From c70aee247e831d21895f5ea3dda7497c50af0721 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Sun, 9 Aug 2026 07:21:35 -0700 Subject: [PATCH] refactor(scripts): migrate JavaScript tools to TypeScript (#121005) * refactor(scripts): migrate JavaScript tools to TypeScript * fix(ci): keep changed-scope preflight zero-install * fix(ci): preserve zero-install script owners * fix(ci): complete script migration follow-through * fix(release): keep stable closeout zero-install * fix(scripts): preserve standalone execution boundaries * fix(scripts): repair standalone loader boundaries * fix(scripts): normalize gateway observation ids * fix(scripts): keep Docker packager standalone * test(scripts): preserve rebase cleanup helpers * test(sessions): use tracked temp directory --- .../skills/openclaw-changelog-update/SKILL.md | 8 +- .../scripts/verify-release-notes.mjs | 6 +- .agents/skills/openclaw-ci-limits/SKILL.md | 2 +- .agents/skills/openclaw-live-updater/SKILL.md | 2 +- .../scripts/update-main.mjs | 135 +- .../skills/openclaw-test-heap-leaks/SKILL.md | 4 +- .../release-openclaw-maintainer/SKILL.md | 2 +- .github/actions/setup-node-env/action.yml | 2 +- .../prompts/mantis-telegram-desktop-proof.md | 2 +- .github/workflows/ci.yml | 94 +- .github/workflows/dated-todo-sweep.yml | 2 +- .github/workflows/docs-sync-publish.yml | 6 +- .github/workflows/ios-periphery.yml | 1 + .github/workflows/mantis-telegram-live.yml | 2 +- .../workflows/mantis-web-ui-chat-proof.yml | 2 +- .github/workflows/npm-telegram-beta-e2e.yml | 2 +- ...nclaw-cross-os-release-checks-reusable.yml | 6 +- .../openclaw-live-and-e2e-checks-reusable.yml | 8 +- .github/workflows/openclaw-npm-release.yml | 4 +- .github/workflows/openclaw-performance.yml | 28 +- .github/workflows/openclaw-release-checks.yml | 18 +- .../workflows/openclaw-release-publish.yml | 10 +- .../openclaw-release-telegram-qa.yml | 8 +- .github/workflows/package-acceptance.yml | 4 +- .github/workflows/plugin-clawhub-new.yml | 2 +- .github/workflows/plugin-clawhub-release.yml | 2 +- .github/workflows/plugin-npm-release.yml | 51 +- .github/workflows/plugin-prerelease.yml | 44 +- .github/workflows/qa-profile-evidence.yml | 4 +- .../shared-openclawkit-periphery.yml | 1 + .github/workflows/vitest-cache-warm.yml | 6 +- AGENTS.md | 2 +- CONTRIBUTING.md | 6 +- Dockerfile | 2 +- SECURITY.md | 2 +- apps/android/app/build.gradle.kts | 8 +- apps/ios/project.yml | 2 +- apps/linux/README.md | 2 +- apps/linux/src-tauri/build.rs | 12 +- .../Sources/OpenClaw/HostEnvSanitizer.swift | 2 +- .../HostEnvSecurityPolicy.generated.swift | 2 +- config/knip.all-exports.config.ts | 2 +- config/knip.config.ts | 43 +- config/knip.scripts-exports.config.ts | 15 +- config/swiftlint.yml | 2 +- docs/ci.md | 8 +- docs/help/testing-live.md | 6 +- docs/help/testing.md | 6 +- docs/plugins/sdk-testing.md | 2 +- docs/providers/openai.md | 4 +- docs/reference/RELEASING.md | 4 +- docs/reference/test.md | 6 +- extensions/diffs-language-pack/package.json | 2 +- extensions/diffs/package.json | 2 +- extensions/diffs/src/test-helpers.ts | 10 +- extensions/discord/package.json | 2 +- .../src/test-file-scenario-runner.test.ts | 2 +- .../qa-lab/src/test-file-scenario-runner.ts | 2 +- extensions/qa-lab/src/web-runtime.test.ts | 2 +- extensions/qa-lab/src/web-runtime.ts | 2 +- package.json | 337 +- packages/ai/src/package.e2e.test.ts | 2 +- packages/sdk/src/package.e2e.test-support.ts | 4 +- pnpm-lock.yaml | 3 + qa/scenarios/runtime/compose-setup.yaml | 4 +- .../runtime/docker-gateway-network.yaml | 2 +- .../runtime/docker-package-install.yaml | 4 +- scripts/AGENTS.md | 4 +- scripts/README.md | 10 +- scripts/android-release-signing.mjs | 37 +- scripts/audit-seams.d.mts | 11 - scripts/{audit-seams.mjs => audit-seams.mts} | 216 +- scripts/bench-test-changed.d.mts | 24 - ...est-changed.mjs => bench-test-changed.mts} | 67 +- scripts/bench-web-fetch.ts | 2 +- scripts/build-all.d.mts | 109 - scripts/{build-all.mjs => build-all.mts} | 322 +- scripts/build-diffs-viewer-runtime.d.mts | 8 - ...ime.mjs => build-diffs-viewer-runtime.mts} | 27 +- scripts/build-discord-activity-sdk.d.mts | 20 - ...sdk.mjs => build-discord-activity-sdk.mts} | 11 +- scripts/build-stamp.d.mts | 1 - scripts/{build-stamp.mjs => build-stamp.mts} | 4 +- scripts/{bundle-a2ui.mjs => bundle-a2ui.mts} | 2 +- scripts/bundled-plugin-assets.d.mts | 30 - ...n-assets.mjs => bundled-plugin-assets.mts} | 59 +- scripts/changed-lanes.d.mts | 57 - scripts/changed-lanes.mjs | 662 +-- scripts/changed-lanes.mts | 710 +++ ...k-built-plugin-control-plane-modules.d.mts | 23 - ...ck-built-plugin-control-plane-modules.mts} | 59 +- scripts/check-changed.d.mts | 79 - scripts/check-changed.mjs | 1195 +---- scripts/check-changed.mts | 1281 +++++ scripts/check-changelog-attributions.d.mts | 20 - scripts/check-changelog-attributions.mjs | 159 +- scripts/check-changelog-attributions.mts | 159 + .../check-channel-agnostic-boundaries.d.mts | 31 - ... => check-channel-agnostic-boundaries.mts} | 69 +- scripts/check-cli-bootstrap-imports.d.mts | 15 - ...ts.mjs => check-cli-bootstrap-imports.mts} | 98 +- scripts/check-cli-startup-memory.d.mts | 75 - scripts/check-cli-startup-memory.mjs | 117 +- scripts/check-control-ui-performance.d.mts | 79 - ...e.mjs => check-control-ui-performance.mts} | 150 +- ...check-control-ui-precompressed-assets.mts} | 2 +- .../check-database-first-legacy-stores.d.mts | 28 - ...=> check-database-first-legacy-stores.mts} | 1257 +++-- scripts/check-deadcode-exports.d.mts | 22 - ...exports.mjs => check-deadcode-exports.mts} | 16 +- scripts/check-deadcode-unused-files.d.mts | 34 - ...es.mjs => check-deadcode-unused-files.mts} | 15 +- scripts/check-dependency-pins.d.mts | 12 - ...ncy-pins.mjs => check-dependency-pins.mts} | 73 +- ...age.mjs => check-deprecated-api-usage.mts} | 57 +- ...d-jsdoc.mjs => check-deprecated-jsdoc.mts} | 33 +- ...es.mjs => check-docker-e2e-boundaries.mts} | 34 +- scripts/check-docs-i18n-glossary.d.mts | 11 - ...ssary.mjs => check-docs-i18n-glossary.mts} | 71 +- scripts/check-docs-mdx.d.mts | 9 - scripts/check-docs-mdx.mjs | 377 +- scripts/check-docs-mdx.mts | 397 ++ ...ck-duplicates.mjs => check-duplicates.mts} | 8 +- scripts/check-dynamic-import-warts.d.mts | 9 - ...rts.mjs => check-dynamic-import-warts.mts} | 46 +- scripts/check-env-var-count.d.mts | 4 - ...-var-count.mjs => check-env-var-count.mts} | 25 +- ...check-extension-package-tsc-boundary.d.mts | 89 - ... check-extension-package-tsc-boundary.mts} | 275 +- .../check-extension-plugin-sdk-boundary.d.mts | 19 - ...> check-extension-plugin-sdk-boundary.mts} | 114 +- .../check-extension-wildcard-reexports.d.mts | 9 - ...=> check-extension-wildcard-reexports.mts} | 8 +- scripts/check-gateway-cpu-scenarios.d.mts | 88 - ...os.mjs => check-gateway-cpu-scenarios.mts} | 127 +- scripts/check-gateway-watch-regression.d.mts | 156 - ...mjs => check-gateway-watch-regression.mts} | 324 +- ... => check-ingress-agent-owner-context.mts} | 6 +- ...drails.mjs => check-kysely-guardrails.mts} | 60 +- scripts/check-max-lines-ratchet.d.mts | 20 - ...atchet.mjs => check-max-lines-ratchet.mts} | 83 +- ...check-media-download-helper-roundtrip.mts} | 8 +- scripts/check-memory-fd-repro.d.mts | 192 - scripts/check-memory-fd-repro.mjs | 903 +--- scripts/check-memory-fd-repro.mts | 945 ++++ .../check-native-state-schema-version.d.mts | 9 - scripts/check-no-conflict-markers.d.mts | 31 - scripts/check-no-deprecated-channel-access.ts | 2 +- scripts/check-no-extension-src-imports.ts | 2 +- ... => check-no-pairing-store-group-auth.mts} | 20 +- scripts/check-no-random-messaging-tmp.d.mts | 13 - ....mjs => check-no-random-messaging-tmp.mts} | 12 +- ...tch.mjs => check-no-raw-channel-fetch.mts} | 8 +- ...rts.mjs => check-no-raw-http2-imports.mts} | 25 +- ...> check-no-runtime-action-load-config.mts} | 2 +- scripts/check-openclaw-package-tarball.mjs | 666 +-- scripts/check-openclaw-package-tarball.mts | 710 +++ scripts/check-package-patches.d.mts | 9 - ...-patches.mjs => check-package-patches.mts} | 60 +- ...pe.mjs => check-pairing-account-scope.mts} | 17 +- ...eck-plugin-extension-import-boundary.d.mts | 39 - ...heck-plugin-extension-import-boundary.mts} | 56 +- scripts/check-plugin-gateway-gauntlet.d.mts | 97 - ....mjs => check-plugin-gateway-gauntlet.mts} | 342 +- scripts/check-plugin-npm-runtime-builds.d.mts | 21 - ...js => check-plugin-npm-runtime-builds.mts} | 26 +- ...ports.mjs => check-plugin-sdk-exports.mts} | 18 +- ...s => check-plugin-sdk-subpath-exports.mts} | 65 +- .../check-plugin-sdk-wildcard-reexports.d.mts | 9 - ...> check-plugin-sdk-wildcard-reexports.mts} | 6 +- scripts/check-protocol-event-coverage.d.mts | 41 - scripts/check-protocol-event-coverage.mjs | 703 +-- scripts/check-protocol-event-coverage.mts | 772 +++ ...gistry.mjs => check-protocol-registry.mts} | 34 +- ...col-since.mjs => check-protocol-since.mts} | 46 +- scripts/check-release-metadata-only.d.mts | 8 - ...ly.mjs => check-release-metadata-only.mts} | 64 +- scripts/check-runtime-sidecar-loaders.d.mts | 14 - ....mjs => check-runtime-sidecar-loaders.mts} | 81 +- scripts/check-script-declarations.d.mts | 6 - scripts/check-script-declarations.mjs | 697 --- ...dk-package-extension-import-boundary.d.mts | 5 - ...sdk-package-extension-import-boundary.mts} | 4 +- scripts/check-session-accessor-boundary.d.mts | 78 - ...js => check-session-accessor-boundary.mts} | 196 +- ...k-session-transcript-reader-boundary.d.mts | 7 - ...ck-session-transcript-reader-boundary.mts} | 44 +- .../check-sqlite-transaction-boundary.d.mts | 9 - ... => check-sqlite-transaction-boundary.mts} | 40 +- .../check-src-extension-import-boundary.d.mts | 5 - ...> check-src-extension-import-boundary.mts} | 4 +- ...> check-telegram-grammy-types-imports.mts} | 10 +- ...est-helper-extension-import-boundary.d.mts | 9 - ...test-helper-extension-import-boundary.mts} | 4 +- scripts/{check-timed.mjs => check-timed.mts} | 2 +- ...ndary.mjs => check-tsgo-core-boundary.mts} | 11 +- .../check-web-fetch-provider-boundaries.d.mts | 16 - ...> check-web-fetch-provider-boundaries.mts} | 93 +- ...check-web-search-provider-boundaries.d.mts | 37 - ... check-web-search-provider-boundaries.mts} | 63 +- ....mjs => check-webhook-auth-body-order.mts} | 12 +- ...heck-workflows.mjs => check-workflows.mts} | 18 +- scripts/check.d.mts | 19 - scripts/{check.mjs => check.mts} | 29 +- scripts/ci-changed-scope.d.mts | 66 - scripts/ci-changed-scope.mjs | 79 +- scripts/ci-run-node-test-shard.d.mts | 59 - ...t-shard.mjs => ci-run-node-test-shard.mts} | 92 +- scripts/ci-run-timings.d.mts | 55 - scripts/ci-run-timings.mjs | 8 +- scripts/close-duplicate-prs-after-merge.d.mts | 86 - scripts/close-duplicate-prs-after-merge.mjs | 139 +- scripts/code-mode-model-matrix.ts | 4 +- scripts/copy-bundled-plugin-metadata.d.mts | 5 - scripts/copy-bundled-plugin-metadata.mjs | 355 +- scripts/copy-bundled-plugin-metadata.mts | 381 ++ scripts/crabbox-routing-policy.d.mts | 27 - ...-policy.mjs => crabbox-routing-policy.mts} | 28 +- scripts/crabbox-wrapper-providers.d.mts | 6 - ...ders.mjs => crabbox-wrapper-providers.mts} | 27 +- scripts/crabbox-wrapper.mjs | 4159 +--------------- scripts/crabbox-wrapper.mts | 4256 +++++++++++++++++ ...ated-todo-scan.mjs => dated-todo-scan.mts} | 68 +- ...ip-runner.mjs => deadcode-knip-runner.mts} | 95 +- scripts/debug-claude-usage.ts | 2 +- scripts/dependency-changes-report.d.mts | 76 - ...port.mjs => dependency-changes-report.mts} | 100 +- .../dependency-ownership-surface-report.d.mts | 90 - ...> dependency-ownership-surface-report.mts} | 209 +- scripts/dependency-vulnerability-gate.d.mts | 60 - ....mjs => dependency-vulnerability-gate.mts} | 92 +- scripts/dev/realtime-talk-live-smoke.ts | 2 +- scripts/docker-channel-promote.d.mts | 37 - scripts/docker-channel-promote.mjs | 38 +- ...ker-e2e-rerun.mjs => docker-e2e-rerun.mts} | 223 +- ...e2e-timings.mjs => docker-e2e-timings.mts} | 64 +- scripts/docker-e2e.mjs | 149 +- scripts/docker-e2e.mts | 168 + scripts/docker/cleanup-smoke/Dockerfile | 2 +- scripts/docs-link-audit.d.mts | 75 - scripts/docs-link-audit.mjs | 878 +--- scripts/docs-link-audit.mts | 914 ++++ scripts/docs-sync-publish.d.mts | 36 - scripts/docs-sync-publish.mjs | 8 + ...lict.mjs => e2e-sandbox-bind-conflict.mts} | 62 +- scripts/e2e/gateway-network-docker.sh | 4 +- scripts/e2e/kitchen-sink-rpc-docker.sh | 2 +- scripts/e2e/kitchen-sink-rpc-walk.d.mts | 185 - scripts/e2e/kitchen-sink-rpc-walk.mjs | 2699 +---------- scripts/e2e/kitchen-sink-rpc-walk.mts | 3013 ++++++++++++ scripts/e2e/lib/agent-turn-output.d.mts | 3 - scripts/e2e/lib/codex-install-utils.d.mts | 14 - scripts/e2e/lib/codex-media-path/client.mjs | 2 +- .../codex-media-path/jsonl-request-tail.d.mts | 6 - ...equest-tail.mjs => jsonl-request-tail.mts} | 14 +- scripts/e2e/lib/codex-media-path/limits.d.mts | 6 - .../e2e/lib/config-reload/log-scanner.d.mts | 6 - scripts/e2e/lib/env-limits.d.mts | 2 - scripts/e2e/lib/fixtures/common.d.mts | 11 - .../e2e/lib/fixtures/mock-openai-config.d.mts | 2 - scripts/e2e/lib/gateway-frame-payload.d.mts | 1 - scripts/e2e/lib/gateway-network/client.d.mts | 52 - .../{client.mjs => client.mts} | 211 +- scripts/e2e/lib/gateway-network/limits.d.mts | 1 - .../{limits.mjs => limits.mts} | 4 +- .../e2e/lib/gateway-network/ws-frames.d.mts | 5 - .../{ws-frames.mjs => ws-frames.mts} | 43 +- scripts/e2e/lib/incremental-line-reader.d.mts | 10 - scripts/e2e/lib/mock-openai-http.d.mts | 36 - scripts/e2e/lib/mock-openai-http.mjs | 12 +- .../lib/npm-telegram-live/prepare-package.mjs | 24 - .../lib/npm-telegram-live/prepare-package.mts | 35 + scripts/e2e/lib/onboard/log-contains.d.mts | 2 - .../openai-web-search-minimal/client.d.mts | 16 - scripts/e2e/lib/openwebui/http-probe.d.mts | 13 - scripts/e2e/lib/plugin-index-sqlite.d.mts | 21 - .../release-upgrade-user-journey/scenario.sh | 2 +- .../lib/release-user-journey/assertions.d.mts | 6 - scripts/e2e/lib/text-file-utils.d.mts | 8 - .../lib/upgrade-survivor/config-recipe.d.mts | 55 - .../{config-recipe.mjs => config-recipe.mts} | 130 +- scripts/e2e/lib/upgrade-survivor/run.sh | 2 +- scripts/e2e/lib/websocket-open.d.mts | 5 - scripts/e2e/npm-telegram-live-docker.sh | 2 +- scripts/e2e/parallels/host-command.ts | 4 +- scripts/e2e/parallels/package-artifact.ts | 2 +- scripts/e2e/telegram-user-crabbox-proof.ts | 2 +- scripts/e2e/update-channel-switch-docker.sh | 2 +- scripts/ensure-cli-startup-build.d.mts | 26 - ...build.mjs => ensure-cli-startup-build.mts} | 21 +- scripts/ensure-extension-memory-build.d.mts | 27 - ....mjs => ensure-extension-memory-build.mts} | 33 +- scripts/ensure-playwright-chromium.d.mts | 57 - ...ium.mjs => ensure-playwright-chromium.mts} | 61 +- scripts/firecrawl-compare.ts | 2 +- scripts/format-docs.d.mts | 41 - scripts/{format-docs.mjs => format-docs.mts} | 63 +- scripts/full-release-validation-at-sha.d.mts | 36 - scripts/full-release-validation-at-sha.mjs | 552 +-- scripts/full-release-validation-at-sha.mts | 602 +++ scripts/gateway-watch-tmux.d.mts | 54 - ...-watch-tmux.mjs => gateway-watch-tmux.mts} | 243 +- ...generate-dependency-release-evidence.d.mts | 133 - ... generate-dependency-release-evidence.mts} | 186 +- ...nerate-host-env-security-policy-swift.mts} | 7 +- ...ly-types.mjs => generate-kysely-types.mts} | 25 +- scripts/generate-npm-package-lock.d.mts | 132 - scripts/generate-npm-package-lock.mjs | 1221 +---- scripts/generate-npm-package-lock.mts | 1346 ++++++ ....mjs => generate-plugin-inventory-doc.mts} | 147 +- scripts/gh-read.ts | 2 +- scripts/{ghsa-patch.mjs => ghsa-patch.mts} | 32 +- scripts/github/barnacle-auto-response.d.mts | 21 - scripts/github/barnacle-auto-response.mjs | 8 + scripts/github/dated-todo-upsert.d.mts | 16 - scripts/github/dependency-guard.d.mts | 118 - scripts/github/dependency-guard.mjs | 53 + .../find-reusable-release-validation.sh | 2 +- scripts/github/pr-ci-sweeper.d.mts | 33 - scripts/github/pr-ci-sweeper.mjs | 47 + .../github/real-behavior-proof-policy.d.mts | 38 - scripts/github/real-behavior-proof-policy.mjs | 63 +- scripts/github/security-sensitive-guard.d.mts | 81 - scripts/github/security-sensitive-guard.mjs | 32 + scripts/ios-release-signing.mjs | 195 +- scripts/ios-release-signing.mts | 214 + scripts/ios-write-swift-filelist.mjs | 68 +- scripts/ios-write-swift-filelist.mts | 68 + ...ova-ci-summary.mjs => kova-ci-summary.mts} | 90 +- scripts/lib/actions-artifact-archive.d.mts | 90 - .../lib/android-release-signing-process.d.mts | 13 - .../lib/android-release-signing-process.mjs | 2 +- scripts/lib/arg-utils.d.mts | 60 - scripts/lib/arg-utils.mts | 1 + .../{arg-utils.mjs => arg-utils.runtime.mjs} | 239 +- scripts/lib/bounded-response.d.mts | 20 - scripts/lib/bounded-response.mjs | 26 +- scripts/lib/budget-number-args.d.mts | 16 - ...number-args.mjs => budget-number-args.mts} | 10 +- .../lib/bundled-plugin-build-entries.d.mts | 1 - scripts/lib/bundled-plugin-paths.d.mts | 6 - scripts/lib/bundled-plugin-source-utils.d.mts | 11 - ...ls.mjs => bundled-plugin-source-utils.mts} | 70 +- ...{callsite-guard.mjs => callsite-guard.mts} | 18 +- scripts/lib/changed-extensions.d.mts | 11 - ...-extensions.mjs => changed-extensions.mts} | 40 +- scripts/lib/changed-path-facts.d.mts | 24 - scripts/lib/changed-path-facts.mjs | 75 +- scripts/lib/channel-contract-test-plan.d.mts | 7 - ...lan.mjs => channel-contract-test-plan.mts} | 41 +- ...g-summary.mjs => check-timing-summary.mts} | 10 +- scripts/lib/ci-changed-node-test-plan.d.mts | 23 - ...plan.mjs => ci-changed-node-test-plan.mts} | 52 +- scripts/lib/ci-node-test-plan.d.mts | 42 - ...de-test-plan.mjs => ci-node-test-plan.mts} | 260 +- scripts/lib/clawhub-bootstrap-artifact.d.mts | 39 - .../lib/codex-app-server-protocol-source.ts | 6 +- scripts/lib/config-boundary-guard.d.mts | 5 - ...ry-guard.mjs => config-boundary-guard.mts} | 49 +- .../lib/cross-os-release-checks/companions.ts | 4 +- .../lib/cross-os-release-checks/install.ts | 2 +- scripts/lib/deprecated-plugin-sdk-usage.d.mts | 15 - ...ge.mjs => deprecated-plugin-sdk-usage.mts} | 12 +- scripts/lib/direct-run.d.mts | 10 - scripts/lib/direct-run.mjs | 13 +- scripts/lib/docker-e2e-image.sh | 4 +- ...acts.mjs => docker-e2e-json-artifacts.mts} | 6 +- scripts/lib/docker-e2e-plan.d.mts | 92 - ...ocker-e2e-plan.mjs => docker-e2e-plan.mts} | 203 +- scripts/lib/docker-e2e-scenarios.d.mts | 38 - ...scenarios.mjs => docker-e2e-scenarios.mts} | 80 +- scripts/lib/docker-release-policy.d.mts | 15 - scripts/lib/docker-release-policy.mjs | 1 + scripts/lib/error-format.d.mts | 2 - .../{error-format.mjs => error-format.mts} | 2 +- .../extension-import-boundary-checker.d.mts | 5 - ... => extension-import-boundary-checker.mts} | 97 +- scripts/lib/extension-package-boundary.ts | 2 +- scripts/lib/extension-source-classifier.d.mts | 13 - ...er.mjs => extension-source-classifier.mts} | 4 +- scripts/lib/extension-test-plan.d.mts | 50 - ...-test-plan.mjs => extension-test-plan.mts} | 113 +- scripts/lib/extension-vitest-paths.d.mts | 3 - ...t-paths.mjs => extension-vitest-paths.mts} | 10 +- scripts/lib/failed-trailer.d.mts | 10 - ...{failed-trailer.mjs => failed-trailer.mts} | 12 +- scripts/lib/format-generated-module.d.mts | 8 - ...module.mjs => format-generated-module.mts} | 21 +- scripts/lib/gateway-server-test-plan.d.mts | 4 - ...-plan.mjs => gateway-server-test-plan.mts} | 14 +- ...t-utils.mjs => generated-output-utils.mts} | 9 +- scripts/lib/generated-text-asset.d.mts | 12 - ...ext-asset.mjs => generated-text-asset.mts} | 10 +- scripts/lib/ghsa-patch-subprocess.d.mts | 22 - ...bprocess.mjs => ghsa-patch-subprocess.mts} | 20 +- scripts/lib/guard-inventory-utils.d.mts | 47 - scripts/lib/guard-inventory-utils.mjs | 12 +- scripts/lib/kova-report-gate.d.mts | 42 - ...a-report-gate.mjs => kova-report-gate.mts} | 272 +- scripts/lib/kova-report-publish-files.d.mts | 15 - scripts/lib/kova-report-publish-files.mjs | 40 +- scripts/lib/kova-report-selector.d.mts | 2 - scripts/lib/kova-report-selector.mjs | 19 +- scripts/lib/kova-workflow-evidence.d.mts | 24 - ...vidence.mjs => kova-workflow-evidence.mts} | 61 +- ...omain.mjs => legacy-store-path-domain.mts} | 49 +- ...ist-test-files.mjs => list-test-files.mts} | 6 +- scripts/lib/local-build-metadata-paths.d.mts | 7 - ...ths.mjs => local-build-metadata-paths.mts} | 6 +- scripts/lib/local-build-metadata.d.mts | 38 - ...-metadata.mjs => local-build-metadata.mts} | 23 +- scripts/lib/local-heavy-check-runtime.d.mts | 64 - ...time.mjs => local-heavy-check-runtime.mts} | 102 +- scripts/lib/managed-child-process.d.mts | 167 - ...-process.mjs => managed-child-process.mts} | 121 +- scripts/lib/merge-head-diff-base.d.mts | 19 - scripts/lib/merge-head-diff-base.mjs | 26 +- scripts/lib/npm-json-output.d.mts | 1 - ...pm-json-output.mjs => npm-json-output.mts} | 10 +- scripts/lib/npm-pack-budget.d.mts | 17 - ...pm-pack-budget.mjs => npm-pack-budget.mts} | 35 +- scripts/lib/npm-publish-plan.d.mts | 39 - scripts/lib/numeric-options.d.mts | 4 - scripts/lib/numeric-options.mjs | 32 +- scripts/lib/openclaw-test-state.mjs | 670 +-- scripts/lib/openclaw-test-state.mts | 675 +++ scripts/lib/optional-bundled-clusters.d.mts | 1 - scripts/lib/output-root-guard.d.mts | 4 - scripts/lib/output-tail.d.mts | 1 - .../lib/{output-tail.mjs => output-tail.mts} | 8 +- scripts/lib/package-dist-inventory.ts | 2 +- scripts/lib/package-root-args.d.mts | 7 - ...ge-root-args.mjs => package-root-args.mts} | 4 +- scripts/lib/packaged-extension-dirs.d.mts | 3 - ...n-dirs.mjs => packaged-extension-dirs.mts} | 4 +- ...-context.mjs => pairing-guard-context.mts} | 6 +- scripts/lib/plain-gh.d.mts | 61 - scripts/lib/plain-gh.mjs | 111 +- scripts/lib/plugin-clawhub-release.ts | 1 - scripts/lib/plugin-contract-test-plan.d.mts | 7 - ...plan.mjs => plugin-contract-test-plan.mts} | 21 +- scripts/lib/plugin-gateway-gauntlet.d.mts | 132 - ...untlet.mjs => plugin-gateway-gauntlet.mts} | 284 +- scripts/lib/plugin-inventory-doc.d.mts | 14 - ...ntory-doc.mjs => plugin-inventory-doc.mts} | 20 +- scripts/lib/plugin-npm-package-manifest.d.mts | 81 - scripts/lib/plugin-npm-package-manifest.mjs | 895 +--- scripts/lib/plugin-npm-package-manifest.mts | 981 ++++ scripts/lib/plugin-npm-runtime-assets.d.mts | 4 - ...sets.mjs => plugin-npm-runtime-assets.mts} | 20 +- scripts/lib/plugin-npm-runtime-build.d.mts | 54 - scripts/lib/plugin-npm-runtime-build.mjs | 444 +- scripts/lib/plugin-npm-runtime-build.mts | 483 ++ scripts/lib/plugin-package-dependencies.d.mts | 15 - ...es.mjs => plugin-package-dependencies.mts} | 21 +- scripts/lib/plugin-prerelease-test-plan.d.mts | 18 - ...an.mjs => plugin-prerelease-test-plan.mts} | 12 +- .../lib/plugin-sdk-declaration-budget.d.mts | 17 - ....mjs => plugin-sdk-declaration-budget.mts} | 10 +- scripts/lib/plugin-sdk-entries.d.mts | 22 - ...sdk-entries.mjs => plugin-sdk-entries.mts} | 2 +- scripts/lib/record-shared.d.mts | 5 - scripts/lib/record-shared.mjs | 12 +- scripts/lib/regexp.mjs | 6 +- scripts/lib/release-upgrade-baseline.d.mts | 6 - ...eline.mjs => release-upgrade-baseline.mts} | 44 +- scripts/lib/release-version.d.mts | 23 - scripts/lib/repo-root.d.mts | 2 - scripts/lib/report-cli-helpers.d.mts | 9 - scripts/lib/report-cli-helpers.mjs | 44 - scripts/lib/report-cli-helpers.mts | 43 + scripts/lib/sleep.d.mts | 2 - scripts/lib/sleep.mjs | 6 +- scripts/lib/source-file-scan-cache.d.mts | 9 - ...n-cache.mjs => source-file-scan-cache.mts} | 50 +- scripts/lib/stable-release-closeout.d.mts | 29 - scripts/lib/state-schema-inline-plugin.d.mts | 9 - ...gin.mjs => state-schema-inline-plugin.mts} | 6 +- scripts/lib/static-extension-assets.d.mts | 32 - ...assets.mjs => static-extension-assets.mts} | 91 +- scripts/lib/test-group-report.d.mts | 64 - ...group-report.mjs => test-group-report.mts} | 194 +- scripts/lib/test-projects-delegation.mts | 84 + scripts/lib/ts-guard-utils.d.mts | 60 - ...