@openclaw/signal 2026.9.5 → 2026.9.7

package/dist/.setup/{doctor-contract-api-Rbq_sRTI.mjs → doctor-contract-api-Db9V9gsY.mjs}

@@ -1,20 +1,36 @@
 import { a as normalizeSignalTransportUrl, r as buildSignalTransportHttpUrl, s as resolveSignalAccountKey, t as assertSignalSocketTransport } from "./transport-url-CAC0JcuI.mjs";
-import { a as isSignalManagedNativeConnectionUrlForBind, i as assignSignalManagedNativePort, o as isValidSignalManagedNativePort, r as allocateSignalManagedNativePort, s as resolveLocalSignalTransportPort } from "./transport-policy-5VSnj5ma.mjs";
+import { a as isSignalManagedNativeConnectionUrlForBind, c as resolveLocalSignalTransportPort, i as assignSignalManagedNativePort, o as isValidSignalManagedNativePort, r as allocateSignalManagedNativePort } from "./transport-policy-B6C_LogW.mjs";
+import { n as hasLegacySignalTransportFields, t as LEGACY_SIGNAL_TRANSPORT_FIELDS } from "./legacy-transport-QIpaMNST.mjs";
+import "node:module";
 import { isRecord, normalizeLowercaseStringOrEmpty, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "openclaw/plugin-sdk/account-resolution";
-import { defineChannelAliasMigration } from "openclaw/plugin-sdk/runtime-doctor-migrations";
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
+//#endregion
 //#region extensions/signal/src/config-compat.ts
-const LEGACY_TRANSPORT_FIELDS = [
-	"configPath",
-	"httpUrl",
-	"httpHost",
-	"httpPort",
-	"cliPath",
-	"autoStart",
-	"startupTimeoutMs",
-	"receiveMode",
-	"ignoreStories"
-];
 const PENDING_LEGACY_TRANSPORT_WARNING = "- channels.signal: legacy auto transport is ambiguous while its endpoint is unavailable; bring the endpoint online and rerun openclaw doctor --fix, or replace the retired fields with an explicit account-owned transport in openclaw.json.";
 const PENDING_LEGACY_INVALID_URL_WARNING = "- channels.signal: legacy httpUrl is invalid; keep the current config, correct httpUrl, then run openclaw doctor --fix.";
 const PENDING_LEGACY_INVALID_HOST_WARNING = "- channels.signal: legacy httpHost is invalid; keep the current config, correct httpHost, then run openclaw doctor --fix.";
@@ -22,24 +38,13 @@ const PENDING_LEGACY_INVALID_PORT_WARNING = "- channels.signal: legacy httpPort
 const PENDING_LEGACY_CONTAINER_ACCOUNT_WARNING = "- channels.signal: legacy container transport requires an account number; add channels.signal.account (or the relevant channels.signal.accounts.*.account) and rerun openclaw doctor --fix.";
 function isSignalTransportConfig(value) {
 	if (!isRecord(value)) return false;
-	if (value.kind === "managed-native") {
-		try {
+	try {
+		if (value.kind === "managed-native") {
 			assertSignalSocketTransport(value);
-		} catch {
-			return false;
-		}
-		if (value.httpPort !== void 0 && !isValidSignalManagedNativePort(value.httpPort)) return false;
-		if (value.url === void 0) return true;
+			if (value.httpPort !== void 0 && !isValidSignalManagedNativePort(value.httpPort)) return false;
+			if (value.url === void 0) return true;
+		} else if (value.kind !== "external-native" && value.kind !== "container") return false;
 		if (typeof value.url !== "string") return false;
-		try {
-			normalizeSignalTransportUrl(value.url);
-			return true;
-		} catch {
-			return false;
-		}
-	}
-	if (value.kind !== "external-native" && value.kind !== "container" || typeof value.url !== "string") return false;
-	try {
