@openclaw/clickclack 2026.7.2-beta.3 → 2026.7.2-beta.4

package/dist/runtime-api.js

@@ -1,4 +1,4 @@
-import { a as createClickClackClient, m as resolveClickClackAccount } from "./setup-surface-CNjp76Xx.js";
-import { a as setClickClackRuntime, r as parseClickClackTarget } from "./channel-CEYthZ9N.js";
-import "./api.js";
-export { createClickClackClient, parseClickClackTarget, resolveClickClackAccount, setClickClackRuntime };
+import { d as createClickClackClient, x as resolveClickClackAccount } from "./setup-surface-Baf26N-D.js";
+import { T as setClickClackRuntime, r as parseClickClackTarget } from "./channel-BDq0KWDB.js";
+import { t as registerClickClackDiscussions } from "./runtime-api-CV1cOqFO.js";
+export { createClickClackClient, parseClickClackTarget, registerClickClackDiscussions, resolveClickClackAccount, setClickClackRuntime };

package/dist/{setup-claim-BUWvZjtu.js → setup-claim-CJIUfZS7.js}

@@ -1,5 +1,6 @@
+import { a as buildClickClackSetupClaimUrl, o as isClickClackSetupLoopbackHost, s as requireClickClackSetupApiBaseUrl } from "./setup-surface-Baf26N-D.js";
 import { createProviderOperationDeadline, readProviderJsonResponse, readResponseTextLimited, resolveProviderOperationTimeoutMs } from "openclaw/plugin-sdk/provider-http";
-import { fetchWithSsrFGuard, isPrivateOrLoopbackHost, resolvePinnedHostnameWithPolicy, ssrfPolicyFromHttpBaseUrlAllowedHostname } from "openclaw/plugin-sdk/ssrf-runtime";
+import { fetchWithSsrFGuard, resolvePinnedHostnameWithPolicy, ssrfPolicyFromHttpBaseUrlAllowedHostname } from "openclaw/plugin-sdk/ssrf-runtime";
 import { withTimeout } from "openclaw/plugin-sdk/text-utility-runtime";
 //#region extensions/clickclack/src/setup-claim.ts
 const CLICKCLACK_ERROR_BODY_LIMIT_BYTES = 8 * 1024;
@@ -20,7 +21,7 @@ function requireString(record, key, label) {
 	if (typeof value !== "string" || !value.trim()) throw new Error(`ClickClack setup code claim returned invalid ${label}.${key}`);
 	return value;
 }
-function parseClickClackSetupCodeClaim(value) {
+function parseClickClackSetupCodeClaim(value, expectedClaimUrl) {
 	const claim = requireRecord(value, "response");
 	const bot = requireRecord(claim.bot, "bot");
 	const workspace = requireRecord(claim.workspace, "workspace");
@@ -31,7 +32,23 @@ function parseClickClackSetupCodeClaim(value) {
 	if (defaultTo !== void 0 && typeof defaultTo !== "string") throw new Error("ClickClack setup code claim returned invalid defaults.defaultTo");
 	if (allowFrom !== void 0 && (!Array.isArray(allowFrom) || !allowFrom.every((entry) => typeof entry === "string"))) throw new Error("ClickClack setup code claim returned invalid defaults.allowFrom");
 	if (agentActivity !== void 0 && typeof agentActivity !== "boolean") throw new Error("ClickClack setup code claim returned invalid defaults.agentActivity");
+	const contractVersion = claim.contract_version;
+	const apiBaseUrlValue = claim.api_base_url;
+	const hasContractMetadata = contractVersion !== void 0 || apiBaseUrlValue !== void 0;
+	if (expectedClaimUrl && !hasContractMetadata) throw new Error("ClickClack setup code claim returned a legacy response for an exact endpoint");
+	let contract = {};
+	if (hasContractMetadata) {
+		if (contractVersion !== 1 || typeof apiBaseUrlValue !== "string") throw new Error("ClickClack setup code claim returned invalid v1 contract metadata");
+		const apiBaseUrl = requireClickClackSetupApiBaseUrl(apiBaseUrlValue, "setup code claim response.api_base_url");
+		const canonicalClaimUrl = buildClickClackSetupClaimUrl(apiBaseUrl);
+		if (expectedClaimUrl && expectedClaimUrl !== canonicalClaimUrl) throw new Error("ClickClack setup code claim returned an API base that does not match the claim URL");
+		contract = {
+			contract_version: 1,
+			api_base_url: apiBaseUrl
+		};
+	}
 	return {
+		...contract,
 		token: requireString(claim, "token", "response"),
 		bot: {
 			id: requireString(bot, "id", "bot"),
