nemoclaw-blueprint/policies/presets/wechat.yaml (1)

18-38: Run the network-policy E2E for this preset before merge.

This adds wildcard egress on two public TLDs, so a selective network-policy-e2e run is the safest check that deny-by-default, whitelist, hot-reload, and SSRF behavior still hold with the new preset.

As per coding guidelines "nemoclaw-blueprint/policies/**: This directory contains network policy definitions and presets. Changes affect sandbox egress rules and SSRF filtering. E2E test recommendation: network-policy-e2e."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@nemoclaw-blueprint/policies/presets/wechat.yaml` around lines 18 - 38, Run
the network-policy-e2e test targeting the new preset named "wechat_bridge" under
network_policies to validate wildcard egress to hosts "*.wechat.com" and
"*.weixin.qq.com"; specifically execute the selective network-policy-e2e suite
and verify deny-by-default, whitelist enforcement, hot-reload behavior, and SSRF
filtering still work with the added endpoints and binaries entries (check
endpoints -> host entries and binaries paths) before merging.

src/ext/wechat/login.ts (1)

136-251: 🏗️ Heavy lift

Split the login state machine into smaller helpers.

runWechatHostQrLogin() is carrying bootstrap, polling, redirect handling, expiry recovery, timeout/abort checks, and user messaging in one branch-heavy loop. Pulling the per-state transitions into helpers would make the protocol easier to extend and safer to change.

As per coding guidelines, **/*.{js,ts,tsx}: Keep function complexity low.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/ext/wechat/login.ts` around lines 136 - 251, The runWechatHostQrLogin
function is too large and stateful; split the per-state logic into small helper
functions to reduce complexity: extract the polling loop into a short
coordinator in runWechatHostQrLogin that calls state handlers like
handleWait(status), handleScanned(status), handleRedirect(status),
handleExpired(session), and handleConfirmed(status) (or similar names) so each
helper owns its transitions and side effects (calls to opts.sleep, opts.log,
emitQr, fetchWechatQrSession, and updating
currentBaseUrl/scannedAnnounced/qrRefreshCount). Keep the existing calls to
pollWechatQrStatus, fetchWechatQrSession, emitQr, errorMessage, and debug,
ensure abort/timeout checks remain in the coordinator, and return the same
WechatLoginResult values from the helpers (or bubble them up) so behavior is
unchanged while reducing complexity in runWechatHostQrLogin.

scripts/generate-openclaw-config.py (1)

400-404: 💤 Low value

Consider removing unused _wechat_config parsing or adding a validation check.

The _wechat_config variable is decoded but never used in this file. While the comment block at lines 450-467 explains that WeChat channel configuration is handled by seed-wechat-accounts.py, parsing the config here without using it may cause confusion.

Consider either:

1. Removing the decode entirely since it's not needed here, or
2. Adding a validation check (e.g., verifying required fields exist) if early validation is intended

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/generate-openclaw-config.py` around lines 400 - 404, The decoded but
unused variable _wechat_config (created from
env.get("NEMOCLAW_WECHAT_CONFIG_B64") via base64.b64decode and json.loads)
should either be removed to avoid confusion or validated if early checks are
intended: either delete the whole _wechat_config parsing expression, or after
creating _wechat_config verify required keys (e.g., "app_id", "app_secret" or
whatever seed-wechat-accounts.py expects) and raise/log a clear error if missing
so the intent is explicit; update corresponding comments to reference
seed-wechat-accounts.py if you keep validation.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

src/lib/onboard.ts (1)

5486-5524: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Persist WeChat QR metadata somewhere durable, and merge it fill-only-if-missing.

This still only survives the current onboard session. A fresh nemoclaw onboard creates a new session before this code runs, so a saved WECHAT_BOT_TOKEN can still rebuild with no WECHAT_ACCOUNT_ID / WECHAT_BASE_URL / WECHAT_USER_ID. Also, the fallback on Lines 5501-5505 only runs when all fields are missing, so a partial env state will overwrite the recorded triple with a partial object on Lines 5517-5524.