 		normalizeSignalTransportUrl(value.url);
 		return true;
 	} catch {
@@ -56,9 +61,6 @@ function legacyBaseUrl(entry, parent) {
 	const rawPort = inherited(entry, parent, "httpPort");
 	return buildSignalTransportHttpUrl(host, typeof rawPort === "number" ? rawPort : 8080);
 }
-function hasLegacyFields(entry) {
-	return LEGACY_TRANSPORT_FIELDS.some((field) => Object.hasOwn(entry, field));
-}
 function wasLegacySignalAccountConfigured(entry, parent) {
 	return Boolean(normalizeOptionalString(inherited(entry, parent, "account")) || normalizeOptionalString(inherited(entry, parent, "configPath")) || normalizeOptionalString(inherited(entry, parent, "httpUrl")) || normalizeOptionalString(inherited(entry, parent, "httpHost")) || normalizeOptionalString(inherited(entry, parent, "cliPath")) || typeof inherited(entry, parent, "httpPort") === "number" || typeof inherited(entry, parent, "autoStart") === "boolean");
 }
@@ -169,7 +171,7 @@ async function resolveLegacyTransport(params) {
 	}
 }
 function clearLegacyTransportFields(entry) {
-	for (const field of LEGACY_TRANSPORT_FIELDS) delete entry[field];
+	for (const field of LEGACY_SIGNAL_TRANSPORT_FIELDS) delete entry[field];
 }
 function hasRootSignalAccount(entries) {
 	const root = entries[0];
@@ -192,7 +194,7 @@ function nestedDefaultOwnsEffectiveTransport(entries) {
 	const accounts = isRecord(entries[0]?.accounts) ? entries[0].accounts : {};
 	const nestedDefaultKey = resolveSignalAccountKey(accounts, DEFAULT_ACCOUNT_ID);
 	const nestedDefault = nestedDefaultKey ? accounts[nestedDefaultKey] : void 0;
-	return isRecord(nestedDefault) && (isSignalTransportConfig(nestedDefault.transport) || hasLegacyFields(nestedDefault));
+	return isRecord(nestedDefault) && (isSignalTransportConfig(nestedDefault.transport) || hasLegacySignalTransportFields(nestedDefault));
 }
 function isDiscardedTransportEntry(entries, index) {
 	if (index === 0) return !hasRootSignalAccount(entries) || nestedDefaultOwnsEffectiveTransport(entries);
@@ -302,6 +304,13 @@ function hasContainerTransportWithoutEffectiveAccount(cfg) {
 	}
 	return false;
 }
+function pendingSignalTransportMigration(cfg, warning) {
+	return {
+		config: cfg,
+		changes: [],
+		warnings: [warning]
+	};
+}
 function prepareLegacySignalTransportMigration(cfg) {
 	const signal = cfg.channels?.signal;
 	if (!isRecord(signal)) return {
@@ -309,29 +318,17 @@ function prepareLegacySignalTransportMigration(cfg) {
 		changes: []
 	};
 	const accounts = isRecord(signal.accounts) ? signal.accounts : {};
-	if (!(Object.hasOwn(signal, "apiMode") || hasLegacyFields(signal) || Object.values(accounts).some((entry) => isRecord(entry) && hasLegacyFields(entry)))) return {
+	if (!(Object.hasOwn(signal, "apiMode") || hasLegacySignalTransportFields(signal) || Object.values(accounts).some(hasLegacySignalTransportFields))) return {
 		config: cfg,
 		changes: []
 	};
 	const apiMode = signal.apiMode;
 	const entries = [signal, ...Object.values(accounts).filter(isRecord)];
-	if (entries.some((entry) => isRecord(entry.transport) && Object.hasOwn(entry.transport, "socketPath") && (entry.transport.kind !== "managed-native" || !isSignalTransportConfig(entry.transport)))) return {
-		config: cfg,
-		changes: [],
-		warnings: ["- channels.signal: invalid transport.socketPath configuration; correct the socket path and remove conflicting HTTP or receiveMode on-start options, then run openclaw doctor --fix."]
