Sync/upstream 2026 04 11

.agents/skills/openclaw-parallels-smoke/SKILL.md

@@ -29,7 +29,13 @@ Use this skill for Parallels guest workflows and smoke interpretation. Do not lo
 ## npm install then update
 
 - Preferred entrypoint: `pnpm test:parallels:npm-update`
-- Flow: fresh snapshot -> install npm package baseline -> smoke -> install current main tgz on the same guest -> smoke again.
+- Required coverage: every release/update regression run must include both lanes:
+  - fresh snapshot -> install requested package/baseline -> smoke
+  - same guest baseline -> run the guest's installed `openclaw update ...` command -> smoke again
+- The update lane must exercise OpenClaw's internal updater. Do not count a direct `npm install -g <tgz-or-spec>` or harness-side package swap as update-flow coverage; those are install smokes only.
+- For published targets, install the old baseline package first (for example `openclaw@2026.4.9`), then run the installed guest CLI with the intended channel/tag (for example `openclaw update --channel beta --yes --json`) and verify `openclaw --version`, `openclaw update status --json`, gateway RPC, and an agent turn after the command.
+- For unpublished targets, pack the candidate on the host, serve the `.tgz` over the harness HTTP server, and point the guest updater at that served package. Prefer `openclaw update --tag http://<host-ip>:<port>/openclaw-<version>.tgz --yes --json`; when channel persistence also matters, pass `--channel <stable|beta>` and set `OPENCLAW_UPDATE_PACKAGE_SPEC` to the same served URL in the guest update environment. The command under test must still be `openclaw update`, not direct npm.
+- For unpublished local-fix validation, remember the old baseline updater code still controls the first hop. A fix that lives only in the new updater code cannot change that already-running old process; the served candidate must either keep package/plugin metadata compatible with the baseline host or the baseline itself must include the updater fix.
 - For beta/stable verification, resolve the tag immediately before the run (`npm view openclaw@beta version dist.tarball` or `npm view openclaw@latest ...`). Tags can move while a long VM matrix is already running; restart the matrix when the intended prerelease appears after an earlier registry 404/tag-lag check.
 - Source Peter's profile in the host shell (`set -a; source "$HOME/.profile"; set +a`) before OpenAI/Anthropic lanes. Do not print profile contents or env dumps; pass provider secrets through the guest exec environment.
 - Same-guest update verification should set the default model explicitly to `openai/gpt-5.4` before the agent turn and use a fresh explicit `--session-id` so old session model state does not leak into the check.

.github/labeler.yml

@@ -297,6 +297,10 @@
   - changed-files:
       - any-glob-to-any-file:
           - "extensions/openai/**"
+"extensions: codex":
+  - changed-files:
+      - any-glob-to-any-file:
+          - "extensions/codex/**"
 "extensions: kimi-coding":
   - changed-files:
       - any-glob-to-any-file:

.github/workflows/ci.yml

@@ -37,9 +37,10 @@ jobs:
       run_build_artifacts: ${{ steps.manifest.outputs.run_build_artifacts }}
       run_checks_fast: ${{ steps.manifest.outputs.run_checks_fast }}
       checks_fast_core_matrix: ${{ steps.manifest.outputs.checks_fast_core_matrix }}
-      checks_fast_extensions_matrix: ${{ steps.manifest.outputs.checks_fast_extensions_matrix }}
+      checks_node_extensions_matrix: ${{ steps.manifest.outputs.checks_node_extensions_matrix }}
       run_checks: ${{ steps.manifest.outputs.run_checks }}
       checks_matrix: ${{ steps.manifest.outputs.checks_matrix }}
+      checks_node_core_test_matrix: ${{ steps.manifest.outputs.checks_node_core_test_matrix }}
       run_extension_fast: ${{ steps.manifest.outputs.run_extension_fast }}
       extension_fast_matrix: ${{ steps.manifest.outputs.extension_fast_matrix }}
       run_check: ${{ steps.manifest.outputs.run_check }}
@@ -135,6 +136,9 @@ jobs:
         run: |
           node --input-type=module <<'EOF'
           import { appendFileSync } from "node:fs";
+          import {
+            createNodeTestShards,
+          } from "./scripts/lib/ci-node-test-plan.mjs";
           import {
             createExtensionTestShards,
             DEFAULT_EXTENSION_TEST_SHARD_COUNT,
@@ -211,12 +215,11 @@ jobs:
                   ]
                 : [],
             ),
-            checks_fast_extensions_matrix: extensionShardMatrix,
+            checks_node_extensions_matrix: extensionShardMatrix,
             run_checks: runNode,
             checks_matrix: createMatrix(
               runNode
                 ? [
-                    { check_name: "checks-node-test", runtime: "node", task: "test" },
                     { check_name: "checks-node-channels", runtime: "node", task: "channels" },
                     ...(isPush
                       ? [
@@ -232,6 +235,17 @@ jobs:
                   ]
                 : [],
             ),
+            checks_node_core_test_matrix: createMatrix(
+              runNode
+                ? createNodeTestShards().map((shard) => ({
+                    check_name: shard.checkName,
+                    runtime: "node",
+                    task: "test-shard",
+                    shard_name: shard.shardName,
+                    configs: shard.configs,
+                  }))
+                : [],
+            ),
             run_extension_fast: hasChangedExtensions,
             extension_fast_matrix: createMatrix(
               hasChangedExtensions
@@ -470,15 +484,15 @@ jobs:
               ;;
           esac
 