{ts-guard-utils.mjs => ts-guard-utils.mts} | 78 +- scripts/lib/ts-topology/scope.ts | 2 +- scripts/lib/tsdown-config-groups.d.mts | 12 - ...ig-groups.mjs => tsdown-config-groups.mts} | 2 +- scripts/lib/tsdown-output-roots.d.mts | 3 - ...tput-roots.mjs => tsdown-output-roots.mts} | 8 +- scripts/lib/tsgo-sparse-guard.d.mts | 28 - ...sparse-guard.mjs => tsgo-sparse-guard.mts} | 41 +- scripts/lib/tsx-cli-shim.mjs | 146 + scripts/lib/vitest-batch-runner.d.mts | 10 - ...tch-runner.mjs => vitest-batch-runner.mts} | 26 +- scripts/lib/vitest-local-scheduling.d.mts | 35 - ...duling.mjs => vitest-local-scheduling.mts} | 55 +- scripts/lib/vitest-process-env.mts | 45 + ...-utils.mjs => vitest-report-cli-utils.mts} | 13 +- scripts/lib/vitest-shard-timings.d.mts | 24 - ...d-timings.mjs => vitest-shard-timings.mts} | 73 +- scripts/lib/windows-cmd-helpers-runtime.mts | 46 + scripts/lib/windows-taskkill.d.mts | 3 - scripts/lib/windows-taskkill.mjs | 4 + scripts/lib/workspace-bootstrap-smoke.d.mts | 7 - ...moke.mjs => workspace-bootstrap-smoke.mts} | 32 +- scripts/list-prod-store-packages.mjs | 20 +- ...ive-docker-stage-private-sdk-exports.d.mts | 1 - ...uild-telegram-desktop-proof-evidence.d.mts | 73 - ...build-telegram-desktop-proof-evidence.mts} | 163 +- scripts/mantis/build-telegram-evidence.d.mts | 133 - ...idence.mjs => build-telegram-evidence.mts} | 119 +- .../mantis/build-web-ui-chat-evidence.d.mts | 87 - scripts/mantis/publish-pr-evidence.d.mts | 85 - scripts/mantis/publish-pr-evidence.mjs | 185 +- scripts/mcp-code-mode-gateway-e2e.ts | 4 +- scripts/npm-placeholder-publication.d.mts | 80 - scripts/npm-placeholder-publication.mjs | 25 + scripts/npm-runner.d.mts | 16 - scripts/{npm-runner.mjs => npm-runner.mts} | 32 +- scripts/ocm-npm-workspace-deps.d.mts | 40 - ...ce-deps.mjs => ocm-npm-workspace-deps.mts} | 76 +- ...openclaw-npm-extended-stable-release.d.mts | 78 - scripts/openclaw-npm-postpublish-verify.ts | 6 +- scripts/openclaw-npm-prepublish-verify.ts | 2 +- scripts/openclaw-npm-release-check.ts | 17 +- scripts/openclaw-npm-resume-run.d.mts | 66 - ...me-run.mjs => openclaw-npm-resume-run.mts} | 113 +- .../openclaw-performance-source-summary.d.mts | 7 - ...> openclaw-performance-source-summary.mts} | 427 +- scripts/openclaw-postpack.d.mts | 2 - scripts/openclaw-prepack.ts | 6 +- scripts/package-changelog.d.mts | 16 - scripts/package-docs-map.d.mts | 2 - scripts/package-openclaw-for-docker.d.mts | 45 - scripts/package-openclaw-for-docker.mjs | 881 +--- scripts/package-openclaw-for-docker.mts | 1000 ++++ scripts/perf/summarize-cpuprofile.d.mts | 9 - scripts/perf/summarize-cpuprofile.mjs | 199 +- scripts/perf/summarize-cpuprofile.mts | 223 + scripts/periphery-intersection.d.mts | 34 - scripts/periphery-intersection.mjs | 73 +- scripts/plan-release-workflow-matrix.d.mts | 40 - .../plan-targeted-docker-lane-groups.d.mts | 16 - scripts/plan-targeted-docker-lane-groups.mjs | 13 +- ...s => plugin-prerelease-liveish-matrix.mts} | 2 +- scripts/plugin-publication-artifact.d.mts | 185 - scripts/plugin-release-pretag-pack-check.ts | 4 +- scripts/plugin-sdk-surface-report.d.mts | 69 - ...port.mjs => plugin-sdk-surface-report.mts} | 116 +- scripts/pnpm-runner.d.mts | 30 - scripts/{pnpm-runner.mjs => pnpm-runner.mts} | 63 +- scripts/postinstall-bundled-plugins.d.mts | 33 - scripts/pr | 2 + .../{pr-gates-lock.mjs => pr-gates-lock.mts} | 8 +- scripts/pr-lib/gates.sh | 2 +- scripts/pre-commit/filter-staged-files.mjs | 15 +- scripts/pre-commit/pnpm-audit-prod.d.mts | 60 - scripts/pre-commit/pnpm-audit-prod.mjs | 11 + .../preinstall-package-manager-warning.d.mts | 69 - .../preinstall-package-manager-warning.mjs | 87 +- ...extension-package-boundary-artifacts.d.mts | 65 - ...-extension-package-boundary-artifacts.mts} | 198 +- scripts/prepare-git-hooks.d.mts | 7 - .../prepublish-plugin-registry-artifact.d.mts | 30 - .../prepublish-plugin-registry-artifact.mjs | 28 + scripts/prepush-ci.sh | 1 + scripts/process-warning-filter.mjs | 37 - scripts/process-warning-filter.mts | 45 + scripts/profile-extension-memory.d.mts | 36 - ...emory.mjs => profile-extension-memory.mts} | 116 +- .../{profile-tsgo.mjs => profile-tsgo.mts} | 93 +- scripts/protocol-gen-kotlin.ts | 2 +- ...xy-install-ca.mjs => proxy-install-ca.mts} | 18 +- scripts/prune-docker-plugin-dist.d.mts | 6 - scripts/publish-model-catalog.d.mts | 80 - ...-catalog.mjs => publish-model-catalog.mts} | 293 +- scripts/qa-coverage-report.ts | 2 +- scripts/qa-parity-report.ts | 2 +- scripts/qa/ux-matrix-evidence-producer.ts | 2 +- scripts/release-beta-smoke.ts | 6 +- scripts/release-candidate-checklist.d.mts | 278 -- ...st.mjs => release-candidate-checklist.mts} | 609 ++- scripts/release-check.ts | 29 +- scripts/release-ci-summary.d.mts | 267 -- scripts/release-ci-summary.mjs | 17 + scripts/release-preflight.mjs | 443 +- scripts/release-preflight.mts | 469 ++ scripts/render-github-release-notes.d.mts | 84 - ...es.mjs => render-github-release-notes.mts} | 210 +- scripts/report-test-temp-creations.d.mts | 19 - scripts/report-test-temp-creations.mjs | 482 +- scripts/report-test-temp-creations.mts | 540 +++ .../resolve-openclaw-package-candidate.d.mts | 107 - .../resolve-openclaw-package-candidate.mjs | 1702 +------ .../resolve-openclaw-package-candidate.mts | 1946 ++++++++ .../resolve-upgrade-survivor-baselines.d.mts | 5 - ...=> resolve-upgrade-survivor-baselines.mts} | 76 +- scripts/root-dependency-ownership-audit.d.mts | 30 - ...js => root-dependency-ownership-audit.mts} | 139 +- scripts/run-additional-boundary-checks.d.mts | 96 - ...mjs => run-additional-boundary-checks.mts} | 293 +- scripts/run-android-gradle.d.mts | 23 - ...roid-gradle.mjs => run-android-gradle.mts} | 35 +- scripts/{run-lint.mjs => run-lint.mts} | 13 +- scripts/run-node-watch-paths.d.mts | 24 - ...tch-paths.mjs => run-node-watch-paths.mts} | 37 +- scripts/run-node.d.mts | 61 - scripts/run-node.mjs | 1596 +------ scripts/run-node.mts | 1732 +++++++ scripts/run-oxlint-shards.d.mts | 106 - ...xlint-shards.mjs => run-oxlint-shards.mts} | 166 +- scripts/run-oxlint.d.mts | 31 - scripts/run-oxlint.mjs | 291 +- scripts/run-oxlint.mts | 307 ++ scripts/run-tsgo.mjs | 84 +- scripts/run-tsgo.mts | 86 + scripts/run-vitest-profile.d.mts | 65 - ...est-profile.mjs => run-vitest-profile.mts} | 64 +- scripts/run-vitest.d.mts | 88 - scripts/run-vitest.mjs | 1259 +---- scripts/run-vitest.mts | 1337 ++++++ scripts/run-with-env.d.mts | 48 - .../{run-with-env.mjs => run-with-env.mts} | 68 +- scripts/runtime-postbuild-stamp.d.mts | 5 - ...-stamp.mjs => runtime-postbuild-stamp.mts} | 4 +- scripts/runtime-postbuild.d.mts | 54 - scripts/runtime-postbuild.mjs | 718 +-- scripts/runtime-postbuild.mts | 738 +++ scripts/stage-bundled-plugin-runtime.d.mts | 1 - scripts/stage-bundled-plugin-runtime.mjs | 356 +- scripts/stage-bundled-plugin-runtime.mts | 369 ++ scripts/sync-native-a2ui.d.mts | 36 - ...c-native-a2ui.mjs => sync-native-a2ui.mts} | 66 +- ...xports.mjs => sync-plugin-sdk-exports.mts} | 8 +- ...est-built-bundled-channel-entry-smoke.mts} | 69 +- ...on.mjs => test-built-plugin-singleton.mts} | 8 +- .../test-built-status-message-runtime.d.mts | 4 - ... => test-built-status-message-runtime.mts} | 14 +- ....mjs => test-cli-startup-bench-budget.mts} | 196 +- scripts/test-docker-all.d.mts | 97 - scripts/test-docker-all.mjs | 1848 +------ scripts/test-docker-all.mts | 1967 ++++++++ scripts/test-extension-batch.d.mts | 18 - ...ion-batch.mjs => test-extension-batch.mts} | 80 +- ...{test-extension.mjs => test-extension.mts} | 18 +- scripts/test-force.ts | 2 +- scripts/test-group-report.d.mts | 87 - ...group-report.mjs => test-group-report.mts} | 348 +- .../{test-hotspots.mjs => test-hotspots.mts} | 12 +- scripts/test-install-sh-docker.sh | 8 +- scripts/test-live-acp-bind-docker.sh | 2 +- scripts/test-live-cli-backend-docker.sh | 2 +- scripts/test-live-codex-harness-docker.sh | 2 +- scripts/test-live-gateway-models-docker.sh | 2 +- scripts/test-live-models-docker.sh | 2 +- scripts/test-live-shard.d.mts | 75 - scripts/test-live-shard.mjs | 766 +-- scripts/test-live-shard.mts | 803 ++++ scripts/test-live-subagent-announce-docker.sh | 2 +- scripts/test-live.d.mts | 23 - scripts/{test-live.mjs => test-live.mts} | 30 +- scripts/test-perf-budget.d.mts | 11 - ...t-perf-budget.mjs => test-perf-budget.mts} | 66 +- ...-imports.mjs => test-projects-imports.mts} | 2 +- ...projects-max.mjs => test-projects-max.mts} | 2 +- ...ts-serial.mjs => test-projects-serial.mts} | 2 +- .../{test-projects.mjs => test-projects.mts} | 83 +- scripts/test-projects.test-support.d.mts | 181 - ...ort.mjs => test-projects.test-support.mts} | 598 ++- scripts/test-report-utils.d.mts | 38 - ...report-utils.mjs => test-report-utils.mts} | 54 +- ...ast-audit.mjs => test-unit-fast-audit.mts} | 8 +- ....mjs => test-update-cli-startup-bench.mts} | 6 +- ...loop.mjs => test-voicecall-closedloop.mts} | 0 scripts/testbox-lease-freshness.d.mts | 26 - ...shness.mjs => testbox-lease-freshness.mts} | 36 +- scripts/transitive-manifest-risk-report.d.mts | 73 - ...js => transitive-manifest-risk-report.mts} | 303 +- scripts/tsdown-build.d.mts | 104 - .../{tsdown-build.mjs => tsdown-build.mts} | 339 +- scripts/ui.js | 370 +- scripts/ui.mts | 412 ++ ...ate-full-release-validation-evidence.d.mts | 62 - ...idate-full-release-validation-evidence.mjs | 92 +- .../validate-qa-runtime-pair-summary.d.mts | 31 - ...s => validate-qa-runtime-pair-summary.mts} | 132 +- .../verify-clawhub-published-artifact.d.mts | 31 - scripts/verify-docker-attestations.d.mts | 42 - .../verify-plugin-npm-published-runtime.d.mts | 23 - ...> verify-plugin-npm-published-runtime.mts} | 123 +- scripts/verify-pr-hosted-gates.d.mts | 77 - scripts/verify-pr-hosted-gates.mjs | 995 +--- scripts/verify-pr-hosted-gates.mts | 1184 +++++ scripts/{verify.mjs => verify.mts} | 24 +- scripts/vitest-process-group.d.mts | 43 - ...ess-group.mjs => vitest-process-group.mts} | 83 +- scripts/watch-node.d.mts | 46 - scripts/watch-node.mjs | 703 +-- scripts/watch-node.mts | 807 ++++ scripts/watch-pr-ci.d.mts | 89 - scripts/watch-pr-ci.mjs | 498 +- scripts/watch-pr-ci.mts | 594 +++ scripts/windows-cmd-helpers.d.mts | 5 - scripts/write-official-channel-catalog.d.mts | 77 - scripts/write-official-channel-catalog.mjs | 608 +-- scripts/write-official-channel-catalog.mts | 694 +++ scripts/write-plugin-sdk-entry-dts.ts | 2 +- scripts/zai-fallback-repro.ts | 6 +- .../reply/commands-export-session.test.ts | 2 +- .../export-html/template.security.test.ts | 2 +- src/channels/AGENTS.md | 2 +- .../channel-import-guardrails.test.ts | 2 +- src/infra/build-stamp.test.ts | 4 +- src/infra/gateway-watch-tmux.test.ts | 12 +- src/infra/openclaw-cli-invocation.test.ts | 4 +- src/infra/package-dist-inventory.ts | 2 +- src/infra/run-node.test.ts | 59 +- src/infra/scripts-modules.d.ts | 21 - src/infra/vitest-config.test.ts | 20 +- src/infra/watch-node.test.ts | 13 +- src/plugin-sdk/AGENTS.md | 2 +- src/plugin-sdk/api-baseline.test.ts | 2 +- src/plugin-sdk/api-baseline.ts | 2 +- src/plugins/AGENTS.md | 2 +- .../contracts/config-boundary-guard.test.ts | 2 +- .../deprecated-internal-config-api.test.ts | 2 +- ...sion-runtime-dependencies.contract.test.ts | 2 +- .../copy-bundled-plugin-metadata.test.ts | 2 +- .../runtime-plugin-boundary.whatsapp.test.ts | 2 +- .../stage-bundled-plugin-runtime.test.ts | 2 +- src/scripts/ci-changed-scope.test.ts | 62 +- src/scripts/docs-link-audit.test.ts | 2 +- src/scripts/test-projects.test.ts | 10 +- test/e2e/qa-lab/config/cli-channel-picker.ts | 14 +- .../media/hosted-media-provider-live.ts | 4 +- .../codex-auth-product-proof.e2e.test.ts | 2 +- .../qa-lab/runtime/docker-artifact-proof.ts | 6 +- .../package-openclaw-for-docker.e2e.test.ts | 26 +- .../update-run-package-self-upgrade.ts | 2 +- test/extension-import-boundaries.test.ts | 6 +- test/external-script-modules.d.ts | 201 - test/helpers/openclaw-test-instance.ts | 4 +- test/official-channel-catalog.test.ts | 2 +- test/openai-onboarding.live.test.ts | 2 +- test/openclaw-npm-postpublish-verify.test.ts | 2 +- test/openclaw-npm-release-check.test.ts | 2 +- test/openclaw-prepack.test.ts | 6 +- test/package-manager-config.test.ts | 9 +- test/package-scripts.test.ts | 10 +- test/plugin-extension-import-boundary.test.ts | 2 +- test/plugin-npm-package-manifest.test.ts | 25 +- test/plugin-npm-runtime-build.test.ts | 4 +- test/release-check.test.ts | 12 +- test/scripts/android-release-signing.test.ts | 37 + test/scripts/arg-utils.test.ts | 2 +- test/scripts/audit-seams.test.ts | 2 +- test/scripts/bench-test-changed.test.ts | 14 +- test/scripts/build-all.test.ts | 40 +- .../build-diffs-viewer-runtime.test.ts | 2 +- test/scripts/bundled-plugin-assets.test.ts | 14 +- .../bundled-plugin-source-utils.test.ts | 6 +- ...ged-lanes-generated-extension-lint.test.ts | 4 +- test/scripts/changed-lanes.test.ts | 100 +- .../channel-contract-test-plan.test.ts | 6 +- ...built-plugin-control-plane-modules.test.ts | 2 +- .../check-changelog-attributions.test.ts | 2 +- .../check-channel-agnostic-boundaries.test.ts | 2 +- .../check-cli-bootstrap-imports.test.ts | 2 +- ...check-database-first-legacy-stores.test.ts | 2 +- test/scripts/check-deadcode-exports.test.ts | 8 +- .../check-deadcode-unused-files.test.ts | 10 +- test/scripts/check-dependency-pins.test.ts | 2 +- .../check-deprecated-api-usage.test.ts | 4 +- test/scripts/check-docs-i18n-glossary.test.ts | 2 +- test/scripts/check-docs-mdx.test.ts | 2 +- .../check-dynamic-import-warts.test.ts | 2 +- test/scripts/check-env-var-count.test.ts | 2 +- ...eck-extension-package-tsc-boundary.test.ts | 4 +- ...check-extension-wildcard-reexports.test.ts | 2 +- .../check-gateway-cpu-scenarios.test.ts | 39 +- .../check-gateway-watch-regression.test.ts | 4 +- test/scripts/check-max-lines-ratchet.test.ts | 2 +- test/scripts/check-memory-fd-repro.test.ts | 2 +- .../check-no-random-messaging-tmp.test.ts | 2 +- ...penclaw-package-tarball-control-ui.test.ts | 2 +- .../check-openclaw-package-tarball.test.ts | 4 +- test/scripts/check-package-patches.test.ts | 2 +- .../check-plugin-npm-runtime-builds.test.ts | 2 +- ...heck-plugin-sdk-wildcard-reexports.test.ts | 2 +- .../check-protocol-event-coverage.test.ts | 2 +- .../check-release-metadata-only.test.ts | 8 +- .../check-runtime-sidecar-loaders.test.ts | 2 +- .../scripts/check-script-declarations.test.ts | 528 -- .../check-session-accessor-boundary.test.ts | 2 +- ...session-transcript-reader-boundary.test.ts | 2 +- .../check-sqlite-transaction-boundary.test.ts | 2 +- test/scripts/check-workflows.test.ts | 12 +- test/scripts/check.test.ts | 8 +- .../scripts/ci-changed-node-test-plan.test.ts | 8 +- test/scripts/ci-node-test-plan.test.ts | 6 +- test/scripts/ci-run-node-test-shard.test.ts | 6 +- test/scripts/ci-workflow-guards.test.ts | 54 +- .../scripts/cli-startup-bench-spawner.test.ts | 94 +- test/scripts/codex-media-path-client.test.ts | 2 +- test/scripts/control-ui-performance.test.ts | 53 +- .../copy-export-html-templates.test.ts | 2 +- test/scripts/crabbox-routing-policy.test.ts | 2 +- test/scripts/crabbox-wrapper.test.ts | 2 +- test/scripts/dated-todo-scan.test.ts | 14 +- .../scripts/dependency-changes-report.test.ts | 14 +- ...ependency-ownership-surface-report.test.ts | 2 +- .../dependency-vulnerability-gate.test.ts | 14 +- test/scripts/direct-run-entrypoints.test.ts | 12 +- test/scripts/docker-all-scheduler.test.ts | 38 +- test/scripts/docker-build-helper.test.ts | 15 +- test/scripts/docker-e2e-helper-cli.test.ts | 57 +- test/scripts/docker-e2e-plan.test.ts | 8 +- test/scripts/ensure-cli-startup-build.test.ts | 8 +- .../ensure-extension-memory-build.test.ts | 6 +- .../ensure-playwright-chromium.test.ts | 10 +- .../extension-import-boundary-checker.test.ts | 4 +- .../extension-source-classifier.test.ts | 2 +- test/scripts/format-docs.test.ts | 4 +- test/scripts/format-generated-module.test.ts | 2 +- .../full-release-validation-at-sha.test.ts | 10 +- test/scripts/gateway-network-client.test.ts | 6 +- ...nerate-dependency-release-evidence.test.ts | 8 +- .../scripts/generate-npm-package-lock.test.ts | 2 +- test/scripts/ghsa-patch.test.ts | 2 +- test/scripts/kitchen-sink-rpc-walk.test.ts | 26 +- test/scripts/kova-ci-summary.test.ts | 39 +- test/scripts/kova-report-gate.test.ts | 21 +- test/scripts/kova-workflow-evidence.test.ts | 4 +- test/scripts/lint-suppressions.test.ts | 4 +- .../scripts/local-heavy-check-runtime.test.ts | 2 +- test/scripts/managed-child-process.test.ts | 4 +- ...ld-telegram-desktop-proof-evidence.test.ts | 2 +- .../mantis-build-telegram-evidence.test.ts | 2 +- .../mantis-publish-pr-evidence.test.ts | 1 - .../mantis-web-ui-chat-proof-workflow.test.ts | 10 + test/scripts/npm-runner.test.ts | 2 +- test/scripts/npm-telegram-live.test.ts | 6 +- test/scripts/ocm-npm-workspace-deps.test.ts | 4 +- .../openclaw-cross-os-release-checks.test.ts | 2 +- ...openclaw-cross-os-release-workflow.test.ts | 4 +- test/scripts/openclaw-live-updater.test.ts | 4 +- ...nclaw-npm-extended-stable-workflow.test.ts | 2 +- test/scripts/openclaw-npm-resume-run.test.ts | 4 +- ...penclaw-performance-source-summary.test.ts | 14 +- .../openclaw-performance-workflow.test.ts | 22 +- test/scripts/openclaw-test-state.test.ts | 11 +- .../package-acceptance-workflow.test.ts | 24 +- test/scripts/package-root-args.test.ts | 2 +- .../scripts/plugin-contract-test-plan.test.ts | 9 +- test/scripts/plugin-gateway-gauntlet.test.ts | 58 +- test/scripts/plugin-inventory-doc.test.ts | 2 +- ...lugin-npm-extended-stable-workflow.test.ts | 18 +- .../plugin-npm-package-manifest-args.test.ts | 2 +- .../plugin-npm-runtime-build-args.test.ts | 6 +- .../plugin-package-dependencies.test.ts | 4 +- .../plugin-prerelease-test-plan.test.ts | 25 +- .../plugin-release-pretag-pack-check.test.ts | 8 +- .../plugin-sdk-declaration-budget.test.ts | 2 +- .../scripts/plugin-sdk-surface-report.test.ts | 28 +- test/scripts/pnpm-runner.test.ts | 2 +- test/scripts/pr-operation-lock.test.ts | 4 +- test/scripts/pr-prepare-gates.test.ts | 2 +- test/scripts/pr-wrappers.test.ts | 12 +- ...tension-package-boundary-artifacts.test.ts | 4 +- test/scripts/profile-extension-memory.test.ts | 10 +- test/scripts/proxy-install-ca.test.ts | 8 +- test/scripts/publish-model-catalog.test.ts | 16 +- .../real-behavior-proof-policy.test.ts | 4 +- .../release-candidate-checklist.test.ts | 18 +- test/scripts/release-no-push-workflow.test.ts | 4 +- test/scripts/release-preflight.test.ts | 18 +- test/scripts/release-upgrade-baseline.test.ts | 2 +- .../render-github-release-notes.test.ts | 2 +- test/scripts/report-cli-helpers.test.ts | 2 +- .../report-test-temp-creations.test.ts | 2 +- ...enclaw-package-candidate-ip-bypass.test.ts | 2 +- ...resolve-openclaw-package-candidate.test.ts | 6 +- .../root-dependency-ownership-audit.test.ts | 2 +- .../run-additional-boundary-checks.test.ts | 24 +- test/scripts/run-android-gradle.test.ts | 2 +- test/scripts/run-oxlint.test.ts | 28 +- test/scripts/run-tsgo.test.ts | 2 +- test/scripts/run-vitest-profile.test.ts | 2 +- test/scripts/run-vitest.test.ts | 18 +- test/scripts/run-with-env.test.ts | 44 +- test/scripts/runtime-postbuild-stamp.test.ts | 4 +- test/scripts/runtime-postbuild.test.ts | 6 +- test/scripts/source-file-scan-cache.test.ts | 2 +- .../stage-bundled-plugin-runtime.test.ts | 2 +- test/scripts/summarize-cpuprofile.test.ts | 2 +- test/scripts/sync-native-a2ui.test.ts | 10 +- .../test-built-status-message-runtime.test.ts | 2 +- test/scripts/test-extension.test.ts | 26 +- test/scripts/test-group-report.test.ts | 81 +- test/scripts/test-hotspots.test.ts | 2 +- test/scripts/test-install-sh-docker.test.ts | 2 +- .../test-live-cli-backend-docker.test.ts | 2 +- test/scripts/test-live-shard.test.ts | 2 +- test/scripts/test-live.test.ts | 62 +- test/scripts/test-perf-budget.test.ts | 2 +- test/scripts/test-projects.test.ts | 274 +- test/scripts/test-report-utils.test.ts | 8 +- test/scripts/testbox-lease-freshness.test.ts | 2 +- .../transitive-manifest-risk-report.test.ts | 14 +- test/scripts/ts-guard-utils.test.ts | 2 +- test/scripts/tsdown-build.test.ts | 20 +- test/scripts/tsdown-config.test.ts | 4 +- test/scripts/ui.test.ts | 2 +- .../upgrade-survivor-baselines.test.ts | 2 +- .../upgrade-survivor-config-recipe.test.ts | 15 +- .../validate-qa-runtime-pair-summary.test.ts | 2 +- ...erify-plugin-npm-published-runtime.test.ts | 2 +- test/scripts/verify-pr-hosted-gates.test.ts | 16 +- test/scripts/verify.test.ts | 6 +- test/scripts/vitest-e2e-global-setup.test.ts | 9 +- test/scripts/vitest-local-scheduling.test.ts | 2 +- test/scripts/vitest-process-group.test.ts | 2 +- test/scripts/vitest-shard-timings.test.ts | 4 +- test/scripts/watch-node.test.ts | 2 +- test/scripts/watch-pr-ci.test.ts | 2 +- .../website-installer-sync-workflow.test.ts | 7 +- ...t-helper-extension-import-boundary.test.ts | 2 +- test/tsconfig/tsconfig.core.test.json | 2 + test/tsconfig/tsconfig.test.root.json | 7 +- test/tsconfig/tsconfig.test.src.json | 4 + test/vitest/vitest.e2e.global-setup.ts | 2 +- test/vitest/vitest.shared.config.ts | 11 +- test/vitest/vitest.system-load.ts | 2 +- test/web-provider-boundary.test.ts | 4 +- tsconfig.scripts.json | 2 + tsdown.config.ts | 8 +- 937 files changed, 48087 insertions(+), 50044 deletions(-) delete mode 100644 scripts/audit-seams.d.mts rename scripts/{audit-seams.mjs => audit-seams.mts} (83%) delete mode 100644 scripts/bench-test-changed.d.mts rename scripts/{bench-test-changed.mjs => bench-test-changed.mts} (80%) delete mode 100644 scripts/build-all.d.mts rename scripts/{build-all.mjs => build-all.mts} (75%) delete mode 100644 scripts/build-diffs-viewer-runtime.d.mts rename scripts/{build-diffs-viewer-runtime.mjs => build-diffs-viewer-runtime.mts} (80%) delete mode 100644 scripts/build-discord-activity-sdk.d.mts rename scripts/{build-discord-activity-sdk.mjs => build-discord-activity-sdk.mts} (81%) delete mode 100644 scripts/build-stamp.d.mts rename scripts/{build-stamp.mjs => build-stamp.mts} (80%) rename scripts/{bundle-a2ui.mjs => bundle-a2ui.mts} (97%) delete mode 100644 scripts/bundled-plugin-assets.d.mts rename scripts/{bundled-plugin-assets.mjs => bundled-plugin-assets.mts} (82%) delete mode 100644 scripts/changed-lanes.d.mts create mode 100644 scripts/changed-lanes.mts delete mode 100644 scripts/check-built-plugin-control-plane-modules.d.mts rename scripts/{check-built-plugin-control-plane-modules.mjs => check-built-plugin-control-plane-modules.mts} (77%) delete mode 100644 scripts/check-changed.d.mts create mode 100644 scripts/check-changed.mts delete