-	};
+	if (entries.some((entry) => isRecord(entry.transport) && Object.hasOwn(entry.transport, "socketPath") && (entry.transport.kind !== "managed-native" || !isSignalTransportConfig(entry.transport)))) return pendingSignalTransportMigration(cfg, "- channels.signal: invalid transport.socketPath configuration; correct the socket path and remove conflicting HTTP or receiveMode on-start options, then run openclaw doctor --fix.");
 	const legacyResolutionEntries = entries.filter((_, index) => shouldMaterializeTransport(entries, index)).filter((entry) => !isSignalTransportConfig(entry.transport));
 	const invalidDerivedEndpoint = findInvalidLegacyDerivedEndpoint(legacyResolutionEntries, signal);
-	if (invalidDerivedEndpoint) return {
-		config: cfg,
-		changes: [],
-		warnings: [invalidDerivedEndpoint === "port" ? PENDING_LEGACY_INVALID_PORT_WARNING : PENDING_LEGACY_INVALID_HOST_WARNING]
-	};
-	if (hasInvalidLegacyHttpUrl(legacyResolutionEntries, signal)) return {
-		config: cfg,
-		changes: [],
-		warnings: [PENDING_LEGACY_INVALID_URL_WARNING]
-	};
+	if (invalidDerivedEndpoint) return pendingSignalTransportMigration(cfg, invalidDerivedEndpoint === "port" ? PENDING_LEGACY_INVALID_PORT_WARNING : PENDING_LEGACY_INVALID_HOST_WARNING);
+	if (hasInvalidLegacyHttpUrl(legacyResolutionEntries, signal)) return pendingSignalTransportMigration(cfg, PENDING_LEGACY_INVALID_URL_WARNING);
 	return {
 		signal,
 		apiMode,
@@ -340,20 +337,12 @@ function prepareLegacySignalTransportMigration(cfg) {
 	};
 }
 function finishLegacySignalTransportMigration(cfg, entries, resolvedTransports) {
-	if (hasInvalidManagedTransportPort(resolvedTransports)) return {
-		config: cfg,
-		changes: [],
-		warnings: [PENDING_LEGACY_INVALID_PORT_WARNING]
-	};
+	if (hasInvalidManagedTransportPort(resolvedTransports)) return pendingSignalTransportMigration(cfg, PENDING_LEGACY_INVALID_PORT_WARNING);
 	const transports = allocateMigratedManagedPorts({
 		entries,
 		transports: resolvedTransports
 	});
-	if (transports.some((transport, index) => shouldMaterializeTransport(entries, index) && !transport)) return {
-		config: cfg,
-		changes: [],
-		warnings: [PENDING_LEGACY_TRANSPORT_WARNING]
-	};
+	if (transports.some((transport, index) => shouldMaterializeTransport(entries, index) && !transport)) return pendingSignalTransportMigration(cfg, PENDING_LEGACY_TRANSPORT_WARNING);
 	const next = applyMigratedSignalTransports({
 		cfg,
 		entries,
@@ -363,11 +352,7 @@ function finishLegacySignalTransportMigration(cfg, entries, resolvedTransports)
 		config: cfg,
 		changes: []
 	};
-	if (hasContainerTransportWithoutEffectiveAccount(next)) return {
-		config: cfg,
-		changes: [],
-		warnings: [PENDING_LEGACY_CONTAINER_ACCOUNT_WARNING]
-	};
+	if (hasContainerTransportWithoutEffectiveAccount(next)) return pendingSignalTransportMigration(cfg, PENDING_LEGACY_CONTAINER_ACCOUNT_WARNING);
 	return {
 		config: next,
 		changes: ["Migrated channels.signal transport settings to concrete account-owned transport objects."]