Store the QR metadata in state that survives fresh onboard runs, and backfill missing fields individually instead of replacing the whole object.

Based on learnings: implement fill-only-if-missing semantics so stored values only backfill missing entries and never depend on overwriting explicitly provided environment state.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/onboard.ts` around lines 5486 - 5524, The code must persist WeChat QR
metadata into durable state and merge recorded values on a per-field
fill-only-if-missing basis instead of overwriting the whole object; update the
block that builds wechatConfig (the branch guarded by
enabledTokenEnvKeys.has("WECHAT_BOT_TOKEN") and the normalizeCredentialValue
calls) to: 1) read a durable store (not just onboardSession.loadSession()) that
survives fresh `nemoclaw onboard` runs to retrieve prior wechat metadata, 2) for
each field (accountId, baseUrl, userId) set wechatConfig.field = envValue ||
recordedValue (i.e., only backfill when the env-normalized value is empty), and
3) when calling onboardSession.updateSession (current.wechatConfig) write back
the merged object but do not overwrite recorded durable storage with
empty/missing values—only persist newly discovered non-empty fields. Use the
existing symbols wechatConfig, normalizeCredentialValue,
onboardSession.loadSession(), and onboardSession.updateSession() to locate the
logic to change.

Dockerfile.base (1)

208-241: Run the container-level E2E matrix for this base-image change before merge.

This layer now bakes a third-party plugin install path into the base image; please validate with the recommended E2E jobs (cloud-e2e, sandbox-survival-e2e, hermes-e2e, rebuild-openclaw-e2e), not only unit tests.

As per coding guidelines, Dockerfile.base: "This file affects the sandbox container image. Layer ordering, permissions, and baked config changes are only testable with a real container build."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Dockerfile.base` around lines 208 - 241, The Dockerfile.base change bakes the
`@tencent-weixin/openclaw-weixin` plugin (ARG WECHAT_PLUGIN_VERSION) into a
sandbox layer via the RUN openclaw plugins install command while switching USER
sandbox/root; before merging, build this base image and run the full container
E2E matrix (cloud-e2e, sandbox-survival-e2e, hermes-e2e, rebuild-openclaw-e2e),
verifying the plugin files exist under /sandbox/.openclaw/extensions, file
ownership/permissions are correct for the sandbox user, the agent process starts
cleanly, onboarding and openclaw doctor --fix behavior remain unchanged, and the
plugin version aligns with WECHAT_ILINK_CLIENT_VERSION in src/ext/wechat/qr.ts.
Ensure any failures are fixed (adjust layering, permissions, or install
location) and re-run the E2E jobs until all pass.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

src/lib/onboard.ts (2)

7834-7841: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Persist WeChat QR metadata before leaving step 5.

result.extraEnv only lands in process.env here. If onboarding is interrupted after messaging setup but before createSandbox() updates current.wechatConfig, resume keeps WECHAT_BOT_TOKEN but loses WECHAT_ACCOUNT_ID / WECHAT_BASE_URL / WECHAT_USER_ID, so the sandbox falls back to a fresh QR login.

Suggested fix

       if (result.extraEnv) {
         for (const [key, value] of Object.entries(result.extraEnv)) {
           process.env[key] = value;
         }
+        onboardSession.updateSession((current: Session) => {
+          current.wechatConfig = {
+            accountId:
+              result.extraEnv.WECHAT_ACCOUNT_ID ?? current.wechatConfig?.accountId,
+            baseUrl:
+              result.extraEnv.WECHAT_BASE_URL ?? current.wechatConfig?.baseUrl,
+            userId:
+              result.extraEnv.WECHAT_USER_ID ?? current.wechatConfig?.userId,
+          };
+          return current;
+        });
       }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/onboard.ts` around lines 7834 - 7841, The extraEnv values are only
written to process.env, so if onboarding is interrupted before createSandbox()
sets current.wechatConfig the account metadata (WECHAT_ACCOUNT_ID,
WECHAT_BASE_URL, WECHAT_USER_ID) is lost; update the persistent onboarding state
with those WeChat fields as soon as result.extraEnv is available (e.g. merge the
relevant keys from result.extraEnv into current.wechatConfig or call the
existing state/save function) in the same block that writes process.env,
ensuring WECHAT_BOT_TOKEN, WECHAT_ACCOUNT_ID, WECHAT_BASE_URL and WECHAT_USER_ID
are stored to current.wechatConfig so resume flows use them even if
createSandbox() never runs.