mode 100644 scripts/check-changelog-attributions.d.mts create mode 100644 scripts/check-changelog-attributions.mts delete mode 100644 scripts/check-channel-agnostic-boundaries.d.mts rename scripts/{check-channel-agnostic-boundaries.mjs => check-channel-agnostic-boundaries.mts} (84%) delete mode 100644 scripts/check-cli-bootstrap-imports.d.mts rename scripts/{check-cli-bootstrap-imports.mjs => check-cli-bootstrap-imports.mts} (74%) delete mode 100644 scripts/check-cli-startup-memory.d.mts delete mode 100644 scripts/check-control-ui-performance.d.mts rename scripts/{check-control-ui-performance.mjs => check-control-ui-performance.mts} (75%) rename scripts/{check-control-ui-precompressed-assets.mjs => check-control-ui-precompressed-assets.mts} (96%) delete mode 100644 scripts/check-database-first-legacy-stores.d.mts rename scripts/{check-database-first-legacy-stores.mjs => check-database-first-legacy-stores.mts} (78%) delete mode 100644 scripts/check-deadcode-exports.d.mts rename scripts/{check-deadcode-exports.mjs => check-deadcode-exports.mts} (92%) delete mode 100644 scripts/check-deadcode-unused-files.d.mts rename scripts/{check-deadcode-unused-files.mjs => check-deadcode-unused-files.mts} (89%) delete mode 100644 scripts/check-dependency-pins.d.mts rename scripts/{check-dependency-pins.mjs => check-dependency-pins.mts} (71%) rename scripts/{check-deprecated-api-usage.mjs => check-deprecated-api-usage.mts} (84%) rename scripts/{check-deprecated-jsdoc.mjs => check-deprecated-jsdoc.mts} (76%) rename scripts/{check-docker-e2e-boundaries.mjs => check-docker-e2e-boundaries.mts} (86%) delete mode 100644 scripts/check-docs-i18n-glossary.d.mts rename scripts/{check-docs-i18n-glossary.mjs => check-docs-i18n-glossary.mts} (78%) delete mode 100644 scripts/check-docs-mdx.d.mts create mode 100644 scripts/check-docs-mdx.mts rename scripts/{check-duplicates.mjs => check-duplicates.mts} (96%) delete mode 100644 scripts/check-dynamic-import-warts.d.mts rename scripts/{check-dynamic-import-warts.mjs => check-dynamic-import-warts.mts} (80%) delete mode 100644 scripts/check-env-var-count.d.mts rename scripts/{check-env-var-count.mjs => check-env-var-count.mts} (85%) delete mode 100644 scripts/check-extension-package-tsc-boundary.d.mts rename scripts/{check-extension-package-tsc-boundary.mjs => check-extension-package-tsc-boundary.mts} (77%) delete mode 100644 scripts/check-extension-plugin-sdk-boundary.d.mts rename scripts/{check-extension-plugin-sdk-boundary.mjs => check-extension-plugin-sdk-boundary.mts} (67%) delete mode 100644 scripts/check-extension-wildcard-reexports.d.mts rename scripts/{check-extension-wildcard-reexports.mjs => check-extension-wildcard-reexports.mts} (93%) delete mode 100644 scripts/check-gateway-cpu-scenarios.d.mts rename scripts/{check-gateway-cpu-scenarios.mjs => check-gateway-cpu-scenarios.mts} (84%) delete mode 100644 scripts/check-gateway-watch-regression.d.mts rename scripts/{check-gateway-watch-regression.mjs => check-gateway-watch-regression.mts} (77%) rename scripts/{check-ingress-agent-owner-context.mjs => check-ingress-agent-owner-context.mts} (89%) rename scripts/{check-kysely-guardrails.mjs => check-kysely-guardrails.mts} (91%) delete mode 100644 scripts/check-max-lines-ratchet.d.mts rename scripts/{check-max-lines-ratchet.mjs => check-max-lines-ratchet.mts} (83%) rename scripts/{check-media-download-helper-roundtrip.mjs => check-media-download-helper-roundtrip.mts} (89%) delete mode 100644 scripts/check-memory-fd-repro.d.mts create mode 100644 scripts/check-memory-fd-repro.mts delete mode 100644 scripts/check-native-state-schema-version.d.mts delete mode 100644 scripts/check-no-conflict-markers.d.mts rename scripts/{check-no-pairing-store-group-auth.mjs => check-no-pairing-store-group-auth.mts} (91%) delete mode 100644 scripts/check-no-random-messaging-tmp.d.mts rename scripts/{check-no-random-messaging-tmp.mjs => check-no-random-messaging-tmp.mts} (88%) rename scripts/{check-no-raw-channel-fetch.mjs => check-no-raw-channel-fetch.mts} (95%) rename scripts/{check-no-raw-http2-imports.mjs => check-no-raw-http2-imports.mts} (82%) rename scripts/{check-no-runtime-action-load-config.mjs => check-no-runtime-action-load-config.mts} (95%) create mode 100644 scripts/check-openclaw-package-tarball.mts delete mode 100644 scripts/check-package-patches.d.mts rename scripts/{check-package-patches.mjs => check-package-patches.mts} (65%) rename scripts/{check-pairing-account-scope.mjs => check-pairing-account-scope.mts} (83%) delete mode 100644 scripts/check-plugin-extension-import-boundary.d.mts rename scripts/{check-plugin-extension-import-boundary.mjs => check-plugin-extension-import-boundary.mts} (76%) delete mode 100644 scripts/check-plugin-gateway-gauntlet.d.mts rename scripts/{check-plugin-gateway-gauntlet.mjs => check-plugin-gateway-gauntlet.mts} (81%) delete mode 100644 scripts/check-plugin-npm-runtime-builds.d.mts rename scripts/{check-plugin-npm-runtime-builds.mjs => check-plugin-npm-runtime-builds.mts} (79%) rename scripts/{check-plugin-sdk-exports.mjs => check-plugin-sdk-exports.mts} (92%) rename scripts/{check-plugin-sdk-subpath-exports.mjs => check-plugin-sdk-subpath-exports.mts} (77%) delete mode 100644 scripts/check-plugin-sdk-wildcard-reexports.d.mts rename scripts/{check-plugin-sdk-wildcard-reexports.mjs => check-plugin-sdk-wildcard-reexports.mts} (94%) delete mode 100644 scripts/check-protocol-event-coverage.d.mts create mode 100644 scripts/check-protocol-event-coverage.mts rename scripts/{check-protocol-registry.mjs => check-protocol-registry.mts} (83%) rename scripts/{check-protocol-since.mjs => check-protocol-since.mts} (81%) delete mode 100644 scripts/check-release-metadata-only.d.mts rename scripts/{check-release-metadata-only.mjs => check-release-metadata-only.mts} (77%) delete mode 100644 scripts/check-runtime-sidecar-loaders.d.mts rename scripts/{check-runtime-sidecar-loaders.mjs => check-runtime-sidecar-loaders.mts} (74%) delete mode 100644 scripts/check-script-declarations.d.mts delete mode 100644 scripts/check-script-declarations.mjs delete mode 100644 scripts/check-sdk-package-extension-import-boundary.d.mts rename scripts/{check-sdk-package-extension-import-boundary.mjs => check-sdk-package-extension-import-boundary.mts} (89%) delete mode 100644 scripts/check-session-accessor-boundary.d.mts rename scripts/{check-session-accessor-boundary.mjs => check-session-accessor-boundary.mts} (86%) delete mode 100644 scripts/check-session-transcript-reader-boundary.d.mts rename scripts/{check-session-transcript-reader-boundary.mjs => check-session-transcript-reader-boundary.mts} (89%) delete mode 100644 scripts/check-sqlite-transaction-boundary.d.mts rename scripts/{check-sqlite-transaction-boundary.mjs => check-sqlite-transaction-boundary.mts} (83%) delete mode 100644 scripts/check-src-extension-import-boundary.d.mts rename scripts/{check-src-extension-import-boundary.mjs => check-src-extension-import-boundary.mts} (92%) rename scripts/{check-telegram-grammy-types-imports.mjs => check-telegram-grammy-types-imports.mts} (88%) delete mode 100644 scripts/check-test-helper-extension-import-boundary.d.mts rename scripts/{check-test-helper-extension-import-boundary.mjs => check-test-helper-extension-import-boundary.mts} (89%) rename scripts/{check-timed.mjs => check-timed.mts} (75%) rename scripts/{check-tsgo-core-boundary.mjs => check-tsgo-core-boundary.mts} (93%) delete mode 100644 scripts/check-web-fetch-provider-boundaries.d.mts rename scripts/{check-web-fetch-provider-boundaries.mjs => check-web-fetch-provider-boundaries.mts} (57%) delete mode 100644 scripts/check-web-search-provider-boundaries.d.mts rename scripts/{check-web-search-provider-boundaries.mjs => check-web-search-provider-boundaries.mts} (78%) rename scripts/{check-webhook-auth-body-order.mjs => check-webhook-auth-body-order.mts} (87%) rename scripts/{check-workflows.mjs => check-workflows.mts} (86%) delete mode 100644 scripts/check.d.mts rename scripts/{check.mjs => check.mts} (88%) delete mode 100644 scripts/ci-changed-scope.d.mts delete mode 100644 scripts/ci-run-node-test-shard.d.mts rename scripts/{ci-run-node-test-shard.mjs => ci-run-node-test-shard.mts} (78%) delete mode 100644 scripts/ci-run-timings.d.mts delete mode 100644 scripts/close-duplicate-prs-after-merge.d.mts delete mode 100644 scripts/copy-bundled-plugin-metadata.d.mts create mode 100644 scripts/copy-bundled-plugin-metadata.mts delete mode 100644 scripts/crabbox-routing-policy.d.mts rename scripts/{crabbox-routing-policy.mjs => crabbox-routing-policy.mts} (67%) delete mode 100644 scripts/crabbox-wrapper-providers.d.mts rename scripts/{crabbox-wrapper-providers.mjs => crabbox-wrapper-providers.mts} (74%) create mode 100755 scripts/crabbox-wrapper.mts rename scripts/{dated-todo-scan.mjs => dated-todo-scan.mts} (83%) rename scripts/{deadcode-knip-runner.mjs => deadcode-knip-runner.mts} (72%) delete mode 100644 scripts/dependency-changes-report.d.mts rename scripts/{dependency-changes-report.mjs => dependency-changes-report.mts} (76%) delete mode 100644 scripts/dependency-ownership-surface-report.d.mts rename scripts/{dependency-ownership-surface-report.mjs => dependency-ownership-surface-report.mts} (68%) delete mode 100644 scripts/dependency-vulnerability-gate.d.mts rename scripts/{dependency-vulnerability-gate.mjs => dependency-vulnerability-gate.mts} (78%) delete mode 100644 scripts/docker-channel-promote.d.mts rename scripts/{docker-e2e-rerun.mjs => docker-e2e-rerun.mts} (71%) rename scripts/{docker-e2e-timings.mjs => docker-e2e-timings.mts} (69%) create mode 100644 scripts/docker-e2e.mts delete mode 100644 scripts/docs-link-audit.d.mts create mode 100644 scripts/docs-link-audit.mts delete mode 100644 scripts/docs-sync-publish.d.mts rename scripts/{e2e-sandbox-bind-conflict.mjs => e2e-sandbox-bind-conflict.mts} (80%) delete mode 100644 scripts/e2e/kitchen-sink-rpc-walk.d.mts create mode 100644 scripts/e2e/kitchen-sink-rpc-walk.mts delete mode 100644 scripts/e2e/lib/agent-turn-output.d.mts delete mode 100644 scripts/e2e/lib/codex-install-utils.d.mts delete mode 100644 scripts/e2e/lib/codex-media-path/jsonl-request-tail.d.mts rename scripts/e2e/lib/codex-media-path/{jsonl-request-tail.mjs => jsonl-request-tail.mts} (80%) delete mode 100644 scripts/e2e/lib/codex-media-path/limits.d.mts delete mode 100644 scripts/e2e/lib/config-reload/log-scanner.d.mts delete mode 100644 scripts/e2e/lib/env-limits.d.mts delete mode 100644 scripts/e2e/lib/fixtures/common.d.mts delete mode 100644 scripts/e2e/lib/fixtures/mock-openai-config.d.mts delete mode 100644 scripts/e2e/lib/gateway-frame-payload.d.mts delete mode 100644 scripts/e2e/lib/gateway-network/client.d.mts rename scripts/e2e/lib/gateway-network/{client.mjs => client.mts} (71%) delete mode 100644 scripts/e2e/lib/gateway-network/limits.d.mts rename scripts/e2e/lib/gateway-network/{limits.mjs => limits.mts} (76%) delete mode 100644 scripts/e2e/lib/gateway-network/ws-frames.d.mts rename scripts/e2e/lib/gateway-network/{ws-frames.mjs => ws-frames.mts} (55%) delete mode 100644 scripts/e2e/lib/incremental-line-reader.d.mts delete mode 100644 scripts/e2e/lib/mock-openai-http.d.mts delete mode 100644 scripts/e2e/lib/npm-telegram-live/prepare-package.mjs create mode 100644 scripts/e2e/lib/npm-telegram-live/prepare-package.mts delete mode 100644 scripts/e2e/lib/onboard/log-contains.d.mts delete mode 100644 scripts/e2e/lib/openai-web-search-minimal/client.d.mts delete mode 100644 scripts/e2e/lib/openwebui/http-probe.d.mts delete mode 100644 scripts/e2e/lib/plugin-index-sqlite.d.mts delete mode 100644 scripts/e2e/lib/release-user-journey/assertions.d.mts delete mode 100644 scripts/e2e/lib/text-file-utils.d.mts delete mode 100644 scripts/e2e/lib/upgrade-survivor/config-recipe.d.mts rename scripts/e2e/lib/upgrade-survivor/{config-recipe.mjs => config-recipe.mts} (73%) delete mode 100644 scripts/e2e/lib/websocket-open.d.mts delete mode 100644 scripts/ensure-cli-startup-build.d.mts rename scripts/{ensure-cli-startup-build.mjs => ensure-cli-startup-build.mts} (78%) delete mode 100644 scripts/ensure-extension-memory-build.d.mts rename scripts/{ensure-extension-memory-build.mjs => ensure-extension-memory-build.mts} (77%) delete mode 100644 scripts/ensure-playwright-chromium.d.mts rename scripts/{ensure-playwright-chromium.mjs => ensure-playwright-chromium.mts} (84%) delete mode 100644 scripts/format-docs.d.mts rename scripts/{format-docs.mjs => format-docs.mts} (82%) delete mode 100644 scripts/full-release-validation-at-sha.d.mts create mode 100644 scripts/full-release-validation-at-sha.mts delete mode 100644 scripts/gateway-watch-tmux.d.mts rename scripts/{gateway-watch-tmux.mjs => gateway-watch-tmux.mts} (72%) delete mode 100644 scripts/generate-dependency-release-evidence.d.mts rename scripts/{generate-dependency-release-evidence.mjs => generate-dependency-release-evidence.mts} (73%) rename scripts/{generate-host-env-security-policy-swift.mjs => generate-host-env-security-policy-swift.mts} (88%) rename scripts/{generate-kysely-types.mjs => generate-kysely-types.mts} (83%) delete mode 100644 scripts/generate-npm-package-lock.d.mts create mode 100644 scripts/generate-npm-package-lock.mts rename scripts/{generate-plugin-inventory-doc.mjs => generate-plugin-inventory-doc.mts} (82%) rename scripts/{ghsa-patch.mjs => ghsa-patch.mts} (84%) delete mode 100644 scripts/github/barnacle-auto-response.d.mts delete mode 100644 scripts/github/dated-todo-upsert.d.mts delete mode 100644 scripts/github/dependency-guard.d.mts delete mode 100644 scripts/github/pr-ci-sweeper.d.mts delete mode 100644 scripts/github/real-behavior-proof-policy.d.mts delete mode 100644 scripts/github/security-sensitive-guard.d.mts create mode 100755 scripts/ios-release-signing.mts create mode 100644 scripts/ios-write-swift-filelist.mts rename scripts/{kova-ci-summary.mjs => kova-ci-summary.mts} (74%) delete mode 100644 scripts/lib/actions-artifact-archive.d.mts delete mode 100644 scripts/lib/android-release-signing-process.d.mts delete mode 100644 scripts/lib/arg-utils.d.mts create mode 100644 scripts/lib/arg-utils.mts rename scripts/lib/{arg-utils.mjs => arg-utils.runtime.mjs} (54%) delete mode 100644 scripts/lib/bounded-response.d.mts delete mode 100644 scripts/lib/budget-number-args.d.mts rename scripts/lib/{budget-number-args.mjs => budget-number-args.mts} (77%) delete mode 100644 scripts/lib/bundled-plugin-build-entries.d.mts delete mode 100644 scripts/lib/bundled-plugin-paths.d.mts delete mode 100644 scripts/lib/bundled-plugin-source-utils.d.mts rename scripts/lib/{bundled-plugin-source-utils.mjs => bundled-plugin-source-utils.mts} (67%) rename scripts/lib/{callsite-guard.mjs => callsite-guard.mts} (73%) delete mode 100644 scripts/lib/changed-extensions.d.mts rename scripts/lib/{changed-extensions.mjs => changed-extensions.mts} (76%) delete mode 100644 scripts/lib/changed-path-facts.d.mts delete mode 100644 scripts/lib/channel-contract-test-plan.d.mts rename scripts/lib/{channel-contract-test-plan.mjs => channel-contract-test-plan.mts} (65%) rename scripts/lib/{check-timing-summary.mjs => check-timing-summary.mts} (72%) delete mode 100644 scripts/lib/ci-changed-node-test-plan.d.mts rename scripts/lib/{ci-changed-node-test-plan.mjs => ci-changed-node-test-plan.mts} (88%) delete mode 100644 scripts/lib/ci-node-test-plan.d.mts rename scripts/lib/{ci-node-test-plan.mjs => ci-node-test-plan.mts} (88%) delete mode 100644 scripts/lib/clawhub-bootstrap-artifact.d.mts delete mode 100644 scripts/lib/config-boundary-guard.d.mts rename scripts/lib/{config-boundary-guard.mjs => config-boundary-guard.mts} (92%) delete mode 100644 scripts/lib/deprecated-plugin-sdk-usage.d.mts rename scripts/lib/{deprecated-plugin-sdk-usage.mjs => deprecated-plugin-sdk-usage.mts} (86%) delete mode 100644 scripts/lib/direct-run.d.mts rename scripts/lib/{docker-e2e-json-artifacts.mjs => docker-e2e-json-artifacts.mts} (83%) delete mode 100644 scripts/lib/docker-e2e-plan.d.mts rename scripts/lib/{docker-e2e-plan.mjs => docker-e2e-plan.mts} (82%) delete mode 100644 scripts/lib/docker-e2e-scenarios.d.mts rename scripts/lib/{docker-e2e-scenarios.mjs => docker-e2e-scenarios.mts} (92%) delete mode 100644 scripts/lib/docker-release-policy.d.mts delete mode 100644 scripts/lib/error-format.d.mts rename scripts/lib/{error-format.mjs => error-format.mts} (81%) delete mode 100644 scripts/lib/extension-import-boundary-checker.d.mts rename scripts/lib/{extension-import-boundary-checker.mjs => extension-import-boundary-checker.mts} (64%) delete mode 100644 scripts/lib/extension-source-classifier.d.mts rename scripts/lib/{extension-source-classifier.mjs => extension-source-classifier.mts} (94%) delete mode 100644 scripts/lib/extension-test-plan.d.mts rename scripts/lib/{extension-test-plan.mjs => extension-test-plan.mts} (84%) delete mode 100644 scripts/lib/extension-vitest-paths.d.mts rename scripts/lib/{extension-vitest-paths.mjs => extension-vitest-paths.mts} (86%) delete mode 100644 scripts/lib/failed-trailer.d.mts rename scripts/lib/{failed-trailer.mjs => failed-trailer.mts} (51%) delete mode 100644 scripts/lib/format-generated-module.d.mts rename scripts/lib/{format-generated-module.mjs => format-generated-module.mts} (77%) delete mode 100644 scripts/lib/gateway-server-test-plan.d.mts rename scripts/lib/{gateway-server-test-plan.mjs => gateway-server-test-plan.mts} (85%) rename scripts/lib/{generated-output-utils.mjs => generated-output-utils.mts} (76%) delete mode 100644 scripts/lib/generated-text-asset.d.mts rename scripts/lib/{generated-text-asset.mjs => generated-text-asset.mts} (63%) delete mode 100644 scripts/lib/ghsa-patch-subprocess.d.mts rename scripts/lib/{ghsa-patch-subprocess.mjs => ghsa-patch-subprocess.mts} (54%) delete mode 100644 scripts/lib/guard-inventory-utils.d.mts delete mode 100644 scripts/lib/kova-report-gate.d.mts rename scripts/lib/{kova-report-gate.mjs => kova-report-gate.mts} (79%) delete mode 100644 scripts/lib/kova-report-publish-files.d.mts delete mode 100644 scripts/lib/kova-report-selector.d.mts delete mode 100644 scripts/lib/kova-workflow-evidence.d.mts rename scripts/lib/{kova-workflow-evidence.mjs => kova-workflow-evidence.mts} (83%) rename scripts/lib/{legacy-store-path-domain.mjs => legacy-store-path-domain.mts} (64%) rename scripts/lib/{list-test-files.mjs => list-test-files.mts} (87%) delete mode 100644 scripts/lib/local-build-metadata-paths.d.mts rename scripts/lib/{local-build-metadata-paths.mjs => local-build-metadata-paths.mts} (80%) delete mode 100644 scripts/lib/local-build-metadata.d.mts rename scripts/lib/{local-build-metadata.mjs => local-build-metadata.mts} (74%) delete mode 100644 scripts/lib/local-heavy-check-runtime.d.mts rename scripts/lib/{local-heavy-check-runtime.mjs => local-heavy-check-runtime.mts} (84%) delete mode 100644 scripts/lib/managed-child-process.d.mts rename scripts/lib/{managed-child-process.mjs => managed-child-process.mts} (78%) delete mode 100644 scripts/lib/merge-head-diff-base.d.mts delete mode 100644 scripts/lib/npm-json-output.d.mts rename scripts/lib/{npm-json-output.mjs => npm-json-output.mts} (66%) delete mode 100644 scripts/lib/npm-pack-budget.d.mts rename scripts/lib/{npm-pack-budget.mjs => npm-pack-budget.mts} (60%) delete mode 100644 scripts/lib/npm-publish-plan.d.mts delete mode 100644 scripts/lib/numeric-options.d.mts create mode 100644 scripts/lib/openclaw-test-state.mts delete mode 100644 scripts/lib/optional-bundled-clusters.d.mts delete mode 100644 scripts/lib/output-root-guard.d.mts delete mode 100644 scripts/lib/output-tail.d.mts rename scripts/lib/{output-tail.mjs => output-tail.mts} (65%) delete mode 100644 scripts/lib/package-root-args.d.mts rename scripts/lib/{package-root-args.mjs => package-root-args.mts} (87%) delete mode 100644 scripts/lib/packaged-extension-dirs.d.mts rename scripts/lib/{packaged-extension-dirs.mjs => packaged-extension-dirs.mts} (84%) rename scripts/lib/{pairing-guard-context.mjs => pairing-guard-context.mts} (73%) delete mode 100644 scripts/lib/plain-gh.d.mts delete mode 100644 scripts/lib/plugin-contract-test-plan.d.mts rename scripts/lib/{plugin-contract-test-plan.mjs => plugin-contract-test-plan.mts} (71%) delete mode 100644 scripts/lib/plugin-gateway-gauntlet.d.mts rename scripts/lib/{plugin-gateway-gauntlet.mjs => plugin-gateway-gauntlet.mts} (67%) delete mode 100644 scripts/lib/plugin-inventory-doc.d.mts rename scripts/lib/{plugin-inventory-doc.mjs => plugin-inventory-doc.mts} (75%) delete mode 100644 scripts/lib/plugin-npm-package-manifest.d.mts create mode 100644 scripts/lib/plugin-npm-package-manifest.mts delete mode 100644 scripts/lib/plugin-npm-runtime-assets.d.mts rename scripts/lib/{plugin-npm-runtime-assets.mjs => plugin-npm-runtime-assets.mts} (70%) delete mode 100644 scripts/lib/plugin-npm-runtime-build.d.mts create mode 100644 scripts/lib/plugin-npm-runtime-build.mts delete mode 100644 scripts/lib/plugin-package-dependencies.d.mts rename scripts/lib/{plugin-package-dependencies.mjs => plugin-package-dependencies.mts} (78%) delete mode 100644 scripts/lib/plugin-prerelease-test-plan.d.mts rename scripts/lib/{plugin-prerelease-test-plan.mjs => plugin-prerelease-test-plan.mts} (92%) delete mode 100644 scripts/lib/plugin-sdk-declaration-budget.d.mts rename scripts/lib/{plugin-sdk-declaration-budget.mjs => plugin-sdk-declaration-budget.mts} (84%) delete mode 100644 scripts/lib/plugin-sdk-entries.d.mts rename scripts/lib/{plugin-sdk-entries.mjs => plugin-sdk-entries.mts} (98%) delete mode 100644 scripts/lib/record-shared.d.mts delete mode 100644 scripts/lib/release-upgrade-baseline.d.mts rename scripts/lib/{release-upgrade-baseline.mjs => release-upgrade-baseline.mts} (67%) delete mode 100644 scripts/lib/release-version.d.mts delete mode 100644 scripts/lib/repo-root.d.mts delete mode 100644 scripts/lib/report-cli-helpers.d.mts delete mode 100644 scripts/lib/report-cli-helpers.mjs create mode 100644 scripts/lib/report-cli-helpers.mts delete mode 100644 scripts/lib/sleep.d.mts delete mode 100644 scripts/lib/source-file-scan-cache.d.mts rename scripts/lib/{source-file-scan-cache.mjs => source-file-scan-cache.mts} (67%) delete mode 100644 scripts/lib/stable-release-closeout.d.mts delete mode 100644 scripts/lib/state-schema-inline-plugin.d.mts rename scripts/lib/{state-schema-inline-plugin.mjs => state-schema-inline-plugin.mts} (91%) delete mode 100644 scripts/lib/static-extension-assets.d.mts rename scripts/lib/{static-extension-assets.mjs => static-extension-assets.mts} (77%) delete mode 100644 scripts/lib/test-group-report.d.mts rename scripts/lib/{test-group-report.mjs => test-group-report.mts} (77%) create mode 100644 scripts/lib/test-projects-delegation.mts delete mode 100644 scripts/lib/ts-guard-utils.d.mts rename scripts/lib/{ts-guard-utils.mjs => ts-guard-utils.mts} (68%) delete mode 100644 scripts/lib/tsdown-config-groups.d.mts rename scripts/lib/{tsdown-config-groups.mjs => tsdown-config-groups.mts} (97%) delete mode 100644 scripts/lib/tsdown-output-roots.d.mts rename scripts/lib/{tsdown-output-roots.mjs => tsdown-output-roots.mts} (77%) delete mode 100644 