@@ -377,11 +362,7 @@ async function migrateLegacySignalTransportConfig(params) {
 	const prepared = prepareLegacySignalTransportMigration(params.cfg);
 	if ("config" in prepared) return prepared;
 	const { signal, apiMode, entries, legacyResolutionEntries } = prepared;
-	if (!params.detect && legacyResolutionEntries.some((entry) => requiresDetection(entry, signal, apiMode))) return {
-		config: params.cfg,
-		changes: [],
-		warnings: [PENDING_LEGACY_TRANSPORT_WARNING]
-	};
+	if (!params.detect && legacyResolutionEntries.some((entry) => requiresDetection(entry, signal, apiMode))) return pendingSignalTransportMigration(params.cfg, PENDING_LEGACY_TRANSPORT_WARNING);
 	const resolvedTransports = await Promise.all(entries.map(async (entry, index) => !shouldMaterializeTransport(entries, index) ? void 0 : await resolveLegacyTransport({
 		entry,
 		parent: signal,
@@ -404,6 +385,163 @@ function migrateLegacySignalTransportConfigSync(cfg) {
 	}));
 }
 //#endregion
+//#region packages/normalization-core/src/record-coerce.ts
+/** Type guard for non-array object records at browser-safe boundaries. */
+function isRecord$1(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+/** Returns a non-array record or null. */
+function asNullableRecord(value) {
+	return isRecord$1(value) ? value : null;
+}
+//#endregion
+//#region src/config/channel-config-normalization.ts
+/** Applies one channel-specific doctor migration to every object-shaped account. */
+function normalizeChannelAccounts(params) {
+	const rawAccounts = asNullableRecord(params.entry.accounts);
+	if (!rawAccounts) return {
+		entry: params.entry,
+		changed: false
+	};
+	let changed = false;
+	const accounts = { ...rawAccounts };
+	for (const [accountId, value] of Object.entries(rawAccounts)) {
+		const account = asNullableRecord(value);
+		if (!account) continue;
+		const normalized = params.normalizeAccount({
+			account,
+			accountId,
+			pathPrefix: `${params.pathPrefix}.accounts.${accountId}`,
+			changes: params.changes
+		});
+		if (normalized.changed) {
+			accounts[accountId] = normalized.entry;
+			changed = true;
+		}
+	}
+	return changed ? {
+		entry: {
+			...params.entry,
+			accounts
+		},
+		changed: true
+	} : {
+		entry: params.entry,
+		changed: false
+	};
+}
+/** Applies the same channel-specific doctor migration at root and account scope. */
+function normalizeChannelConfigEntries(params) {
+	const changes = params.changes ?? [];
+	const channels = params.cfg.channels;
+	const entry = asNullableRecord(channels?.[params.channelId]);
+	if (!entry) return {
+		config: params.cfg,
+		changes
+	};
+	const channelPath = `channels.${params.channelId}`;
+	const root = params.normalizeEntry({
+		entry,
+		pathPrefix: channelPath,
+		changes
+	});
+	const accounts = normalizeChannelAccounts({
+		entry: root.entry,
+		pathPrefix: channelPath,
+		changes,
+		normalizeAccount: (accountParams) => params.normalizeEntry({
+			entry: accountParams.account,
+			accountId: accountParams.accountId,
+			pathPrefix: accountParams.pathPrefix,
+			changes: accountParams.changes
+		})
+	});
+	if (!root.changed && !accounts.changed) return {
+		config: params.cfg,
+		changes
+	};
+	return {
+		config: {
+			...params.cfg,
+			channels: {
+				...channels,
+				[params.channelId]: accounts.entry
+			}
+		},
+		changes
+	};
+}
+//#endregion
+//#region src/plugin-sdk/legacy-webhook-listener-migration.ts
+/** Preserve explicitly configured webhook listeners while moving ingress onto Gateway routes. */
