@openclaw/clickclack 2026.7.2-beta.3 → 2026.7.2-beta.5

package/dist/{setup-surface-CNjp76Xx.js → setup-surface-CD6MUC1g.js}

@@ -1,6 +1,5 @@
 import { createAccountListHelpers, hasConfiguredAccountValue } from "openclaw/plugin-sdk/account-helpers";
 import { DEFAULT_ACCOUNT_ID, DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$2, normalizeAccountId } from "openclaw/plugin-sdk/account-id";
-import { resolveMergedAccountConfig } from "openclaw/plugin-sdk/account-resolution";
 import { resolveNormalizedAccountEntry } from "openclaw/plugin-sdk/account-resolution-runtime";
 import { resolveIntegerOption } from "openclaw/plugin-sdk/number-runtime";
 import { resolveDefaultSecretProviderAlias } from "openclaw/plugin-sdk/provider-auth";
@@ -11,10 +10,13 @@ import { getChatChannelMeta } from "openclaw/plugin-sdk/channel-plugin-common";
 import { buildChannelConfigSchema, buildMultiAccountChannelSchema } from "openclaw/plugin-sdk/channel-config-schema";
 import { z } from "zod";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
+import { redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
 import { readProviderJsonResponse, readResponseTextLimited } from "openclaw/plugin-sdk/provider-http";
 import { WebSocket } from "ws";
-import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1, applyAccountNameToChannelSection, applySetupAccountConfigPatch, baseUrlTextInput, createSetupTranslator, createStandardChannelSetupStatus, defineTokenCredential, formatDocsLink, hasConfiguredSecretInput, migrateBaseNameToDefaultAccount, moveSingleAccountChannelSectionToDefaultAccount, setSetupChannelEnabled } from "openclaw/plugin-sdk/setup";
+import { defineChannelSetupContract } from "openclaw/plugin-sdk/channel-setup";
+import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1, applyAccountNameToChannelSection, baseUrlTextInput, createSetupTranslator, createStandardChannelSetupStatus, defineTokenCredential, formatDocsLink, hasConfiguredSecretInput, migrateBaseNameToDefaultAccount, moveSingleAccountChannelSectionToDefaultAccount, patchScopedAccountConfig, setSetupChannelEnabled } from "openclaw/plugin-sdk/setup";
 import { createSetupInputPresenceValidator } from "openclaw/plugin-sdk/setup-runtime";
+import net from "node:net";
 //#region \0rolldown/runtime.js
 var __defProp = Object.defineProperty;
 var __exportAll = (all, no_symbols) => {
@@ -35,8 +37,11 @@ var __exportAll = (all, no_symbols) => {
 const DEFAULT_RECONNECT_MS = 1500;
 const MIN_RECONNECT_MS = 100;
 const MAX_RECONNECT_MS = 6e4;
-const { listAccountIds: listClickClackAccountIds, resolveDefaultAccountId: resolveDefaultClickClackAccountId } = createAccountListHelpers("clickclack", {
+const DEFAULT_DISCUSSIONS_SECTION = "Sessions";
+const { listAccountIds: listClickClackAccountIds, resolveDefaultAccountId: resolveDefaultClickClackAccountId, resolveAccountConfig: resolveMergedClickClackAccountConfig } = createAccountListHelpers("clickclack", {
 	normalizeAccountId,
+	omitKeys: ["defaultAccount"],
+	nestedObjectKeys: ["discussions"],
 	hasImplicitDefaultAccount: (cfg) => {
 		const channel = cfg.channels?.clickclack;
 		return Boolean(channel?.baseUrl?.trim() && (hasConfiguredAccountValue(channel.token) || Boolean(channel.tokenFile?.trim()) || Boolean(process.env.CLICKCLACK_BOT_TOKEN?.trim())) && channel.workspace?.trim());
@@ -44,13 +49,7 @@ const { listAccountIds: listClickClackAccountIds, resolveDefaultAccountId: resol
 });
 function resolveClickClackAccountConfig(cfg, accountId) {
 	const channel = cfg.channels?.clickclack;
-	const merged = resolveMergedAccountConfig({
-		channelConfig: cfg.channels?.clickclack,
-		accounts: channel?.accounts,
-		accountId,
-		omitKeys: ["defaultAccount"],
-		normalizeAccountId
-	});
+	const merged = resolveMergedClickClackAccountConfig(cfg, accountId);