scripts/lib/tsgo-sparse-guard.d.mts rename scripts/lib/{tsgo-sparse-guard.mjs => tsgo-sparse-guard.mts} (83%) create mode 100644 scripts/lib/tsx-cli-shim.mjs delete mode 100644 scripts/lib/vitest-batch-runner.d.mts rename scripts/lib/{vitest-batch-runner.mjs => vitest-batch-runner.mts} (71%) delete mode 100644 scripts/lib/vitest-local-scheduling.d.mts rename scripts/lib/{vitest-local-scheduling.mjs => vitest-local-scheduling.mts} (80%) create mode 100644 scripts/lib/vitest-process-env.mts rename scripts/lib/{vitest-report-cli-utils.mjs => vitest-report-cli-utils.mts} (70%) delete mode 100644 scripts/lib/vitest-shard-timings.d.mts rename scripts/lib/{vitest-shard-timings.mjs => vitest-shard-timings.mts} (65%) create mode 100644 scripts/lib/windows-cmd-helpers-runtime.mts delete mode 100644 scripts/lib/windows-taskkill.d.mts delete mode 100644 scripts/lib/workspace-bootstrap-smoke.d.mts rename scripts/lib/{workspace-bootstrap-smoke.mjs => workspace-bootstrap-smoke.mts} (82%) delete mode 100644 scripts/live-docker-stage-private-sdk-exports.d.mts delete mode 100644 scripts/mantis/build-telegram-desktop-proof-evidence.d.mts rename scripts/mantis/{build-telegram-desktop-proof-evidence.mjs => build-telegram-desktop-proof-evidence.mts} (64%) delete mode 100644 scripts/mantis/build-telegram-evidence.d.mts rename scripts/mantis/{build-telegram-evidence.mjs => build-telegram-evidence.mts} (81%) delete mode 100644 scripts/mantis/build-web-ui-chat-evidence.d.mts delete mode 100644 scripts/mantis/publish-pr-evidence.d.mts delete mode 100644 scripts/npm-placeholder-publication.d.mts delete mode 100644 scripts/npm-runner.d.mts rename scripts/{npm-runner.mjs => npm-runner.mts} (78%) delete mode 100644 scripts/ocm-npm-workspace-deps.d.mts rename scripts/{ocm-npm-workspace-deps.mjs => ocm-npm-workspace-deps.mts} (82%) delete mode 100644 scripts/openclaw-npm-extended-stable-release.d.mts delete mode 100644 scripts/openclaw-npm-resume-run.d.mts rename scripts/{openclaw-npm-resume-run.mjs => openclaw-npm-resume-run.mts} (61%) delete mode 100644 scripts/openclaw-performance-source-summary.d.mts rename scripts/{openclaw-performance-source-summary.mjs => openclaw-performance-source-summary.mts} (52%) delete mode 100644 scripts/openclaw-postpack.d.mts delete mode 100644 scripts/package-changelog.d.mts delete mode 100644 scripts/package-docs-map.d.mts delete mode 100644 scripts/package-openclaw-for-docker.d.mts create mode 100644 scripts/package-openclaw-for-docker.mts delete mode 100644 scripts/perf/summarize-cpuprofile.d.mts create mode 100644 scripts/perf/summarize-cpuprofile.mts delete mode 100644 scripts/periphery-intersection.d.mts delete mode 100644 scripts/plan-release-workflow-matrix.d.mts delete mode 100644 scripts/plan-targeted-docker-lane-groups.d.mts rename scripts/{plugin-prerelease-liveish-matrix.mjs => plugin-prerelease-liveish-matrix.mts} (97%) delete mode 100644 scripts/plugin-publication-artifact.d.mts delete mode 100644 scripts/plugin-sdk-surface-report.d.mts rename scripts/{plugin-sdk-surface-report.mjs => plugin-sdk-surface-report.mts} (89%) delete mode 100644 scripts/pnpm-runner.d.mts rename scripts/{pnpm-runner.mjs => pnpm-runner.mts} (77%) delete mode 100644 scripts/postinstall-bundled-plugins.d.mts rename scripts/{pr-gates-lock.mjs => pr-gates-lock.mts} (91%) delete mode 100644 scripts/pre-commit/pnpm-audit-prod.d.mts delete mode 100644 scripts/preinstall-package-manager-warning.d.mts delete mode 100644 scripts/prepare-extension-package-boundary-artifacts.d.mts rename scripts/{prepare-extension-package-boundary-artifacts.mjs => prepare-extension-package-boundary-artifacts.mts} (88%) delete mode 100644 scripts/prepare-git-hooks.d.mts delete mode 100644 scripts/prepublish-plugin-registry-artifact.d.mts delete mode 100644 scripts/process-warning-filter.mjs create mode 100644 scripts/process-warning-filter.mts delete mode 100644 scripts/profile-extension-memory.d.mts rename scripts/{profile-extension-memory.mjs => profile-extension-memory.mts} (84%) rename scripts/{profile-tsgo.mjs => profile-tsgo.mts} (84%) rename scripts/{proxy-install-ca.mjs => proxy-install-ca.mts} (86%) delete mode 100644 scripts/prune-docker-plugin-dist.d.mts delete mode 100644 scripts/publish-model-catalog.d.mts rename scripts/{publish-model-catalog.mjs => publish-model-catalog.mts} (70%) delete mode 100644 scripts/release-candidate-checklist.d.mts rename scripts/{release-candidate-checklist.mjs => release-candidate-checklist.mts} (76%) delete mode 100644 scripts/release-ci-summary.d.mts create mode 100644 scripts/release-preflight.mts delete mode 100644 scripts/render-github-release-notes.d.mts rename scripts/{render-github-release-notes.mjs => render-github-release-notes.mts} (70%) delete mode 100644 scripts/report-test-temp-creations.d.mts create mode 100644 scripts/report-test-temp-creations.mts delete mode 100644 scripts/resolve-openclaw-package-candidate.d.mts create mode 100644 scripts/resolve-openclaw-package-candidate.mts delete mode 100644 scripts/resolve-upgrade-survivor-baselines.d.mts rename scripts/{resolve-upgrade-survivor-baselines.mjs => resolve-upgrade-survivor-baselines.mts} (73%) delete mode 100644 scripts/root-dependency-ownership-audit.d.mts rename scripts/{root-dependency-ownership-audit.mjs => root-dependency-ownership-audit.mts} (75%) delete mode 100644 scripts/run-additional-boundary-checks.d.mts rename scripts/{run-additional-boundary-checks.mjs => run-additional-boundary-checks.mts} (66%) delete mode 100644 scripts/run-android-gradle.d.mts rename scripts/{run-android-gradle.mjs => run-android-gradle.mts} (75%) rename scripts/{run-lint.mjs => run-lint.mts} (83%) delete mode 100644 scripts/run-node-watch-paths.d.mts rename scripts/{run-node-watch-paths.mjs => run-node-watch-paths.mts} (79%) delete mode 100644 scripts/run-node.d.mts create mode 100644 scripts/run-node.mts delete mode 100644 scripts/run-oxlint-shards.d.mts rename scripts/{run-oxlint-shards.mjs => run-oxlint-shards.mts} (79%) delete mode 100644 scripts/run-oxlint.d.mts create mode 100644 scripts/run-oxlint.mts create mode 100644 scripts/run-tsgo.mts delete mode 100644 scripts/run-vitest-profile.d.mts rename scripts/{run-vitest-profile.mjs => run-vitest-profile.mts} (69%) delete mode 100644 scripts/run-vitest.d.mts create mode 100644 scripts/run-vitest.mts delete mode 100644 scripts/run-with-env.d.mts rename scripts/{run-with-env.mjs => run-with-env.mts} (78%) delete mode 100644 scripts/runtime-postbuild-stamp.d.mts rename scripts/{runtime-postbuild-stamp.mjs => runtime-postbuild-stamp.mts} (90%) delete mode 100644 scripts/runtime-postbuild.d.mts create mode 100644 scripts/runtime-postbuild.mts delete mode 100644 scripts/stage-bundled-plugin-runtime.d.mts create mode 100644 scripts/stage-bundled-plugin-runtime.mts delete mode 100644 scripts/sync-native-a2ui.d.mts rename scripts/{sync-native-a2ui.mjs => sync-native-a2ui.mts} (82%) rename scripts/{sync-plugin-sdk-exports.mjs => sync-plugin-sdk-exports.mts} (88%) rename scripts/{test-built-bundled-channel-entry-smoke.mjs => test-built-bundled-channel-entry-smoke.mts} (79%) rename scripts/{test-built-plugin-singleton.mjs => test-built-plugin-singleton.mts} (95%) delete mode 100644 scripts/test-built-status-message-runtime.d.mts rename scripts/{test-built-status-message-runtime.mjs => test-built-status-message-runtime.mts} (85%) rename scripts/{test-cli-startup-bench-budget.mjs => test-cli-startup-bench-budget.mts} (65%) delete mode 100644 scripts/test-docker-all.d.mts create mode 100644 scripts/test-docker-all.mts delete mode 100644 scripts/test-extension-batch.d.mts rename scripts/{test-extension-batch.mjs => test-extension-batch.mts} (78%) rename scripts/{test-extension.mjs => test-extension.mts} (82%) delete mode 100644 scripts/test-group-report.d.mts rename scripts/{test-group-report.mjs => test-group-report.mts} (75%) rename scripts/{test-hotspots.mjs => test-hotspots.mts} (81%) delete mode 100644 scripts/test-live-shard.d.mts create mode 100644 scripts/test-live-shard.mts delete mode 100644 scripts/test-live.d.mts rename scripts/{test-live.mjs => test-live.mts} (88%) delete mode 100644 scripts/test-perf-budget.d.mts rename scripts/{test-perf-budget.mjs => test-perf-budget.mts} (69%) rename scripts/{test-projects-imports.mjs => test-projects-imports.mts} (83%) rename scripts/{test-projects-max.mjs => test-projects-max.mts} (78%) rename scripts/{test-projects-serial.mjs => test-projects-serial.mts} (81%) rename scripts/{test-projects.mjs => test-projects.mts} (83%) delete mode 100644 scripts/test-projects.test-support.d.mts rename scripts/{test-projects.test-support.mjs => test-projects.test-support.mts} (88%) delete mode 100644 scripts/test-report-utils.d.mts rename scripts/{test-report-utils.mjs => test-report-utils.mts} (66%) rename scripts/{test-unit-fast-audit.mjs => test-unit-fast-audit.mts} (90%) rename scripts/{test-update-cli-startup-bench.mjs => test-update-cli-startup-bench.mts} (90%) rename scripts/{test-voicecall-closedloop.mjs => test-voicecall-closedloop.mts} (100%) delete mode 100644 scripts/testbox-lease-freshness.d.mts rename scripts/{testbox-lease-freshness.mjs => testbox-lease-freshness.mts} (78%) delete mode 100644 scripts/transitive-manifest-risk-report.d.mts rename scripts/{transitive-manifest-risk-report.mjs => transitive-manifest-risk-report.mts} (71%) delete mode 100644 scripts/tsdown-build.d.mts rename scripts/{tsdown-build.mjs => tsdown-build.mts} (76%) create mode 100644 scripts/ui.mts delete mode 100644 scripts/validate-full-release-validation-evidence.d.mts delete mode 100644 scripts/validate-qa-runtime-pair-summary.d.mts rename scripts/{validate-qa-runtime-pair-summary.mjs => validate-qa-runtime-pair-summary.mts} (77%) delete mode 100644 scripts/verify-clawhub-published-artifact.d.mts delete mode 100644 scripts/verify-docker-attestations.d.mts delete mode 100644 scripts/verify-plugin-npm-published-runtime.d.mts rename scripts/{verify-plugin-npm-published-runtime.mjs => verify-plugin-npm-published-runtime.mts} (77%) delete mode 100644 scripts/verify-pr-hosted-gates.d.mts create mode 100644 scripts/verify-pr-hosted-gates.mts rename scripts/{verify.mjs => verify.mts} (80%) delete mode 100644 scripts/vitest-process-group.d.mts rename scripts/{vitest-process-group.mjs => vitest-process-group.mts} (65%) delete mode 100644 scripts/watch-node.d.mts create mode 100644 scripts/watch-node.mts delete mode 100644 scripts/watch-pr-ci.d.mts create mode 100644 scripts/watch-pr-ci.mts delete mode 100644 scripts/windows-cmd-helpers.d.mts delete mode 100644 scripts/write-official-channel-catalog.d.mts create mode 100644 scripts/write-official-channel-catalog.mts delete mode 100644 src/infra/scripts-modules.d.ts delete mode 100644 test/scripts/check-script-declarations.test.ts diff --git a/.agents/skills/openclaw-changelog-update/SKILL.md b/.agents/skills/openclaw-changelog-update/SKILL.md index c5e9b56b26be..e788c9852853 100644 --- a/.agents/skills/openclaw-changelog-update/SKILL.md +++ b/.agents/skills/openclaw-changelog-update/SKILL.md @@ -50,7 +50,7 @@ every human `Thanks @...` attribution. writing grouped prose: ```bash - node .agents/skills/openclaw-changelog-update/scripts/verify-release-notes.mjs \ + node --import tsx .agents/skills/openclaw-changelog-update/scripts/verify-release-notes.mjs \ --base \ --target \ --main-ref origin/main \ @@ -200,7 +200,7 @@ every human `Thanks @...` attribution. - after the manifest-driven rewrite, regenerate and verify the complete contribution record before committing: ```bash - node .agents/skills/openclaw-changelog-update/scripts/verify-release-notes.mjs \ + node --import tsx .agents/skills/openclaw-changelog-update/scripts/verify-release-notes.mjs \ --base \ --target \ --main-ref origin/main \ @@ -228,7 +228,7 @@ every human `Thanks @...` attribution. - after the GitHub release or prerelease is published, verify every matching release page against the same source section: ```bash - node .agents/skills/openclaw-changelog-update/scripts/verify-release-notes.mjs \ + node --import tsx .agents/skills/openclaw-changelog-update/scripts/verify-release-notes.mjs \ --base \ --target \ --version \ @@ -238,7 +238,7 @@ every human `Thanks @...` attribution. - add one `--release-tag` for every beta and stable page in the train; a `### Release verification` tail is permitted, but any other body drift fails the check -- `scripts/render-github-release-notes.mjs` is the canonical release-body +- `scripts/render-github-release-notes.mts` is the canonical release-body renderer used by candidate validation, publish, and verification. When the complete `## YYYY.M.PATCH` section fits GitHub's 125,000-character limit and the renderer's matching 125,000-byte safety ceiling, the body must contain diff --git a/.agents/skills/openclaw-changelog-update/scripts/verify-release-notes.mjs b/.agents/skills/openclaw-changelog-update/scripts/verify-release-notes.mjs index 7a7a37c6d3c9..c71ed0a6027a 100644 --- a/.agents/skills/openclaw-changelog-update/scripts/verify-release-notes.mjs +++ b/.agents/skills/openclaw-changelog-update/scripts/verify-release-notes.mjs @@ -1,4 +1,4 @@ -#!/usr/bin/env node +#!/usr/bin/env -S node --import tsx import { execFileSync, spawnSync } from "node:child_process"; import { @@ -20,7 +20,7 @@ import { parseShippedBaselineExclusions, releaseNotesVersionForTag, verifyGithubReleaseNotes, -} from "../../../../scripts/render-github-release-notes.mjs"; +} from "../../../../scripts/render-github-release-notes.mts"; const repo = "openclaw/openclaw"; const githubSnapshotSchemaVersion = 1; @@ -78,7 +78,7 @@ function fail(message) { function printUsage() { console.log(`Usage: - node .agents/skills/openclaw-changelog-update/scripts/verify-release-notes.mjs \\ + node --import tsx .agents/skills/openclaw-changelog-update/scripts/verify-release-notes.mjs \\ --base --target --version [options] Required: diff --git a/.agents/skills/openclaw-ci-limits/SKILL.md b/.agents/skills/openclaw-ci-limits/SKILL.md index bbb61e21b549..f6027b4d744c 100644 --- a/.agents/skills/openclaw-ci-limits/SKILL.md +++ b/.agents/skills/openclaw-ci-limits/SKILL.md @@ -184,7 +184,7 @@ For workflow-only or docs/skill-only changes in a Codex worktree: ```bash node scripts/run-vitest.mjs test/scripts/ci-workflow-guards.test.ts -node scripts/check-workflows.mjs +node --import tsx scripts/check-workflows.mts node scripts/docs-list.js ./node_modules/.bin/oxfmt --check .github/workflows/ci.yml .github/workflows/codeql-critical-quality.yml docs/ci.md test/scripts/ci-workflow-guards.test.ts .agents/skills/openclaw-ci-limits/SKILL.md .agents/skills/openclaw-ci-limits/agents/openai.yaml git diff --check diff --git a/.agents/skills/openclaw-live-updater/SKILL.md b/.agents/skills/openclaw-live-updater/SKILL.md index 529b5eeb5778..1ff01276ded5 100644 --- a/.agents/skills/openclaw-live-updater/SKILL.md +++ b/.agents/skills/openclaw-live-updater/SKILL.md @@ -20,7 +20,7 @@ Keep `/Users/steipete/openclaw` a read-only-to-the-agent deployment mirror: clea 1. Run the deterministic updater and retain its JSON: ```bash - node .agents/skills/openclaw-live-updater/scripts/update-main.mjs + node --import tsx .agents/skills/openclaw-live-updater/scripts/update-main.mjs ``` Stop on any failed invariant. Do not repair the mirror destructively. The helper holds one checkout-scoped lock across update, build, Gateway proof, and Mac work. A concurrent heartbeat returns `reason: "overlap"`; it must not start another build. A dead owner lock may be recovered, but unreadable or unsafe lock state fails closed. diff --git a/.agents/skills/openclaw-live-updater/scripts/update-main.mjs b/.agents/skills/openclaw-live-updater/scripts/update-main.mjs index 53b5b963a024..37b8dd2db076 100644 --- a/.agents/skills/openclaw-live-updater/scripts/update-main.mjs +++ b/.agents/skills/openclaw-live-updater/scripts/update-main.mjs @@ -24,16 +24,16 @@ import { isDirectRunUrl } from "../../../../scripts/lib/direct-run.mjs"; import { BUILD_STAMP_FILE, RUNTIME_POSTBUILD_STAMP_FILE, -} from "../../../../scripts/lib/local-build-metadata.mjs"; -import { runManagedCommand } from "../../../../scripts/lib/managed-child-process.mjs"; +} from "../../../../scripts/lib/local-build-metadata.mts"; +import { runManagedCommand } from "../../../../scripts/lib/managed-child-process.mts"; import { runNodeConfigFiles, runNodeSourceRoots, -} from "../../../../scripts/run-node-watch-paths.mjs"; +} from "../../../../scripts/run-node-watch-paths.mts"; import { resolveBuildRequirement, resolveRuntimePostBuildRequirement, -} from "../../../../scripts/run-node.mjs"; +} from "../../../../scripts/run-node.mts"; const DEFAULT_CHECKOUT = "/Users/steipete/openclaw"; const DEFAULT_EXPECTED_ORIGIN = "openclaw/openclaw"; @@ -90,6 +90,68 @@ exec "$@" const DEPENDENCY_INPUT_RE = /^(?:\.npmrc$|package\.json$|pnpm-lock\.yaml$|pnpm-workspace\.yaml$|patches\/)|(?:^|\/)package\.json$/u; +/** + * @typedef {object} GatewayDeploymentRef + * @property {string} entrypoint + */ + +/** + * The fields required when the updater invokes the managed Gateway CLI. + * LaunchAgent inspection returns a richer object, while focused probes may + * provide only this execution view. + * + * @typedef {object} GatewayCliDeploymentBase + * @property {string} configPath + * @property {string} entrypoint + * @property {string} executable + * @property {string[]} invocationPrefix + * @property {number} port + * @property {Record} [serviceEnvironment] + * @property {string | null} [workingDirectory] + */ + +/** + * @typedef {GatewayCliDeploymentBase & { + * envFilePath?: null, + * runtime?: string, + * wrapperPath?: null, + * }} DirectGatewayCliDeployment + */ + +/** + * @typedef {GatewayCliDeploymentBase & { + * envFilePath: string, + * runtime: string, + * wrapperPath: string, + * }} WrappedGatewayCliDeployment + */ + +/** @typedef {DirectGatewayCliDeployment | WrappedGatewayCliDeployment} GatewayCliDeployment */ + +/** + * The stable identity fields used to verify a LaunchAgent retarget. + * Repointing deliberately does not require the execution-only fields above. + * + * @typedef {object} GatewayRepointDeployment + * @property {string} configPath + * @property {string} entrypoint + * @property {string} label + * @property {number} port + */ + +/** + * The updater's established test/API result keeps owner details extensible, + * while naming the fields every completed maintenance run exposes. + * + * @typedef {Record & { + * actions: Record, + * buildBefore: Record, + * changedPaths?: string[], + * macTarget?: Record, + * release?: () => void, + * }} UpdateResult + */ + class UpdateInvariantError extends Error { constructor(code, message, details, options) { super(message, options); @@ -115,7 +177,11 @@ class UpdateCommandError extends Error { } } -/** Re-throw the original runtime value while exposing the Error contract to type-aware lint. */ +/** + * Re-throw the original runtime value while exposing the Error contract to type-aware lint. + * + * @returns {never} + */ function throwPreservingValue(value) { throw /** @type {Error} */ (value); } @@ -1377,6 +1443,13 @@ function inspectManagedGatewayDeployment(checkout) { return readManagedGatewayLaunchAgent(checkout); } +/** + * @param {string} checkout + * @param {GatewayRepointDeployment} deployment + * @param {(deployment: GatewayRepointDeployment, replacement: string) => void} replaceEntrypoint + * @param {(checkout: string) => GatewayRepointDeployment | null} [inspectDeployment] + * @returns {GatewayRepointDeployment & { changed: boolean, previousEntrypoint?: string }} + */ export function repointManagedGatewayDeployment( checkout, deployment, @@ -1631,6 +1704,13 @@ export function parseLaunchctlArguments(output) { : []; } +/** + * @param {string} checkout + * @param {string[]} args + * @param {GatewayCliDeployment | null | undefined} deployment + * @param {{ stderr?: "inherit" | "pipe", timeoutMs?: number }} [options] + * @returns {string} + */ export function runBuiltGatewayCli(checkout, args, deployment, options = {}) { const observedDeployment = deployment ?? readManagedGatewayLaunchAgent(checkout); const sourceEntrypoint = path.join(checkout, "dist/index.js"); @@ -1738,6 +1818,13 @@ export function runBuiltGatewayCli(checkout, args, deployment, options = {}) { } } +/** + * @param {string} checkout + * @param {string} method + * @param {Record} params + * @param {GatewayCliDeployment | null | undefined} deployment + * @returns {string} + */ export function runBuiltGatewayCall(checkout, method, params, deployment) { const managedDeployment = deployment ?? readManagedGatewayLaunchAgent(checkout); return runBuiltGatewayCli( @@ -1756,6 +1843,11 @@ export function runBuiltGatewayCall(checkout, method, params, deployment) { ); } +/** + * @param {string} checkout + * @param {(checkout: string, method: string, params: { requestId: string }, deployment: GatewayDeploymentRef | null) => string} [callGateway] + * @param {GatewayDeploymentRef | null} [deployment] + */ export function prepareGatewaySuspension( checkout, callGateway = runBuiltGatewayCall, @@ -2629,6 +2721,23 @@ function defaultSleep(ms) { return delay(ms); } +/** + * @param {(command: string, args: string[], checkout: string, options?: Record) => unknown | Promise} runCommand + * @param {string} checkout + * @param {string} expectedSha + * @param {(ms: number) => void | Promise} [sleep] + * @param {GatewayCliDeployment | null} [deployment] + * @param {{ + * now?: () => number, + * probeMilestones?: (deployment: GatewayCliDeployment) => { + * listenerReady: boolean, + * healthzReady: boolean, + * readyzReady: boolean, + * }, + * timing?: Record, + * }} [options] + * @returns {Promise>} + */ export async function verifyGatewayReadiness( runCommand, checkout, @@ -2825,6 +2934,12 @@ function summarizeGatewayLogAudit(entries) { }; } +/** + * @param {string} output + * @param {number} sinceMs + * @param {string | null} [sourceRoot] + * @param {string[] | null} [managedSourceRoots] + */ export function parseGatewayLogAudit(output, sinceMs, sourceRoot = null, managedSourceRoots = []) { const entries = parseGatewayLogEntries(output, sinceMs).filter((entry) => isCurrentGatewayLogSource(entry.source, sourceRoot, managedSourceRoots), @@ -2888,6 +3003,10 @@ export function resolveManagedPluginSourceRoots(report) { return roots; } +/** + * @param {string} checkout + * @param {GatewayDeploymentRef | null | undefined} deployment + */ export function resolveManagedGatewaySourceRoot(checkout, deployment) { return typeof deployment?.entrypoint === "string" && deployment.entrypoint.length > 0 ? path.dirname(path.resolve(deployment.entrypoint)) @@ -3026,6 +3145,12 @@ async function defaultVerifyMacTarget(checkout) { return target; } +/** + * @overload + * @param {Record} options + * @param {Record} [dependencies] + * @returns {Promise} + */ export async function maintainMain(options, dependencies = {}) { const lock = acquireMaintenanceLock(options.checkout, options.lockPath); if (!lock.acquired) { diff --git a/.agents/skills/openclaw-test-heap-leaks/SKILL.md b/.agents/skills/openclaw-test-heap-leaks/SKILL.md index b9cceb42c603..e2935b338fed 100644 --- a/.agents/skills/openclaw-test-heap-leaks/SKILL.md +++ b/.agents/skills/openclaw-test-heap-leaks/SKILL.md @@ -24,7 +24,7 @@ For **runtime fixes** (e.g., closure leaks in long-running services like the gat ``` - For a suspected file, rerun that file with one worker and collect wall/RSS evidence: `/usr/bin/time -l pnpm test --maxWorkers=1 --reporter=verbose`. - - Current `pnpm test` execution is planned by `scripts/test-projects.mjs`. Record the printed Vitest config or shard and preserve that shape when the report is configuration- or worker-budget-specific. + - Current `pnpm test` execution is planned by `scripts/test-projects.mts`. Record the printed Vitest config or shard and preserve that shape when the report is configuration- or worker-budget-specific. 