---

7809-7816: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Wrap the host-QR handler call in try/catch, not promise .catch().

Line 7813 still lets a synchronous throw escape before .catch() is attached, so onboarding can abort instead of skipping the channel. If a future handler stops being async or throws during setup, this path regresses.

Suggested fix

-      const result = await handler().catch((err: unknown) => ({
-        kind: "error" as const,
-        message: err instanceof Error ? err.message : String(err),
-      }));
+      let result;
+      try {
+        result = await handler();
+      } catch (err: unknown) {
+        result = {
+          kind: "error" as const,
+          message: err instanceof Error ? err.message : String(err),
+        };
+      }

In JavaScript/TypeScript, does `await handler().catch(...)` catch exceptions thrown synchronously before `handler()` returns a promise?

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/onboard.ts` around lines 7809 - 7816, The current code uses await
handler().catch(...) which does not catch synchronous throws thrown before
handler() returns a Promise; replace that pattern with a try/catch around the
await call: call handler() inside a try block (const result = await handler()),
and in the catch block set result to the structured error object ({ kind:
"error" as const, message: err instanceof Error ? err.message : String(err) }).
Update the variable declaration for result so it exists in the outer scope
(e.g., let result;) and ensure the error object uses the same shape expected
downstream.

docs/manage-sandboxes/messaging-channels.md (3)

31-31: ⚡ Quick win

Replace clause-separating colons with periods/commas.

Lines 31, 71, and 75 use colons as general punctuation rather than to introduce lists.

As per coding guidelines, "Colons should only introduce a list. Flag colons used as general punctuation between clauses."

Also applies to: 71-71, 75-75

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/manage-sandboxes/messaging-channels.md` at line 31, Replace
clause-separating colons used as general punctuation with periods or commas in
the three sentences flagged: change "WeChat is an exception: it is wired up
during `nemoclaw onboard` only — see [Add Channels After
Onboarding](`#add-channels-after-onboarding`) for the limitation." to use a period
or comma instead of the colon, and similarly update the sentences at the other
flagged occurrences (the lines containing the same colon-used-as-clause pattern
at lines 71 and 75) so colons only introduce lists; ensure the punctuation flows
grammatically (period or comma) and keep the backticked command and link text
intact.

---

7-7: ⚡ Quick win

Split description.agent to one sentence per source line.

Line 7 packs two sentences into one line, which breaks the docs diff-readability rule.

As per coding guidelines, "One sentence per line in source (makes diffs readable)."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/manage-sandboxes/messaging-channels.md` at line 7, The description.agent
string currently contains two sentences on one source line; split it so each
sentence is on its own line to follow the "one sentence per line" rule — locate
the description.agent entry in messaging-channels.md (the agent: "Explains how
Telegram, Discord, Slack, and WeChat reach the sandboxed OpenClaw agent through
OpenShell-managed processes and NemoClaw channel commands. Use when setting up
messaging channels, chat interfaces, or integrations without relying on nemoclaw
tunnel start for bridges.") and break it into two lines, one with the sentence
about which platforms reach the sandboxed OpenClaw agent and a second line
starting "Use when setting up..." so each sentence is a separate source line.

---

69-75: ⚡ Quick win

Reduce em-dash density in this paragraph (LLM pattern detected).

This paragraph uses multiple em dashes; keep at most one per paragraph and use periods/commas for the rest.