 	const account = resolveNormalizedAccountEntry(channel?.accounts, accountId, normalizeAccountId);
 	const accountTokenFile = account?.tokenFile?.trim();
 	if (accountTokenFile) return {
@@ -108,6 +107,9 @@ function resolveClickClackAccount(params) {
 		env: params.env
 	});
 	const workspace = merged.workspace?.trim() ?? "";
+	const discussionsWorkspace = merged.discussions?.workspace?.trim() || workspace;
+	const controlUrlBase = merged.discussions?.controlUrlBase?.trim();
+	const apiEndpoint = merged.apiBaseUrl?.trim().replace(/\/$/, "") || baseUrl;
 	return {
 		accountId,
 		enabled,
@@ -121,7 +123,6 @@ function resolveClickClackAccount(params) {
 		replyMode: merged.replyMode === "model" ? "model" : "agent",
 		model: normalizeOptionalString(merged.model),
 		systemPrompt: normalizeOptionalString(merged.systemPrompt),
-		timeoutSeconds: merged.timeoutSeconds,
 		toolsAllow: merged.toolsAllow,
 		defaultTo: merged.defaultTo?.trim() || "channel:general",
 		allowFrom: merged.allowFrom ?? ["*"],
@@ -131,10 +132,17 @@ function resolveClickClackAccount(params) {
 		}),
 		agentActivity: merged.agentActivity === true,
 		commandMenu: merged.commandMenu !== false,
+		discussions: {
+			enabled: merged.discussions?.enabled === true,
+			workspace: discussionsWorkspace,
+			...controlUrlBase ? { controlUrlBase } : {},
+			section: merged.discussions?.section?.trim() || DEFAULT_DISCUSSIONS_SECTION
+		},
 		config: {
 			...merged,
 			allowFrom: merged.allowFrom ?? ["*"]
-		}
+		},
+		apiEndpoint
 	};
 }
 /**
@@ -177,6 +185,7 @@ const ClickClackAccountConfigSchema = z.object({
 	name: z.string().optional(),
 	enabled: z.boolean().optional(),
 	baseUrl: z.string().url().optional(),
+	apiBaseUrl: z.string().url().optional(),
 	token: buildSecretInputSchema().optional(),
 	tokenFile: z.string().optional(),
 	workspace: z.string().optional(),
@@ -185,13 +194,18 @@ const ClickClackAccountConfigSchema = z.object({
 	replyMode: z.enum(["agent", "model"]).optional(),
 	model: z.string().optional(),
 	systemPrompt: z.string().optional(),
-	timeoutSeconds: z.number().int().min(1).max(3600).optional(),
 	toolsAllow: z.array(z.string()).optional(),
 	defaultTo: z.string().optional(),
 	allowFrom: z.array(z.string()).optional(),
 	reconnectMs: z.number().int().min(100).max(6e4).optional(),
 	agentActivity: z.boolean().optional(),
-	commandMenu: z.boolean().optional()
+	commandMenu: z.boolean().optional(),
+	discussions: z.object({
+		enabled: z.boolean().optional(),
+		workspace: z.string().optional(),
+		controlUrlBase: z.string().url().optional(),
+		section: z.string().optional()
+	}).strict().optional()
 }).strict();
 /**
 * Config schema exported to core so `openclaw doctor` and config validation
@@ -222,6 +236,15 @@ const CLICKCLACK_CORRELATION_ID_PATTERN = /^[A-Za-z0-9._:-]+$/u;
 const CLICKCLACK_CORRELATION_ID_HEADER = "X-Correlation-ID";
 const CLICKCLACK_INBOUND_JSON_LIMIT_BYTES = 16 * 1024 * 1024;
 const CLICKCLACK_WEBSOCKET_HANDSHAKE_TIMEOUT_MS = 3e4;
+const CLICKCLACK_MESSAGE_PAGE_LIMIT = 200;
+const CLICKCLACK_DISCUSSION_ROOT_PAGE_LIMIT = 8;
+const CLICKCLACK_DISCUSSION_THREAD_REQUEST_LIMIT = 24;
+function compareMessages(left, right) {
+	return left.created_at.localeCompare(right.created_at) || left.id.localeCompare(right.id);
+}
+function keepLatestMessages(messages, limit) {
+	return messages.toSorted(compareMessages).slice(-limit);
+}
 var ClickClackHttpError = class extends Error {
 	constructor(status, detail, headers) {
 		super(`ClickClack ${status}: ${detail}`);
@@ -229,6 +252,12 @@ var ClickClackHttpError = class extends Error {
 		this.headers = headers;
 	}
 };
+/** Matches the workspace/name uniqueness error returned by current ClickClack servers. */
+function isClickClackChannelNameConflict(error) {