+function createLegacyWebhookListenerDoctorContract(params) {
+	const portKey = params.portKey ?? "webhookPort";
+	const hostKey = params.hostKey === void 0 ? "webhookHost" : params.hostKey;
+	const source = (entry) => params.webhookKey ? asNullableRecord(entry[params.webhookKey]) : entry;
+	const hasLegacy = (value) => {
+		const entry = asNullableRecord(value);
+		const listener = entry && source(entry);
+		return Boolean(listener && (Object.hasOwn(listener, portKey) || hostKey && Object.hasOwn(listener, hostKey)));
+	};
+	const prefix = `channels.${params.channelKey}`;
+	return {
+		legacyConfigRules: [{
+			path: ["channels", params.channelKey],
+			message: `${prefix} webhook listeners moved to Gateway routes. Run "openclaw doctor --fix" to preserve explicitly configured listener settings as legacyWebhook.`,
+			match: (value) => {
+				const accounts = asNullableRecord(asNullableRecord(value)?.accounts);
+				return hasLegacy(value) || Object.values(accounts ?? {}).some(hasLegacy);
+			}
+		}],
+		normalizeCompatibilityConfig: ({ cfg }) => {
+			const root = asNullableRecord(asNullableRecord(cfg.channels)?.[params.channelKey]);
+			const inherited = root && source(root);
+			const canonicalRoot = asNullableRecord(root?.legacyWebhook);
+			return normalizeChannelConfigEntries({
+				cfg,
+				channelId: params.channelKey,
+				normalizeEntry: ({ entry, accountId, pathPrefix, changes }) => {
+					const listener = source(entry);
+					if (!listener || !hasLegacy(entry)) return {
+						entry,
+						changed: false
+					};
+					const next = { ...entry };
+					const port = Object.hasOwn(listener, portKey) ? listener[portKey] : (accountId ? canonicalRoot?.port ?? inherited?.[portKey] : void 0) ?? params.defaultPort;
+					const inheritedHost = accountId ? canonicalRoot ? canonicalRoot.host : (hostKey ? inherited?.[hostKey] : void 0) ?? params.defaultHost : params.defaultHost;
+					const host = hostKey ? listener[hostKey] ?? inheritedHost : inheritedHost;
+					const legacyPath = [pathPrefix, params.webhookKey].filter(Boolean).join(".");
+					if (Object.hasOwn(entry, "legacyWebhook")) changes.push(`Removed ${legacyPath} legacy listener keys; ${pathPrefix}.legacyWebhook is already configured.`);
+					else if (accountId && root?.legacyWebhook === false) changes.push(`Removed ${legacyPath} legacy listener keys; ${prefix}.legacyWebhook: false keeps this account's inherited listener disabled.`);
+					else {
+						next.legacyWebhook = {
+							port,
+							...host !== void 0 ? { host } : {}
+						};
+						changes.push(`Moved ${legacyPath} listener settings to ${pathPrefix}.legacyWebhook. Point the external callback or reverse proxy at the Gateway port and webhook path, verify delivery, then set legacyWebhook: false to disable legacy forwarding.`);
+					}
+					const updated = params.webhookKey ? { ...listener } : next;
+					delete updated[portKey];
+					if (hostKey) delete updated[hostKey];
+					if (params.webhookKey) {
+						if (Object.keys(updated).length) next[params.webhookKey] = updated;
+						else delete next[params.webhookKey];
+					}
+					return {
+						entry: next,
+						changed: true
+					};
+				}
+			});
+		}
+	};
+}
+//#endregion
+//#region \0openclaw:bundled-sdk:openclaw/plugin-sdk/runtime-doctor-migrations
+var runtime_doctor_migrations_exports = /* @__PURE__ */ __exportAll({ createLegacyWebhookListenerDoctorContract: () => createLegacyWebhookListenerDoctorContract });
+import * as import_openclaw_plugin_sdk_runtime_doctor_migrations from "openclaw/plugin-sdk/runtime-doctor-migrations";
