@clawling/clawchat-plugin-openclaw 2026.9.7-1 → 2026.9.8-1

package/README.md

@@ -31,7 +31,7 @@ Install and activate the ClawChat plugin from npm package @clawling/clawchat-plu
 Pick one of these invite-code activation paths after the plugin is loaded
 into OpenClaw:
 
-- **Runtime slash command (recommended).** Send `/clawchat-activate A1B2C3`
+- **Runtime slash command (recommended).** Send `/clawchat-activate K7RM4TQP`
   in the chat where OpenClaw is running. Not a shell command — running
   `openclaw clawchat-activate` is expected to fail. This is the reliable
   first-time activation path on OpenClaw 2026.5.5 and newer.

package/dist/src/commands.js

@@ -4,9 +4,27 @@ const ACTIVATION_FLAGS = ["--new-account", "--repair"];
 function stripActivationFlags(raw) {
     return ACTIVATION_FLAGS.reduce((acc, flag) => acc.split(flag).join(" "), raw);
 }
+/**
+ * A whole argument token that looks like a ClawChat connect code.
+ *
+ * member-backend mints **8** characters drawn from
+ * `ABCDEFGHJKLMNPQRSTUVWXYZ23456789`, with 0/1/I/O excluded so humans can
+ * transcribe them. This deliberately accepts a band around that length rather
+ * than exactly 8: the length is the server's to choose, and pinning it here is
+ * what previously broke activation outright. A too-long or too-short token is left for the server to reject —
+ * the code is checked there anyway, so a permissive local filter costs nothing
+ * while a strict one silently swallows valid codes.
+ *
+ * Matching whole tokens (not a substring scan) is what keeps the command word
+ * itself out of the result when `ctx.args` is absent and we fall back to
+ * `ctx.commandBody`, which still carries `/clawchat-activate`.
+ */
+const INVITE_CODE_PATTERN = /^[A-Z0-9]{6,12}$/u;
 function extractInviteCode(value) {
     const raw = typeof value === "string" ? value.trim() : "";
-    return stripActivationFlags(raw).match(/\b[A-Z0-9]{6}\b/u)?.[0] ?? "";
+    return (stripActivationFlags(raw)
+        .split(/\s+/u)
+        .find((token) => INVITE_CODE_PATTERN.test(token)) ?? "");
 }
 /**
  * Read the activation intent from the command args.
@@ -102,14 +120,14 @@ function formatOutputVisibilityResult(outputVisibility) {
 export function registerOpenclawClawlingCommands(api) {
     api.registerCommand({
         name: "clawchat-activate",
-        description: "Activate ClawChat with an invite code, e.g. /clawchat-activate A1B2C3.",
+        description: "Activate ClawChat with an invite code, e.g. /clawchat-activate K7RM4TQP.",
         acceptsArgs: true,
         requireAuth: true,
         async handler(ctx) {
             const rawArgs = ctx.args ?? ctx.commandBody;
             const code = extractInviteCode(rawArgs);
             if (!code) {
-                return { text: "ClawChat invite code is required. Usage: /clawchat-activate A1B2C3" };
+                return { text: "ClawChat invite code is required. Usage: /clawchat-activate K7RM4TQP" };
             }
             const intent = extractActivationIntent(rawArgs);
             try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawling/clawchat-plugin-openclaw",
-  "version": "2026.9.7-1",
+  "version": "2026.9.8-1",
   "description": "OpenClaw ClawChat channel plugin",
   "license": "MIT",
   "author": "CLAWLING PTE. LTD.",

package/src/commands.ts

@@ -10,9 +10,30 @@ function stripActivationFlags(raw: string): string {
   return ACTIVATION_FLAGS.reduce((acc, flag) => acc.split(flag).join(" "), raw);
 }
 
+/**
+ * A whole argument token that looks like a ClawChat connect code.
+ *
+ * member-backend mints **8** characters drawn from
+ * `ABCDEFGHJKLMNPQRSTUVWXYZ23456789`, with 0/1/I/O excluded so humans can
+ * transcribe them. This deliberately accepts a band around that length rather
+ * than exactly 8: the length is the server's to choose, and pinning it here is
+ * what previously broke activation outright. A too-long or too-short token is left for the server to reject —
+ * the code is checked there anyway, so a permissive local filter costs nothing
+ * while a strict one silently swallows valid codes.
+ *
+ * Matching whole tokens (not a substring scan) is what keeps the command word
+ * itself out of the result when `ctx.args` is absent and we fall back to
+ * `ctx.commandBody`, which still carries `/clawchat-activate`.
+ */
+const INVITE_CODE_PATTERN = /^[A-Z0-9]{6,12}$/u;
+
 function extractInviteCode(value: unknown): string {
   const raw = typeof value === "string" ? value.trim() : "";
-  return stripActivationFlags(raw).match(/\b[A-Z0-9]{6}\b/u)?.[0] ?? "";
+  return (
+    stripActivationFlags(raw)
+      .split(/\s+/u)
+      .find((token) => INVITE_CODE_PATTERN.test(token)) ?? ""
+  );
 }
 
 /**
@@ -118,14 +139,14 @@ function formatOutputVisibilityResult(outputVisibility: OutputVisibility): strin
 export function registerOpenclawClawlingCommands(api: Pick<OpenClawPluginApi, "registerCommand" | "logger" | "runtime">): void {
   api.registerCommand({
     name: "clawchat-activate",
-    description: "Activate ClawChat with an invite code, e.g. /clawchat-activate A1B2C3.",
+    description: "Activate ClawChat with an invite code, e.g. /clawchat-activate K7RM4TQP.",
     acceptsArgs: true,
     requireAuth: true,
     async handler(ctx) {
       const rawArgs = ctx.args ?? ctx.commandBody;
       const code = extractInviteCode(rawArgs);
       if (!code) {
-        return { text: "ClawChat invite code is required. Usage: /clawchat-activate A1B2C3" };
+        return { text: "ClawChat invite code is required. Usage: /clawchat-activate K7RM4TQP" };
       }
       const intent = extractActivationIntent(rawArgs);
       try {