-  checks-fast-extensions-shard:
+  checks-node-extensions-shard:
     name: ${{ matrix.check_name }}
     needs: [preflight]
     if: needs.preflight.outputs.run_checks_fast == 'true'
     runs-on: blacksmith-16vcpu-ubuntu-2404
     timeout-minutes: 60
     strategy:
       fail-fast: false
-      matrix: ${{ fromJson(needs.preflight.outputs.checks_fast_extensions_matrix) }}
+      matrix: ${{ fromJson(needs.preflight.outputs.checks_node_extensions_matrix) }}
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -497,16 +511,16 @@ jobs:
           OPENCLAW_EXTENSION_BATCH: ${{ matrix.extensions_csv }}
         run: pnpm test:extensions:batch -- "$OPENCLAW_EXTENSION_BATCH"
 
-  checks-fast-extensions:
-    name: checks-fast-extensions
-    needs: [preflight, checks-fast-extensions-shard]
+  checks-node-extensions:
+    name: checks-node-extensions
+    needs: [preflight, checks-node-extensions-shard]
     if: always() && needs.preflight.outputs.run_checks_fast == 'true'
     runs-on: blacksmith-16vcpu-ubuntu-2404
     timeout-minutes: 5
     steps:
       - name: Verify extension shards
         env:
-          SHARD_RESULT: ${{ needs.checks-fast-extensions-shard.result }}
+          SHARD_RESULT: ${{ needs.checks-node-extensions-shard.result }}
         run: |
           if [ "$SHARD_RESULT" != "success" ]; then
             echo "Extension shard checks failed: $SHARD_RESULT" >&2
@@ -599,6 +613,102 @@ jobs:
               ;;
           esac
 