@@ -53,30 +70,35 @@ function parseClickClackSetupCodeClaim(value) {
 }
 /** Claims a one-time setup code without sending any existing bot credential. */
 async function claimClickClackSetupCode(params) {
-	const baseUrl = params.baseUrl.replace(/\/+$/, "");
-	const parsedBaseUrl = new URL(baseUrl);
+	let parsedClaimUrl;
+	try {
+		parsedClaimUrl = new URL(params.claimUrl);
+	} catch {
+		throw new Error("ClickClack setup code claim URL must be a valid HTTP(S) endpoint.");
+	}
+	if (parsedClaimUrl.protocol !== "http:" && parsedClaimUrl.protocol !== "https:" || parsedClaimUrl.username || parsedClaimUrl.password || parsedClaimUrl.search || parsedClaimUrl.hash || !parsedClaimUrl.pathname.endsWith("/api/bot-setup-codes/claim")) throw new Error("ClickClack setup code claim URL must be a valid HTTP(S) endpoint.");
 	const deadline = createProviderOperationDeadline({
 		label: "ClickClack setup code claim",
 		timeoutMs: CLICKCLACK_SETUP_CODE_CLAIM_TIMEOUT_MS
 	});
 	let pinnedHttpTarget;
-	if (parsedBaseUrl.protocol === "http:") {
+	if (parsedClaimUrl.protocol === "http:") {
 		const resolveTimeoutMs = resolveProviderOperationTimeoutMs({
 			deadline,
 			defaultTimeoutMs: CLICKCLACK_SETUP_CODE_CLAIM_TIMEOUT_MS
 		});
-		const pinned = await withTimeout(resolvePinnedHostnameWithPolicy(parsedBaseUrl.hostname, {
+		const pinned = await withTimeout(resolvePinnedHostnameWithPolicy(parsedClaimUrl.hostname, {
 			lookupFn: params.lookupFn,
 			policy: { dangerouslyAllowPrivateNetwork: true }
 		}), resolveTimeoutMs, { message: `ClickClack setup code claim timed out after ${CLICKCLACK_SETUP_CODE_CLAIM_TIMEOUT_MS}ms` });
-		if (!pinned.addresses.every((address) => isPrivateOrLoopbackHost(address))) throw new Error("ClickClack setup codes require HTTPS unless the server is on a private or loopback network.");
+		if (!pinned.addresses.every((address) => isClickClackSetupLoopbackHost(address))) throw new Error("ClickClack setup codes require HTTPS unless the server is on loopback.");
 		pinnedHttpTarget = {
 			hostname: pinned.hostname,
 			addresses: pinned.addresses
 		};
 	}
 	const { response, release } = await fetchWithSsrFGuard({
-		url: `${baseUrl}/api/bot-setup-codes/claim`,
+		url: params.claimUrl,
 		fetchImpl: params.fetch,
 		init: {
 			method: "POST",
@@ -91,8 +113,8 @@ async function claimClickClackSetupCode(params) {
 			deadline,
 			defaultTimeoutMs: CLICKCLACK_SETUP_CODE_CLAIM_TIMEOUT_MS
 		}),
-		requireHttps: parsedBaseUrl.protocol === "https:",
-		policy: ssrfPolicyFromHttpBaseUrlAllowedHostname(baseUrl),
+		requireHttps: parsedClaimUrl.protocol === "https:",
+		policy: ssrfPolicyFromHttpBaseUrlAllowedHostname(params.claimUrl),
 		lookupFn: params.lookupFn,
 		...pinnedHttpTarget ? { dispatcherPolicy: {
 			mode: "direct",
@@ -105,7 +127,7 @@ async function claimClickClackSetupCode(params) {
 			const detail = await readResponseTextLimited(response, CLICKCLACK_ERROR_BODY_LIMIT_BYTES);
 			throw new ClickClackSetupCodeClaimError(response.status, detail);
 		}
-		return parseClickClackSetupCodeClaim(await readProviderJsonResponse(response, "ClickClack setup code claim", { maxBytes: CLICKCLACK_SETUP_CODE_CLAIM_JSON_LIMIT_BYTES }));
+		return parseClickClackSetupCodeClaim(await readProviderJsonResponse(response, "ClickClack setup code claim", { maxBytes: CLICKCLACK_SETUP_CODE_CLAIM_JSON_LIMIT_BYTES }), params.expectedClaimUrl);
 	} finally {
 		await release();
 	}

package/dist/setup-plugin-api.js

@@ -1,4 +1,4 @@
-import { l as clickClackConfigAdapter, n as clickClackSetupAdapter, s as clickClackConfigSchema, t as clickClackSetupWizard, u as clickClackMeta } from "./setup-surface-CNjp76Xx.js";
+import { _ as clickClackMeta, g as clickClackConfigAdapter, m as clickClackConfigSchema, n as clickClackSetupAdapter, r as clickClackSetupContract, t as clickClackSetupWizard } from "./setup-surface-Baf26N-D.js";
 //#region extensions/clickclack/src/channel.setup.ts