+	if (!(error instanceof ClickClackHttpError) || error.status !== 400 && error.status !== 409) return false;
+	const message = error.message.toLowerCase();
+	return (message.includes("unique") || message.includes("duplicate")) && message.includes("channel") && /workspace.*name|name.*workspace/u.test(message);
+}
 /** Accepts the same bounded request-correlation shape as the ClickClack API. */
 function normalizeClickClackCorrelationId(value) {
 	if (typeof value !== "string") return;
@@ -258,7 +287,7 @@ function createClickClackClient(options) {
 		});
 		if (!response.ok) {
 			const detail = await readResponseTextLimited(response, CLICKCLACK_ERROR_BODY_LIMIT_BYTES);
-			throw new ClickClackHttpError(response.status, detail, new Headers(response.headers));
+			throw new ClickClackHttpError(response.status, redactToolPayloadText(detail), new Headers(response.headers));
 		}
 		return await readProviderJsonResponse(response, "ClickClack response", { maxBytes: CLICKCLACK_INBOUND_JSON_LIMIT_BYTES });
 	}
@@ -289,9 +318,63 @@ function createClickClackClient(options) {
 		channels: async (workspaceId) => {
 			return (await request(`/api/workspaces/${encodeURIComponent(workspaceId)}/channels`)).channels;
 		},
+		createChannel: async (workspaceId, channel) => {
+			return (await request(`/api/workspaces/${encodeURIComponent(workspaceId)}/channels`, {
+				method: "POST",
+				body: JSON.stringify(channel)
+			})).channel;
+		},
+		updateChannel: async (channelId, patch) => {
+			return (await request(`/api/channels/${encodeURIComponent(channelId)}`, {
+				method: "PATCH",
+				body: JSON.stringify(patch)
+			})).channel;
+		},
 		channelMessages: async (channelId, afterSeq, limit = 20) => {
 			return (await request(`/api/channels/${encodeURIComponent(channelId)}/messages?after_seq=${afterSeq}&limit=${limit}`)).messages;
 		},
+		latestChannelMessages: async (channelId, limit = 30) => {
+			const boundedLimit = Math.max(1, Math.min(CLICKCLACK_MESSAGE_PAGE_LIMIT, limit));
+			let beforeSeq;
+			let latest = [];
+			let rootPageCount = 0;
+			let threadRequestCount = 0;
+			let truncated = false;
+			while (true) {
+				rootPageCount += 1;
+				const query = new URLSearchParams({ limit: String(CLICKCLACK_MESSAGE_PAGE_LIMIT) });
+				if (beforeSeq !== void 0) query.set("before_seq", String(beforeSeq));
+				const page = await request(`/api/channels/${encodeURIComponent(channelId)}/messages?${query.toString()}`);
+				for (const root of page.messages) {
+					latest = keepLatestMessages([...latest, root], boundedLimit);
+					const lastReplyAt = root.thread_state?.last_reply_at;
+					const cutoff = latest.length === boundedLimit ? latest[0]?.created_at : void 0;
+					if (!root.thread_state?.reply_count || lastReplyAt !== void 0 && cutoff !== void 0 && lastReplyAt < cutoff) continue;
+					if (threadRequestCount >= CLICKCLACK_DISCUSSION_THREAD_REQUEST_LIMIT) {
+						truncated = true;
+						continue;
+					}
+					threadRequestCount += 1;
+					const threadQuery = new URLSearchParams({ limit: String(CLICKCLACK_MESSAGE_PAGE_LIMIT) });
+					const thread = await request(`/api/messages/${encodeURIComponent(root.id)}/thread?${threadQuery.toString()}`);
+					if (thread.replies.length < root.thread_state.reply_count) {
+						truncated = true;
+						continue;
+					}
+					latest = keepLatestMessages([...latest, ...thread.replies], boundedLimit);
+				}
+				if (!page.has_older) return {
+					messages: latest,
+					truncated
+				};
+				if (rootPageCount >= CLICKCLACK_DISCUSSION_ROOT_PAGE_LIMIT) return {
+					messages: latest,
+					truncated: true
+				};
+				if (page.messages.length === 0 || !Number.isSafeInteger(page.oldest_seq) || page.oldest_seq < 0 || page.oldest_seq === beforeSeq) throw new Error("ClickClack message pagination did not advance");