+  checks-node-core-test-shard:
+    name: ${{ matrix.check_name }}
+    needs: [preflight, build-artifacts]
+    if: always() && needs.preflight.outputs.run_checks == 'true' && needs.build-artifacts.result == 'success'
+    runs-on: blacksmith-16vcpu-ubuntu-2404
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJson(needs.preflight.outputs.checks_node_core_test_matrix) }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+          submodules: false
+
+      - name: Setup Node environment
+        uses: ./.github/actions/setup-node-env
+        with:
+          node-version: "${{ matrix.node_version || '24.x' }}"
+          cache-key-suffix: "${{ matrix.cache_key_suffix || 'node24' }}"
+          install-bun: "false"
+          use-sticky-disk: "false"
+
+      - name: Configure Node test resources
+        run: echo "OPENCLAW_VITEST_MAX_WORKERS=2" >> "$GITHUB_ENV"
+
+      - name: Download dist artifact
+        uses: actions/download-artifact@v8
+        with:
+          name: dist-build
+          path: dist/
+
+      - name: Download A2UI bundle artifact
+        uses: actions/download-artifact@v8
+        with:
+          name: canvas-a2ui-bundle
+          path: src/canvas-host/a2ui/
+
+      - name: Run Node test shard
+        env:
+          NODE_OPTIONS: --max-old-space-size=6144
+          OPENCLAW_NODE_TEST_CONFIGS_JSON: ${{ toJson(matrix.configs) }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          node --input-type=module <<'EOF'
+          import { spawnSync } from "node:child_process";
+          import { resolveVitestCliEntry, resolveVitestNodeArgs } from "./scripts/run-vitest.mjs";
+
+          const configs = JSON.parse(process.env.OPENCLAW_NODE_TEST_CONFIGS_JSON ?? "[]");
+          if (!Array.isArray(configs) || configs.length === 0) {
+            console.error("Missing node test shard configs");
+            process.exit(1);
+          }
+
+          for (const config of configs) {
+            console.error(`[test] starting ${config}`);
+            const result = spawnSync(
+              "pnpm",
+              [
+                "exec",
+                "node",
+                ...resolveVitestNodeArgs(process.env),
+                resolveVitestCliEntry(),
+                "run",
+                "--config",
+                config,
+              ],
+              {
+                env: process.env,
+                stdio: "inherit",
+              },
+            );
+            if ((result.status ?? 1) !== 0) {
+              process.exit(result.status ?? 1);
+            }
+          }
+          EOF
+
+  checks-node-core-test:
+    name: checks-node-core
+    needs: [preflight, checks-node-core-test-shard]
+    if: always() && needs.preflight.outputs.run_checks == 'true'
+    runs-on: blacksmith-16vcpu-ubuntu-2404
+    timeout-minutes: 5
+    steps:
+      - name: Verify node test shards
+        env:
+          SHARD_RESULT: ${{ needs.checks-node-core-test-shard.result }}
+        run: |
+          if [ "$SHARD_RESULT" != "success" ]; then
+            echo "Node test shards failed: $SHARD_RESULT" >&2
+            exit 1
+          fi
+
   extension-fast:
     name: "extension-fast"
     needs: [preflight]

.github/workflows/install-smoke.yml

@@ -194,6 +194,13 @@ jobs:
           push: false
           provenance: false
 
+      - name: Setup Node environment for local pack smoke
+        uses: ./.github/actions/setup-node-env
+        with:
+          install-bun: "false"
+          install-deps: "true"
+          use-sticky-disk: "false"
+
       - name: Run installer docker tests
         env:
           OPENCLAW_INSTALL_URL: https://openclaw.ai/install.sh

.github/workflows/openclaw-npm-release.yml

@@ -493,6 +493,7 @@ jobs:
           RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
         run: |
           set -euo pipefail
+          printf '//registry.npmjs.org/:_authToken=%s\n' "${NODE_AUTH_TOKEN}" > "${HOME}/.npmrc"
           npm whoami >/dev/null
           npm dist-tag add "openclaw@${RELEASE_VERSION}" latest
           promoted_latest="$(npm view openclaw dist-tags.latest)"

.oxfmtrc.jsonc

@@ -1,9 +1,9 @@
 {
   "$schema": "./node_modules/oxfmt/configuration_schema.json",
-  "experimentalSortImports": {
+  "sortImports": {
     "newlinesBetween": false,
   },
-  "experimentalSortPackageJson": {
+  "sortPackageJson": {
     "sortScripts": true,
   },
   "tabWidth": 2,
@@ -20,6 +20,7 @@
     "pnpm-lock.yaml/",
     "src/gateway/server-methods/CLAUDE.md",
     "src/auto-reply/reply/export-html/",
+    "src/canvas-host/a2ui/a2ui.bundle.js",
     "Swabble/",
     "vendor/",
   ],

.oxlintrc.json

@@ -8,19 +8,23 @@
   },
   "rules": {
     "curly": "error",
-    "eslint-plugin-unicorn/prefer-array-find": "off",
+    "eslint-plugin-unicorn/prefer-array-find": "error",
     "eslint/no-await-in-loop": "off",
-    "eslint/no-new": "off",
+    "eslint/no-new": "error",
     "eslint/no-shadow": "off",
-    "eslint/no-unmodified-loop-condition": "off",
-    "oxc/no-accumulating-spread": "off",
+    "eslint/no-unmodified-loop-condition": "error",
+    "eslint-plugin-unicorn/prefer-set-size": "error",
+    "oxc/no-accumulating-spread": "error",
     "oxc/no-async-endpoint-handlers": "off",
     "oxc/no-map-spread": "off",
+    "typescript/consistent-return": "error",
     "typescript/no-explicit-any": "error",
-    "typescript/no-extraneous-class": "off",
+    "typescript/no-extraneous-class": "error",
+    "typescript/no-unnecessary-type-conversion": "error",
     "typescript/no-unsafe-type-assertion": "off",
     "unicorn/consistent-function-scoping": "off",
-    "unicorn/require-post-message-target-origin": "off"
+    "unicorn/prefer-set-size": "error",
+    "unicorn/require-post-message-target-origin": "error"
   },
   "ignorePatterns": [
     "assets/",
@@ -54,13 +58,7 @@
         "**/*test-support.ts"
       ],
       "rules": {
-        "typescript/await-thenable": "off",
-        "typescript/no-base-to-string": "off",
         "typescript/no-explicit-any": "off",
-        "typescript/no-floating-promises": "off",
-        "typescript/no-misused-spread": "off",
-        "typescript/no-redundant-type-constituents": "off",
-        "typescript/no-unnecessary-template-expression": "off",
         "typescript/unbound-method": "off",
         "eslint/no-unsafe-optional-chaining": "off"
       }