 const clickClackSetupPlugin = {
 	id: "clickclack",
@@ -12,6 +12,7 @@ const clickClackSetupPlugin = {
 	configSchema: clickClackConfigSchema,
 	config: clickClackConfigAdapter,
 	setup: clickClackSetupAdapter,
+	setupContract: clickClackSetupContract,
 	setupWizard: clickClackSetupWizard
 };
 //#endregion

package/dist/{setup-surface-CNjp76Xx.js → setup-surface-Baf26N-D.js}

@@ -11,10 +11,13 @@ import { getChatChannelMeta } from "openclaw/plugin-sdk/channel-plugin-common";
 import { buildChannelConfigSchema, buildMultiAccountChannelSchema } from "openclaw/plugin-sdk/channel-config-schema";
 import { z } from "zod";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
+import { redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
 import { readProviderJsonResponse, readResponseTextLimited } from "openclaw/plugin-sdk/provider-http";
 import { WebSocket } from "ws";
+import { defineChannelSetupContract } from "openclaw/plugin-sdk/channel-setup";
 import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1, applyAccountNameToChannelSection, applySetupAccountConfigPatch, baseUrlTextInput, createSetupTranslator, createStandardChannelSetupStatus, defineTokenCredential, formatDocsLink, hasConfiguredSecretInput, migrateBaseNameToDefaultAccount, moveSingleAccountChannelSectionToDefaultAccount, setSetupChannelEnabled } from "openclaw/plugin-sdk/setup";
 import { createSetupInputPresenceValidator } from "openclaw/plugin-sdk/setup-runtime";
+import net from "node:net";
 //#region \0rolldown/runtime.js
 var __defProp = Object.defineProperty;
 var __exportAll = (all, no_symbols) => {
@@ -35,6 +38,7 @@ var __exportAll = (all, no_symbols) => {
 const DEFAULT_RECONNECT_MS = 1500;
 const MIN_RECONNECT_MS = 100;
 const MAX_RECONNECT_MS = 6e4;
+const DEFAULT_DISCUSSIONS_SECTION = "Sessions";
 const { listAccountIds: listClickClackAccountIds, resolveDefaultAccountId: resolveDefaultClickClackAccountId } = createAccountListHelpers("clickclack", {
 	normalizeAccountId,
 	hasImplicitDefaultAccount: (cfg) => {
@@ -49,6 +53,7 @@ function resolveClickClackAccountConfig(cfg, accountId) {
 		accounts: channel?.accounts,
 		accountId,
 		omitKeys: ["defaultAccount"],
+		nestedObjectKeys: ["discussions"],
 		normalizeAccountId
 	});
 	const account = resolveNormalizedAccountEntry(channel?.accounts, accountId, normalizeAccountId);
@@ -108,6 +113,9 @@ function resolveClickClackAccount(params) {
 		env: params.env
 	});
 	const workspace = merged.workspace?.trim() ?? "";
+	const discussionsWorkspace = merged.discussions?.workspace?.trim() || workspace;
+	const controlUrlBase = merged.discussions?.controlUrlBase?.trim();
+	const apiEndpoint = merged.apiBaseUrl?.trim().replace(/\/$/, "") || baseUrl;
 	return {
 		accountId,
 		enabled,
@@ -121,7 +129,6 @@ function resolveClickClackAccount(params) {
 		replyMode: merged.replyMode === "model" ? "model" : "agent",
 		model: normalizeOptionalString(merged.model),
 		systemPrompt: normalizeOptionalString(merged.systemPrompt),
-		timeoutSeconds: merged.timeoutSeconds,
 		toolsAllow: merged.toolsAllow,
 		defaultTo: merged.defaultTo?.trim() || "channel:general",
 		allowFrom: merged.allowFrom ?? ["*"],
@@ -131,10 +138,17 @@ function resolveClickClackAccount(params) {
 		}),
 		agentActivity: merged.agentActivity === true,
 		commandMenu: merged.commandMenu !== false,
+		discussions: {
+			enabled: merged.discussions?.enabled === true,
+			workspace: discussionsWorkspace,
+			...controlUrlBase ? { controlUrlBase } : {},
+			section: merged.discussions?.section?.trim() || DEFAULT_DISCUSSIONS_SECTION
+		},
 		config: {
 			...merged,
 			allowFrom: merged.allowFrom ?? ["*"]
-		}
+		},
+		apiEndpoint
 	};
 }
 /**
@@ -177,6 +191,7 @@ const ClickClackAccountConfigSchema = z.object({
 	name: z.string().optional(),
 	enabled: z.boolean().optional(),
 	baseUrl: z.string().url().optional(),
+	apiBaseUrl: z.string().url().optional(),