2. Collect the strongest available heap evidence. - Run `pnpm test:perf:profile:runner -- --output-dir .artifacts/test-perf/vitest-runner-profile -- ` for a CPU profile plus a sampling heap profile of the unit runner. Open the heap profile in DevTools and inspect the largest allocation families. @@ -53,7 +53,7 @@ For **runtime fixes** (e.g., closure leaks in long-running services like the gat ## Heuristics - Do not call everything a leak. Growth in a non-isolated shared Vitest project can be a worker-lifetime problem rather than an application object leak. -- `scripts/test-projects.mjs`, `scripts/test-group-report.mjs`, and `scripts/run-vitest-profile.mjs` are the current execution, grouped-RSS, and profile entrypoints. +- `scripts/test-projects.mts`, `scripts/test-group-report.mts`, and `scripts/run-vitest-profile.mts` are the current execution, grouped-RSS, and profile entrypoints. - The `[test] starting ...` lines identify the Vitest config or shard to reproduce. - `.artifacts/vitest-shard-timings.json` stores config/shard durations for scheduling. It is not a file-level memory-hotspot or behavior manifest. - When the same retained object families grow across multiple intervals in the same worker PID, trust the snapshots over intuition, then confirm ambiguous calls with retainer evidence. diff --git a/.agents/skills/release-openclaw-maintainer/SKILL.md b/.agents/skills/release-openclaw-maintainer/SKILL.md index e8478c95ec54..1202796a87a4 100644 --- a/.agents/skills/release-openclaw-maintainer/SKILL.md +++ b/.agents/skills/release-openclaw-maintainer/SKILL.md @@ -480,7 +480,7 @@ HEAD/worktree-bound manifest under git metadata for cutover review. credit from that PR's record on the same bullet. - Changelog entries should be user-facing, not internal release-process notes. - GitHub release and prerelease bodies use - `scripts/render-github-release-notes.mjs`. When the full matching + `scripts/render-github-release-notes.mts`. When the full matching `CHANGELOG.md` version section fits GitHub's 125,000-character limit and the renderer's matching 125,000-byte safety ceiling, publish the exact `## YYYY.M.PATCH` block through the line before the next level-2 heading, diff --git a/.github/actions/setup-node-env/action.yml b/.github/actions/setup-node-env/action.yml index f1a203b8118a..6fbc44fbec79 100644 --- a/.github/actions/setup-node-env/action.yml +++ b/.github/actions/setup-node-env/action.yml @@ -482,7 +482,7 @@ runs: path: .artifacts/build-all-cache # Exact keys deduplicate concurrent jobs. Coarse restore supplies the # newest declaration groups; build-all rehashes every group's inputs. - key: ${{ github.repository }}-build-all-v1-${{ inputs.build-all-cache-scope }}-${{ runner.os }}-${{ runner.arch }}-node-${{ inputs.node-version }}-${{ hashFiles('package.json', 'pnpm-lock.yaml', 'tsconfig*.json', 'tsdown*.config.ts', 'scripts/build-all.mjs', 'scripts/tsdown-build.mjs', 'scripts/lib/tsdown-*.mjs', 'scripts/lib/plugin-sdk-*', 'scripts/lib/bundled-plugin-*', 'scripts/lib/optional-bundled-clusters.mjs', 'src/**', 'packages/**', 'extensions/**') }} + key: ${{ github.repository }}-build-all-v1-${{ inputs.build-all-cache-scope }}-${{ runner.os }}-${{ runner.arch }}-node-${{ inputs.node-version }}-${{ hashFiles('package.json', 'pnpm-lock.yaml', 'tsconfig*.json', 'tsdown*.config.ts', 'scripts/build-all.mts', 'scripts/tsdown-build.mts', 'scripts/lib/tsdown-*.mts', 'scripts/lib/plugin-sdk-*', 'scripts/lib/bundled-plugin-*', 'scripts/lib/optional-bundled-clusters.mjs', 'src/**', 'packages/**', 'extensions/**') }} restore-keys: | ${{ github.repository }}-build-all-v1-${{ inputs.build-all-cache-scope }}-${{ runner.os }}-${{ runner.arch }}-node-${{ inputs.node-version }}- diff --git a/.github/codex/prompts/mantis-telegram-desktop-proof.md b/.github/codex/prompts/mantis-telegram-desktop-proof.md index b26ba6037cf7..d36b0b63d39a 100644 --- a/.github/codex/prompts/mantis-telegram-desktop-proof.md +++ b/.github/codex/prompts/mantis-telegram-desktop-proof.md @@ -156,7 +156,7 @@ than Telegram-visible behavior`. Use this manifest shape and do not create `--sut-lane`/`--sut-repo-root` during `start`. ```bash - node scripts/mantis/build-telegram-desktop-proof-evidence.mjs \ + node --import tsx scripts/mantis/build-telegram-desktop-proof-evidence.mts \ --output-dir "$MANTIS_OUTPUT_DIR" \ --baseline-repo-root "$GITHUB_WORKSPACE" \ --baseline-output-dir \ diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index efdc1205329c..ddae6453cc88 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -59,6 +59,7 @@ concurrency: env: FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" + NODE_VERSION: "24.x" jobs: # Preflight: establish routing truth and job matrices once, then let real @@ -379,6 +380,19 @@ jobs: node scripts/ci-changed-scope.mjs --base "$BASE" --head "$HEAD_SHA" fi + - name: Setup manifest TypeScript runtime + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + with: + node-version: ${{ env.NODE_VERSION }} + + - name: Setup manifest pnpm + uses: ./.github/actions/setup-pnpm-store-cache + with: + node-version: ${{ env.NODE_VERSION }} + + - name: Install manifest dependencies + run: pnpm install --frozen-lockfile --prefer-offline --ignore-scripts + - name: Build CI manifest id: manifest env: @@ -404,7 +418,7 @@ jobs: OPENCLAW_CI_REPOSITORY: ${{ github.repository }} OPENCLAW_CI_EVENT_NAME: ${{ github.event_name }} run: | - node --input-type=module <<'EOF' + node --import tsx --input-type=module <<'EOF' import { appendFileSync, existsSync, readFileSync } from "node:fs"; const eventName = process.env.OPENCLAW_CI_EVENT_NAME ?? ""; @@ -423,7 +437,10 @@ jobs: const frozenTarget = eventName === "workflow_dispatch" && checkoutRevision !== workflowRevision; - const nodeTestPlan = await import("./scripts/lib/ci-node-test-plan.mjs"); + const nodeTestPlanPath = existsSync("./scripts/lib/ci-node-test-plan.mts") + ? "./scripts/lib/ci-node-test-plan.mts" + : "./scripts/lib/ci-node-test-plan.mjs"; + const nodeTestPlan = await import(nodeTestPlanPath); const createNodeTestPlan = typeof nodeTestPlan.createNodeTestShardBundles === "function" ? nodeTestPlan.createNodeTestShardBundles @@ -435,9 +452,14 @@ jobs: } let changedNodeTestPlan = {}; - if (existsSync("./scripts/lib/ci-changed-node-test-plan.mjs")) { + const changedNodeTestPlanPath = existsSync( + "./scripts/lib/ci-changed-node-test-plan.mts", + ) + ? "./scripts/lib/ci-changed-node-test-plan.mts" + : "./scripts/lib/ci-changed-node-test-plan.mjs"; + if (existsSync(changedNodeTestPlanPath)) { try { - changedNodeTestPlan = await import("./scripts/lib/ci-changed-node-test-plan.mjs"); + changedNodeTestPlan = await import(changedNodeTestPlanPath); } catch (error) { console.warn(`Changed Node test planner import failed; using compact full suite: ${error}`); } @@ -453,7 +475,9 @@ jobs: return {}; }; const channelContractPlan = await importTargetPlan( - "./scripts/lib/channel-contract-test-plan.mjs", + existsSync("./scripts/lib/channel-contract-test-plan.mts") + ? "./scripts/lib/channel-contract-test-plan.mts" + : "./scripts/lib/channel-contract-test-plan.mjs", ); const createChannelContractTestShards = typeof channelContractPlan.createChannelContractTestShards === "function" @@ -469,7 +493,9 @@ jobs: }; const pluginContractPlan = await importTargetPlan( - "./scripts/lib/plugin-contract-test-plan.mjs", + existsSync("./scripts/lib/plugin-contract-test-plan.mts") + ? "./scripts/lib/plugin-contract-test-plan.mts" + : "./scripts/lib/plugin-contract-test-plan.mjs", ); const createPluginContractTestShards = typeof pluginContractPlan.createPluginContractTestShards === "function" @@ -1124,7 +1150,7 @@ jobs: uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 with: path: .artifacts/build-all-cache - key: ${{ runner.os }}-build-all-v4-${{ hashFiles('package.json', 'pnpm-lock.yaml', 'scripts/build-all.mjs', 'scripts/runtime-postbuild.mjs', 'scripts/write-plugin-sdk-entry-dts.ts', 'scripts/lib/plugin-sdk-entries.mjs', 'scripts/lib/plugin-sdk-entrypoints.json', 'scripts/lib/plugin-sdk-private-local-only-subpaths.json', 'scripts/lib/plugin-sdk-deprecated-public-subpaths.json', 'scripts/lib/plugin-sdk-deprecated-barrel-subpaths.json', 'tsconfig.json', 'tsconfig.plugin-sdk.dts.json', 'src/**', 'packages/**', '!src/**/dist/**', '!src/**/node_modules/**', '!packages/**/dist/**', '!packages/**/node_modules/**') }} + key: ${{ runner.os }}-build-all-v4-${{ hashFiles('package.json', 'pnpm-lock.yaml', 'scripts/build-all.mts', 'scripts/runtime-postbuild.mjs', 'scripts/runtime-postbuild.mts', 'scripts/lib/tsx-cli-shim.mjs', 'scripts/write-plugin-sdk-entry-dts.ts', 'scripts/lib/plugin-sdk-entries.mts', 'scripts/lib/plugin-sdk-entrypoints.json', 'scripts/lib/plugin-sdk-private-local-only-subpaths.json', 'scripts/lib/plugin-sdk-deprecated-public-subpaths.json', 'scripts/lib/plugin-sdk-deprecated-barrel-subpaths.json', 'tsconfig.json', 'tsconfig.plugin-sdk.dts.json', 'src/**', 'packages/**', '!src/**/dist/**', '!src/**/node_modules/**', '!packages/**/dist/**', '!packages/**/node_modules/**') }} restore-keys: | ${{ runner.os }}-build-all-v4- @@ -1305,7 +1331,7 @@ jobs: if [ "$RUN_GATEWAY_WATCH" = "true" ] && [ "$PARALLEL_GATEWAY_WATCH" = "true" ]; then start_check "gateway-watch" \ - node scripts/check-gateway-watch-regression.mjs --skip-build + node --import tsx scripts/check-gateway-watch-regression.mts --skip-build fi wait_checks @@ -1314,7 +1340,7 @@ jobs: # starve the Gateway readiness deadline used by this regression gate. if [ "$RUN_GATEWAY_WATCH" = "true" ] && [ "$PARALLEL_GATEWAY_WATCH" != "true" ]; then start_check "gateway-watch" \ - node scripts/check-gateway-watch-regression.mjs --skip-build + node --import tsx scripts/check-gateway-watch-regression.mts --skip-build wait_checks fi @@ -1441,7 +1467,7 @@ jobs: # Install the managed browser revision pinned by the selected target instead. pnpm --dir ui exec playwright install chromium else - node scripts/ensure-playwright-chromium.mjs + node --import tsx scripts/ensure-playwright-chromium.mts fi - name: Lint Control UI window.open usage @@ -1491,7 +1517,7 @@ jobs: use-actions-cache: ${{ (github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.run_attempt > 1)) && 'true' || (github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'false' || 'true') }} - name: Install Playwright Chromium - run: node scripts/ensure-playwright-chromium.mjs + run: node --import tsx scripts/ensure-playwright-chromium.mts - name: Test Control UI end-to-end run: >- @@ -1731,18 +1757,18 @@ jobs: run: | # Pack the public runtime before overlaying private QA artifacts so they cannot leak. unset OPENCLAW_BUILD_PRIVATE_QA - node scripts/build-all.mjs qaRuntime + node --import tsx scripts/build-all.mts qaRuntime pnpm ui:build package_args=( --skip-build --output-dir .artifacts/qa-e2e/smoke-ci-package --output-name openclaw-current.tgz ) - if grep -Fq -- '--allow-unreleased-changelog' scripts/package-openclaw-for-docker.mjs; then + if grep -Fq -- '--allow-unreleased-changelog' scripts/package-openclaw-for-docker.mts; then package_args=(--allow-unreleased-changelog "${package_args[@]}") fi node scripts/package-openclaw-for-docker.mjs "${package_args[@]}" - OPENCLAW_BUILD_PRIVATE_QA=1 node scripts/build-all.mjs qaRuntime + OPENCLAW_BUILD_PRIVATE_QA=1 node --import tsx scripts/build-all.mts qaRuntime - name: Run smoke profile part env: @@ -2061,13 +2087,13 @@ jobs: # Frozen release targets can predate the workflow-owned shard runner. # Keep its implementation pinned to this workflow revision, while tests # continue to run against the checked-out candidate. - if: ${{ hashFiles('scripts/ci-run-node-test-shard.mjs') == '' }} + if: ${{ hashFiles('scripts/ci-run-node-test-shard.mts') == '' }} uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: ref: ${{ github.workflow_sha }} path: .ci-workflow sparse-checkout: | - scripts/ci-run-node-test-shard.mjs + scripts/ci-run-node-test-shard.mts scripts/lib/direct-run.mjs scripts/lib/local-heavy-check-runtime.mjs sparse-checkout-cone-mode: false @@ -2092,12 +2118,12 @@ jobs: shell: bash run: | set -euo pipefail - runner="scripts/ci-run-node-test-shard.mjs" + runner="scripts/ci-run-node-test-shard.mts" if [[ ! -f "$runner" ]]; then runner=".ci-workflow/${runner}" [[ -f "$runner" ]] fi - node "$runner" + node --import tsx "$runner" # Types, lint, and format check shards. check-shard: @@ -2175,7 +2201,7 @@ jobs: env: # Config/toolchain inputs the tree-OID gate below cannot see; must # stay identical to the boundary lane's fingerprint composition. - BOUNDARY_CONFIG_HASH: ${{ hashFiles('tsconfig.json', 'tsconfig.plugin-sdk.dts.json', 'packages/plugin-sdk/tsconfig.json', 'scripts/check-extension-package-tsc-boundary.mjs', 'scripts/prepare-extension-package-boundary-artifacts.mjs', 'scripts/write-plugin-sdk-entry-dts.ts', 'scripts/lib/plugin-sdk-entrypoints.json', 'scripts/lib/plugin-sdk-entries.mjs', 'package.json', 'pnpm-lock.yaml') }} + BOUNDARY_CONFIG_HASH: ${{ hashFiles('tsconfig.json', 'tsconfig.plugin-sdk.dts.json', 'packages/plugin-sdk/tsconfig.json', 'scripts/check-extension-package-tsc-boundary.mts', 'scripts/prepare-extension-package-boundary-artifacts.mts', 'scripts/write-plugin-sdk-entry-dts.ts', 'scripts/lib/plugin-sdk-entrypoints.json', 'scripts/lib/plugin-sdk-entries.mts', 'package.json', 'pnpm-lock.yaml') }} run: | set -euo pipefail sticky_root=/var/tmp/openclaw-ext-boundary @@ -2218,14 +2244,6 @@ jobs: case "$TASK" in guards) pnpm check:no-conflict-markers - if has_package_script "check:script-declarations"; then - pnpm check:script-declarations - elif [[ "$HISTORICAL_TARGET" != "true" ]]; then - echo "Current CI targets must provide the check:script-declarations package script." >&2 - exit 1 - else - echo "[skip] historical target predates the script declaration contract" - fi if [[ "$HISTORICAL_TARGET" == "true" ]]; then echo "[skip] historical target skips the wall-clock doctor deprecation registry guard" elif has_package_script "check:doctor-deprecation-registry"; then @@ -2278,7 +2296,7 @@ jobs: pnpm lint "${lint_args[@]}" else echo "[skip] changed scope cannot affect control-UI i18n catalogs" - node scripts/run-oxlint-shards.mjs "${lint_args[@]}" + node --import tsx scripts/run-oxlint-shards.mts "${lint_args[@]}" fi if [ "$FORMAT_CHECK" = "true" ]; then pnpm format:check @@ -2451,7 +2469,7 @@ jobs: env: # Config/toolchain inputs the tree-OID gate below cannot see; must # stay identical to the seed step and check-lint's restore gate. - BOUNDARY_CONFIG_HASH: ${{ hashFiles('tsconfig.json', 'tsconfig.plugin-sdk.dts.json', 'packages/plugin-sdk/tsconfig.json', 'scripts/check-extension-package-tsc-boundary.mjs', 'scripts/prepare-extension-package-boundary-artifacts.mjs', 'scripts/write-plugin-sdk-entry-dts.ts', 'scripts/lib/plugin-sdk-entrypoints.json', 'scripts/lib/plugin-sdk-entries.mjs', 'package.json', 'pnpm-lock.yaml') }} + BOUNDARY_CONFIG_HASH: ${{ hashFiles('tsconfig.json', 'tsconfig.plugin-sdk.dts.json', 'packages/plugin-sdk/tsconfig.json', 'scripts/check-extension-package-tsc-boundary.mts', 'scripts/prepare-extension-package-boundary-artifacts.mts', 'scripts/write-plugin-sdk-entry-dts.ts', 'scripts/lib/plugin-sdk-entrypoints.json', 'scripts/lib/plugin-sdk-entries.mts', 'package.json', 'pnpm-lock.yaml') }} run: | set -euo pipefail sticky_root=/var/tmp/openclaw-ext-boundary @@ -2489,7 +2507,7 @@ jobs: packages/plugin-sdk/dist extensions/*/dist/.boundary-tsc.tsbuildinfo extensions/*/dist/.boundary-tsc.stamp - key: ${{ runner.os }}-extension-package-boundary-v1-${{ hashFiles('tsconfig.json', 'tsconfig.plugin-sdk.dts.json', 'packages/plugin-sdk/tsconfig.json', 'packages/llm-core/package.json', 'packages/model-catalog-core/package.json', 'scripts/check-extension-package-tsc-boundary.mjs', 'scripts/prepare-extension-package-boundary-artifacts.mjs', 'scripts/write-plugin-sdk-entry-dts.ts', 'scripts/lib/plugin-sdk-entrypoints.json', 'scripts/lib/plugin-sdk-entries.mjs', 'src/plugin-sdk/**', 'src/plugins/types.ts', 'src/auto-reply/**', 'packages/llm-core/src/**', 'packages/model-catalog-core/src/**', 'src/video-generation/dashscope-compatible.ts', 'src/video-generation/types.ts', 'src/types/**', 'extensions/**', 'extensions/tsconfig.package-boundary*.json', 'package.json', 'pnpm-lock.yaml') }} + key: ${{ runner.os }}-extension-package-boundary-v1-${{ hashFiles('tsconfig.json', 'tsconfig.plugin-sdk.dts.json', 'packages/plugin-sdk/tsconfig.json', 'packages/llm-core/package.json', 'packages/model-catalog-core/package.json', 'scripts/check-extension-package-tsc-boundary.mts', 'scripts/prepare-extension-package-boundary-artifacts.mts', 'scripts/write-plugin-sdk-entry-dts.ts', 'scripts/lib/plugin-sdk-entrypoints.json', 'scripts/lib/plugin-sdk-entries.mts', 'src/plugin-sdk/**', 'src/plugins/types.ts', 'src/auto-reply/**', 'packages/llm-core/src/**', 'packages/model-catalog-core/src/**', 'src/video-generation/dashscope-compatible.ts', 'src/video-generation/types.ts', 'src/types/**', 'extensions/**', 'extensions/tsconfig.package-boundary*.json', 'package.json', 'pnpm-lock.yaml') }} restore-keys: | ${{ runner.os }}-extension-package-boundary-v1- @@ -2522,11 +2540,11 @@ jobs: packages/plugin-sdk/tsconfig.json \ packages/llm-core/package.json \ packages/model-catalog-core/package.json \ - scripts/check-extension-package-tsc-boundary.mjs \ - scripts/prepare-extension-package-boundary-artifacts.mjs \ + scripts/check-extension-package-tsc-boundary.mts \ + scripts/prepare-extension-package-boundary-artifacts.mts \ scripts/write-plugin-sdk-entry-dts.ts \ scripts/lib/plugin-sdk-entrypoints.json \ - scripts/lib/plugin-sdk-entries.mjs \ + scripts/lib/plugin-sdk-entries.mts \ package.json \ pnpm-lock.yaml ) @@ -2567,7 +2585,7 @@ jobs: case "$ADDITIONAL_CHECK_GROUP" in boundaries) - node scripts/run-additional-boundary-checks.mjs + node --import tsx scripts/run-additional-boundary-checks.mts ;; prompt-snapshots) # No presence fallback: the boundary runner previously invoked @@ -2582,14 +2600,14 @@ jobs: fi ;; session-accessor-boundary) - if [ ! -f scripts/check-session-accessor-boundary.mjs ]; then + if [ ! -f scripts/check-session-accessor-boundary.mts ]; then echo "[skip] session accessor boundary check is not present in this checkout" elif ! node -e 'const pkg = require("./package.json"); process.exit(pkg.scripts?.["lint:tmp:session-accessor-boundary"] ? 0 : 1);'; then echo "[skip] session accessor boundary script is not present in package.json" else run_check "lint:tmp:session-accessor-boundary" pnpm run lint:tmp:session-accessor-boundary fi - if [ ! -f scripts/check-sqlite-transaction-boundary.mjs ]; then + if [ ! -f scripts/check-sqlite-transaction-boundary.mts ]; then echo "[skip] SQLite transaction boundary check is not present in this checkout" elif ! node -e 'const pkg = require("./package.json"); process.exit(pkg.scripts?.["lint:tmp:sqlite-transaction-boundary"] ? 0 : 1);'; then echo "[skip] SQLite transaction boundary script is not present in package.json" @@ -2598,7 +2616,7 @@ jobs: fi ;; session-transcript-reader-boundary) - if [ ! -f scripts/check-session-transcript-reader-boundary.mjs ]; then + if [ ! -f scripts/check-session-transcript-reader-boundary.mts ]; then echo "[skip] session transcript reader boundary check is not present in this checkout" elif ! node -e 'const pkg = require("./package.json"); process.exit(pkg.scripts?.["lint:tmp:session-transcript-reader-boundary"] ? 0 : 1);'; then echo "[skip] session transcript reader boundary script is not present in package.json" @@ -2649,7 +2667,7 @@ jobs: shell: bash env: # Must stay identical to the restore gates above. - BOUNDARY_CONFIG_HASH: ${{ hashFiles('tsconfig.json', 'tsconfig.plugin-sdk.dts.json', 'packages/plugin-sdk/tsconfig.json', 'scripts/check-extension-package-tsc-boundary.mjs', 'scripts/prepare-extension-package-boundary-artifacts.mjs', 'scripts/write-plugin-sdk-entry-dts.ts', 'scripts/lib/plugin-sdk-entrypoints.json', 'scripts/lib/plugin-sdk-entries.mjs', 'package.json', 'pnpm-lock.yaml') }} + BOUNDARY_CONFIG_HASH: ${{ hashFiles('tsconfig.json', 'tsconfig.plugin-sdk.dts.json', 'packages/plugin-sdk/tsconfig.json', 'scripts/check-extension-package-tsc-boundary.mts', 'scripts/prepare-extension-package-boundary-artifacts.mts', 'scripts/write-plugin-sdk-entry-dts.ts', 'scripts/lib/plugin-sdk-entrypoints.json', 'scripts/lib/plugin-sdk-entries.mts', 'package.json', 'pnpm-lock.yaml') }} run: | set -euo pipefail sticky_root=/var/tmp/openclaw-ext-boundary diff --git a/.github/workflows/dated-todo-sweep.yml b/.github/workflows/dated-todo-sweep.yml index 065bd46f2b35..511ad64f5685 100644 --- a/.github/workflows/dated-todo-sweep.yml +++ b/.github/workflows/dated-todo-sweep.yml @@ -44,7 +44,7 @@ jobs: install-bun: "false" - name: Collect dated TODO candidates - run: node scripts/dated-todo-scan.mjs + run: node --import tsx scripts/dated-todo-scan.mts - name: Capture sweep date id: sweep-date diff --git a/.github/workflows/docs-sync-publish.yml b/.github/workflows/docs-sync-publish.yml index 283df79bd493..0adf2c5aff7e 100644 --- a/.github/workflows/docs-sync-publish.yml +++ b/.github/workflows/docs-sync-publish.yml @@ -8,6 +8,10 @@ on: - docs/** - scripts/docs-list.js - scripts/docs-sync-publish.mjs + - scripts/check-docs-mdx.mjs + - scripts/check-docs-mdx.mts + - scripts/lib/mintlify-accordion.mjs + - scripts/lib/tsx-cli-shim.mjs - .github/workflows/docs-sync-publish.yml workflow_dispatch: @@ -84,7 +88,7 @@ jobs: - name: Install docs MDX checker dependency if: env.OPENCLAW_DOCS_SYNC_TOKEN != '' working-directory: publish - run: npm install --no-save --package-lock=false @mdx-js/mdx@3.1.1 + run: npm install --no-save --package-lock=false @mdx-js/mdx@3.1.1 tsx@4.23.1 - name: Check publish docs MDX if: env.OPENCLAW_DOCS_SYNC_TOKEN != '' diff --git a/.github/workflows/ios-periphery.yml b/.github/workflows/ios-periphery.yml index cd63a1bcb7b1..96f2774f2158 100644 --- a/.github/workflows/ios-periphery.yml +++ b/.github/workflows/ios-periphery.yml @@ -64,6 +64,7 @@ jobs: "scripts/format-swift.sh", "scripts/install-swift-tools.sh", "scripts/ios-write-swift-filelist.mjs", + "scripts/ios-write-swift-filelist.mts", "scripts/lint-swift.sh", ], { ignoreReturnCode: true, silent: true }); if (result.exitCode !== 0 && result.exitCode !