As per coding guidelines, "Excessive em dashes. One per paragraph is fine; multiple per paragraph or em dashes used instead of commas/periods should be flagged."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/manage-sandboxes/messaging-channels.md` around lines 69 - 75, The
paragraph in messaging-channels.md overuses em dashes; edit the text so it
contains at most one em dash and convert other dash-separated clauses into
sentences or comma clauses, preserving meaning and tokens like
<sandbox>-wechat-bridge, openshell:resolve:env:WECHAT_BOT_TOKEN, and the env var
NEMOCLAW_WECHAT_QUIET; ensure the sentence about personal WeChat (bot_type=3),
the QR handshake flow that captures token/accountId/baseUrl/userId, and the
DM-only allowIdsMode: "dm" behavior are preserved but reflowed with periods or
commas instead of multiple em dashes.

docs/manage-sandboxes/messaging-channels.md (7)

213-213: ⚡ Quick win

Rewrite in active voice.

The phrase "are produced by" uses passive voice.

♻️ Suggested rewrite

-For WeChat specifically, the in-sandbox bridge emits a single `[wechat] [<accountId>] provider ready` line on stderr after the first successful iLink hit and an annotated line when the agent turn fails after the provider connected; both are produced by the diagnostics preload and are useful for telling "channel up, inference broken" apart from "channel never connected".
+For WeChat specifically, the in-sandbox bridge emits a single `[wechat] [<accountId>] provider ready` line on stderr after the first successful iLink hit and an annotated line when the agent turn fails after the provider connected; the diagnostics preload produces both and they help distinguish "channel up, inference broken" from "channel never connected".

As per coding guidelines: "Active voice required. Flag passive constructions."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/manage-sandboxes/messaging-channels.md` at line 213, Rewrite the passive
clause "are produced by the diagnostics preload" into active voice; locate the
sentence containing "[wechat] [<accountId>] provider ready" and change it to
something like "the diagnostics preload emits these lines" (or "the diagnostics
preload produces both lines") so the sentence reads actively and clearly
attributes the emission to diagnostics preload.

---

33-34: ⚡ Quick win

Split into one sentence per line.

The guidelines require one sentence per line in Markdown source to make diffs readable.
Break this into two lines:

-WeChat is an exception.
-It is wired up during `nemoclaw onboard` only — see [Add Channels After Onboarding](`#add-channels-after-onboarding`) for the limitation.
+WeChat is an exception.
+It is wired up during `nemoclaw onboard` only — see [Add Channels After Onboarding](`#add-channels-after-onboarding`) for the limitation.

As per coding guidelines: "One sentence per line in source (makes diffs readable). Flag paragraphs where multiple sentences appear on the same line."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/manage-sandboxes/messaging-channels.md` around lines 33 - 34, The
two-sentence paragraph ("WeChat is an exception. It is wired up during `nemoclaw
onboard` only — see [Add Channels After
Onboarding](`#add-channels-after-onboarding`) for the limitation.") should be
split so each sentence is on its own line in the Markdown source; update the
content in messaging-channels.md so the first line is "WeChat is an exception."
and the second line is "It is wired up during `nemoclaw onboard` only — see [Add
Channels After Onboarding](`#add-channels-after-onboarding`) for the limitation."

---

78-78: ⚡ Quick win

Rewrite in active voice.

The phrase "is added to" uses passive voice.

♻️ Suggested rewrite

-WeChat is DM-only (`allowIdsMode: "dm"`) — the operator who scanned the QR is added to `WECHAT_ALLOWED_IDS` automatically, and you can append more comma-separated WeChat user IDs through the same env var.
+WeChat is DM-only (`allowIdsMode: "dm"`) — NemoClaw adds the operator who scanned the QR to `WECHAT_ALLOWED_IDS` automatically, and you can append more comma-separated WeChat user IDs through the same env var.