 	token: buildSecretInputSchema().optional(),
 	tokenFile: z.string().optional(),
 	workspace: z.string().optional(),
@@ -185,13 +200,18 @@ const ClickClackAccountConfigSchema = z.object({
 	replyMode: z.enum(["agent", "model"]).optional(),
 	model: z.string().optional(),
 	systemPrompt: z.string().optional(),
-	timeoutSeconds: z.number().int().min(1).max(3600).optional(),
 	toolsAllow: z.array(z.string()).optional(),
 	defaultTo: z.string().optional(),
 	allowFrom: z.array(z.string()).optional(),
 	reconnectMs: z.number().int().min(100).max(6e4).optional(),
 	agentActivity: z.boolean().optional(),
-	commandMenu: z.boolean().optional()
+	commandMenu: z.boolean().optional(),
+	discussions: z.object({
+		enabled: z.boolean().optional(),
+		workspace: z.string().optional(),
+		controlUrlBase: z.string().url().optional(),
+		section: z.string().optional()
+	}).strict().optional()
 }).strict();
 /**
 * Config schema exported to core so `openclaw doctor` and config validation
@@ -222,6 +242,15 @@ const CLICKCLACK_CORRELATION_ID_PATTERN = /^[A-Za-z0-9._:-]+$/u;
 const CLICKCLACK_CORRELATION_ID_HEADER = "X-Correlation-ID";
 const CLICKCLACK_INBOUND_JSON_LIMIT_BYTES = 16 * 1024 * 1024;
 const CLICKCLACK_WEBSOCKET_HANDSHAKE_TIMEOUT_MS = 3e4;
+const CLICKCLACK_MESSAGE_PAGE_LIMIT = 200;
+const CLICKCLACK_DISCUSSION_ROOT_PAGE_LIMIT = 8;
+const CLICKCLACK_DISCUSSION_THREAD_REQUEST_LIMIT = 24;
+function compareMessages(left, right) {
+	return left.created_at.localeCompare(right.created_at) || left.id.localeCompare(right.id);
+}
+function keepLatestMessages(messages, limit) {
+	return messages.toSorted(compareMessages).slice(-limit);
+}
 var ClickClackHttpError = class extends Error {
 	constructor(status, detail, headers) {
 		super(`ClickClack ${status}: ${detail}`);
@@ -229,6 +258,12 @@ var ClickClackHttpError = class extends Error {
 		this.headers = headers;
 	}
 };
+/** Matches the workspace/name uniqueness error returned by current ClickClack servers. */
+function isClickClackChannelNameConflict(error) {
+	if (!(error instanceof ClickClackHttpError) || error.status !== 400 && error.status !== 409) return false;
+	const message = error.message.toLowerCase();
+	return (message.includes("unique") || message.includes("duplicate")) && message.includes("channel") && /workspace.*name|name.*workspace/u.test(message);
+}
 /** Accepts the same bounded request-correlation shape as the ClickClack API. */
 function normalizeClickClackCorrelationId(value) {
 	if (typeof value !== "string") return;
@@ -258,7 +293,7 @@ function createClickClackClient(options) {
 		});
 		if (!response.ok) {
 			const detail = await readResponseTextLimited(response, CLICKCLACK_ERROR_BODY_LIMIT_BYTES);
-			throw new ClickClackHttpError(response.status, detail, new Headers(response.headers));
+			throw new ClickClackHttpError(response.status, redactToolPayloadText(detail), new Headers(response.headers));
 		}
 		return await readProviderJsonResponse(response, "ClickClack response", { maxBytes: CLICKCLACK_INBOUND_JSON_LIMIT_BYTES });
 	}
@@ -289,9 +324,63 @@ function createClickClackClient(options) {
 		channels: async (workspaceId) => {
 			return (await request(`/api/workspaces/${encodeURIComponent(workspaceId)}/channels`)).channels;
 		},
+		createChannel: async (workspaceId, channel) => {
+			return (await request(`/api/workspaces/${encodeURIComponent(workspaceId)}/channels`, {
+				method: "POST",
+				body: JSON.stringify(channel)
+			})).channel;
+		},
+		updateChannel: async (channelId, patch) => {
+			return (await request(`/api/channels/${encodeURIComponent(channelId)}`, {
+				method: "PATCH",
+				body: JSON.stringify(patch)
+			})).channel;
+		},
 		channelMessages: async (channelId, afterSeq, limit = 20) => {
 			return (await request(`/api/channels/${encodeURIComponent(channelId)}/messages?after_seq=${afterSeq}&limit=${limit}`)).messages;
 		},
+		latestChannelMessages: async (channelId, limit = 30) => {
