Real bug found in v2.1.0: ubuntu-runner zip preserved LF line endings, which
breaks Windows batch parsing. cmd.exe mis-tokenized 'setlocal' as 'local',
trashed env vars, and produced 'URL: //node--win-x64.zip' on Node download.
Symptom: Windows users who unzip and double-click setup.bat see a flood of
'XXX is not recognized as a command' errors followed by curl 'No host part'.
Fix: convert .bat/.cmd/.ps1 to CRLF, ensure .sh/.command/.mjs stay LF, before
zipping in the portable-skeleton job.
The previous job ran setup.{sh,bat} on the runner which downloaded Node.js +
3.4 GB of OpenClaw deps (clawdbot, @sliverp, node-llama-cpp), pushing the
Windows zip past GitHub's 2 GB single-file limit.
The portable folder is designed to fetch deps on first launch via setup.sh —
ship just the source skeleton (~1 MB) and let the user-side script populate
app/runtime + app/core/node_modules from China mirrors at first launch.
This also collapses portable-windows + portable-mac into one ubuntu-runner
job since the skeleton is platform-agnostic.
- 3-create-persistence.ps1: chain dd && mkfs.ext4 with && (was ;, so dd
failures still ran mkfs and produced bogus images); fix \wsl$\$wslDistro
variable expansion ambiguity using \${wslDistro}; mirror docker-desktop
branch with the same && chaining
- setup-openclaw.sh: guard mktemp failure; ensure partial node tarballs are
cleaned via EXIT trap; tolerate hosts with no non-loopback NIC under
pipefail; don't let test-installation.sh failure exit the post-install
- install.sh: add `set -o pipefail`; surface npm install failures (was
hidden by `| tail -5`); JSON-escape user-provided API_KEY before writing
to openclaw.json so keys with backslashes/quotes don't break the config
- Add SECURITY.md: private disclosure channel + scope
Two real bugs in the portable launchers:
1. Windows-Install.bat: xcopy reads from %TEMP%\node-<ver>-win-x64
but Expand-Archive extracts into %TEMP%\node-extract\node-<ver>-win-x64.
Result: empty runtime\node-win-x64\ on networked install path.
2. Mac-Start.command + Windows-Start.bat: legacy-config sync block
was placed AFTER the default-config block, so the "config.json
exists but openclaw.json doesn't" branch was unreachable. Existing
USB users with config.json never got their settings migrated;
they got the empty default instead.
Reordered so legacy migration runs first, default only as fallback.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
When users run setup.ps1 from PowerShell with cwd outside the repo
(e.g. C:\Users\Admin>), npm 11 walks up looking for package.json and
errors with ENOENT before honoring --prefix. setup.bat already pushd's
into core; setup.ps1 was missing the equivalent Push-Location guard.
Fixes#27 (setup.ps1 ENOENT package.json reported by lawler-code).
- agent.sh: add --uninstall flag, detect arm64/x86_64 for macOS
- agent.html: add uninstall section with tab switching
- guide.html: replace simple uninstall with full one-click uninstall blocks
in both oneclick-install and remote-support sections
- downloads: add agent-mac-intel binary for Intel Mac users
Add in-app WeChat scanning via Tencent iLink API:
- server.js: QR code PNG renderer, WeChat API proxy, plugin auto-install
- index.html: WeChat channel card with QR display and polling UI
- Windows-Start.bat: auto-install WeChat plugin on startup
- Windows-Install.bat: copy WeChat plugin during installation
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
PR #13 (luckylibin) version includes:
- QQ plugin installation step (was missing)
- --all-platforms flag to download Mac Node.js runtimes
- More robust error handling
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