As per coding guidelines: "Active voice required. Flag passive constructions."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/manage-sandboxes/messaging-channels.md` at line 78, Rewrite the passive
sentence into active voice: instead of "the operator who scanned the QR is added
to `WECHAT_ALLOWED_IDS` automatically," change it to state the system/action
actively adds the operator to `WECHAT_ALLOWED_IDS` (e.g., "the system
automatically adds the operator who scanned the QR to `WECHAT_ALLOWED_IDS`");
keep and reference `allowIdsMode: "dm"` and `WECHAT_ALLOWED_IDS` so the line
reads clearly like "With `allowIdsMode: "dm"`, the system automatically adds the
operator who scanned the QR to `WECHAT_ALLOWED_IDS`, and you can append more
comma-separated WeChat user IDs via the same env var."

---

77-77: ⚡ Quick win

Rewrite in active voice.

The sentence uses passive constructions ("is registered," "replaced").

♻️ Suggested rewrite

-The token is registered as the `<sandbox>-wechat-bridge` OpenShell provider and replaced inside the sandbox by the `openshell:resolve:env:WECHAT_BOT_TOKEN` placeholder, so it is never baked into the image or written to disk inside the running container.
+NemoClaw registers the token as the `<sandbox>-wechat-bridge` OpenShell provider and replaces it inside the sandbox with the `openshell:resolve:env:WECHAT_BOT_TOKEN` placeholder, so the token is never baked into the image or written to disk inside the running container.

As per coding guidelines: "Active voice required. Flag passive constructions."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/manage-sandboxes/messaging-channels.md` at line 77, Rewrite the sentence
in active voice: state that "we" (or the system) registers the token as the
`<sandbox>-wechat-bridge` OpenShell provider and that this registration replaces
the token inside the sandbox with the `openshell:resolve:env:WECHAT_BOT_TOKEN`
placeholder, ensuring the token is never baked into the image or written to disk
inside the running container; update the line to use that active-voice wording
and remove the passive phrases "is registered" and "replaced."

---

136-136: ⚡ Quick win

Reduce em dash usage.

This sentence contains two em dashes, which the guidelines flag as excessive.

♻️ Suggested rewrite

-The reason is that the host-side iLink QR handshake — which is the only way to obtain a WeChat bot token — does not fit the paste-prompt model the other channels use, and the `channels add` command has no slot for the per-account metadata (`accountId`, `baseUrl`, `userId`) that the in-sandbox bridge needs to start.
+The reason is that the host-side iLink QR handshake (the only way to obtain a WeChat bot token) does not fit the paste-prompt model the other channels use, and the `channels add` command has no slot for the per-account metadata (`accountId`, `baseUrl`, `userId`) that the in-sandbox bridge needs to start.

As per coding guidelines: "Excessive em dashes. One per paragraph is fine; multiple per paragraph or em dashes used instead of commas/periods should be flagged."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/manage-sandboxes/messaging-channels.md` at line 136, The sentence in
docs/manage-sandboxes/messaging-channels.md overuses em dashes; rewrite it to
use at most one em dash or replace the clauses with commas/parentheses or a
period for clarity — e.g., explain that the host-side iLink QR handshake is the
only way to obtain a WeChat bot token and that it doesn't fit the paste-prompt
model used by other channels, and note that the `channels add` command has no
slot for the per-account metadata (`accountId`, `baseUrl`, `userId`) the
in-sandbox bridge needs to start.

---

105-105: ⚡ Quick win

Rewrite in active voice.

The phrase "cannot be configured" is passive.

♻️ Suggested rewrite

-WeChat cannot be configured non-interactively in this release because the iLink QR handshake requires a human to scan the QR on a paired phone.
+You cannot configure WeChat non-interactively in this release because the iLink QR handshake requires a human to scan the QR on a paired phone.