== 1) { diff --git a/.github/workflows/mantis-telegram-live.yml b/.github/workflows/mantis-telegram-live.yml index 6ea1af97bc11..10cb06f81387 100644 --- a/.github/workflows/mantis-telegram-live.yml +++ b/.github/workflows/mantis-telegram-live.yml @@ -508,7 +508,7 @@ jobs: fi echo "telegram_exit=${telegram_exit}" >> "$GITHUB_OUTPUT" - node "${GITHUB_WORKSPACE}/scripts/mantis/build-telegram-evidence.mjs" \ + node --import tsx "${GITHUB_WORKSPACE}/scripts/mantis/build-telegram-evidence.mts" \ --output-dir "$root" \ --candidate-ref "$CANDIDATE_SHA" \ --candidate-sha "$CANDIDATE_SHA" \ diff --git a/.github/workflows/mantis-web-ui-chat-proof.yml b/.github/workflows/mantis-web-ui-chat-proof.yml index cb08a5dc1831..e5fd9508fdaf 100644 --- a/.github/workflows/mantis-web-ui-chat-proof.yml +++ b/.github/workflows/mantis-web-ui-chat-proof.yml @@ -297,7 +297,7 @@ jobs: "$candidate_repo/ui/src/test-helpers/control-ui-e2e.ts" cd "$candidate_repo" - node scripts/ensure-playwright-chromium.mjs + node --import tsx scripts/ensure-playwright-chromium.mts set +e OPENCLAW_MANTIS_WEB_UI_CHAT_OUTPUT_DIR="$root" \ diff --git a/.github/workflows/npm-telegram-beta-e2e.yml b/.github/workflows/npm-telegram-beta-e2e.yml index 67b68ea16070..6ae96bcac677 100644 --- a/.github/workflows/npm-telegram-beta-e2e.yml +++ b/.github/workflows/npm-telegram-beta-e2e.yml @@ -237,7 +237,7 @@ jobs: OPENCLAW_BUILD_PRIVATE_QA: "1" run: | set -euo pipefail - node scripts/build-all.mjs qaRuntime + node --import tsx scripts/build-all.mts qaRuntime test -f dist/plugin-sdk/qa-runtime.js test -f dist/extensions/qa-lab/runtime-api.js diff --git a/.github/workflows/openclaw-cross-os-release-checks-reusable.yml b/.github/workflows/openclaw-cross-os-release-checks-reusable.yml index f84f3c5b1df0..8705d788ba33 100644 --- a/.github/workflows/openclaw-cross-os-release-checks-reusable.yml +++ b/.github/workflows/openclaw-cross-os-release-checks-reusable.yml @@ -619,7 +619,7 @@ jobs: shell: bash run: | set -euo pipefail - node workflow/scripts/resolve-openclaw-package-candidate.mjs \ + pnpm --dir workflow exec node --import tsx scripts/resolve-openclaw-package-candidate.mts \ --source artifact \ --artifact-dir "$INPUT_DIR" \ --package-sha256 "$INPUT_CANDIDATE_SHA256" \ @@ -737,11 +737,11 @@ jobs: env: BASELINE_PACK_JSON: ${{ runner.temp }}/openclaw-cross-os-release-checks/prepare/baseline/pack.json run: | - node --input-type=module <<'NODE' >>"$GITHUB_OUTPUT" + node --import tsx --input-type=module <<'NODE' >>"$GITHUB_OUTPUT" import crypto from "node:crypto"; import fs from "node:fs"; import path from "node:path"; - import { resolveNpmJsonEntries } from "./scripts/lib/npm-json-output.mjs"; + import { resolveNpmJsonEntries } from "./scripts/lib/npm-json-output.mts"; function resolveTarballFileName(value, label) { const fileName = typeof value === "string" ? value.trim() : ""; if ( diff --git a/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml b/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml index 086f7673de60..ef0678503013 100644 --- a/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml +++ b/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml @@ -2296,7 +2296,7 @@ jobs: ) # Frozen targets that predate the opt-in flag still strict-pack against their versioned changelog. if [[ "$ALLOW_UNRELEASED_CHANGELOG" == "true" ]] && \ - grep -Fq -- '--allow-unreleased-changelog' scripts/package-openclaw-for-docker.mjs; then + grep -Fq -- '--allow-unreleased-changelog' scripts/package-openclaw-for-docker.mts; then package_args+=(--allow-unreleased-changelog) fi node scripts/package-openclaw-for-docker.mjs "${package_args[@]}" @@ -2341,12 +2341,12 @@ jobs: cp "${tgzs[0]}" "$target" fi echo "Validating Docker E2E package tarball: $target" - validator="scripts/check-openclaw-package-tarball.mjs" + validator=(node scripts/check-openclaw-package-tarball.mjs) if [[ -n "${EXPECTED_PACKAGE_FILE_NAME// }" ]]; then - validator=".release-harness/scripts/check-openclaw-package-tarball.mjs" + validator=(pnpm --dir .release-harness exec node scripts/check-openclaw-package-tarball.mjs) fi started_at="$(date +%s)" - timeout --foreground 5m node "$validator" "$target" + timeout --foreground 5m "${validator[@]}" "$GITHUB_WORKSPACE/$target" finished_at="$(date +%s)" echo "Docker E2E package tarball validation finished in $((finished_at - started_at))s." digest="$(sha256sum "$target" | awk '{print $1}')" diff --git a/.github/workflows/openclaw-npm-release.yml b/.github/workflows/openclaw-npm-release.yml index 45963e305dba..f0ef6a7d1550 100644 --- a/.github/workflows/openclaw-npm-release.yml +++ b/.github/workflows/openclaw-npm-release.yml @@ -358,7 +358,7 @@ jobs: for package_dir in "${package_dirs[@]}"; do runtime_args+=(--package "$package_dir") done - node scripts/check-plugin-npm-runtime-builds.mjs "${runtime_args[@]}" + node --import tsx scripts/check-plugin-npm-runtime-builds.mts "${runtime_args[@]}" for package_dir in "${package_dirs[@]}"; do OPENCLAW_PLUGIN_NPM_RUNTIME_BUILD=0 \ @@ -387,7 +387,7 @@ jobs: RELEASE_NPM_DIST_TAG: ${{ inputs.npm_dist_tag }} run: | set -euo pipefail - node scripts/generate-dependency-release-evidence.mjs \ + node --import tsx scripts/generate-dependency-release-evidence.mts \ --release-ref "$RELEASE_REF" \ --npm-dist-tag "$RELEASE_NPM_DIST_TAG" \ --output-dir "$RUNNER_TEMP/openclaw-release-dependency-evidence" \ diff --git a/.github/workflows/openclaw-performance.yml b/.github/workflows/openclaw-performance.yml index e80329e33ed2..b3d3ea169f03 100644 --- a/.github/workflows/openclaw-performance.yml +++ b/.github/workflows/openclaw-performance.yml @@ -393,14 +393,20 @@ jobs: shell: bash run: | set -euo pipefail - npm_wrapper="$PERFORMANCE_HELPER_DIR/scripts/ocm-npm-workspace-deps.mjs" + npm_wrapper="$PERFORMANCE_HELPER_DIR/scripts/ocm-npm-workspace-deps.mts" + npm_adapter="${RUNNER_TEMP}/openclaw-ocm-npm" workspace_dependency_dirs="" if [[ -f "${GITHUB_WORKSPACE}/packages/ai/package.json" ]]; then workspace_dependency_dirs="${GITHUB_WORKSPACE}/packages/ai" fi - chmod 0755 "$npm_wrapper" + cat > "$npm_adapter" <<'EOF' + #!/usr/bin/env bash + exec node --import tsx "$OPENCLAW_OCM_NPM_WRAPPER" "$@" + EOF + chmod 0755 "$npm_adapter" { - echo "OCM_INTERNAL_NPM_BIN=$npm_wrapper" + echo "OCM_INTERNAL_NPM_BIN=$npm_adapter" + echo "OPENCLAW_OCM_NPM_WRAPPER=$npm_wrapper" echo "OPENCLAW_OCM_REAL_NPM_BIN=$(command -v npm)" echo "OPENCLAW_OCM_WORKSPACE_DEPENDENCY_DIRS=$workspace_dependency_dirs" } >> "$GITHUB_ENV" @@ -529,7 +535,7 @@ jobs: echo "report_md=$report_md" >> "$GITHUB_OUTPUT" set +e - node "$PERFORMANCE_HELPER_DIR/scripts/lib/kova-workflow-evidence.mjs" \ + node --import tsx "$PERFORMANCE_HELPER_DIR/scripts/lib/kova-workflow-evidence.mts" \ --plan "$KOVA_PLAN_JSON" \ --report "$report_json" \ --profile "$PROFILE" \ @@ -547,7 +553,7 @@ jobs: if [[ "$KOVA_REF" == "$KOVA_CANONICAL_CONFIG_REF" || "$KOVA_REF" == "$KOVA_LEGACY_LIST_CONFIG_REF" ]]; then gate_args+=(--require-instrumented-performance-contract) fi - if node "$PERFORMANCE_HELPER_DIR/scripts/lib/kova-report-gate.mjs" "${gate_args[@]}" + if node --import tsx "$PERFORMANCE_HELPER_DIR/scripts/lib/kova-report-gate.mts" "${gate_args[@]}" then effective_status=0 { @@ -564,7 +570,7 @@ jobs: set -e summary_path="$SUMMARY_DIR/${LANE_ID}.md" - summary_args=(node "$PERFORMANCE_HELPER_DIR/scripts/kova-ci-summary.mjs" --report "$report_json" --output "$summary_path" --lane "$LANE_ID") + summary_args=(node --import tsx "$PERFORMANCE_HELPER_DIR/scripts/kova-ci-summary.mts" --report "$report_json" --output "$summary_path" --lane "$LANE_ID") set +e "${summary_args[@]}" summary_status=$? @@ -733,7 +739,7 @@ jobs: fi mkdir -p "$SOURCE_PERF_DIR/mock-hello" - if ! node -e "const fs=require('node:fs'); const scripts=require('./package.json').scripts||{}; process.exit(scripts['test:gateway:cpu-scenarios'] && scripts['test:extensions:memory'] && scripts.openclaw && fs.existsSync('openclaw.mjs') && fs.existsSync('scripts/profile-extension-memory.mjs') ? 0 : 1)"; then + if ! node -e "const fs=require('node:fs'); const scripts=require('./package.json').scripts||{}; process.exit(scripts['test:gateway:cpu-scenarios'] && scripts['test:extensions:memory'] && scripts.openclaw && fs.existsSync('openclaw.mjs') && fs.existsSync('scripts/profile-extension-memory.mts') ? 0 : 1)"; then cat > "$SOURCE_PERF_DIR/index.md" <> "$GITHUB_STEP_SUMMARY" exit 0 fi # target_ref may predate the dedicated profile; preserve the historical full build there. - if node -e "import('./scripts/build-all.mjs').then((module) => process.exit(module.BUILD_ALL_PROFILES?.sourcePerformance ? 0 : 1)).catch(() => process.exit(1))"; then - OPENCLAW_BUILD_PRIVATE_QA=1 node scripts/build-all.mjs sourcePerformance + if node --import tsx -e "import('./scripts/build-all.mts').then((module) => process.exit(module.BUILD_ALL_PROFILES?.sourcePerformance ? 0 : 1)).catch(() => process.exit(1))"; then + OPENCLAW_BUILD_PRIVATE_QA=1 node --import tsx scripts/build-all.mts sourcePerformance else pnpm build fi @@ -918,7 +924,7 @@ jobs: echo "SQLite state smoke probe is not available in ${TESTED_REF}; continuing with the remaining source probes." >> "$GITHUB_STEP_SUMMARY" fi - summary_args=(node "$PERFORMANCE_HELPER_DIR/scripts/openclaw-performance-source-summary.mjs" \ + summary_args=(node --import tsx "$PERFORMANCE_HELPER_DIR/scripts/openclaw-performance-source-summary.mts" \ --source-dir "$SOURCE_PERF_DIR" \ --output "$SOURCE_PERF_DIR/index.md") if [[ -n "${SOURCE_PERF_BASELINE_DIR:-}" && -d "$SOURCE_PERF_BASELINE_DIR" ]]; then diff --git a/.github/workflows/openclaw-release-checks.yml b/.github/workflows/openclaw-release-checks.yml index d54866f716f1..a59d576167d0 100644 --- a/.github/workflows/openclaw-release-checks.yml +++ b/.github/workflows/openclaw-release-checks.yml @@ -728,7 +728,7 @@ jobs: --required-plugin-packages-json "$required_packages" ) fi - node scripts/resolve-openclaw-package-candidate.mjs \ + node --import tsx scripts/resolve-openclaw-package-candidate.mts \ "${source_args[@]}" \ "${registry_args[@]}" \ --output-dir .artifacts/docker-e2e-package \ @@ -1253,7 +1253,7 @@ jobs: - name: Build private QA runtime env: NODE_OPTIONS: --max-old-space-size=8192 - run: node scripts/build-all.mjs qaRuntime + run: node --import tsx scripts/build-all.mts qaRuntime - name: Run parity lane id: run_lane @@ -1434,7 +1434,7 @@ jobs: - name: Build private QA runtime env: NODE_OPTIONS: --max-old-space-size=8192 - run: node scripts/build-all.mjs qaRuntime + run: node --import tsx scripts/build-all.mts qaRuntime - name: Generate parity report id: generate_report @@ -1517,7 +1517,7 @@ jobs: - name: Build private QA runtime env: NODE_OPTIONS: --max-old-space-size=8192 - run: node scripts/build-all.mjs qaRuntime + run: node --import tsx scripts/build-all.mts qaRuntime - name: Run runtime-pair lane id: candidate_runtime_pair @@ -1581,7 +1581,7 @@ jobs: if [[ "$CANDIDATE_SUITE_OUTCOME" != "success" ]]; then validator_args+=(--require-explicit-gap) fi - node trusted-suite-validator/scripts/validate-qa-runtime-pair-summary.mjs "${validator_args[@]}" + node --import tsx trusted-suite-validator/scripts/validate-qa-runtime-pair-summary.mts "${validator_args[@]}" if [[ "$CANDIDATE_SUITE_OUTCOME" != "success" ]]; then echo "::notice::Trusted workflow validation accepted frozen-candidate runtime-pair evidence after its suite failed." fi @@ -1653,7 +1653,7 @@ jobs: if [[ "$CANDIDATE_REPORT_OUTCOME" != "success" ]]; then validator_args+=(--require-explicit-gap) fi - node trusted-report-validator/scripts/validate-qa-runtime-pair-summary.mjs "${validator_args[@]}" + node --import tsx trusted-report-validator/scripts/validate-qa-runtime-pair-summary.mts "${validator_args[@]}" if [[ "$CANDIDATE_REPORT_OUTCOME" != "success" ]]; then echo "::notice::Trusted workflow validation accepted the frozen-candidate runtime-pair report after its reporter failed." fi @@ -2127,7 +2127,7 @@ jobs: - name: Build private QA runtime env: NODE_OPTIONS: --max-old-space-size=8192 - run: node scripts/build-all.mjs qaRuntime + run: node --import tsx scripts/build-all.mts qaRuntime - name: Run Discord live lane id: run_lane @@ -2226,7 +2226,7 @@ jobs: - name: Build private QA runtime env: NODE_OPTIONS: --max-old-space-size=8192 - run: node scripts/build-all.mjs qaRuntime + run: node --import tsx scripts/build-all.mts qaRuntime - name: Run WhatsApp live lane id: run_lane @@ -2322,7 +2322,7 @@ jobs: - name: Build private QA runtime env: NODE_OPTIONS: --max-old-space-size=8192 - run: node scripts/build-all.mjs qaRuntime + run: node --import tsx scripts/build-all.mts qaRuntime - name: Run Slack live lane id: run_lane diff --git a/.github/workflows/openclaw-release-publish.yml b/.github/workflows/openclaw-release-publish.yml index cfca7a6d682b..49f509724258 100644 --- a/.github/workflows/openclaw-release-publish.yml +++ b/.github/workflows/openclaw-release-publish.yml @@ -779,7 +779,7 @@ jobs: changelog_file="${RUNNER_TEMP}/CHANGELOG.md" notes_file="${RUNNER_TEMP}/release-notes.md" git show "${TARGET_SHA}:CHANGELOG.md" > "${changelog_file}" - node scripts/render-github-release-notes.mjs \ + node --import tsx scripts/render-github-release-notes.mts \ --changelog "${changelog_file}" \ --tag "${RELEASE_TAG}" \ --repository "${GITHUB_REPOSITORY}" \ @@ -1399,7 +1399,7 @@ jobs: echo "openclaw@${release_version} is already published; openclaw_npm_resume_run_id is required to bind postpublish proof to the original workflow identity." >&2 exit 1 fi - resume_state="$(node "${GITHUB_WORKSPACE}/.release-harness/scripts/openclaw-npm-resume-run.mjs" \ + resume_state="$(node --import tsx "${GITHUB_WORKSPACE}/.release-harness/scripts/openclaw-npm-resume-run.mts" \ --repo "${GITHUB_REPOSITORY}" \ --run-id "${OPENCLAW_NPM_RESUME_RUN_ID}")" resume_url="$(printf '%s' "${resume_state}" | jq -er '.url')" @@ -1469,7 +1469,7 @@ jobs: local metadata_file="${3:-}" local changelog_file="${RUNNER_TEMP}/CHANGELOG.md" local -a render_args=( - node scripts/render-github-release-notes.mjs + node --import tsx scripts/render-github-release-notes.mts --changelog "${changelog_file}" --tag "${RELEASE_TAG}" --repository "${GITHUB_REPOSITORY}" @@ -1514,12 +1514,12 @@ jobs: RELEASE_CHANGELOG_FILE="${changelog_file}" \ RELEASE_REPOSITORY="${GITHUB_REPOSITORY}" \ RELEASE_TAG="${RELEASE_TAG}" \ - node --input-type=module <<'NODE' + node --import tsx --input-type=module <<'NODE' import { readFileSync } from "node:fs"; import { releaseNotesVersionForTag, verifyGithubReleaseNotes, - } from "./scripts/render-github-release-notes.mjs"; + } from "./scripts/render-github-release-notes.mts"; const body = readFileSync(process.env.RELEASE_BODY_FILE, "utf8"); const changelog = readFileSync(process.env.RELEASE_CHANGELOG_FILE, "utf8"); diff --git a/.github/workflows/openclaw-release-telegram-qa.yml b/.github/workflows/openclaw-release-telegram-qa.yml index 98372e372156..8e5937c54fff 100644 --- a/.github/workflows/openclaw-release-telegram-qa.yml +++ b/.github/workflows/openclaw-release-telegram-qa.yml @@ -477,7 +477,7 @@ jobs: OPENCLAW_BUILD_PRIVATE_QA=1 \ PATH="$PATH" \ RUNNER_TEMP="$RUNNER_TEMP" \ - pnpm exec node scripts/build-all.mjs qaRuntime + pnpm exec node --import tsx scripts/build-all.mts qaRuntime - name: Move built candidate outside trusted workspace id: move_candidate @@ -539,7 +539,7 @@ jobs: pnpm_version="$(pnpm --version)" jq -n \ --arg archiveRoot "$archive_root" \ - --arg buildCommand "node scripts/build-all.mjs qaRuntime" \ + --arg buildCommand "node --import tsx scripts/build-all.mts qaRuntime" \ --arg candidateSha "$TARGET_SHA" \ --arg candidateTree "$CANDIDATE_TREE" \ --arg nodeVersion "$node_version" \ @@ -748,7 +748,7 @@ jobs: .candidateSha == $candidateSha and .candidateTree == $candidateTree and .archiveRoot == "openclaw-telegram-candidate" and - .buildCommand == "node scripts/build-all.mjs qaRuntime" and + .buildCommand == "node --import tsx scripts/build-all.mts qaRuntime" and .sourceJob == "build_candidate" ' "$manifest_path" >/dev/null [[ -d "$candidate_root/node_modules" && -f "$candidate_root/dist/index.js" ]] @@ -899,7 +899,7 @@ jobs: id: build_harness env: NODE_OPTIONS: --max-old-space-size=8192 - run: node scripts/build-all.mjs qaRuntime + run: node --import tsx scripts/build-all.mts qaRuntime - name: Validate candidate artifact metadata id: metadata diff --git a/.github/workflows/package-acceptance.yml b/.github/workflows/package-acceptance.yml index 272f8cfb5f63..ae50e5b6b44f 100644 --- a/.github/workflows/package-acceptance.yml +++ b/.github/workflows/package-acceptance.yml @@ -575,7 +575,7 @@ jobs: } fi - node scripts/resolve-openclaw-package-candidate.mjs \ + node --import tsx scripts/resolve-openclaw-package-candidate.mts \ --source "$SOURCE" \ --package-ref "$PACKAGE_REF" \ --package-spec "$PACKAGE_SPEC" \ @@ -707,7 +707,7 @@ jobs: --pre-date 2026-03-15T00:00:00Z ) fi - node scripts/resolve-upgrade-survivor-baselines.mjs "${args[@]}" >/dev/null + node --import tsx scripts/resolve-upgrade-survivor-baselines.mts "${args[@]}" >/dev/null echo "baseline=$fallback_baseline" >> "$GITHUB_OUTPUT" - name: Upload package-under-test artifact diff --git a/.github/workflows/plugin-clawhub-new.yml b/.github/workflows/plugin-clawhub-new.yml index 06a2c347dbd9..57b960156556 100644 --- a/.github/workflows/plugin-clawhub-new.yml +++ b/.github/workflows/plugin-clawhub-new.yml @@ -537,7 +537,7 @@ jobs: package_slug="${package_name#@openclaw/}" output_dir="${artifact_root}/packages/${package_slug}" mkdir -p "${output_dir}" - node scripts/check-plugin-npm-runtime-builds.mjs --package "${package_dir}" + node --import tsx scripts/check-plugin-npm-runtime-builds.mts --package "${package_dir}" OPENCLAW_CLAWHUB_PACK_OUTPUT_DIR="${output_dir}" \ PACKAGE_TAG="${package_tag}" \ bash .release-harness/scripts/plugin-clawhub-publish.sh --pack "${package_dir}" diff --git a/.github/workflows/plugin-clawhub-release.yml b/.github/workflows/plugin-clawhub-release.yml index 79c713d2ee51..6027de40bd0d 100644 --- a/.github/workflows/plugin-clawhub-release.yml +++ b/.github/workflows/plugin-clawhub-release.yml @@ -340,7 +340,7 @@ jobs: install-deps: "true" - name: Verify package-local runtime build - run: node scripts/check-plugin-npm-runtime-builds.mjs --package "${{ matrix.plugin.packageDir }}" + run: node --import tsx scripts/check-plugin-npm-runtime-builds.mts --package "${{ matrix.plugin.packageDir }}" - name: Install pinned ClawHub CLI wrapper run: | diff --git a/.github/workflows/plugin-npm-release.yml b/.github/workflows/plugin-npm-release.yml index bb46d8db0edc..dc85a9f30642 100644 --- a/.github/workflows/plugin-npm-release.yml +++ b/.github/workflows/plugin-npm-release.yml @@ -10,17 +10,20 @@ on: - "extensions/**" - "package.json" - "scripts/generate-npm-package-lock.mjs" + - "scripts/generate-npm-package-lock.mts" - "scripts/lib/npm-publish-plan.mjs" - - "scripts/lib/npm-json-output.mjs" + - "scripts/lib/npm-json-output.mts" - "scripts/lib/release-version.mjs" - "scripts/lib/plugin-npm-package-manifest.mjs" + - "scripts/lib/plugin-npm-package-manifest.mts" + - "scripts/lib/tsx-cli-shim.mjs" - "scripts/lib/plugin-npm-release.ts" - "scripts/lib/actions-artifact-archive.mjs" - "scripts/plugin-npm-publish.sh" - "scripts/plugin-publication-artifact.mjs" - "scripts/plugin-npm-release-check.ts" - "scripts/plugin-npm-release-plan.ts" - - "scripts/verify-plugin-npm-published-runtime.mjs" + - "scripts/verify-plugin-npm-published-runtime.mts" workflow_dispatch: inputs: publish_scope: @@ -339,8 +342,11 @@ jobs: fetch-depth: 1 sparse-checkout: | scripts/generate-npm-package-lock.mjs - scripts/lib/npm-json-output.mjs + scripts/generate-npm-package-lock.mts + scripts/lib/npm-json-output.mts scripts/lib/plugin-npm-package-manifest.mjs + scripts/lib/plugin-npm-package-manifest.mts + scripts/lib/tsx-cli-shim.mjs sparse-checkout-cone-mode: false - name: Overlay trusted packaging helper @@ -350,11 +356,20 @@ jobs: .release-tooling/scripts/generate-npm-package-lock.mjs \ scripts/generate-npm-package-lock.mjs cp \ - .release-tooling/scripts/lib/npm-json-output.mjs \ - scripts/lib/npm-json-output.mjs + .release-tooling/scripts/generate-npm-package-lock.mts \ + scripts/generate-npm-package-lock.mts + cp \ + .release-tooling/scripts/lib/npm-json-output.mts \ + scripts/lib/npm-json-output.mts cp \ .release-tooling/scripts/lib/plugin-npm-package-manifest.mjs \ scripts/lib/plugin-npm-package-manifest.mjs + cp \ + .release-tooling/scripts/lib/plugin-npm-package-manifest.mts \ + scripts/lib/plugin-npm-package-manifest.mts + cp \ + .release-tooling/scripts/lib/tsx-cli-shim.mjs \ + scripts/lib/tsx-cli-shim.mjs - name: Setup Node environment uses: ./.github/actions/setup-node-env @@ -403,9 +418,9 @@ jobs: OPENCLAW_PLUGIN_NPM_PACK_OUTPUT_DIR="${artifact_dir}" \ bash scripts/plugin-npm-publish.sh --pack "${PACKAGE_DIR}" > "${pack_output}" - node --input-type=module - "${pack_output}" "${pack_json}" <<'NODE' + node --import tsx --input-type=module - "${pack_output}" "${pack_json}" <<'NODE' import fs from "node:fs"; - import { resolveNpmJsonEntries } from "./scripts/lib/npm-json-output.mjs"; + import { resolveNpmJsonEntries } from "./scripts/lib/npm-json-output.mts"; const raw = fs.readFileSync(process.argv[2], "utf8").trim(); let pack; @@ -1245,11 +1260,23 @@ jobs: scripts/generate-npm-package-lock.mjs \ .publication-target/scripts/generate-npm-package-lock.mjs cp \ - scripts/lib/npm-json-output.mjs \ - .publication-target/scripts/lib/npm-json-output.mjs + scripts/generate-npm-package-lock.mts \ + .publication-target/scripts/generate-npm-package-lock.mts + cp \ + scripts/lib/npm-json-output.mts \ + .publication-target/scripts/lib/npm-json-output.mts cp \ scripts/lib/plugin-npm-package-manifest.mjs \ .publication-target/scripts/lib/plugin-npm-package-manifest.mjs + cp \ + scripts/lib/plugin-npm-package-manifest.mts \ + .publication-target/scripts/lib/plugin-npm-package-manifest.mts + cp \ + scripts/lib/tsx-cli-shim.mjs \ + .publication-target/scripts/lib/tsx-cli-shim.mjs + cp \ + scripts/lib/tsx-cli-shim.mjs \ + .publication-target/scripts/lib/tsx-cli-shim.mjs - name: Setup OIDC publication target if: steps.publication_evidence.outputs.publish_route == 'npm-oidc' @@ -1286,7 +1313,7 @@ jobs: env: PACKAGE_NAME: ${{ matrix.plugin.packageName }} PACKAGE_VERSION: ${{ matrix.plugin.version }} - run: node scripts/verify-plugin-npm-published-runtime.mjs "${PACKAGE_NAME}@${PACKAGE_VERSION}" + run: node --import tsx scripts/verify-plugin-npm-published-runtime.mts "${PACKAGE_NAME}@${PACKAGE_VERSION}" - name: Check bootstrap npm package version id: bootstrap_npm_package_version @@ -1385,14 +1412,14 @@ jobs: env: PACKAGE_NAME: ${{ steps.publication_evidence.outputs.package_name }} PACKAGE_VERSION: ${{ steps.publication_evidence.outputs.package_version }} - run: node scripts/verify-plugin-npm-published-runtime.mjs "${PACKAGE_NAME}@${PACKAGE_VERSION}" + run: node --import tsx scripts/verify-plugin-npm-published-runtime.mts "${PACKAGE_NAME}@${PACKAGE_VERSION}" - name: Verify immutable npm readback runtime if: steps.publication_evidence.outputs.publish_route == 'npm-readback' env: PACKAGE_NAME: ${{ steps.publication_evidence.outputs.package_name }} PACKAGE_VERSION: ${{ steps.publication_evidence.outputs.package_version }} - run: node scripts/verify-plugin-npm-published-runtime.mjs "${PACKAGE_NAME}@${PACKAGE_VERSION}" + run: node --import tsx scripts/verify-plugin-npm-published-runtime.mts "${PACKAGE_NAME}@${PACKAGE_VERSION}" - name: Record Meta trusted publisher checkpoint if: steps.publication_evidence.outputs.publish_route == 'npm-token-bootstrap' diff --git a/.github/workflows/plugin-prerelease.yml b/.github/workflows/plugin-prerelease.yml index dccfa2daefe0..599857ccf5ac 100644 --- a/.github/workflows/plugin-prerelease.yml +++ b/.github/workflows/plugin-prerelease.yml @@ -67,14 +67,27 @@ jobs: persist-credentials: false submodules: false + - name: Setup manifest TypeScript runtime + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + with: + node-version: "24.x" + + - name: Setup manifest pnpm + uses: ./.github/actions/setup-pnpm-store-cache + with: + node-version: "24.x" + + - name: Install manifest dependencies + run: pnpm install --frozen-lockfile --prefer-offline --ignore-scripts + - name: Build plugin prerelease manifest id: manifest env: EXPECTED_SHA: ${{ inputs.expected_sha }} FULL_RELEASE_VALIDATION: ${{ inputs.full_release_validation && 'true' || 'false' }} run: | - node --input-type=module <<'EOF' - import { appendFileSync } from "node:fs"; + node --import tsx --input-type=module <<'EOF' + import { appendFileSync, existsSync } from "node:fs"; import { execFileSync } from "node:child_process"; const createMatrix = (include) => ({ include }); @@ -95,9 +108,19 @@ jobs: let extensionShards = []; let nodeShards = []; + const targetPlanPaths = { + "plugin-prerelease-test-plan": "./scripts/lib/plugin-prerelease-test-plan.mts", + "extension-test-plan": "./scripts/lib/extension-test-plan.mts", + "ci-node-test-plan": "./scripts/lib/ci-node-test-plan.mts", + }; + const targetPlanPath = (name) => { + const mtsPath = targetPlanPaths[name]; + return existsSync(mtsPath) ? mtsPath : mtsPath.replace(/\.mts$/u, ".mjs"); + }; + try { const { assertPluginPrereleaseTestPlanComplete } = await import( - "./scripts/lib/plugin-prerelease-test-plan.mjs" + targetPlanPath("plugin-prerelease-test-plan") ); pluginPrereleasePlan = assertPluginPrereleaseTestPlanComplete(); } catch (error) { @@ -107,7 +130,8 @@ jobs: error && typeof error === "object" && "url" in error ? String(error.url) : ""; if ( errorCode === "ERR_MODULE_NOT_FOUND" && - moduleUrl.endsWith("/scripts/lib/plugin-prerelease-test-plan.mjs") + (moduleUrl.endsWith("/scripts/lib/plugin-prerelease-test-plan.mjs") || + moduleUrl.endsWith("/scripts/lib/plugin-prerelease-test-plan.mts")) ) { console.warn( "Plugin prerelease plan unavailable in target ref; skipping static and Docker plugin prerelease lanes.", @@ -119,7 +143,7 @@ jobs: try { const { createExtensionTestShards, DEFAULT_EXTENSION_TEST_SHARD_COUNT } = await import( - "./scripts/lib/extension-test-plan.mjs" + targetPlanPath("extension-test-plan") ); extensionShards = createExtensionTestShards({ shardCount: DEFAULT_EXTENSION_TEST_SHARD_COUNT, @@ -146,7 +170,8 @@ jobs: error && typeof error === "object" && "url" in error ? String(error.url) : ""; if ( errorCode === "ERR_MODULE_NOT_FOUND" && - moduleUrl.endsWith("/scripts/lib/extension-test-plan.mjs") + (moduleUrl.endsWith("/scripts/lib/extension-test-plan.mjs") || + moduleUrl.endsWith("/scripts/lib/extension-test-plan.mts")) ) { console.warn( "Extension test plan unavailable in target ref; skipping extension prerelease shards.", @@ -157,7 +182,7 @@ jobs: } try { - const { createNodeTestShards } = await import("./scripts/lib/ci-node-test-plan.mjs"); + const { createNodeTestShards } = await import(targetPlanPath("ci-node-test-plan")); nodeShards = createNodeTestShards({ includeReleaseOnlyPluginShards: true, }) @@ -178,7 +203,8 @@ jobs: error && typeof error === "object" && "url" in error ? String(error.url) : ""; if ( errorCode === "ERR_MODULE_NOT_FOUND" && - moduleUrl.endsWith("/scripts/lib/ci-node-test-plan.mjs") + (moduleUrl.endsWith("/scripts/lib/ci-node-test-plan.mjs") || + moduleUrl.endsWith("/scripts/lib/ci-node-test-plan.mts")) ) { console.warn( "Node test plan unavailable in target ref; skipping release-only plugin Node shard.", @@ -322,7 +348,7 @@ jobs: const result = spawnSync( "pnpm", - ["exec", "node", "scripts/test-projects.mjs", ...configs], + ["exec", "node", "--import", "tsx", "scripts/test-projects.mts", ...configs], { env: childEnv, stdio: "inherit", diff --git a/.github/workflows/qa-profile-evidence.yml b/.github/workflows/qa-profile-evidence.yml index 08d1cc789a10..db93d8cb4317 100644 --- a/.github/workflows/qa-profile-evidence.yml +++ b/.github/workflows/qa-profile-evidence.yml @@ -290,10 +290,10 @@ jobs: - name: Build private QA runtime env: NODE_OPTIONS: --max-old-space-size=8192 - run: node scripts/build-all.mjs qaRuntime + run: node --import tsx scripts/build-all.mts qaRuntime - name: Ensure Playwright Chromium - run: node scripts/ensure-playwright-chromium.mjs + run: node --import tsx scripts/ensure-playwright-chromium.mts - name: Run QA profile id: run_profile diff --git a/.github/workflows/shared-openclawkit-periphery.yml b/.github/workflows/shared-openclawkit-periphery.yml index 904ce1813a2f..2be5d6772788 100644 --- a/.github/workflows/shared-openclawkit-periphery.yml +++ b/.github/workflows/shared-openclawkit-periphery.yml @@ -60,6 +60,7 @@ jobs: "scripts/periphery-intersection.mjs", "scripts/ios-configure-signing.sh", "scripts/ios-write-swift-filelist.mjs", + "scripts/ios-write-swift-filelist.mts", "scripts/ios-write-version-xcconfig.sh", "test/scripts/periphery-intersection.test.ts", ], { ignoreReturnCode: true, silent: true }); diff --git a/.github/workflows/vitest-cache-warm.yml b/.github/workflows/vitest-cache-warm.yml index 9cf1a13c20b7..d6426bf356c1 100644 --- a/.github/workflows/vitest-cache-warm.yml +++ b/.github/workflows/vitest-cache-warm.yml @@ -41,9 +41,9 @@ jobs: shell: bash run: | set -euo pipefail - node --input-type=module <<'EOF' + node --import tsx --input-type=module <<'EOF' import { appendFileSync } from "node:fs"; - import { createNodeTestShards } from "./scripts/lib/ci-node-test-plan.mjs"; + import { createNodeTestShards } from "./scripts/lib/ci-node-test-plan.mts"; // Warm the selected planner envelopes for the striped unit-fast graph // plus import-bound graphs that remained cold in protected-cache readers. @@ -90,4 +90,4 @@ jobs: EOF - name: Warm transform and compile caches - run: node scripts/ci-run-node-test-shard.mjs + run: node --import tsx scripts/ci-run-node-test-shard.mts diff --git a/AGENTS.md b/AGENTS.md index de59dce61534..b2b82f866ade 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -170,7 +170,7 @@ Skills own workflows; root owns hard policy and routing. Product direction and m - Typecheck: `tsgo` lanes only (`pnpm tsgo*`, `pnpm check:test-types`); never add `tsc --noEmit`, `typecheck`, `check:types`. - Formatting: `oxfmt`, not Prettier. Write paths with `pnpm format `; no `format:write` script. Checks use repo wrappers (`pnpm format:*`, `scripts/run-oxlint.mjs`; full `pnpm lint:*` only when scope requires). - SDK surface gate: `pnpm plugin-sdk:surface:check`; no `plugin-sdk:surface-report` script. -- `scripts/*.mjs` exports: matching declaration in sibling `.d.mts` mandatory. `pnpm check:script-declarations` (check-guards) + `check-test-types` enforce; new export without declaration = red CI. +- Script implementations use TypeScript where their runtime supports `tsx`; plain-Node lifecycle, packaged, Docker, and loader closures remain JavaScript and are included in the scripts program through `allowJs`. - Script wrappers: failing or crashed run must end with one final `[tool] FAILED (exit N)` stderr line; crash = nonzero exit. Truncated output must never read as success. Pattern: `scripts/run-oxlint.mjs`. - Tooling crash `Cannot find module ...` right after pulling/merging main = stale `node_modules`, not a code bug. `pnpm install` first; only then debug. - Build before push when build output, packaging, lazy/module boundaries, dynamic imports, or published surfaces can change; agent builds default to the selected remote box unless platform-specific proof requires another remote host. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 57deb891bde0..6e2751bf5494 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -63,9 +63,9 @@ For coordinated change sets that genuinely need more than 20 PRs, join the **#cl - These commands also cover the shared seam/smoke files that the default unit lane skips - If you changed broader runtime behavior, still run the relevant wider lanes (`pnpm test:extensions`, `pnpm test:channels`, or `pnpm test`) before asking for review - If you touched bundled-plugin boundaries in shared code, run the matching inventories: - - `node scripts/check-src-extension-import-boundary.mjs --json` for `src/**` - - `node scripts/check-sdk-package-extension-import-boundary.mjs --json` for `src/plugin-sdk/**` and `packages/**` - - `node scripts/check-test-helper-extension-import-boundary.mjs --json` for `test/helpers/**` + - `node --import tsx scripts/check-src-extension-import-boundary.mts --json` for `src/**` + - `node --import tsx scripts/check-sdk-package-extension-import-boundary.mts --json` for `src/plugin-sdk/**` and `packages/**` + - `node --import tsx scripts/check-test-helper-extension-import-boundary.mts --json` for `test/helpers/**` - Shared test helpers must use `src/test-utils/bundled-plugin-public-surface.ts` instead of repo-relative `extensions/**` imports. Keep plugin-local deep mocks inside the owning bundled plugin package. - If you are using an AI coding agent with OpenClaw skills available, run the `autoreview` skill before opening or updating your PR. Address accepted/actionable findings before asking for review. - Do not submit refactor-only PRs unless a maintainer explicitly requested that refactor for an active fix or deliverable. diff --git a/Dockerfile b/Dockerfile index 70c69e2e8e68..f1f5a18f861f 100644 --- a/Dockerfile +++ b/Dockerfile @@ -75,7 +75,7 @@ COPY package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc ./ COPY openclaw.mjs ./ COPY ui/package.json ./ui/package.json COPY patches ./patches -COPY scripts/postinstall-bundled-plugins.mjs scripts/preinstall-package-manager-warning.mjs scripts/npm-runner.mjs scripts/windows-cmd-helpers.mjs scripts/prepare-git-hooks.mjs ./scripts/ +COPY scripts/postinstall-bundled-plugins.mjs scripts/preinstall-package-manager-warning.mjs scripts/windows-cmd-helpers.mjs scripts/prepare-git-hooks.mjs ./scripts/ COPY scripts/lib/guard-inventory-utils.mjs ./scripts/lib/guard-inventory-utils.mjs COPY scripts/lib/package-dist-imports.mjs ./scripts/lib/package-dist-imports.mjs diff --git a/SECURITY.md b/SECURITY.md index 128889e7c070..2a9e29be57e7 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -275,7 +275,7 @@ Security boundary notes: - Enforcement reference points: - temp root resolver: `src/infra/tmp-openclaw-dir.ts` - SDK temp helpers: `src/plugin-sdk/temp-path.ts` - - messaging/channel tmp guardrail: `scripts/check-no-random-messaging-tmp.mjs` + - messaging/channel tmp guardrail: `scripts/check-no-random-messaging-tmp.mts` ### Operational Guidance diff --git a/apps/android/app/build.gradle.kts b/apps/android/app/build.gradle.kts index 579165dacec2..2e8324bc3b9a 100644 --- a/apps/android/app/build.gradle.kts +++ b/apps/android/app/build.gradle.kts @@ -152,7 +152,9 @@ abstract class StageCanvasA2uiTask workingDir(root) commandLine( "node", - "scripts/sync-native-a2ui.mjs", + "--import", + "tsx", + "scripts/sync-native-a2ui.mts", "--write", "--output", outputDirectory @@ -172,8 +174,8 @@ val stageCanvasA2ui = sourceFiles.from( openClawRepositoryRoot.resolve("package.json"), openClawRepositoryRoot.resolve("pnpm-lock.yaml"), - openClawRepositoryRoot.resolve("scripts/bundle-a2ui.mjs"), - openClawRepositoryRoot.resolve("scripts/sync-native-a2ui.mjs"), + openClawRepositoryRoot.resolve("scripts/bundle-a2ui.mts"), + openClawRepositoryRoot.resolve("scripts/sync-native-a2ui.mts"), openClawRepositoryRoot.resolve("extensions/canvas/package.json"), openClawRepositoryRoot.resolve("extensions/canvas/scripts/bundle-a2ui.mjs"), openClawRepositoryRoot.resolve("extensions/canvas/src/host/a2ui/index.html"), diff --git a/apps/ios/project.yml b/apps/ios/project.yml index 24333f11936a..df5a1939a490 100644 --- a/apps/ios/project.yml +++ b/apps/ios/project.yml @@ -117,7 +117,7 @@ targets: resource_bundle="$TARGET_BUILD_DIR/$UNLOCALIZED_RESOURCES_FOLDER_PATH/OpenClawKit_OpenClawKit.bundle" test -d "$resource_product" test -d "$resource_bundle" - node "$repo_root/scripts/sync-native-a2ui.mjs" \ + node --import tsx "$repo_root/scripts/sync-native-a2ui.mts" \ --write \ --output "$resource_product/CanvasA2UI" rm -rf "$resource_bundle/CanvasA2UI" diff --git a/apps/linux/README.md b/apps/linux/README.md index 470cc1bc3d58..3c981726ab9c 100644 --- a/apps/linux/README.md +++ b/apps/linux/README.md @@ -59,7 +59,7 @@ The running app gives the headless `openclaw node run` host a single Canvas WebV The Canvas plugin sources remain the source of truth for the A2UI renderer. Each native build generates `index.html` and `a2ui.bundle.js` into its isolated build output before compiling. Run -`node scripts/sync-native-a2ui.mjs --check` from the repository root to verify fresh bundles are +`node --import tsx scripts/sync-native-a2ui.mts --check` from the repository root to verify fresh bundles are byte-identical and every native build owner is wired. ## Quick Chat widgets diff --git a/apps/linux/src-tauri/build.rs b/apps/linux/src-tauri/build.rs index a3f3b4761a53..9f3397f0799e 100644 --- a/apps/linux/src-tauri/build.rs +++ b/apps/linux/src-tauri/build.rs @@ -33,8 +33,8 @@ fn stage_canvas_a2ui() { for input in [ "package.json", "pnpm-lock.yaml", - "scripts/bundle-a2ui.mjs", - "scripts/sync-native-a2ui.mjs", + "scripts/bundle-a2ui.mts", + "scripts/sync-native-a2ui.mts", "extensions/canvas/package.json", "extensions/canvas/scripts/bundle-a2ui.mjs", "extensions/canvas/src/host/a2ui/index.html", @@ -44,7 +44,13 @@ fn stage_canvas_a2ui() { } let status = Command::new("node") - .args(["scripts/sync-native-a2ui.mjs", "--write", "--output"]) + .args([ + "--import", + "tsx", + "scripts/sync-native-a2ui.mts", + "--write", + "--output", + ]) .arg(&output_dir) .current_dir(&repo_root) .status() diff --git a/apps/macos/Sources/OpenClaw/HostEnvSanitizer.swift b/apps/macos/Sources/OpenClaw/HostEnvSanitizer.swift index d134b22b349a..cf7aeccc0433 100644 --- a/apps/macos/Sources/OpenClaw/HostEnvSanitizer.swift +++ b/apps/macos/Sources/OpenClaw/HostEnvSanitizer.swift @@ -6,7 +6,7 @@ struct HostEnvOverrideDiagnostics: Equatable { } enum HostEnvSanitizer { - /// Generated from src/infra/host-env-security-policy.json via scripts/generate-host-env-security-policy-swift.mjs. + /// Generated from src/infra/host-env-security-policy.json via scripts/generate-host-env-security-policy-swift.mts. /// Parity is validated by src/infra/host-env-security.policy-parity.test.ts. private static let blockedInheritedKeys = HostEnvSecurityPolicy.blockedInheritedKeys private static let blockedInheritedPrefixes = HostEnvSecurityPolicy.blockedInheritedPrefixes diff --git a/apps/macos/Sources/OpenClaw/HostEnvSecurityPolicy.generated.swift b/apps/macos/Sources/OpenClaw/HostEnvSecurityPolicy.generated.swift index f712085c2c55..0d5ae7f247e7 100644 --- a/apps/macos/Sources/OpenClaw/HostEnvSecurityPolicy.generated.swift +++ b/apps/macos/Sources/OpenClaw/HostEnvSecurityPolicy.generated.swift @@ -1,6 +1,6 @@ // Generated file. Do not edit directly. // Source: src/infra/host-env-security-policy.json -// Regenerate: node scripts/generate-host-env-security-policy-swift.mjs --write +// Regenerate: node --import tsx scripts/generate-host-env-security-policy-swift.mts --write import Foundation diff --git a/config/knip.all-exports.config.ts b/config/knip.all-exports.config.ts index 43fe2929fb82..f0bda1a106b4 100644 --- a/config/knip.all-exports.config.ts +++ b/config/knip.all-exports.config.ts @@ -61,7 +61,7 @@ const ROOT_TEST_ENTRY_GLOBS = [ // QA scenario YAML dispatches these scripts/tests by path rather than import. ...QA_SCENARIO_EXECUTION_ENTRIES, // Invoked directly by the sandbox bind-conflict E2E verification script. - "scripts/e2e-sandbox-bind-conflict.mjs!", + "scripts/e2e-sandbox-bind-conflict.mts!", // The Voice Call QA scenario loads this fixture through a generated plugin directory. "test/e2e/qa-lab/runtime/fixtures/voice-call-runtime-plugin/index.js!", // Loaded with cache-busting query strings so configuration fallback tests diff --git a/config/knip.config.ts b/config/knip.config.ts index c687a8e684fb..83316718cf35 100644 --- a/config/knip.config.ts +++ b/config/knip.config.ts @@ -1,6 +1,9 @@ /** * Knip configuration for OpenClaw root and bundled plugin dependency hygiene. */ +import fs from "node:fs"; +import path from "node:path"; + const BUNDLED_PLUGIN_ROOT_DIR = "extensions"; function bundledPluginFile(pluginId: string, relativePath: string, suffix = ""): string { @@ -16,13 +19,14 @@ const repositoryScriptEntries = [ ".github/actions/register-bind-mount-cleanup/main.cjs!", ".github/actions/register-bind-mount-cleanup/post.cjs!", "apps/android/scripts/build-release-artifacts.ts!", - "scripts/build-discord-activity-sdk.mjs!", + "scripts/bundle-a2ui.mts!", + "scripts/build-discord-activity-sdk.mts!", "scripts/check-live-cache.ts!", "scripts/check-package-dist-imports.mjs!", "scripts/dev/ios-node-e2e.ts!", "scripts/diffs-shiki-curated.ts!", // Reusable Docker workflows invoke this from the downloaded .release-harness tree. - "scripts/docker-e2e.mjs!", + "scripts/docker-e2e.mts!", "scripts/e2e/lib/browser-cdp-snapshot/assert-snapshot.mjs!", "scripts/e2e/lib/browser-cdp-snapshot/fixture-server.mjs!", "scripts/e2e/lib/bundled-plugin-install-uninstall/runtime-smoke.mjs!", @@ -40,7 +44,7 @@ const repositoryScriptEntries = [ "scripts/e2e/lib/fixtures/config.mjs!", "scripts/e2e/lib/fixtures/plugins.mjs!", "scripts/e2e/lib/fixtures/workspace.mjs!", - "scripts/e2e/lib/npm-telegram-live/prepare-package.mjs!", + "scripts/e2e/lib/npm-telegram-live/prepare-package.mts!", "scripts/e2e/lib/onboard/assert-config.mjs!", "scripts/e2e/lib/onboard/write-config.mjs!", "scripts/e2e/lib/openai-chat-tools/client.mjs!", @@ -61,9 +65,9 @@ const repositoryScriptEntries = [ "scripts/fixtures/packed-plugin-sdk-type-smoke.ts!", "scripts/ios-release-cut.ts!", "scripts/ios-release-plan.ts!", - "scripts/ios-release-signing.mjs!", + "scripts/ios-release-signing.mts!", "scripts/lib/docker-plugin-selection.mjs!", - "scripts/lib/openclaw-test-state.mjs!", + "scripts/lib/openclaw-test-state.mts!", "scripts/list-prod-store-packages.mjs!", // Invoked by scripts/lib/live-docker-stage.sh during container validation. "scripts/live-docker-normalize-config.ts!", @@ -73,10 +77,10 @@ const repositoryScriptEntries = [ "scripts/openclaw-release-clawhub-runtime-state.ts!", // Oxlint loads this JS plugin by path from config/oxlint/boundary-guards.json. "scripts/oxlint-boundary-guards.mjs!", - "scripts/plugin-prerelease-liveish-matrix.mjs!", + "scripts/plugin-prerelease-liveish-matrix.mts!", // Generates the checked-in native protocol models from core descriptor metadata. "scripts/protocol-gen.ts!", - "scripts/pr-gates-lock.mjs!", + "scripts/pr-gates-lock.mts!", "scripts/pr-lib/ci-dispatch.mjs!", "scripts/pr-lib/review-artifacts.mjs!", "scripts/pr-lib/process-group-runner.mjs!", @@ -87,7 +91,7 @@ const repositoryScriptEntries = [ "scripts/secrets/openclaw-bws-resolver.mjs!", "scripts/sqlite-session-entry-cache-lifetime-proof.ts!", "scripts/sync-labels.ts!", - "scripts/test-built-bundled-channel-entry-smoke.mjs!", + "scripts/test-built-bundled-channel-entry-smoke.mts!", "scripts/update-clawtributors.ts!", "scripts/verify-stable-main-closeout.mjs!", "scripts/write-package-dist-inventory.ts!", @@ -97,8 +101,25 @@ const repositoryScriptEntries = [ "skills/meme-maker/scripts/meme.mjs!", ] as const; +// Compatibility shims are executable roots and load their typed implementations by computed URL, +// which Knip cannot follow in either direction. +function listScriptShimEntries(dir = "scripts"): string[] { + return fs.readdirSync(dir, { withFileTypes: true }).flatMap((entry) => { + const entryPath = path.join(dir, entry.name); + if (entry.isDirectory()) { + return listScriptShimEntries(entryPath); + } + if (!entry.isFile() || (!entry.name.endsWith(".mjs") && !entry.name.endsWith(".js"))) { + return []; + } + const implementationPath = entryPath.replace(/\.(?:mjs|js)$/u, ".mts"); + return fs.existsSync(implementationPath) ? [`${entryPath}!`, `${implementationPath}!