+			const boundedLimit = Math.max(1, Math.min(CLICKCLACK_MESSAGE_PAGE_LIMIT, limit));
+			let beforeSeq;
+			let latest = [];
+			let rootPageCount = 0;
+			let threadRequestCount = 0;
+			let truncated = false;
+			while (true) {
+				rootPageCount += 1;
+				const query = new URLSearchParams({ limit: String(CLICKCLACK_MESSAGE_PAGE_LIMIT) });
+				if (beforeSeq !== void 0) query.set("before_seq", String(beforeSeq));
+				const page = await request(`/api/channels/${encodeURIComponent(channelId)}/messages?${query.toString()}`);
+				for (const root of page.messages) {
+					latest = keepLatestMessages([...latest, root], boundedLimit);
+					const lastReplyAt = root.thread_state?.last_reply_at;
+					const cutoff = latest.length === boundedLimit ? latest[0]?.created_at : void 0;
+					if (!root.thread_state?.reply_count || lastReplyAt !== void 0 && cutoff !== void 0 && lastReplyAt < cutoff) continue;
+					if (threadRequestCount >= CLICKCLACK_DISCUSSION_THREAD_REQUEST_LIMIT) {
+						truncated = true;
+						continue;
+					}
+					threadRequestCount += 1;
+					const threadQuery = new URLSearchParams({ limit: String(CLICKCLACK_MESSAGE_PAGE_LIMIT) });
+					const thread = await request(`/api/messages/${encodeURIComponent(root.id)}/thread?${threadQuery.toString()}`);
+					if (thread.replies.length < root.thread_state.reply_count) {
+						truncated = true;
+						continue;
+					}
+					latest = keepLatestMessages([...latest, ...thread.replies], boundedLimit);
+				}
+				if (!page.has_older) return {
+					messages: latest,
+					truncated
+				};
+				if (rootPageCount >= CLICKCLACK_DISCUSSION_ROOT_PAGE_LIMIT) return {
+					messages: latest,
+					truncated: true
+				};
+				if (page.messages.length === 0 || !Number.isSafeInteger(page.oldest_seq) || page.oldest_seq < 0 || page.oldest_seq === beforeSeq) throw new Error("ClickClack message pagination did not advance");
+				beforeSeq = page.oldest_seq;
+			}
+		},
 		directMessages: async (conversationId, afterSeq, limit = 20) => {
 			return (await request(`/api/dms/${encodeURIComponent(conversationId)}/messages?after_seq=${afterSeq}&limit=${limit}`)).messages;
 		},
@@ -447,6 +536,59 @@ async function resolveChannelId(client, workspaceId, channel) {
 	return found.id;
 }
 //#endregion
+//#region extensions/clickclack/src/setup-contract.ts
+const CLICKCLACK_SETUP_CODE_CLAIM_PATH = "/api/bot-setup-codes/claim";
+const LOOPBACK_ADDRESSES = new net.BlockList();
+LOOPBACK_ADDRESSES.addSubnet("127.0.0.0", 8, "ipv4");
+LOOPBACK_ADDRESSES.addAddress("::1", "ipv6");
+const BASE_PATH_SEGMENT = /^[A-Za-z0-9._~-]+$/u;
+function isClickClackSetupLoopbackHost(hostname) {
+	const normalized = hostname.toLowerCase().replace(/^\[|\]$/gu, "");
+	if (normalized === "localhost") return true;
+	const family = net.isIP(normalized);
+	return family !== 0 && LOOPBACK_ADDRESSES.check(normalized, family === 4 ? "ipv4" : "ipv6");
+}
+function requireClickClackSetupApiBaseUrl(value, label) {
+	if (!value || value !== value.trim()) throw new Error(`ClickClack ${label} is invalid`);
+	let parsed;
+	try {
+		parsed = new URL(value);
+	} catch {
+		throw new Error(`ClickClack ${label} is invalid`);
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:" || !parsed.hostname || parsed.hostname.endsWith(".") || parsed.username || parsed.password || parsed.search || parsed.hash) throw new Error(`ClickClack ${label} is invalid`);
+	if (parsed.protocol === "http:" && !isClickClackSetupLoopbackHost(parsed.hostname)) throw new Error(`ClickClack ${label} must use HTTPS unless it is on loopback`);
+	const pathname = parsed.pathname;
+	let basePath = "";
+	if (pathname !== "/") {
+		if (pathname.endsWith("/") || pathname.includes("//") || pathname.includes("\\") || pathname.slice(1).split("/").some((segment) => !BASE_PATH_SEGMENT.test(segment))) throw new Error(`ClickClack ${label} is invalid`);
+		basePath = pathname;
+	}