As per coding guidelines: "Active voice required. Flag passive constructions."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/manage-sandboxes/messaging-channels.md` at line 105, Rewrite the passive
sentence "WeChat cannot be configured non-interactively in this release because
the iLink QR handshake requires a human to scan the QR on a paired phone." into
active voice; replace it with an active construction such as "This release does
not support non-interactive configuration of WeChat because the iLink QR
handshake requires a human to scan the QR on a paired phone," updating the
sentence in the docs/managing-sandboxes messaging-channels content where the
original passive phrase appears.

---

54-54: ⚡ Quick win

Rewrite in active voice.

The phrase "Captured via host-side QR scan" uses passive voice.

♻️ Suggested rewrite

-| WeChat (personal) | Captured via host-side QR scan during `nemoclaw onboard` — no token to paste | `WECHAT_ALLOWED_IDS` for DM allowlisting (the WeChat user who scanned the QR is added automatically) |
+| WeChat (personal) | Host-side QR scan during `nemoclaw onboard` captures the token — no token to paste | `WECHAT_ALLOWED_IDS` for DM allowlisting (the WeChat user who scanned the QR is added automatically) |

As per coding guidelines: "Active voice required. Flag passive constructions."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/manage-sandboxes/messaging-channels.md` at line 54, The table row for
"WeChat (personal)" uses passive voice ("Captured via host-side QR scan");
change it to active voice by rephrasing the cell to something like "Host
captures it by scanning the QR during `nemoclaw onboard` — no token to paste"
(update the table row string containing "WeChat (personal) | Captured via
host-side QR scan during `nemoclaw onboard`" to the active phrasing and keep the
existing `WECHAT_ALLOWED_IDS` note unchanged).

docs/manage-sandboxes/messaging-channels.md (3)

35-35: ⚡ Quick win

Use active voice.

The phrase "is generated at image build time" uses passive voice.

Suggested rewrite:
"Do not run openclaw channels add or openclaw channels remove inside the sandbox because the image build generates /sandbox/.openclaw/openclaw.json at build time and changes inside the running container do not persist across rebuilds."

As per coding guidelines: "Active voice required. Flag passive constructions."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/manage-sandboxes/messaging-channels.md` at line 35, The sentence
contains passive voice ("is generated at image build time") — update the line
mentioning `/sandbox/.openclaw/openclaw.json` so it uses active voice; replace
the passive clause with an active construction such as: "the image build
generates `/sandbox/.openclaw/openclaw.json` at build time" in the sentence that
starts "Do not run `openclaw channels add` or `openclaw channels remove` inside
the sandbox..." to produce the suggested rewrite and remove the passive
phrasing.

---

73-73: 💤 Low value

Remove unnecessary bold emphasis.

The bold formatting on "personal WeChat" is not necessary. The guidelines reserve bold for UI labels, parameter names, and genuine warnings. This mode name does not require emphasis beyond the surrounding context.

Suggested rewrite:
"The supported mode in this release is personal WeChat (bot_type=3)."

As per coding guidelines: "Unnecessary bold on routine instructions" is an LLM pattern to avoid, and "Bold is reserved for UI labels, parameter names, and genuine warnings."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/manage-sandboxes/messaging-channels.md` at line 73, Remove the
unnecessary bold around "personal WeChat" in the sentence and replace it with
plain text so the line reads: The supported mode in this release is personal
WeChat (`bot_type=3`). Locate the string containing "**personal WeChat**
(`bot_type=3`)" and delete the bold markdown markers (**) while preserving the
inline code token `bot_type=3`.

---

74-74: ⚡ Quick win

Use active voice.

The phrase "are not wired up yet" uses passive voice.

Suggested rewrite:
"This release does not support WeChat Official Account or WeCom/Enterprise WeChat."