+__reExport(runtime_doctor_migrations_exports, import_openclaw_plugin_sdk_runtime_doctor_migrations);
+//#endregion
 //#region extensions/signal/src/account-key-repair.ts
 function repairSignalAccountKeys({ cfg }) {
 	const signal = cfg.channels?.signal;
@@ -450,24 +588,7 @@ function repairSignalAccountKeys({ cfg }) {
 }
 //#endregion
 //#region extensions/signal/config-doctor-api.ts
-const RETIRED_SIGNAL_ACCOUNT_TRANSPORT_FIELDS = [
-	"configPath",
-	"httpUrl",
-	"httpHost",
-	"httpPort",
-	"cliPath",
-	"autoStart",
-	"startupTimeoutMs",
-	"receiveMode",
-	"ignoreStories"
-];
-function hasRetiredSignalAccountTransportFields(value) {
-	return isRecord(value) && RETIRED_SIGNAL_ACCOUNT_TRANSPORT_FIELDS.some((field) => Object.hasOwn(value, field));
-}
-function hasRetiredSignalAccountMapTransportFields(value) {
-	return isRecord(value) && Object.values(value).some(hasRetiredSignalAccountTransportFields);
-}
-const streamingAliasMigration = defineChannelAliasMigration({
+const streamingAliasMigration = (0, runtime_doctor_migrations_exports.defineChannelAliasMigration)({
 	channelId: "signal",
 	streaming: {
 		defaultMode: "partial",
@@ -480,7 +601,7 @@ const legacyConfigRules = [
 	{
 		path: ["channels", "signal"],
 		message: "Signal transport config is now account-owned; run \"openclaw doctor --fix\" to migrate retired channels.signal transport fields.",
-		match: (value) => isRecord(value) && (Object.hasOwn(value, "apiMode") || hasRetiredSignalAccountTransportFields(value))
+		match: (value) => isRecord(value) && (Object.hasOwn(value, "apiMode") || hasLegacySignalTransportFields(value))
 	},
 	{
 		path: [
@@ -489,7 +610,7 @@ const legacyConfigRules = [
 			"accounts"
 		],
 		message: "Signal transport config is now account-owned; run \"openclaw doctor --fix\" to migrate retired per-account transport fields.",
-		match: hasRetiredSignalAccountMapTransportFields
+		match: (value) => isRecord(value) && Object.values(value).some(hasLegacySignalTransportFields)
 	}
 ];
 function normalizeCompatibilityConfig({ cfg }) {
@@ -507,4 +628,4 @@ function normalizeCompatibilityConfig({ cfg }) {
 	};
 }
 //#endregion
-export { migrateLegacySignalTransportConfig as a, clearLegacySignalTransportFieldsForAccount as i, normalizeCompatibilityConfig as n, repairSignalAccountKeys as r, legacyConfigRules as t };
+export { migrateLegacySignalTransportConfig as a, clearLegacySignalTransportFieldsForAccount as i, normalizeCompatibilityConfig as n, __exportAll as o, repairSignalAccountKeys as r, legacyConfigRules as t };

package/dist/.setup/{identity-YXPmgFMu.mjs → identity-B3JyPqGO.mjs}

@@ -36,9 +36,7 @@ function resolveSignalSender(params) {
 function formatSignalSenderId(sender) {
 	return sender.kind === "phone" ? sender.e164 : `uuid:${sender.raw}`;
 }
-function formatSignalSenderDisplay(sender) {
-	return sender.kind === "phone" ? sender.e164 : `uuid:${sender.raw}`;
-}
+const formatSignalSenderDisplay = formatSignalSenderId;
 function formatSignalPairingIdLine(sender) {
 	if (sender.kind === "phone") return `Your Signal number: ${sender.e164}`;
 	return `Your Signal sender id: ${formatSignalSenderId(sender)}`;
@@ -46,9 +44,7 @@ function formatSignalPairingIdLine(sender) {
 function resolveSignalRecipient(sender) {
 	return sender.kind === "phone" ? sender.e164 : sender.raw;
 }
-function resolveSignalPeerId(sender) {
-	return sender.kind === "phone" ? sender.e164 : `uuid:${sender.raw}`;
-}
+const resolveSignalPeerId = formatSignalSenderId;
