !== undefined || entry.blockStreamingCoalesce !== undefined) {
+    const block = isRecord(streaming.block) ? { ...streaming.block } : {};
+    if (entry.blockStreaming !== undefined && block.enabled === undefined) {
+      block.enabled = entry.blockStreaming;
+    }
+    if (entry.blockStreamingCoalesce !== undefined && block.coalesce === undefined) {
+      block.coalesce = entry.blockStreamingCoalesce;
+    }
+    streaming.block = block;
+  }
+
+  entry.streaming = streaming;
+  delete entry.streamMode;
+  delete entry.chunkMode;
+  delete entry.blockStreaming;
+  delete entry.blockStreamingCoalesce;
+  delete entry.draftChunk;
+  return true;
+};
+
+const migrateLegacyTelegramStreamingConfig = (cfg = {}) => {
+  const telegram = cfg.channels?.telegram;
+  if (!isRecord(telegram)) return false;
+
+  let changed = migrateLegacyTelegramStreamingEntry(telegram);
+  if (isRecord(telegram.accounts)) {
+    for (const account of Object.values(telegram.accounts)) {
+      if (migrateLegacyTelegramStreamingEntry(account)) changed = true;
+    }
+  }
+  return changed;
+};
+
+module.exports = {
+  migrateLegacyTelegramStreamingConfig,
+  migrateLegacyTelegramStreamingEntry,
+};

package/lib/server/openclaw-thinking.js

@@ -27,6 +27,31 @@ const loadThinkingModule = async () => {
   return thinkingModulePromise;
 };
 
+const isNormalizeThinkLevel = (candidate) => {
+  if (typeof candidate !== "function") return false;
+  try {
+    return (
+      candidate("off") === "off" &&
+      candidate("low") === "low" &&
+      candidate("high") === "high"
+    );
+  } catch {
+    return false;
+  }
+};
+
+const resolveNormalizeThinkLevel = (mod) => {
+  const candidates = [
+    mod.normalizeThinkLevel,
+    mod.f,
+    mod.p,
+    ...Object.values(mod),
+  ];
+  const match = candidates.find(isNormalizeThinkLevel);
+  if (!match) throw new Error("OpenClaw normalizeThinkLevel export not found");
+  return match;
+};
+
 const splitModelKey = (modelKey = "") => {
   const normalized = String(modelKey || "").trim();
   const slashIndex = normalized.indexOf("/");
@@ -55,7 +80,7 @@ const resolveThinkingApi = async () => {
   return {
     listThinkingLevelOptions: mod.listThinkingLevelOptions || mod.i,
     resolveThinkingDefaultForModel: mod.resolveThinkingDefaultForModel || mod.s,
-    normalizeThinkLevel: mod.normalizeThinkLevel || mod.p,
+    normalizeThinkLevel: resolveNormalizeThinkLevel(mod),
   };
 };
 

package/lib/server/routes/system.js

@@ -1,5 +1,6 @@
 const { buildManagedPaths } = require("../internal-files-migration");
 const { readOpenclawConfig } = require("../openclaw-config");
+const { shouldSkipSystemCronInstall } = require("../../cli/git-runtime");
 const {
   readAlphaclawConfig,
   updateOpenAiCompatApiFeature,
@@ -388,6 +389,9 @@ const registerSystemRoutes = ({
       kSystemCronConfigPath,
       JSON.stringify(nextConfig, null, 2),
     );
+    if (shouldSkipSystemCronInstall()) {
+      return getSystemCronStatus();
+    }
     if (nextConfig.enabled) {
       fs.writeFileSync(
         kSystemCronPath,

package/lib/server/usage-tracker-config.js

@@ -1,5 +1,8 @@
 const path = require("path");
 const { readOpenclawConfig, writeOpenclawConfig } = require("./openclaw-config");
+const {
+  migrateLegacyTelegramStreamingConfig,
+} = require("./openclaw-config-migrations");
 
 const kUsageTrackerPluginPath = path.resolve(
   __dirname,
@@ -123,7 +126,8 @@ const ensureUsageTrackerPluginConfig = ({ fsModule, openclawDir }) => {
     openclawDir,
     fallback: {},
   });
-  const changed = reconcileManagedPluginConfig(cfg);
+  const migrated = migrateLegacyTelegramStreamingConfig(cfg);
+  const changed = reconcileManagedPluginConfig(cfg) || migrated;
   if (!changed) return false;
   writeOpenclawConfig({
     fsModule,

package/lib/setup/hourly-git-sync.sh

@@ -12,6 +12,23 @@ if [[ -f "$REPO/.env" ]]; then
   set +a
 fi
 
+if [[ -f "$REPO/cron/system-sync.json" ]]; then
+  if node - "$REPO/cron/system-sync.json" <<'NODE'
+const fs = require('fs');
+const file = process.argv[2];
+try {
+  const config = JSON.parse(fs.readFileSync(file, 'utf8'));
+  process.exit(config && config.enabled === false ? 0 : 1);
+} catch {
+  process.exit(1);
+}
+NODE
+  then
+    echo "hourly-git-sync: disabled by cron/system-sync.json"
+    exit 0
+  fi
+fi
+
 # Drop cron scheduler runtime-only churn when it is metadata/timestamp-only.
 maybe_restore_if_runtime_only() {
   local file="$1"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrysb/alphaclaw",
-  "version": "0.9.18",
+  "version": "0.9.20",
   "publishConfig": {
     "access": "public"
   },
@@ -33,7 +33,7 @@
   "dependencies": {
     "express": "^4.21.0",
     "http-proxy": "^1.18.1",
-    "openclaw": "2026.5.28",
+    "openclaw": "2026.6.11",
     "ws": "^8.19.0"
   },
   "devDependencies": {
@@ -51,6 +51,6 @@
     "wouter-preact": "^3.7.1"
   },
   "engines": {
-    "node": ">=22.14.0"
+    "node": ">=22.19.0"
   }
 }