As per coding guidelines: "Active voice required. Flag passive constructions."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/manage-sandboxes/messaging-channels.md` at line 74, Replace the
passive-voice sentence "WeChat Official Account and WeCom/Enterprise WeChat are
not wired up yet." with an active-voice phrasing; for example change it to "This
release does not support WeChat Official Account or WeCom/Enterprise WeChat."
Update the string in the docs file where that exact sentence appears so the
documentation uses active voice.

src/lib/onboard.ts (1)

7792-7848: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Persist and rehydrate the WeChat QR metadata, not just the token.

createSandbox() can only seed WeChat from WECHAT_ACCOUNT_ID / WECHAT_BASE_URL / WECHAT_USER_ID or session.wechatConfig. Here, a saved WECHAT_BOT_TOKEN skips the host-QR handler entirely, and a fresh host-QR login only leaves result.extraEnv in process.env until step 6 runs. A fresh onboard with a cached token, or an interruption after this step but before createSandbox(), will recreate the sandbox with the token but without the account metadata and force another QR login.

Suggested fix

-    if (getMessagingToken(ch.envKey)) {
+    if (getMessagingToken(ch.envKey)) {
+      if (ch.name === "wechat") {
+        const recorded = onboardSession.loadSession()?.wechatConfig;
+        if (recorded?.accountId && !process.env.WECHAT_ACCOUNT_ID) {
+          process.env.WECHAT_ACCOUNT_ID = recorded.accountId;
+        }
+        if (recorded?.baseUrl && !process.env.WECHAT_BASE_URL) {
+          process.env.WECHAT_BASE_URL = recorded.baseUrl;
+        }
+        if (recorded?.userId && !process.env.WECHAT_USER_ID) {
+          process.env.WECHAT_USER_ID = recorded.userId;
+        }
+      }
       console.log(`  ✓ ${ch.name} — already configured`);
     } else if (ch.loginMethod === "host-qr") {
@@
       if (result.extraEnv) {
         for (const [key, value] of Object.entries(result.extraEnv)) {
           process.env[key] = value;
         }
+        if (ch.name === "wechat") {
+          onboardSession.updateSession((current: Session) => {
+            current.wechatConfig = {
+              accountId: result.extraEnv.WECHAT_ACCOUNT_ID,
+              baseUrl: result.extraEnv.WECHAT_BASE_URL,
+              userId: result.extraEnv.WECHAT_USER_ID,
+            };
+            return current;
+          });
+        }
       }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/onboard.ts` around lines 7792 - 7848, When a host-QR flow returns a
token you must also persist any non-secret metadata (result.extraEnv) so future
runs that skip the QR handler (via getMessagingToken(ch.envKey)) can rehydrate
those env keys before createSandbox runs; update the host-QR success path (the
block that calls saveCredential and sets process.env) to also store
result.extraEnv alongside the saved token (either by extending saveCredential to
accept metadata or adding a small saveMetadata helper) and ensure the early
branch where getMessagingToken(ch.envKey) is true rehydrates that stored
metadata into process.env (populate WECHAT_ACCOUNT_ID / WECHAT_BASE_URL /
WECHAT_USER_ID or session.wechatConfig equivalents) so createSandbox gets the
full WeChat config.

docs/manage-sandboxes/messaging-channels.md (3)

72-72: ⚡ Quick win

Remove non-essential bold from routine text (LLM pattern detected).

Bold formatting in this sentence reads as emphasis without a warning/UI-label context.

As per coding guidelines, "Unnecessary bold on routine instructions ... should be flagged. Bold is reserved for UI labels, parameter names, and genuine warnings."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/manage-sandboxes/messaging-channels.md` at line 72, The sentence uses
unnecessary bold around "personal WeChat"; update the sentence to remove the
bold formatting so it reads: personal WeChat (`bot_type=3`) instead of
**personal WeChat** (`bot_type=3`)—keep the inline code `bot_type=3` intact and
only remove the surrounding **...** around the phrase "personal WeChat".

---

191-192: ⚡ Quick win

Use WeChat casing in prose.

Both occurrences of wechat in prose should be WeChat (inline code uses are exempt).