+				beforeSeq = page.oldest_seq;
+			}
+		},
 		directMessages: async (conversationId, afterSeq, limit = 20) => {
 			return (await request(`/api/dms/${encodeURIComponent(conversationId)}/messages?after_seq=${afterSeq}&limit=${limit}`)).messages;
 		},
@@ -447,6 +530,59 @@ async function resolveChannelId(client, workspaceId, channel) {
 	return found.id;
 }
 //#endregion
+//#region extensions/clickclack/src/setup-contract.ts
+const CLICKCLACK_SETUP_CODE_CLAIM_PATH = "/api/bot-setup-codes/claim";
+const LOOPBACK_ADDRESSES = new net.BlockList();
+LOOPBACK_ADDRESSES.addSubnet("127.0.0.0", 8, "ipv4");
+LOOPBACK_ADDRESSES.addAddress("::1", "ipv6");
+const BASE_PATH_SEGMENT = /^[A-Za-z0-9._~-]+$/u;
+function isClickClackSetupLoopbackHost(hostname) {
+	const normalized = hostname.toLowerCase().replace(/^\[|\]$/gu, "");
+	if (normalized === "localhost") return true;
+	const family = net.isIP(normalized);
+	return family !== 0 && LOOPBACK_ADDRESSES.check(normalized, family === 4 ? "ipv4" : "ipv6");
+}
+function requireClickClackSetupApiBaseUrl(value, label) {
+	if (!value || value !== value.trim()) throw new Error(`ClickClack ${label} is invalid`);
+	let parsed;
+	try {
+		parsed = new URL(value);
+	} catch {
+		throw new Error(`ClickClack ${label} is invalid`);
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:" || !parsed.hostname || parsed.hostname.endsWith(".") || parsed.username || parsed.password || parsed.search || parsed.hash) throw new Error(`ClickClack ${label} is invalid`);
+	if (parsed.protocol === "http:" && !isClickClackSetupLoopbackHost(parsed.hostname)) throw new Error(`ClickClack ${label} must use HTTPS unless it is on loopback`);
+	const pathname = parsed.pathname;
+	let basePath = "";
+	if (pathname !== "/") {
+		if (pathname.endsWith("/") || pathname.includes("//") || pathname.includes("\\") || pathname.slice(1).split("/").some((segment) => !BASE_PATH_SEGMENT.test(segment))) throw new Error(`ClickClack ${label} is invalid`);
+		basePath = pathname;
+	}
+	const canonical = parsed.origin + basePath;
+	if (value !== canonical) throw new Error(`ClickClack ${label} is not canonical`);
+	return canonical;
+}
+function requireClickClackSetupClaimUrl(value) {
+	let parsed;
+	try {
+		parsed = new URL(value);
+	} catch {
+		throw new Error("ClickClack setup URL has an invalid claim endpoint.");
+	}
+	if (parsed.username || parsed.password || parsed.search || parsed.hash || !parsed.pathname.endsWith("/api/bot-setup-codes/claim")) throw new Error("ClickClack setup URL has an invalid claim endpoint.");
+	const basePath = parsed.pathname.slice(0, -26);
+	const apiBaseUrl = requireClickClackSetupApiBaseUrl(parsed.origin + basePath, "setup URL API base");
+	const claimUrl = apiBaseUrl + CLICKCLACK_SETUP_CODE_CLAIM_PATH;
+	if (value !== claimUrl) throw new Error("ClickClack setup URL has a non-canonical claim endpoint.");
+	return {
+		claimUrl,
+		apiBaseUrl
+	};
+}
+function buildClickClackSetupClaimUrl(baseUrl) {
+	return baseUrl.replace(/\/+$/u, "") + CLICKCLACK_SETUP_CODE_CLAIM_PATH;
+}
+//#endregion
 //#region extensions/clickclack/src/setup-core.ts
 const channel$1 = "clickclack";
 const SETUP_CODE_ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
@@ -489,19 +625,30 @@ function parseClickClackSetupCodeInput(params) {
 		}
 		if (setupUrl.protocol !== "http:" && setupUrl.protocol !== "https:") throw new Error("ClickClack setup codes require an HTTP(S) URL.");
 		if (setupUrl.username || setupUrl.password) throw new Error("ClickClack setup URLs must not include credentials.");
+		if (setupUrl.search) throw new Error("ClickClack setup URLs must not include a query.");
 		code = setupUrl.hash.slice(1);
 		if (!code) throw new Error("ClickClack setup URL is missing its #CODE fragment.");
 		setupUrl.hash = "";