+	const canonical = parsed.origin + basePath;
+	if (value !== canonical) throw new Error(`ClickClack ${label} is not canonical`);
+	return canonical;
+}
+function requireClickClackSetupClaimUrl(value) {
+	let parsed;
+	try {
+		parsed = new URL(value);
+	} catch {
+		throw new Error("ClickClack setup URL has an invalid claim endpoint.");
+	}
+	if (parsed.username || parsed.password || parsed.search || parsed.hash || !parsed.pathname.endsWith("/api/bot-setup-codes/claim")) throw new Error("ClickClack setup URL has an invalid claim endpoint.");
+	const basePath = parsed.pathname.slice(0, -26);
+	const apiBaseUrl = requireClickClackSetupApiBaseUrl(parsed.origin + basePath, "setup URL API base");
+	const claimUrl = apiBaseUrl + CLICKCLACK_SETUP_CODE_CLAIM_PATH;
+	if (value !== claimUrl) throw new Error("ClickClack setup URL has a non-canonical claim endpoint.");
+	return {
+		claimUrl,
+		apiBaseUrl
+	};
+}
+function buildClickClackSetupClaimUrl(baseUrl) {
+	return baseUrl.replace(/\/+$/u, "") + CLICKCLACK_SETUP_CODE_CLAIM_PATH;
+}
+//#endregion
 //#region extensions/clickclack/src/setup-core.ts
 const channel$1 = "clickclack";
 const SETUP_CODE_ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
@@ -489,19 +631,30 @@ function parseClickClackSetupCodeInput(params) {
 		}
 		if (setupUrl.protocol !== "http:" && setupUrl.protocol !== "https:") throw new Error("ClickClack setup codes require an HTTP(S) URL.");
 		if (setupUrl.username || setupUrl.password) throw new Error("ClickClack setup URLs must not include credentials.");
+		if (setupUrl.search) throw new Error("ClickClack setup URLs must not include a query.");
 		code = setupUrl.hash.slice(1);
 		if (!code) throw new Error("ClickClack setup URL is missing its #CODE fragment.");
 		setupUrl.hash = "";
-		setupUrl.search = "";
-		baseUrl = requireClickClackSetupCodeBaseUrl(setupUrl.toString());
+		let exactClaimUrl;
+		if (setupUrl.pathname.endsWith("/api/bot-setup-codes/claim")) {
+			const exactEndpoint = requireClickClackSetupClaimUrl(setupUrl.toString());
+			baseUrl = exactEndpoint.apiBaseUrl;
+			exactClaimUrl = exactEndpoint.claimUrl;
+		} else baseUrl = requireClickClackSetupCodeBaseUrl(setupUrl.toString());
 		if (params.baseUrl) {
 			if (requireClickClackSetupCodeBaseUrl(params.baseUrl) !== baseUrl) throw new Error("ClickClack --base-url does not match the server in the setup-code URL.");
 		}
-	} else {
-		code = code.startsWith("#") ? code.slice(1) : code;
-		if (!params.baseUrl) throw new Error("A bare ClickClack setup code requires --base-url.");
-		baseUrl = requireClickClackSetupCodeBaseUrl(params.baseUrl);
+		const normalizedCode = normalizeClickClackSetupCode(code);
+		if (!normalizedCode) throw new Error("ClickClack setup code must contain 12 valid base32 characters.");
+		return {
+			code: normalizedCode,
+			baseUrl,
+			...exactClaimUrl ? { exactClaimUrl } : {}
+		};
 	}
+	code = code.startsWith("#") ? code.slice(1) : code;
+	if (!params.baseUrl) throw new Error("A bare ClickClack setup code requires --base-url.");
+	baseUrl = requireClickClackSetupCodeBaseUrl(params.baseUrl);
 	const normalizedCode = normalizeClickClackSetupCode(code);
 	if (!normalizedCode) throw new Error("ClickClack setup code must contain 12 valid base32 characters.");
 	return {
@@ -522,7 +675,8 @@ function applyClickClackSetupConfigPatch(params) {
 	const namedConfig = applyAccountNameToChannelSection({
 		cfg: accountId === DEFAULT_ACCOUNT_ID ? params.cfg : moveSingleAccountChannelSectionToDefaultAccount({
 			cfg: params.cfg,
-			channelKey: channel$1
+			channelKey: channel$1,
+			setupSurface: clickClackSetupAdapter
 		}),
 		channelKey: channel$1,
 		accountId,
@@ -585,21 +739,32 @@ function applyClickClackCredentialConfig(params) {
 }
 const clickClackSetupAdapter = {
 	resolveAccountId: ({ accountId }) => normalizeAccountId(accountId),
-	prepareAccountConfigInput: async ({ input }) => {
