feat(ui): add empty state for overseer view when no goals exist

…ailway.json

- Guard resolveUserPath against undefined/null input in paths.js and utils.js
- Create src/agents/workspace-run.js with centralized workspace fallback
- Create src/logging/redact-identifier.js for SHA-256 identifier redaction
- Add classifySessionKeyShape to session-key.js for malformed key detection
- Update cli-runner.js and pi-embedded-runner/run.js to use workspace-run
- Pass agentId through all runner call sites (agent, cron, hooks, followup)
- Replace inline sha256HexPrefix in status-all/channels.js with shared util

Tasks completed: 2/2 (3 commits)
- Task 1: resolveUserPath undefined guard + workspace-run module (#25)
- Task 2: FAQ typo (#76) + .caf audio extension (#78)

SUMMARY: .planning/phases/13-paths-config-refactoring/13-01-SUMMARY.md

Add Cognito auth to frontend

All database operations now handle async DatabaseAdapter:
- seedEmbeddingCache() - async with transaction support
- readMeta() / writeMeta() - return Promises
- All stale file cleanup operations - awaited
- All session file cleanup operations - awaited
- Database close() - handle both sync/async variants
- Added init() method for async post-construction

All prepare().run/get/all() calls properly awaited.
All linting errors resolved.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

All database operations now handle async DatabaseAdapter:
- seedEmbeddingCache() - async with transaction support
- readMeta() / writeMeta() - return Promises
- All stale file cleanup operations - awaited
- All session file cleanup operations - awaited
- Database close() - handle both sync/async variants
- Added init() method for async post-construction

All prepare().run/get/all() calls properly awaited.
All linting errors resolved.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Co-authored-by: chatgpt-codex-connector[bot] <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

…w#25)

Markdown files (SKILL.md, MEMORY.md, HEARTBEAT.md) are loaded as agent
context and treated as authoritative instructions. Before this change,
skill-scanner.ts only scanned JS/TS files — leaving the primary injection
vector undetected.

Changes:
- Add MD_SCANNABLE_EXTENSIONS (.md, .txt) and isMdScannable() helper
- Add MD_LINE_RULES with two injection detection patterns:
  - 'injected-instruction': imperative openers (ignore/disregard/you are
    now/override/execute/act as/pretend you are) at line start
  - 'injected-instruction': hidden HTML comment instructions
    (<!-- ignore / <!-- system / <!-- override)
- Wire MD_LINE_RULES into scanSource() for .md/.txt files
- Include .md/.txt files in walkDirWithLimit() directory traversal

Severity: warn (not critical) — markdown instructions are common in
legitimate skill docs; the rules flag suspicious imperative patterns
for human review rather than blocking.

Fixes improvement item openclaw#25 from openclaw-improvement-ideas.md.

MOYENS (16):
- openclaw#1 generateReactiveFollowUp maxLength string vs number — aligne sur string
- openclaw#2 Multi-threading mort — filtre sur mappedLeads (avec score) au lieu de result.leads
- openclaw#3 _checkEmailSpecificity null safety — (prospectIntel || '').match()
- openclaw#4 totalContacts pre-dedup — utilise addedCount
- openclaw#5 Bounces tous hard_bounce — distinction soft/hard, soft = retry pas blacklist
- openclaw#8 _isSystemEmail includes() trop large — exact match + prefix patterns
- openclaw#10 sendBatch bypass warmup — recordSend dans domain-manager apres chaque envoi
- openclaw#11 Domain manager parsing ':' dans password — split limite a 4 segments
- openclaw#12 prospectDomains jamais nettoye — cleanup LRU max 2000 entries
- openclaw#13 trackNicheEvent('clicked') ignore — ajout compteur clicked
- openclaw#14 apStorage.getLeads() inexistant — utilise automailer storage.getEmails()
- openclaw#25 Interval HITL drafts jamais cleared — clearInterval dans gracefulShutdown

FAIBLES (9):
- openclaw#17 Retry skip prompt 25-35 mots → aligne sur 50-65 mots 4-blocs
- openclaw#18 _scoreAndFilter gate 60 mots → 80 mots (coherent avec prompts)
- openclaw#19 "curieux d'avoir ton retour" autorise dans follow-ups → remplace
- openclaw#20 seniorities priorite inversee → brain > config
- openclaw#21 data.growth jamais active → detecte via employee count + multi-country
- openclaw#23 Fallback plan non-pondere → utilise icp-loader.getNicheForCycle()
- campaign-engine: double updateEmailStatus pour opened → supprime appel redondant

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Release: survey completion + scrollable options UX