-		setupUrl.search = "";
-		baseUrl = requireClickClackSetupCodeBaseUrl(setupUrl.toString());
+		let exactClaimUrl;
+		if (setupUrl.pathname.endsWith("/api/bot-setup-codes/claim")) {
+			const exactEndpoint = requireClickClackSetupClaimUrl(setupUrl.toString());
+			baseUrl = exactEndpoint.apiBaseUrl;
+			exactClaimUrl = exactEndpoint.claimUrl;
+		} else baseUrl = requireClickClackSetupCodeBaseUrl(setupUrl.toString());
 		if (params.baseUrl) {
 			if (requireClickClackSetupCodeBaseUrl(params.baseUrl) !== baseUrl) throw new Error("ClickClack --base-url does not match the server in the setup-code URL.");
 		}
-	} else {
-		code = code.startsWith("#") ? code.slice(1) : code;
-		if (!params.baseUrl) throw new Error("A bare ClickClack setup code requires --base-url.");
-		baseUrl = requireClickClackSetupCodeBaseUrl(params.baseUrl);
+		const normalizedCode = normalizeClickClackSetupCode(code);
+		if (!normalizedCode) throw new Error("ClickClack setup code must contain 12 valid base32 characters.");
+		return {
+			code: normalizedCode,
+			baseUrl,
+			...exactClaimUrl ? { exactClaimUrl } : {}
+		};
 	}
+	code = code.startsWith("#") ? code.slice(1) : code;
+	if (!params.baseUrl) throw new Error("A bare ClickClack setup code requires --base-url.");
+	baseUrl = requireClickClackSetupCodeBaseUrl(params.baseUrl);
 	const normalizedCode = normalizeClickClackSetupCode(code);
 	if (!normalizedCode) throw new Error("ClickClack setup code must contain 12 valid base32 characters.");
 	return {
@@ -522,84 +669,61 @@ function applyClickClackSetupConfigPatch(params) {
 	const namedConfig = applyAccountNameToChannelSection({
 		cfg: accountId === DEFAULT_ACCOUNT_ID ? params.cfg : moveSingleAccountChannelSectionToDefaultAccount({
 			cfg: params.cfg,
-			channelKey: channel$1
+			channelKey: channel$1,
+			setupSurface: clickClackSetupAdapter
 		}),
 		channelKey: channel$1,
 		accountId,
 		name: params.name
 	});
-	return applySetupAccountConfigPatch({
+	return patchScopedAccountConfig({
 		cfg: accountId !== DEFAULT_ACCOUNT_ID ? migrateBaseNameToDefaultAccount({
 			cfg: namedConfig,
 			channelKey: channel$1
 		}) : namedConfig,
 		channelKey: channel$1,
 		accountId,
-		patch: params.patch
+		patch: params.patch,
+		...params.clearFields ? { clearFields: params.clearFields } : {}
 	});
 }
-function clearClickClackSetupConfigFields(params) {
-	const clickclack = params.cfg.channels?.clickclack;
-	if (!clickclack) return params.cfg;
-	const accountId = normalizeAccountId(params.accountId);
-	if (accountId === DEFAULT_ACCOUNT_ID) {
-		const nextClickClack = { ...clickclack };
-		for (const field of params.fields) delete nextClickClack[field];
-		return {
-			...params.cfg,
-			channels: {
-				...params.cfg.channels,
-				clickclack: nextClickClack
-			}
-		};
-	}
-	const currentAccount = clickclack.accounts?.[accountId];
-	if (!currentAccount) return params.cfg;
-	const nextAccount = { ...currentAccount };
-	for (const field of params.fields) delete nextAccount[field];
-	return {
-		...params.cfg,
-		channels: {
-			...params.cfg.channels,
-			clickclack: {
-				...clickclack,
-				accounts: {
-					...clickclack.accounts,
-					[accountId]: nextAccount
-				}
-			}
-		}
-	};
-}
 function applyClickClackCredentialConfig(params) {
 	const fieldsToClear = params.useEnv ? ["token", "tokenFile"] : params.tokenFile ? ["token"] : params.token !== void 0 ? ["tokenFile"] : [];
-	return clearClickClackSetupConfigFields({
-		cfg: applyClickClackSetupConfigPatch({
-			cfg: params.cfg,
-			accountId: params.accountId,
-			patch: params.useEnv ? {} : params.tokenFile ? { tokenFile: params.tokenFile } : params.token !== void 0 ? { token: params.token } : {}
-		}),
+	return applyClickClackSetupConfigPatch({
+		cfg: params.cfg,
 		accountId: params.accountId,