-		if (!input.code?.trim()) return input;
-		if (input.token?.trim() || input.tokenFile?.trim() || input.useEnv) throw new Error(SETUP_CODE_CONFLICT_ERROR);
-		const setup = parseClickClackSetupCodeInput({
-			code: input.code,
-			baseUrl: input.baseUrl
+	prepareAccountConfigInput: async ({ cfg, accountId, input }) => {
+		const setupInput = input;
+		if (!setupInput.code?.trim()) return setupInput;
+		if (setupInput.token?.trim() || setupInput.tokenFile?.trim() || setupInput.useEnv) throw new Error(SETUP_CODE_CONFLICT_ERROR);
+		let setup = parseClickClackSetupCodeInput({
+			code: setupInput.code,
+			baseUrl: setupInput.baseUrl
 		});
+		const privateApiBaseUrl = normalizeClickClackBaseUrl(resolveClickClackAccountConfig(cfg, accountId).apiBaseUrl);
+		const claimUrl = setup.exactClaimUrl && !privateApiBaseUrl ? setup.exactClaimUrl : buildClickClackSetupClaimUrl(privateApiBaseUrl ?? setup.baseUrl);
 		let claim;
 		try {
-			const { claimClickClackSetupCode } = await import("./setup-claim-BUWvZjtu.js");
-			claim = await claimClickClackSetupCode(setup);
+			const { claimClickClackSetupCode } = await import("./setup-claim-CJIUfZS7.js");
+			claim = await claimClickClackSetupCode({
+				claimUrl,
+				code: setup.code,
+				...setup.exactClaimUrl ? { expectedClaimUrl: setup.exactClaimUrl } : {}
+			});
 		} catch (error) {
 			throw formatClickClackSetupCodeClaimError(error);
 		}
-		const { code: _code, tokenFile: _tokenFile, useEnv: _useEnv, ...remainingInput } = input;
+		setup = {
+			...setup,
+			baseUrl: claim.api_base_url ?? setup.baseUrl
+		};
+		const { code: _code, tokenFile: _tokenFile, useEnv: _useEnv, ...remainingInput } = setupInput;
 		return {
 			...remainingInput,
 			baseUrl: setup.baseUrl,
@@ -633,40 +798,42 @@ const clickClackSetupAdapter = {
 			}
 		],
 		validate: ({ cfg, accountId, input }) => {
-			const baseUrl = normalizeClickClackBaseUrl(input.baseUrl);
-			if (input.baseUrl && !baseUrl) return INVALID_BASE_URL_ERROR;
-			if (!input.useEnv) return null;
+			const setupInput = input;
+			const baseUrl = normalizeClickClackBaseUrl(setupInput.baseUrl);
+			if (setupInput.baseUrl && !baseUrl) return INVALID_BASE_URL_ERROR;
+			if (!setupInput.useEnv) return null;
 			const existing = resolveClickClackAccountConfig(cfg, accountId);
 			const existingBaseUrl = normalizeClickClackBaseUrl(existing.baseUrl);
 			if (!baseUrl && existing.baseUrl?.trim() && !existingBaseUrl) return INVALID_BASE_URL_ERROR;
 			if (!baseUrl && !existingBaseUrl) return REQUIRED_INPUT_ERROR;
-			if (!input.workspace?.trim() && !existing.workspace?.trim()) return REQUIRED_INPUT_ERROR;
+			if (!setupInput.workspace?.trim() && !existing.workspace?.trim()) return REQUIRED_INPUT_ERROR;
 			return null;
 		}
 	}),
 	applyAccountConfig: ({ cfg, accountId, input }) => {
-		const existing = input.useEnv ? resolveClickClackAccountConfig(cfg, accountId) : void 0;
-		const baseUrl = normalizeClickClackBaseUrl(input.baseUrl ?? existing?.baseUrl);
-		const workspace = input.workspace?.trim() || existing?.workspace?.trim();
-		const tokenFile = input.tokenFile?.trim();
-		const token = input.token?.trim();
+		const setupInput = input;
+		const existing = setupInput.useEnv ? resolveClickClackAccountConfig(cfg, accountId) : void 0;
+		const baseUrl = normalizeClickClackBaseUrl(setupInput.baseUrl ?? existing?.baseUrl);
+		const workspace = setupInput.workspace?.trim() || existing?.workspace?.trim();
+		const tokenFile = setupInput.tokenFile?.trim();
+		const token = setupInput.token?.trim();
 		return applyClickClackCredentialConfig({
 			cfg: applyClickClackSetupConfigPatch({
 				cfg,
 				accountId,
-				name: input.name,
+				name: setupInput.name,
 				patch: {
 					...baseUrl ? { baseUrl } : {},
 					...workspace ? { workspace } : {},
-					...input.defaultTo?.trim() ? { defaultTo: input.defaultTo.trim() } : {},
-					...input.allowFrom ? { allowFrom: [...input.allowFrom] } : {},