 function parseSignalAllowEntry(entry) {
 	const trimmed = entry.trim();
 	if (!trimmed) return null;

package/dist/.setup/{install-signal-cli-bXeTrTyL.mjs → install-signal-cli-ChvjzM6X.mjs}

@@ -1,12 +1,11 @@
 import { isRecord, normalizeLowercaseStringOrEmpty, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import path from "node:path";
 import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
-import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
+import { extractErrorCode, formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import fs from "node:fs/promises";
 import { CONFIG_DIR, extractArchive, resolveBrewExecutable } from "openclaw/plugin-sdk/setup-tools";
-import { createWriteStream } from "node:fs";
-import { Readable, Transform } from "node:stream";
-import { pipeline } from "node:stream/promises";
+import { walkDirectory } from "@openclaw/fs-safe/walk";
+import { root } from "openclaw/plugin-sdk/file-access-runtime";
 import { readProviderJsonObjectResponse } from "openclaw/plugin-sdk/provider-http";
 import { runPluginCommandWithTimeout } from "openclaw/plugin-sdk/run-command";
 import { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime";
@@ -35,17 +34,6 @@ async function extractSignalCliArchive(archivePath, installRoot, timeoutMs) {
 function looksLikeArchive(name) {
 	return name.endsWith(".tar.gz") || name.endsWith(".tgz") || name.endsWith(".zip");
 }
-function isNodeReadableStream(value) {
-	return Boolean(value && typeof value.pipe === "function");
-}
-function chunkByteLength(chunk) {
-	if (typeof chunk === "string") return Buffer.byteLength(chunk);
-	if (chunk instanceof Uint8Array) return chunk.byteLength;
-	return Buffer.byteLength(String(chunk));
-}
-async function cancelUnusedResponseBody(response) {
-	await response.body?.cancel().catch(() => void 0);
-}
 function normalizeReleaseAsset(value) {
 	if (!isRecord(value)) return;
 	const name = normalizeOptionalString(value.name);
@@ -89,7 +77,6 @@ function pickAsset(assets, platform, arch) {
 }
 /** @internal Exported for testing. */
 async function downloadToFile(url, dest, maxRedirects = 5, maxBytes = MAX_SIGNAL_CLI_ARCHIVE_BYTES) {
-	let completed = false;
 	const { response, release } = await fetchWithSsrFGuard({
 		url,
 		maxRedirects,
@@ -99,51 +86,37 @@ async function downloadToFile(url, dest, maxRedirects = 5, maxBytes = MAX_SIGNAL
 		auditContext: "signal-cli-install-archive"
 	});
 	try {
-		if (!response.ok || !response.body) {
-			await cancelUnusedResponseBody(response);
-			throw new Error(`HTTP ${response.status || "?"} downloading file`);
-		}
+		if (!response.ok || !response.body) throw new Error(`HTTP ${response.status || "?"} downloading file`);
 		const rawLength = response.headers.get("content-length");
 		if (rawLength !== null) {
 			const trimmedLength = rawLength.trim();
 			const declaredLength = CONTENT_LENGTH_RE.test(trimmedLength) ? Number(trimmedLength) : NaN;
-			if (Number.isFinite(declaredLength) && declaredLength > maxBytes) {
-				await cancelUnusedResponseBody(response);
-				throw new Error(`signal-cli archive exceeds the ${maxBytes}-byte download cap (declared ${declaredLength}).`);
-			}
+			if (Number.isFinite(declaredLength) && declaredLength > maxBytes) throw new Error(`signal-cli archive exceeds the ${maxBytes}-byte download cap (declared ${declaredLength}).`);
 		}
-		let totalBytes = 0;
 		const body = response.body;
-		const readable = isNodeReadableStream(body) ? body : Readable.fromWeb(body);