-		fields: fieldsToClear
+		clearFields: fieldsToClear,
+		patch: params.useEnv ? {} : params.tokenFile ? { tokenFile: params.tokenFile } : params.token !== void 0 ? { token: params.token } : {}
 	});
 }
 const clickClackSetupAdapter = {
 	resolveAccountId: ({ accountId }) => normalizeAccountId(accountId),
-	prepareAccountConfigInput: async ({ input }) => {
-		if (!input.code?.trim()) return input;
-		if (input.token?.trim() || input.tokenFile?.trim() || input.useEnv) throw new Error(SETUP_CODE_CONFLICT_ERROR);
-		const setup = parseClickClackSetupCodeInput({
-			code: input.code,
-			baseUrl: input.baseUrl
+	prepareAccountConfigInput: async ({ cfg, accountId, input }) => {
+		const setupInput = input;
+		if (!setupInput.code?.trim()) return setupInput;
+		if (setupInput.token?.trim() || setupInput.tokenFile?.trim() || setupInput.useEnv) throw new Error(SETUP_CODE_CONFLICT_ERROR);
+		let setup = parseClickClackSetupCodeInput({
+			code: setupInput.code,
+			baseUrl: setupInput.baseUrl
 		});
+		const privateApiBaseUrl = normalizeClickClackBaseUrl(resolveClickClackAccountConfig(cfg, accountId).apiBaseUrl);
+		const claimUrl = setup.exactClaimUrl && !privateApiBaseUrl ? setup.exactClaimUrl : buildClickClackSetupClaimUrl(privateApiBaseUrl ?? setup.baseUrl);
 		let claim;
 		try {
-			const { claimClickClackSetupCode } = await import("./setup-claim-BUWvZjtu.js");
-			claim = await claimClickClackSetupCode(setup);
+			const { claimClickClackSetupCode } = await import("./setup-claim-BFU16zoo.js");
+			claim = await claimClickClackSetupCode({
+				claimUrl,
+				code: setup.code,
+				...setup.exactClaimUrl ? { expectedClaimUrl: setup.exactClaimUrl } : {}
+			});
 		} catch (error) {
 			throw formatClickClackSetupCodeClaimError(error);
 		}
-		const { code: _code, tokenFile: _tokenFile, useEnv: _useEnv, ...remainingInput } = input;
+		setup = {
+			...setup,
+			baseUrl: claim.api_base_url ?? setup.baseUrl
+		};
+		const { code: _code, tokenFile: _tokenFile, useEnv: _useEnv, ...remainingInput } = setupInput;
 		return {
 			...remainingInput,
 			baseUrl: setup.baseUrl,
@@ -633,40 +757,42 @@ const clickClackSetupAdapter = {
 			}
 		],
 		validate: ({ cfg, accountId, input }) => {
-			const baseUrl = normalizeClickClackBaseUrl(input.baseUrl);
-			if (input.baseUrl && !baseUrl) return INVALID_BASE_URL_ERROR;
-			if (!input.useEnv) return null;
+			const setupInput = input;
+			const baseUrl = normalizeClickClackBaseUrl(setupInput.baseUrl);
+			if (setupInput.baseUrl && !baseUrl) return INVALID_BASE_URL_ERROR;
+			if (!setupInput.useEnv) return null;
 			const existing = resolveClickClackAccountConfig(cfg, accountId);
 			const existingBaseUrl = normalizeClickClackBaseUrl(existing.baseUrl);
 			if (!baseUrl && existing.baseUrl?.trim() && !existingBaseUrl) return INVALID_BASE_URL_ERROR;
 			if (!baseUrl && !existingBaseUrl) return REQUIRED_INPUT_ERROR;
-			if (!input.workspace?.trim() && !existing.workspace?.trim()) return REQUIRED_INPUT_ERROR;
+			if (!setupInput.workspace?.trim() && !existing.workspace?.trim()) return REQUIRED_INPUT_ERROR;
 			return null;
 		}
 	}),
 	applyAccountConfig: ({ cfg, accountId, input }) => {
-		const existing = input.useEnv ? resolveClickClackAccountConfig(cfg, accountId) : void 0;
-		const baseUrl = normalizeClickClackBaseUrl(input.baseUrl ?? existing?.baseUrl);
-		const workspace = input.workspace?.trim() || existing?.workspace?.trim();
-		const tokenFile = input.tokenFile?.trim();
-		const token = input.token?.trim();
+		const setupInput = input;
+		const existing = setupInput.useEnv ? resolveClickClackAccountConfig(cfg, accountId) : void 0;
+		const baseUrl = normalizeClickClackBaseUrl(setupInput.baseUrl ?? existing?.baseUrl);
+		const workspace = setupInput.workspace?.trim() || existing?.workspace?.trim();
