🦄 Sync 2026-07-04 08:36:24

2026-07-27 02:11:19 +08:00 · 2026-07-04 08:36:24 +08:00 · 2026-07-04 08:36:24 +08:00 · 064929ddec
commit 064929ddec
parent 68e58dd787
18 changed files with 690 additions and 546 deletions
--- a/luci-app-openclaw/CHANGELOG.md
+++ b/luci-app-openclaw/CHANGELOG.md
@ -4,6 +4,52 @@

 格式基于 [Keep a Changelog](https://keepachangelog.com/zh-CN/1.0.0/)。

+## [2.0.8] - 2026-07-04
+
+### 修复 ARM64 Node.js 下载资产不一致
+
+- 默认 Node.js 更新为 `22.23.0`，与 GitHub Release 和长期 `node-bins` 中的 ARM64 musl 资产保持一致。
+- 同步更新 `build-node-musl.yml` 手动构建参数，避免后续手动构建继续产出旧版本 Node.js。
+- `node-bins` release 已补齐 `node-v22.23.0-linux-arm64-musl.tar.xz`，用于 ARM64 OpenWrt/iStoreOS 在线安装。
+
+### 测试
+
+- 更新 Node.js 默认版本、Node 版本比较和 ARM64 musl 打包契约测试。
+
+---
+
+## [2.0.7] - 2026-07-04
+
+### 适配 OpenClaw v2026.6.11
+
+- `OC_TESTED_VERSION` 更新为 `2026.6.11`，继续默认安装 npm `latest` 稳定标签。
+- 保持默认 Node.js `22.22.2` 和最低要求 `22.19.0`，满足 OpenClaw `2026.6.11` 的 `engines.node`。
+- README 同步当前适配版本：OpenClaw `2026.6.11`、微信插件 `@tencent-weixin/openclaw-weixin@2.4.6`、微信 CLI `2.1.4`。
+
+### 修复微信插件安装、登录和卸载
+
+- 微信插件安装和升级时，如缺少 `python3`，后台自动尝试 `opkg update && opkg install python3-light`，失败后在安装日志给出手动命令。
+- 微信登录前只修复 npm cache、tmp、微信账号状态目录和配置文件权限，避免递归改写插件代码目录属主。
+- 微信登录增加 `openclaw` 用户写权限预检，目录不可写时直接在二维码日志返回明确错误。
+- 微信卸载会清理 legacy extensions、npm projects 中的微信插件包、微信账号状态目录，并用 Node.js 结构化删除 `plugins.allow`、`plugins.installs`、`plugins.entries`、`channels`、`channel` 中的 `openclaw-weixin/weixin` 配置。
+- 备份 API 改用统一安装路径 helper，兼容用户把 `install_path` 误填成 `/mnt/data/openclaw` 的场景。
+
+### 测试
+
+- 更新 OpenClaw 默认版本契约到 `2026.6.11`。
+- 增加微信插件自动安装 `python3-light`、登录权限预检和卸载清理 npm projects/config 的契约断言。
+
+### 致谢
+
+感谢以下用户通过 Issue 或 PR 提供问题反馈、复现信息和修复思路：
+
+- @hotwa (#85)
+- @djbadboyvip (#94)、@alan9771 (#93, #82)、@luckymai3688 (#92, #91)、@lucian521 (#90)
+- @svgr110 (#89)、@Cuscito (#88)、@hwliu11 (#84)、@sam528300-lab (#78)
+- @yiyibuguai (#75)、@xuguoliang189 (#64)、@ampcwin (#70)、@okareyouok (#60)
+
+---
+
 ## [2.0.6] - 2026-06-08

 ### 适配 OpenClaw v2026.6.1
--- a/luci-app-openclaw/Makefile
+++ b/luci-app-openclaw/Makefile
@ -7,7 +7,7 @@ include $(TOPDIR)/rules.mk

 PKG_NAME:=luci-app-openclaw
 PKG_VERSION:=$(strip $(shell cat $(CURDIR)/VERSION 2>/dev/null || echo "1.0.0"))
-PKG_RELEASE:=17
+PKG_RELEASE:=18

 PKG_MAINTAINER:=10000ge10000 <10000ge10000@users.noreply.github.com>
 PKG_LICENSE:=GPL-3.0
--- a/luci-app-openclaw/README.md
+++ b/luci-app-openclaw/README.md
@ -27,9 +27,9 @@

 | 组件 | 默认版本 | 说明 |
 |------|----------|------|
-| OpenClaw | `2026.6.1` | npm `latest` 稳定标签；不默认追 `2026.6.5-beta.2` |
-| Node.js | `22.22.2` | Alpine musl LTS 包；OpenClaw 2026.6.x 要求 `>=22.19.0`，安装后会按 `engines.node` 做强校验 |
-| 微信插件 | `@tencent-weixin/openclaw-weixin@2.4.3` | CLI 使用 `@tencent-weixin/openclaw-weixin-cli@2.1.4` |
+| OpenClaw | `2026.6.11` | npm `latest` 稳定标签 |
+| Node.js | `22.23.0` | Alpine musl LTS 包；OpenClaw 2026.6.x 要求 `>=22.19.0`，安装后会按 `engines.node` 做强校验 |
+| 微信插件 | `@tencent-weixin/openclaw-weixin@2.4.6` | CLI 使用 `@tencent-weixin/openclaw-weixin-cli@2.1.4` |