`] : []; + }); +} + const rootEntries = [ ...repositoryScriptEntries, + ...listScriptShimEntries(), // Knip loads these audit configurations directly by command-line path. "config/knip.config.ts!", "config/knip.all-exports.config.ts!", @@ -161,7 +182,7 @@ const rootEntries = [ // Package-script owners invoke these generated-artifact modules directly. "src/config/doc-baseline.ts!", "src/plugins/runtime-sidecar-paths-baseline.ts!", - // Imported by scripts/tsdown-build.mjs as the AI package build configuration. + // Imported by scripts/tsdown-build.mts as the AI package build configuration. "tsdown.ai.config.ts!", // Maintainer-owned compatibility data referenced by release/docs workflows. "src/commands/doctor/shared/deprecation-compat.ts!", @@ -266,7 +287,7 @@ const rootToolingAndWorkspaceDependencies = [ "@lit-labs/signals", "@lit/context", "@lit/task", - // scripts/ui.js anchors these lookups at ui/package.json before invoking the UI workspace. + // scripts/ui.mts anchors these lookups at ui/package.json before invoking the UI workspace. "@vitest/browser-playwright", "dompurify", // Root typecheck/test projects compile @openclaw/net-policy source directly. @@ -691,7 +712,7 @@ const config = { [`${BUNDLED_PLUGIN_ROOT_DIR}/deepinfra`]: bundledPluginWorkspace(), [`${BUNDLED_PLUGIN_ROOT_DIR}/discord`]: bundledPluginWorkspace(), [`${BUNDLED_PLUGIN_ROOT_DIR}/diffs`]: bundledPluginWorkspace([ - // scripts/build-diffs-viewer-runtime.mjs bundles this browser entry. + // scripts/build-diffs-viewer-runtime.mts bundles this browser entry. "src/viewer-client.ts!", ]), [`${BUNDLED_PLUGIN_ROOT_DIR}/elevenlabs`]: bundledPluginWorkspace(), diff --git a/config/knip.scripts-exports.config.ts b/config/knip.scripts-exports.config.ts index 88c0ac4087cc..0e0cb8e5ea86 100644 --- a/config/knip.scripts-exports.config.ts +++ b/config/knip.scripts-exports.config.ts @@ -5,10 +5,21 @@ * companion pass keeps the rest of scripts/** as library project files and * makes repository tests real consumers of deliberately testable helpers. */ +import fs from "node:fs"; import productionConfig from "./knip.config.ts"; -const scriptEntries = productionConfig.workspaces["."].entry.filter((entry) => - entry.startsWith("scripts/"), +function isTypedShimImplementationEntry(entry: string): boolean { + const filePath = entry.endsWith("!") ? entry.slice(0, -1) : entry; + // The export-free Crabbox implementation must remain a root so its library imports stay live. + if (!filePath.endsWith(".mts") || filePath === "scripts/crabbox-wrapper.mts") { + return false; + } + const basePath = filePath.slice(0, -".mts".length); + return fs.existsSync(`${basePath}.mjs`) || fs.existsSync(`${basePath}.js`); +} + +const scriptEntries = productionConfig.workspaces["."].entry.filter( + (entry) => entry.startsWith("scripts/") && !isTypedShimImplementationEntry(entry), ); const repositoryToolEntries = [ diff --git a/config/swiftlint.yml b/config/swiftlint.yml index 890f02448ade..d59ac8394d98 100644 --- a/config/swiftlint.yml +++ b/config/swiftlint.yml @@ -20,7 +20,7 @@ excluded: - "*.playground" # Generated (protocol-gen-swift.ts) - ../apps/macos/Sources/OpenClawProtocol/GatewayModels.swift - # Generated (generate-host-env-security-policy-swift.mjs) + # Generated (generate-host-env-security-policy-swift.mts) - ../apps/macos/Sources/OpenClaw/HostEnvSecurityPolicy.generated.swift analyzer_rules: diff --git a/docs/ci.md b/docs/ci.md index 207b62af7a5f..2cb7c4116622 100644 --- a/docs/ci.md +++ b/docs/ci.md @@ -120,7 +120,7 @@ The slowest Node test families are split or balanced so each job stays small wit - Node shard and build-artifact jobs also restore Node's portable on-disk compile cache through immutable Actions caches. Independent `test` and `build` namespaces prevent their writers from replacing each other's archives: the scheduled test warmer owns the protected test seed, while `build-artifacts` may publish at most one protected build archive per UTC day from trusted `main` pushes. PR and ordinary test jobs only read protected snapshots, so feature-branch bytecode never enters the shared seed and PR traffic creates no cache archives. This reuses V8 bytecode for Node-loaded orchestration, build tooling, and external dependencies across different checkout paths, including when only part of the source graph changes. Vitest child processes disable an inherited compile cache because coverage can be enabled inside dynamic configs and V8 coverage can lose source-position precision when scripts are deserialized from bytecode. - The build-artifact job also persists content-fingerprinted `build-all` step outputs. CI's self-built plugin SDK declarations hash the complete repository-owned TypeScript/JSON source graph, exclude installed and generated directories, and restore both flat declarations and package bridges after `tsdown` clears `dist`. Documentation, workflow, plugin, and other changes outside that graph can reuse the declaration snapshot; source changes rebuild it before the export gate runs. - Full declaration builds split `tsdown` into AI, workspace-package, and unified groups. Each group caches declarations only, then still rebuilds runtime JavaScript before restoring those declarations. Core or plugin changes therefore invalidate only the large unified graph, while workspace-package changes conservatively invalidate every dependent declaration group. Public full builds generally use an immutable Actions cache; coarse restore keys seed partial changes, per-group content fingerprints reject stale data, and GitHub's cache quota evicts old generations. The weekly Node 22 lane instead publishes a 14-day artifact after successful `main` runs and restores only artifacts whose immutable producer identity resolves to that workflow on `main`, avoiding quota churn without allowing PR code to write a shared cache. Private-QA declarations are never persisted in Actions caches because cache namespaces are not confidentiality boundaries. -- `check-additional-*` stripes the supplemental boundary guard list (`scripts/run-additional-boundary-checks.mjs`) into one prompt-heavy shard (`check-additional-boundaries-a`, which includes the Codex prompt snapshot drift check) and one combined shard for the remaining stripes (`check-additional-boundaries-bcd`), each running independent guards concurrently and printing per-check timings. Package-boundary compile/canary work stays together, and runtime topology architecture runs separately from the gateway watch coverage embedded in `build-artifacts`. +- `check-additional-*` stripes the supplemental boundary guard list (`scripts/run-additional-boundary-checks.mts`) into one prompt-heavy shard (`check-additional-boundaries-a`, which includes the Codex prompt snapshot drift check) and one combined shard for the remaining stripes (`check-additional-boundaries-bcd`), each running independent guards concurrently and printing per-check timings. Package-boundary compile/canary work stays together, and runtime topology architecture runs separately from the gateway watch coverage embedded in `build-artifacts`. - On the 32-vCPU self-hosted build runner, Gateway watch, channel tests, and the core support-boundary shard start together inside `build-artifacts` after `dist/` and `dist-runtime/` are already built. GitHub-hosted fallback runs keep Gateway watch serial so low-core contention cannot consume its readiness deadline. Both paths then run the two built TUI PTY artifact canaries alone; the dedicated Node shard owns the full serial suite. Once admitted, canonical Linux CI permits up to 28 concurrent Node test jobs and @@ -219,7 +219,7 @@ ratchet-down when cleanup lowers the real count. - `config/env-var-count-budget.txt` caps the number of distinct `OPENCLAW_*` names in production source under `src/`, `packages/`, and `extensions/` - (tests and QA Lab excluded). Checked by `node scripts/check-env-var-count.mjs`. + (tests and QA Lab excluded). Checked by `node --import tsx scripts/check-env-var-count.mts`. Removing env vars: lower the number in the same PR. Adding one is a config-surface decision — justify it in the PR body. - `docs/.generated/config-baseline.counts.json` caps the per-kind @@ -521,7 +521,7 @@ The slow Bun global install image-provider smoke is separately gated by `run_bun - a bare Node/Git runner for installer/update/plugin-dependency lanes; - a functional image that installs the same tarball into `/app` for normal functionality lanes. -Docker lane definitions live in `scripts/lib/docker-e2e-scenarios.mjs`, planner logic lives in `scripts/lib/docker-e2e-plan.mjs`, and the runner only executes the selected plan. The scheduler selects the image per lane with `OPENCLAW_DOCKER_E2E_BARE_IMAGE` and `OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE`, then runs lanes with `OPENCLAW_SKIP_DOCKER_BUILD=1`. +Docker lane definitions live in `scripts/lib/docker-e2e-scenarios.mts`, planner logic lives in `scripts/lib/docker-e2e-plan.mts`, and the runner only executes the selected plan. The scheduler selects the image per lane with `OPENCLAW_DOCKER_E2E_BARE_IMAGE` and `OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE`, then runs lanes with `OPENCLAW_SKIP_DOCKER_BUILD=1`. ### Tunables @@ -679,7 +679,7 @@ Local changed-lane logic lives in `scripts/changed-lanes.mjs` and is executed by - release metadata-only version bumps run targeted version/config/root-dependency checks; - unknown root/config changes fail safe to all check lanes. -Local changed-test routing lives in `scripts/test-projects.test-support.mjs` and is intentionally cheaper than `check:changed`: direct test edits run themselves, source edits prefer explicit mappings, then sibling tests and import-graph dependents. Shared group-room delivery config is one of the explicit mappings: changes to the group visible-reply config, source reply delivery mode, or the message-tool system prompt route through the core reply tests plus Discord and Slack delivery regressions so a shared default change fails before the first PR push. Use `OPENCLAW_TEST_CHANGED_BROAD=1 pnpm test:changed` only when the change is harness-wide enough that the cheap mapped set is not a trustworthy proxy. +Local changed-test routing lives in `scripts/test-projects.test-support.mts` and is intentionally cheaper than `check:changed`: direct test edits run themselves, source edits prefer explicit mappings, then sibling tests and import-graph dependents. Shared group-room delivery config is one of the explicit mappings: changes to the group visible-reply config, source reply delivery mode, or the message-tool system prompt route through the core reply tests plus Discord and Slack delivery regressions so a shared default change fails before the first PR push. Use `OPENCLAW_TEST_CHANGED_BROAD=1 pnpm test:changed` only when the change is harness-wide enough that the cheap mapped set is not a trustworthy proxy. ## Testbox validation diff --git a/docs/help/testing-live.md b/docs/help/testing-live.md index c01802073323..4d33ad5a226a 100644 --- a/docs/help/testing-live.md +++ b/docs/help/testing-live.md @@ -416,7 +416,7 @@ OPENCLAW_LIVE_CODEX_HARNESS=1 \ OPENCLAW_LIVE_CODEX_HARNESS_COMPACTION_STRESS_TURNS=8 \ OPENCLAW_LIVE_CODEX_HARNESS_LARGE_OUTPUT_BYTES=800000 \ OPENCLAW_LIVE_CODEX_HARNESS_DEBUG=1 \ - node scripts/test-live.mjs --quiet src/gateway/gateway-codex-harness.live.test.ts + node --import tsx scripts/test-live.mts --quiet src/gateway/gateway-codex-harness.live.test.ts ``` GPT-5.6 native Codex matrix: @@ -456,7 +456,7 @@ OPENCLAW_LIVE_OPENAI_LONG_CONTEXT=1 \ OPENCLAW_LIVE_OPENAI_LONG_CONTEXT_PROFILE=full \ OPENCLAW_LIVE_OPENAI_LONG_CONTEXT_METRICS=1 \ OPENCLAW_LIVE_OPENAI_LONG_CONTEXT_OUTPUT=1 \ - node scripts/test-live.mjs --quiet src/gateway/gateway-openai-long-context.live.test.ts + node --import tsx scripts/test-live.mts --quiet src/gateway/gateway-openai-long-context.live.test.ts ``` Reduced-budget recipe: @@ -466,7 +466,7 @@ OPENCLAW_LIVE_OPENAI_LONG_CONTEXT=1 \ OPENCLAW_LIVE_OPENAI_LONG_CONTEXT_PROFILE=reduced \ OPENCLAW_LIVE_OPENAI_LONG_CONTEXT_METRICS=1 \ OPENCLAW_LIVE_OPENAI_LONG_CONTEXT_OUTPUT=1 \ - node scripts/test-live.mjs --quiet src/gateway/gateway-openai-long-context.live.test.ts + node --import tsx scripts/test-live.mts --quiet src/gateway/gateway-openai-long-context.live.test.ts ``` ### Long-context hard oracles diff --git a/docs/help/testing.md b/docs/help/testing.md index 19a16a9d16cb..639f969d22e5 100644 --- a/docs/help/testing.md +++ b/docs/help/testing.md @@ -741,7 +741,7 @@ Native dependency policy: committed diff and prints wall time plus macOS max RSS. - `pnpm test:perf:changed:bench -- --worktree` benchmarks the current dirty tree by routing the changed file list through - `scripts/test-projects.mjs` and the root Vitest config. + `scripts/test-projects.mts` and the root Vitest config. - `pnpm test:perf:profile:main` writes a main-thread CPU profile for Vitest/Vite startup and transform overhead. - `pnpm test:perf:profile:runner` writes runner CPU+heap profiles for @@ -882,9 +882,9 @@ These Docker runners split into two buckets: `OPENCLAW_LIVE_GATEWAY_STEP_TIMEOUT_MS=45000`, and `OPENCLAW_LIVE_GATEWAY_MODEL_TIMEOUT_MS=90000`. Set `OPENCLAW_LIVE_MAX_MODELS` or the gateway env vars when you explicitly want a smaller cap or larger scan. -- `test:docker:all` builds the live Docker image once via `test:docker:live-build`, packs OpenClaw once as an npm tarball through `scripts/package-openclaw-for-docker.mjs`, then builds/reuses two `scripts/e2e/Dockerfile` images. The bare image is only the Node/Git runner for install/update/plugin-dependency lanes; those lanes mount the prebuilt tarball. The functional image installs the same tarball into `/app` for built-app functionality lanes. Docker lane definitions live in `scripts/lib/docker-e2e-scenarios.mjs`; planner logic lives in `scripts/lib/docker-e2e-plan.mjs`; `scripts/test-docker-all.mjs` executes the selected plan. The aggregate uses a weighted local scheduler: `OPENCLAW_DOCKER_ALL_PARALLELISM` controls process slots, while resource caps keep heavy live, npm-install, and multi-service lanes from all starting at once. If a single lane is heavier than the active caps, the scheduler can still start it when the pool is empty and then keeps it running alone until capacity is available again. Defaults are 10 slots, `OPENCLAW_DOCKER_ALL_LIVE_LIMIT=9`, `OPENCLAW_DOCKER_ALL_NPM_LIMIT=5`, and `OPENCLAW_DOCKER_ALL_SERVICE_LIMIT=7`; tune `OPENCLAW_DOCKER_ALL_WEIGHT_LIMIT` or `OPENCLAW_DOCKER_ALL_DOCKER_LIMIT` (and other `OPENCLAW_DOCKER_ALL__LIMIT` overrides) only when the Docker host has more headroom. The runner performs a Docker preflight by default, removes stale OpenClaw E2E containers, prints status every 30 seconds, stores successful lane timings in `.artifacts/docker-tests/lane-timings.json`, and uses those timings to start longer lanes first on later runs. Use `OPENCLAW_DOCKER_ALL_DRY_RUN=1` to print the weighted lane manifest without building or running Docker, or `node scripts/test-docker-all.mjs --plan-json` to print the CI plan for selected lanes, package/image needs, and credentials. +- `test:docker:all` builds the live Docker image once via `test:docker:live-build`, packs OpenClaw once as an npm tarball through `scripts/package-openclaw-for-docker.mjs`, then builds/reuses two `scripts/e2e/Dockerfile` images. The bare image is only the Node/Git runner for install/update/plugin-dependency lanes; those lanes mount the prebuilt tarball. The functional image installs the same tarball into `/app` for built-app functionality lanes. Docker lane definitions live in `scripts/lib/docker-e2e-scenarios.mts`; planner logic lives in `scripts/lib/docker-e2e-plan.mts`; `scripts/test-docker-all.mjs` executes the selected plan. The aggregate uses a weighted local scheduler: `OPENCLAW_DOCKER_ALL_PARALLELISM` controls process slots, while resource caps keep heavy live, npm-install, and multi-service lanes from all starting at once. If a single lane is heavier than the active caps, the scheduler can still start it when the pool is empty and then keeps it running alone until capacity is available again. Defaults are 10 slots, `OPENCLAW_DOCKER_ALL_LIVE_LIMIT=9`, `OPENCLAW_DOCKER_ALL_NPM_LIMIT=5`, and `OPENCLAW_DOCKER_ALL_SERVICE_LIMIT=7`; tune `OPENCLAW_DOCKER_ALL_WEIGHT_LIMIT` or `OPENCLAW_DOCKER_ALL_DOCKER_LIMIT` (and other `OPENCLAW_DOCKER_ALL__LIMIT` overrides) only when the Docker host has more headroom. The runner performs a Docker preflight by default, removes stale OpenClaw E2E containers, prints status every 30 seconds, stores successful lane timings in `.artifacts/docker-tests/lane-timings.json`, and uses those timings to start longer lanes first on later runs. Use `OPENCLAW_DOCKER_ALL_DRY_RUN=1` to print the weighted lane manifest without building or running Docker, or `node scripts/test-docker-all.mjs --plan-json` to print the CI plan for selected lanes, package/image needs, and credentials. - `Package Acceptance` is the GitHub-native package gate for "does this installable tarball work as a product?" It resolves one candidate package from `source=npm`, `source=ref`, `source=url`, `source=trusted-url`, or `source=artifact`, uploads it as `package-under-test`, then runs the reusable Docker E2E lanes against that exact tarball instead of repacking the selected ref. Profiles are ordered by breadth: `smoke`, `package`, `product`, and `full` (plus `custom` for an explicit lane list). See [Testing updates and plugins](/help/testing-updates-plugins) for the package/update/plugin contract, published-upgrade survivor matrix, release defaults, and failure triage. -- Build and release checks run `scripts/check-cli-bootstrap-imports.mjs` after tsdown. The guard walks the static built graph from `dist/entry.js` and `dist/cli/run-main.js` and fails if that pre-dispatch bootstrap graph statically imports any external package (Commander, prompt UI, undici, logging, and similar startup-heavy deps all count) before command dispatch; it also caps the bundled gateway run chunk at 70 KB and rejects static imports of known cold gateway paths (`control-ui-assets`, `diagnostic-stability-bundle`, `onboard-helpers`, `process-respawn`, `restart-sentinel`, `server-close`, `server-reload-handlers`) from that chunk. `scripts/release-check.ts` separately smoke-tests the packed CLI with `--help`, `onboard --help`, `doctor --help`, `status --json --timeout 1`, `config schema`, and `models list --provider openai`. +- Build and release checks run `scripts/check-cli-bootstrap-imports.mts` after tsdown. The guard walks the static built graph from `dist/entry.js` and `dist/cli/run-main.js` and fails if that pre-dispatch bootstrap graph statically imports any external package (Commander, prompt UI, undici, logging, and similar startup-heavy deps all count) before command dispatch; it also caps the bundled gateway run chunk at 70 KB and rejects static imports of known cold gateway paths (`control-ui-assets`, `diagnostic-stability-bundle`, `onboard-helpers`, `process-respawn`, `restart-sentinel`, `server-close`, `server-reload-handlers`) from that chunk. `scripts/release-check.ts` separately smoke-tests the packed CLI with `--help`, `onboard --help`, `doctor --help`, `status --json --timeout 1`, `config schema`, and `models list --provider openai`. - Package Acceptance legacy compatibility is capped at `2026.4.25` (`2026.4.25-beta.*` included). Through that cutoff, the harness tolerates only shipped-package metadata gaps: omitted private QA inventory entries, missing `gateway install --wrapper`, missing patch files in the tarball-derived git fixture, missing persisted `update.channel`, legacy plugin install-record locations, missing marketplace install-record persistence, and config metadata migration during `plugins update`. For packages after `2026.4.25`, those paths are strict failures. - Container smoke runners: `test:docker:openwebui`, `test:docker:onboard`, `test:docker:npm-onboard-channel-agent`, `test:docker:release-user-journey`, `test:docker:release-typed-onboarding`, `test:docker:release-media-memory`, `test:docker:release-upgrade-user-journey`, `test:docker:release-plugin-marketplace`, `test:docker:skill-install`, `test:docker:update-channel-switch`, `test:docker:upgrade-survivor`, `test:docker:published-upgrade-survivor`, `test:docker:session-runtime-context`, `test:docker:agents-delete-shared-workspace`, `test:docker:gateway-network`, `test:docker:browser-cdp-snapshot`, `test:docker:mcp-channels`, `test:docker:agent-bundle-mcp-tools`, `test:docker:cron-mcp-cleanup`, `test:docker:plugins`, `test:docker:plugin-update`, `test:docker:plugin-lifecycle-matrix`, and `test:docker:config-reload` boot one or more real containers and verify higher-level integration paths. - Docker/Bash E2E lanes that install the packed OpenClaw tarball through `scripts/lib/openclaw-e2e-instance.sh` cap `npm install` at `OPENCLAW_E2E_NPM_INSTALL_TIMEOUT` (default `600s`; set `0` to disable the wrapper for debugging). diff --git a/docs/plugins/sdk-testing.md b/docs/plugins/sdk-testing.md index 1164148ee017..ef295e10a710 100644 --- a/docs/plugins/sdk-testing.md +++ b/docs/plugins/sdk-testing.md @@ -337,7 +337,7 @@ pnpm test src/plugins/contracts/runtime-seams.contract.test.ts ## Lint enforcement (in-repo plugins) -`scripts/run-additional-boundary-checks.mjs` runs a set of `lint:plugins:*` +`scripts/run-additional-boundary-checks.mts` runs a set of `lint:plugins:*` import-boundary checks in CI; each can also be run standalone locally: | Command | Enforces | diff --git a/docs/providers/openai.md b/docs/providers/openai.md index 9510f61eb2e1..992830b3b157 100644 --- a/docs/providers/openai.md +++ b/docs/providers/openai.md @@ -1131,8 +1131,8 @@ compatibility fallback when the shared never prints token material: ```bash - OPENCLAW_LIVE_TEST=1 OPENCLAW_LIVE_GPT_LIVE=1 node scripts/test-live.mjs -- extensions/openai/realtime-quicksilver.live.test.ts - OPENCLAW_LIVE_TEST=1 OPENCLAW_LIVE_GPT_LIVE=1 node scripts/test-live.mjs -- extensions/openai/realtime-quicksilver-gateway-bridge.live.test.ts + OPENCLAW_LIVE_TEST=1 OPENCLAW_LIVE_GPT_LIVE=1 node --import tsx scripts/test-live.mts -- extensions/openai/realtime-quicksilver.live.test.ts + OPENCLAW_LIVE_TEST=1 OPENCLAW_LIVE_GPT_LIVE=1 node --import tsx scripts/test-live.mts -- extensions/openai/realtime-quicksilver-gateway-bridge.live.test.ts ``` diff --git a/docs/reference/RELEASING.md b/docs/reference/RELEASING.md index 13df3129889b..e43c74a90eef 100644 --- a/docs/reference/RELEASING.md +++ b/docs/reference/RELEASING.md @@ -490,7 +490,7 @@ Use this box to answer "does the release behave correctly in QA scenarios and li ### Package -The Package box is the installable-product gate. It is backed by `Package Acceptance` and the resolver `scripts/resolve-openclaw-package-candidate.mjs`. The resolver normalizes a candidate into the `package-under-test` tarball consumed by Docker E2E, validates the package inventory, records the package version and SHA-256, and keeps the workflow harness ref separate from the package source ref. +The Package box is the installable-product gate. It is backed by `Package Acceptance` and the resolver `scripts/resolve-openclaw-package-candidate.mts`. The resolver normalizes a candidate into the `package-under-test` tarball consumed by Docker E2E, validates the package inventory, records the package version and SHA-256, and keeps the workflow harness ref separate from the package source ref. Supported candidate sources: @@ -719,7 +719,7 @@ If a maintainer must fall back to local npm authentication, run any 1Password CL - [`.github/workflows/openclaw-release-checks.yml`](https://github.com/openclaw/openclaw/blob/main/.github/workflows/openclaw-release-checks.yml) - [`.github/workflows/openclaw-cross-os-release-checks-reusable.yml`](https://github.com/openclaw/openclaw/blob/main/.github/workflows/openclaw-cross-os-release-checks-reusable.yml) - [`.github/workflows/docker-release.yml`](https://github.com/openclaw/openclaw/blob/main/.github/workflows/docker-release.yml) -- [`scripts/resolve-openclaw-package-candidate.mjs`](https://github.com/openclaw/openclaw/blob/main/scripts/resolve-openclaw-package-candidate.mjs) +- [`scripts/resolve-openclaw-package-candidate.mts`](https://github.com/openclaw/openclaw/blob/main/scripts/resolve-openclaw-package-candidate.mts) - [`scripts/openclaw-npm-release-check.ts`](https://github.com/openclaw/openclaw/blob/main/scripts/openclaw-npm-release-check.ts) - [`scripts/package-mac-dist.sh`](https://github.com/openclaw/openclaw/blob/main/scripts/package-mac-dist.sh) - [`scripts/make_appcast.sh`](https://github.com/openclaw/openclaw/blob/main/scripts/make_appcast.sh) diff --git a/docs/reference/test.md b/docs/reference/test.md index f3def3a4ec3e..f390be73d1d9 100644 --- a/docs/reference/test.md +++ b/docs/reference/test.md @@ -95,7 +95,7 @@ Test wrapper runs end with a short `[test] passed|failed|skipped ... in ...` sum - `src/test-utils/openclaw-test-state.ts`: use from Vitest when a test needs an isolated `HOME`, `OPENCLAW_STATE_DIR`, `OPENCLAW_CONFIG_PATH`, config fixture, workspace, agent dir, or auth-profile store. - `pnpm test:env-mutations:report`: non-blocking report of tests/harnesses that mutate `HOME`, `OPENCLAW_STATE_DIR`, `OPENCLAW_CONFIG_PATH`, `OPENCLAW_WORKSPACE_DIR`, or related env keys directly. Use it to find migration candidates for the shared test-state helper. - `test/helpers/openclaw-test-instance.ts`: process-level E2E tests needing a running Gateway, CLI env, log capture, and cleanup in one place. -- Docker/Bash E2E lanes that source `scripts/lib/docker-e2e-image.sh` can pass `docker_e2e_test_state_shell_b64