+		const tokenFile = setupInput.tokenFile?.trim();
+		const token = setupInput.token?.trim();
 		return applyClickClackCredentialConfig({
 			cfg: applyClickClackSetupConfigPatch({
 				cfg,
 				accountId,
-				name: input.name,
+				name: setupInput.name,
 				patch: {
 					...baseUrl ? { baseUrl } : {},
 					...workspace ? { workspace } : {},
-					...input.defaultTo?.trim() ? { defaultTo: input.defaultTo.trim() } : {},
-					...input.allowFrom ? { allowFrom: [...input.allowFrom] } : {},
-					...input.agentActivity !== void 0 ? { agentActivity: input.agentActivity } : {}
+					...setupInput.defaultTo?.trim() ? { defaultTo: setupInput.defaultTo.trim() } : {},
+					...setupInput.allowFrom ? { allowFrom: [...setupInput.allowFrom] } : {},
+					...setupInput.agentActivity !== void 0 ? { agentActivity: setupInput.agentActivity } : {}
 				}
 			}),
 			accountId,
 			token,
 			tokenFile,
-			useEnv: input.useEnv
+			useEnv: setupInput.useEnv
 		});
 	},
 	afterAccountConfigWritten: async ({ cfg, accountId, runtime }) => {
@@ -678,6 +804,77 @@ const clickClackSetupAdapter = {
 		});
 	}
 };
+const clickClackSetupContract = defineChannelSetupContract({
+	fields: {
+		code: {
+			kind: "string",
+			sensitive: true,
+			cli: {
+				flags: "--code <code>",
+				description: "ClickClack one-time setup code or setup URL"
+			}
+		},
+		token: {
+			kind: "string",
+			sensitive: true,
+			cli: {
+				flags: "--token <token>",
+				description: "ClickClack bot token"
+			}
+		},
+		tokenFile: {
+			kind: "string",
+			sensitive: true,
+			cli: {
+				flags: "--token-file <path>",
+				description: "ClickClack bot token file"
+			}
+		},
+		baseUrl: {
+			kind: "string",
+			cli: {
+				flags: "--base-url <url>",
+				description: "ClickClack API base URL"
+			}
+		},
+		workspace: {
+			kind: "string",
+			cli: {
+				flags: "--workspace <workspace>",
+				description: "ClickClack workspace id, slug, or name"
+			}
+		},
+		defaultTo: {
+			kind: "string",
+			cli: {
+				flags: "--default-to <target>",
+				description: "Default ClickClack target"
+			}
+		},
+		allowFrom: {
+			kind: "string-list",
+			cli: {
+				flags: "--allow-from <ids>",
+				description: "Allowed ClickClack senders"
+			}
+		},
+		agentActivity: {
+			kind: "boolean",
+			cli: {
+				flags: "--agent-activity",
+				description: "Enable ClickClack agent activity"
+			}
+		},
+		useEnv: {
+			kind: "boolean",
+			cli: {
+				flags: "--use-env",
+				description: "Use CLICKCLACK_BOT_TOKEN"
+			}
+		}
+	},
+	legacyAdapter: clickClackSetupAdapter
+});
 //#endregion
 //#region extensions/clickclack/src/setup-verify.ts
 var setup_verify_exports = /* @__PURE__ */ __exportAll({
@@ -708,7 +905,7 @@ async function checkClickClackSetupConnection(params) {
 		if (usesUnavailableImplicitEnvToken(account, token)) return { status: "skipped-env-token" };
 		if (!account.baseUrl || !account.workspace || !token) return { status: "skipped-unconfigured" };
 		const client = createClickClackClient({
-			baseUrl: account.baseUrl,
+			baseUrl: account.apiEndpoint,
 			token
 		});
 		const me = await client.me();
@@ -908,4 +1105,4 @@ const clickClackSetupWizard = {
 	disable: (cfg) => setSetupChannelEnabled(cfg, channel, false)
 };
 //#endregion
-export { createClickClackClient as a, CLICKCLACK_CHANNEL_ID as c, DEFAULT_ACCOUNT_ID$2 as d, listClickClackAccountIds as f, resolveDefaultClickClackAccountId as h, resolveWorkspaceId as i, clickClackConfigAdapter as l, resolveClickClackAccount as m, clickClackSetupAdapter as n, normalizeClickClackCorrelationId as o, listEnabledClickClackAccounts as p, resolveChannelId as r, clickClackConfigSchema as s, clickClackSetupWizard as t, clickClackMeta as u };