-		const limiter = new Transform({ transform(chunk, _encoding, callback) {
-			totalBytes += chunkByteLength(chunk);
-			if (totalBytes > maxBytes) {
-				callback(/* @__PURE__ */ new Error(`signal-cli archive exceeded the ${maxBytes}-byte download cap.`));
-				return;
-			}
-			callback(null, chunk);
-		} });
-		const out = createWriteStream(dest);
-		await pipeline(readable, limiter, out);
-		completed = true;
+		async function* chunks() {
+			yield* body.values({ preventCancel: true });
+		}
+		await (await root(path.dirname(dest))).create(path.basename(dest), chunks(), {
+			maxBytes,
+			mkdir: false,
+			durable: false,
+			mode: 438 & ~process.umask()
+		});
+	} catch (error) {
+		if (extractErrorCode(error) === "too-large") throw new Error(`signal-cli archive exceeded the ${maxBytes}-byte download cap.`, { cause: error });
+		throw error;
 	} finally {
 		await release();
-		if (!completed) await fs.rm(dest, { force: true }).catch(() => void 0);
 	}
 }
 async function findSignalCliBinary(root) {
-	const candidates = [];
-	const enqueue = async (dir, depth) => {
-		if (depth > 3) return;
-		const entries = await fs.readdir(dir, { withFileTypes: true }).catch(() => []);
-		for (const entry of entries) {
-			const full = path.join(dir, entry.name);
-			if (entry.isDirectory()) await enqueue(full, depth + 1);
-			else if (entry.isFile() && entry.name === "signal-cli") candidates.push(full);
-		}
-	};
-	await enqueue(root, 0);
-	return candidates[0] ?? null;
+	const { entries } = await walkDirectory(root, {
+		maxDepth: 4,
+		symlinks: "skip",
+		include: (entry) => entry.kind === "file" && entry.name === "signal-cli"
+	});
+	return entries[0]?.path ?? null;
 }
 async function resolveBrewSignalCliPath(brewExe) {
 	try {
@@ -221,13 +194,10 @@ async function installSignalCliFromRelease(runtime) {
 	});
 	let releaseInfo;
 	try {
-		if (!response.ok) {
-			await cancelUnusedResponseBody(response);
-			return {
-				ok: false,
-				error: `Failed to fetch release info (${response.status})`
-			};
-		}
+		if (!response.ok) return {
+			ok: false,
+			error: `Failed to fetch release info (${response.status})`
+		};
 		try {
 			const normalized = normalizeSignalCliRelease(await readProviderJsonObjectResponse(response, "signal.release-info"));
 			if (!normalized) throw new Error("Unexpected signal-cli release info");
@@ -254,10 +224,6 @@ async function installSignalCliFromRelease(runtime) {
 		await downloadToFile(asset.browser_download_url, archivePath);
 		const installRoot = path.join(CONFIG_DIR, "tools", "signal-cli", releaseInfo.version);
 		await fs.mkdir(installRoot, { recursive: true });
-		if (!looksLikeArchive(normalizeLowercaseStringOrEmpty(asset.name))) return {
-			ok: false,
-			error: `Unsupported archive type: ${asset.name}`
-		};
 		try {
 			await extractSignalCliArchive(archivePath, installRoot, 6e4);
 		} catch (err) {

package/dist/.setup/legacy-transport-QIpaMNST.mjs

@@ -0,0 +1,18 @@
+import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
+//#region extensions/signal/src/legacy-transport.ts
+const LEGACY_SIGNAL_TRANSPORT_FIELDS = [
+	"configPath",
+	"httpUrl",
+	"httpHost",
+	"httpPort",
+	"cliPath",
+	"autoStart",
+	"startupTimeoutMs",
+	"receiveMode",
+	"ignoreStories"
+];
+function hasLegacySignalTransportFields(value) {
+	return isRecord(value) && LEGACY_SIGNAL_TRANSPORT_FIELDS.some((field) => Object.hasOwn(value, field));
+}
+//#endregion
+export { hasLegacySignalTransportFields as n, LEGACY_SIGNAL_TRANSPORT_FIELDS as t };