-					...input.agentActivity !== void 0 ? { agentActivity: input.agentActivity } : {}
+					...setupInput.defaultTo?.trim() ? { defaultTo: setupInput.defaultTo.trim() } : {},
+					...setupInput.allowFrom ? { allowFrom: [...setupInput.allowFrom] } : {},
+					...setupInput.agentActivity !== void 0 ? { agentActivity: setupInput.agentActivity } : {}
 				}
 			}),
 			accountId,
 			token,
 			tokenFile,
-			useEnv: input.useEnv
+			useEnv: setupInput.useEnv
 		});
 	},
 	afterAccountConfigWritten: async ({ cfg, accountId, runtime }) => {
@@ -678,6 +845,77 @@ const clickClackSetupAdapter = {
 		});
 	}
 };
+const clickClackSetupContract = defineChannelSetupContract({
+	fields: {
+		code: {
+			kind: "string",
+			sensitive: true,
+			cli: {
+				flags: "--code <code>",
+				description: "ClickClack one-time setup code or setup URL"
+			}
+		},
+		token: {
+			kind: "string",
+			sensitive: true,
+			cli: {
+				flags: "--token <token>",
+				description: "ClickClack bot token"
+			}
+		},
+		tokenFile: {
+			kind: "string",
+			sensitive: true,
+			cli: {
+				flags: "--token-file <path>",
+				description: "ClickClack bot token file"
+			}
+		},
+		baseUrl: {
+			kind: "string",
+			cli: {
+				flags: "--base-url <url>",
+				description: "ClickClack API base URL"
+			}
+		},
+		workspace: {
+			kind: "string",
+			cli: {
+				flags: "--workspace <workspace>",
+				description: "ClickClack workspace id, slug, or name"
+			}
+		},
+		defaultTo: {
+			kind: "string",
+			cli: {
+				flags: "--default-to <target>",
+				description: "Default ClickClack target"
+			}
+		},
+		allowFrom: {
+			kind: "string-list",
+			cli: {
+				flags: "--allow-from <ids>",
+				description: "Allowed ClickClack senders"
+			}
+		},
+		agentActivity: {
+			kind: "boolean",
+			cli: {
+				flags: "--agent-activity",
+				description: "Enable ClickClack agent activity"
+			}
+		},
+		useEnv: {
+			kind: "boolean",
+			cli: {
+				flags: "--use-env",
+				description: "Use CLICKCLACK_BOT_TOKEN"
+			}
+		}
+	},
+	legacyAdapter: clickClackSetupAdapter
+});
 //#endregion
 //#region extensions/clickclack/src/setup-verify.ts
 var setup_verify_exports = /* @__PURE__ */ __exportAll({
@@ -708,7 +946,7 @@ async function checkClickClackSetupConnection(params) {
 		if (usesUnavailableImplicitEnvToken(account, token)) return { status: "skipped-env-token" };
 		if (!account.baseUrl || !account.workspace || !token) return { status: "skipped-unconfigured" };
 		const client = createClickClackClient({
-			baseUrl: account.baseUrl,
+			baseUrl: account.apiEndpoint,
 			token
 		});
 		const me = await client.me();
@@ -908,4 +1146,4 @@ const clickClackSetupWizard = {
 	disable: (cfg) => setSetupChannelEnabled(cfg, channel, false)
 };
 //#endregion
-export { createClickClackClient as a, CLICKCLACK_CHANNEL_ID as c, DEFAULT_ACCOUNT_ID$2 as d, listClickClackAccountIds as f, resolveDefaultClickClackAccountId as h, resolveWorkspaceId as i, clickClackConfigAdapter as l, resolveClickClackAccount as m, clickClackSetupAdapter as n, normalizeClickClackCorrelationId as o, listEnabledClickClackAccounts as p, resolveChannelId as r, clickClackConfigSchema as s, clickClackSetupWizard as t, clickClackMeta as u };
+export { resolveDefaultClickClackAccountId as S, clickClackMeta as _, buildClickClackSetupClaimUrl as a, listEnabledClickClackAccounts as b, resolveChannelId as c, createClickClackClient as d, isClickClackChannelNameConflict as f, clickClackConfigAdapter as g, CLICKCLACK_CHANNEL_ID as h, CLICKCLACK_SETUP_CODE_CLAIM_PATH as i, resolveWorkspaceId as l, clickClackConfigSchema as m, clickClackSetupAdapter as n, isClickClackSetupLoopbackHost as o, normalizeClickClackCorrelationId as p, clickClackSetupContract as r, requireClickClackSetupApiBaseUrl as s, clickClackSetupWizard as t, ClickClackHttpError as u, DEFAULT_ACCOUNT_ID$2 as v, resolveClickClackAccount as x, listClickClackAccountIds as y };