+export { resolveDefaultClickClackAccountId as S, clickClackMeta as _, buildClickClackSetupClaimUrl as a, listEnabledClickClackAccounts as b, resolveChannelId as c, createClickClackClient as d, isClickClackChannelNameConflict as f, clickClackConfigAdapter as g, CLICKCLACK_CHANNEL_ID as h, CLICKCLACK_SETUP_CODE_CLAIM_PATH as i, resolveWorkspaceId as l, clickClackConfigSchema as m, clickClackSetupAdapter as n, isClickClackSetupLoopbackHost as o, normalizeClickClackCorrelationId as p, clickClackSetupContract as r, requireClickClackSetupApiBaseUrl as s, clickClackSetupWizard as t, ClickClackHttpError as u, DEFAULT_ACCOUNT_ID$2 as v, resolveClickClackAccount as x, listClickClackAccountIds as y };

package/node_modules/ws/lib/receiver.js

@@ -77,6 +77,7 @@ class Receiver extends Writable {
 
     this._totalPayloadLength = 0;
     this._messageLength = 0;
+    this._numFragments = 0;
     this._fragments = [];
 
     this._errored = false;
@@ -500,6 +501,19 @@ class Receiver extends Writable {
       return;
     }
 
+    if (this._maxFragments > 0 && ++this._numFragments > this._maxFragments) {
+      const error = this.createError(
+        RangeError,
+        'Too many message fragments',
+        false,
+        1008,
+        'WS_ERR_TOO_MANY_BUFFERED_PARTS'
+      );
+
+      cb(error);
+      return;
+    }
+
     if (this._compressed) {
       this._state = INFLATING;
       this.decompress(data, cb);
@@ -507,22 +521,6 @@ class Receiver extends Writable {
     }
 
     if (data.length) {
-      if (
-        this._maxFragments > 0 &&
-        this._fragments.length >= this._maxFragments
-      ) {
-        const error = this.createError(
-          RangeError,
-          'Too many message fragments',
-          false,
-          1008,
-          'WS_ERR_TOO_MANY_BUFFERED_PARTS'
-        );
-
-        cb(error);
-        return;
-      }
-
       //
       // This message is not compressed so its length is the sum of the payload
       // length of all fragments.
@@ -562,22 +560,6 @@ class Receiver extends Writable {
           return;
         }
 
-        if (
-          this._maxFragments > 0 &&
-          this._fragments.length >= this._maxFragments
-        ) {
-          const error = this.createError(
-            RangeError,
-            'Too many message fragments',
-            false,
-            1008,
-            'WS_ERR_TOO_MANY_BUFFERED_PARTS'
-          );
-
-          cb(error);
-          return;
-        }
-
         this._fragments.push(buf);
       }
 
@@ -604,6 +586,7 @@ class Receiver extends Writable {
     this._totalPayloadLength = 0;
     this._messageLength = 0;
     this._fragmented = 0;
+    this._numFragments = 0;
     this._fragments = [];
 
     if (this._opcode === 2) {

package/node_modules/ws/lib/websocket-server.js

@@ -43,9 +43,9 @@ class WebSocketServer extends EventEmitter {
    *     called
    * @param {Function} [options.handleProtocols] A hook to handle protocols
    * @param {String} [options.host] The hostname where to bind the server
-   * @param {Number} [options.maxBufferedChunks=1048576] The maximum number of
+   * @param {Number} [options.maxBufferedChunks=262144] The maximum number of
    *     buffered data chunks
-   * @param {Number} [options.maxFragments=131072] The maximum number of message
+   * @param {Number} [options.maxFragments=16384] The maximum number of message
    *     fragments
    * @param {Number} [options.maxPayload=104857600] The maximum allowed message
    *     size
@@ -69,8 +69,8 @@ class WebSocketServer extends EventEmitter {
     options = {
       allowSynchronousEvents: true,
       autoPong: true,
-      maxBufferedChunks: 1024 * 1024,
-      maxFragments: 128 * 1024,
+      maxBufferedChunks: 256 * 1024,
+      maxFragments: 16 * 1024,
       maxPayload: 100 * 1024 * 1024,
       skipUTF8Validation: false,
       perMessageDeflate: false,