As per coding guidelines, the word list requires "WeChat with a capital C," and code spans are the only exemption.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/manage-sandboxes/messaging-channels.md` around lines 191 - 192, Change
the lowercase "wechat" used in prose to the correct casing "WeChat" in the
sentence that describes `channels remove wechat` and the subsequent sentence
mentioning the `<sandbox>-wechat-bridge` provider and openclaw state files;
leave inline code spans (e.g., `channels remove wechat`,
`<sandbox>-wechat-bridge`, `openclaw.json`,
`/sandbox/.openclaw/openclaw-weixin/`) unchanged. Ensure both plain-text
occurrences are updated to "WeChat" to follow the style guide.

---

9-9: ⚡ Quick win

Use product-name casing in prose (NemoClaw).

nemoclaw appears in prose here and should be NemoClaw (keep lowercase only inside inline code).

As per coding guidelines, "NemoClaw is the correct form and nemoclaw in prose should be flagged."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/manage-sandboxes/messaging-channels.md` at line 9, Replace the lowercase
product name "nemoclaw" used in prose with the correct product-name casing
"NemoClaw" in the sentence "Use when setting up messaging channels, chat
interfaces, or integrations without relying on nemoclaw tunnel start for
bridges."; leave lowercase only when it appears inside inline code (e.g.,
`nemoclaw`) and ensure other prose occurrences in this document use "NemoClaw"
consistently.

src/lib/actions/sandbox/policy-channel.ts (1)

14-17: ⚡ Quick win

This require() is still eager, so unrelated commands now load host-QR dependencies.

Because this runs at module import time, Slack/Telegram/policy commands now pull in ../../host-qr-handlers and its transitive QR/iLink deps too. That defeats the isolation the comment describes and widens the failure surface unnecessarily.

Suggested fix

-// Lazy-required: keeps qrcode-terminal + the iLink HTTP client out of the
-// import graph for non-host-qr channels-add calls.
-const { HOST_QR_LOGIN_HANDLERS } = require("../../host-qr-handlers") as typeof import("../../host-qr-handlers");
 const onboardSession = require("../../state/onboard-session") as typeof import("../../state/onboard-session");

   if (isNonInteractive()) {
     console.error(
       `  '${channelArg}' requires an interactive QR login; cannot run in non-interactive mode.`,
@@
-  const handler = HOST_QR_LOGIN_HANDLERS[channelArg];
+  const { HOST_QR_LOGIN_HANDLERS } =
+    require("../../host-qr-handlers") as typeof import("../../host-qr-handlers");
+  const handler = HOST_QR_LOGIN_HANDLERS[channelArg];

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/actions/sandbox/policy-channel.ts` around lines 14 - 17, The
require() calls for HOST_QR_LOGIN_HANDLERS and onboardSession are executed at
module import time, pulling heavy host-QR deps into unrelated commands; change
them to be lazy-loaded where they are actually needed by moving the
require()/import() into the function(s) that use HOST_QR_LOGIN_HANDLERS and
onboardSession (e.g., inside the handler or helper that references those symbols
in policy-channel.ts) or use dynamic import() at the call site so these modules
are only loaded on-demand; ensure all references use the locally-imported values
and update any typings accordingly.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

scripts/generate-openclaw-config.py (1)

660-679: 💤 Low value

Remove unused _seed_wechat_accounts() function and subprocess import.

_seed_wechat_accounts() is dead code—it's never called within this file and not imported by any other modules. The subprocess module (line 45) is used exclusively by this function. The private naming convention (_seed_wechat_accounts) suggests internal use only, yet the function has no callers. Remove both the function and the now-unneeded import, or if it should be invoked as part of the configuration pipeline, add an explicit call in main().

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/generate-openclaw-config.py` around lines 660 - 679, The
_seed_wechat_accounts() function is unused and the subprocess import is only
referenced by it; remove dead code by deleting the _seed_wechat_accounts
function and the subprocess import (or alternatively, if seeding must run, add
an explicit invocation of _seed_wechat_accounts() inside main() and ensure
subprocess remains imported). Locate the function named _seed_wechat_accounts
and the top-level "import subprocess" and either delete both or add the call in
main() so the import is justified.