.vscode/settings.json

@@ -17,6 +17,5 @@
   "typescript.preferences.importModuleSpecifierEnding": "js",
   "typescript.reportStyleChecksAsWarnings": false,
   "typescript.updateImportsOnFileMove.enabled": "always",
-  "typescript.tsdk": "node_modules/typescript/lib",
-  "typescript.experimental.useTsgo": true
+  "typescript.tsdk": "node_modules/typescript/lib"
 }

AGENTS.md

@@ -73,6 +73,8 @@
 - Extension test boundary:
   - Keep extension-owned onboarding/config/provider coverage under the owning bundled plugin package when feasible.
   - If core tests need bundled plugin behavior, consume it through public `src/plugin-sdk/<id>.ts` facades or the plugin's `api.ts`, not private extension modules.
+  - Shared helpers under `test/helpers/**` are part of that same boundary. Do not hardcode repo-relative `extensions/**` imports there, and do not keep plugin-local deep mocks in shared helpers just because multiple tests use them.
+  - When core tests or shared helpers need bundled plugin public surfaces, use `src/test-utils/bundled-plugin-public-surface.ts` for `api.ts`, `runtime-api.ts`, `contract-api.ts`, `test-api.ts`, plugin entrypoint `index.js`, and resolved module ids for dynamic import or mocking.
   - If a core test is asserting extension-specific behavior instead of a generic contract, move it to the owning extension package.
 
 ## Docs Linking (Mintlify)
@@ -149,6 +151,7 @@
 - Config schema drift uses `pnpm config:docs:gen` / `pnpm config:docs:check`.
 - Plugin SDK API drift uses `pnpm plugin-sdk:api:gen` / `pnpm plugin-sdk:api:check`.
 - If you change config schema/help or the public Plugin SDK surface, run the matching gen command and commit the updated `.sha256` hash file. Keep the two drift-check flows adjacent in scripts/workflows/docs guidance rather than inventing a third pattern.
+- When `pnpm tsgo` fails, triage by coherent surface instead of by raw error count: rerun the gate, group failures by package/module/type contract, open the source-of-truth type or export file first, fix the root mismatch, then rerun `pnpm tsgo` before widening into downstream consumers. Check `origin/main` before doing broad cleanup because some apparent type debt is already fixed upstream.
 - For narrowly scoped changes, prefer narrowly scoped tests that directly validate the touched behavior. If no meaningful scoped test exists, say so explicitly and use the next most direct validation available.
 - Verification modes for work on `main`:
   - Default mode: `main` is relatively stable. Count pre-commit hook coverage when it already verified the current tree, avoid rerunning the exact same checks just for ceremony, and prefer keeping CI/main green before landing.
@@ -296,7 +299,7 @@
 
 - When working on a GitHub Issue or PR, print the full URL at the end of the task.
 - When answering questions, respond with high-confidence answers only: verify in code; do not guess.
-- Carbon: prefer latest published beta over stable when possible; do not switch to stable casually.
+- Carbon version edits are owner-only: do not change `@buape/carbon` version pins unless you are Shadow (@thewilloftheshadow) as verified by gh.
 - Any dependency with `pnpm.patchedDependencies` must use an exact version (no `^`/`~`).
 - Patching dependencies (pnpm patches, overrides, or vendored changes) requires explicit approval; do not do this by default.
 - **Multi-agent safety:** do **not** create/apply/drop `git stash` entries unless explicitly requested (this includes `git pull --rebase --autostash`). Assume other agents may be working; keep unrelated WIP untouched and avoid cross-cutting state changes.