 ## 📦 安装

@ -111,15 +111,15 @@ openclaw-env setup
 微信渠道安装前会检查：

 - `openclaw` 系统用户是否存在，不存在时自动创建
- `python3` 是否已安装
+- `python3` 是否已安装；缺失时会自动执行 `opkg update && opkg install python3-light`
 - npm cache、tmp、OpenClaw 数据目录是否可由 `openclaw` 用户写入
 - 旧渠道名 `weixin` 会迁移为 `openclaw-weixin`

-如缺少 Python3：
+如自动安装失败，可手动安装：

 ```bash
 opkg update
-opkg install python3
+opkg install python3-light
 ```

 ## 已知说明
--- a/luci-app-openclaw/VERSION
+++ b/luci-app-openclaw/VERSION
@ -1 +1 @@
-2.0.6
+2.0.8
--- a/luci-app-openclaw/docs/ISSUE_TRIAGE_2026-07-04.md
+++ b/luci-app-openclaw/docs/ISSUE_TRIAGE_2026-07-04.md
@ -0,0 +1,32 @@
+# Issue Triage 2026-07-04
+
+本文件记录 2026-07-04 维护时对 open issue / PR 的处理边界，便于后续关闭 issue 时引用。
+
+## 已在 2.0.7 覆盖
+
+- OpenClaw 默认版本升级：`2026.6.11`，覆盖和当前稳定版、Node 最低版本相关的问题反馈。
+- 微信插件安装：缺少 Python 时自动尝试安装 `python3-light`，失败后给出明确手动命令。
+- 微信插件登录：收窄权限修复范围，增加 `openclaw` 用户写权限预检。
+- 微信插件卸载：清理 legacy extension、npm projects 中的微信插件包、微信账号状态目录和配置中的 `openclaw-weixin/weixin` 残留。
+- 自定义安装路径：备份 API 改用统一路径 helper，继续兼容 `/mnt/data` 和误填 `/mnt/data/openclaw`。
+
+## 已在 2.0.8 覆盖
+
+- ARM64 musl Node.js 默认版本和自托管资产对齐到 `22.23.0`。
+- 长期 `node-bins` release 已补齐 `node-v22.23.0-linux-arm64-musl.tar.xz`，避免在线安装继续请求不存在的 `22.22.2` 资产。
+- 手动 ARM64 musl Node.js 构建 workflow 同步到 `22.23.0`。
+
+## 已由当前 main 既有实现覆盖
+
+- 可配置安装根目录和路径规范化：PR #85 的核心路径 helper、`/mnt/data/openclaw` 误填兼容、危险路径拒绝已经在 main 存在。
+- HOME 不全局污染：`profile.d/openclaw.sh` 仅在 wrapper 内注入 `HOME`。
+- 控制台打开方式：Web 控制台使用新窗口 HTTP Gateway URL，避免 LuCI HTTPS / iframe / 旧 token 混用。
+- 微信渠道名迁移：init 脚本会把旧 `weixin` 迁移到 `openclaw-weixin`，并清理 duplicate entries。
+
+## 暂不关闭
+
+以下类型 issue 不应仅凭 2.0.7 关闭，需要单独复现或确认：
+
+- 模型/provider 具体行为差异或上游 OpenClaw 功能请求。
+- 缺少完整日志、无法确认由本次 Node / 微信 / 权限修复覆盖的问题。
+- 需要用户确认网络、DNS、代理、设备资源或第三方 API 状态的问题。
--- a/luci-app-openclaw/luasrc/controller/openclaw.lua
+++ b/luci-app-openclaw/luasrc/controller/openclaw.lua
@ -99,6 +99,17 @@ local function write_wechat_log_and_exit(log_file, exit_file, content, exit_code
 	end
 end

+local function wechat_python3_bootstrap_cmd(log_file)
+	return "if ! command -v python3 >/dev/null 2>&1; then " ..
+		"echo '未检测到 python3，正在尝试安装 python3-light...' >> " .. shellquote(log_file) .. "; " ..
+		"(opkg update && opkg install python3-light) >> " .. shellquote(log_file) .. " 2>&1 || true; " ..
+		"fi; " ..
+		"if ! command -v python3 >/dev/null 2>&1; then " ..
+		"echo '❌ python3-light 自动安装失败，请手动执行: opkg update && opkg install python3-light' >> " .. shellquote(log_file) .. "; " ..
+		"echo 127 > /tmp/openclaw-wechat-install.exit; exit 0; " ..
+		"fi; "
+end
+
 function index()
 	-- 主入口: 服务 → OpenClaw (🧠 作为菜单图标)
 	local page = entry({"admin", "services", "openclaw"}, alias("admin", "services", "openclaw", "basic"), _("OpenClaw"), 90)
@ -808,10 +819,8 @@ function action_backup()
 	local uci = require "luci.model.uci".cursor()
 	local action = http.formvalue("action") or "create"

-	-- 获取安装路径
-	local install_path_uci = uci:get("openclaw", "main", "install_path") or "/opt"
-	-- 实际安装路径
-	local install_path = install_path_uci .. "/openclaw"
+	-- 使用统一路径 helper，兼容用户误填 /mnt/data/openclaw 的场景。
+	local install_path = get_install_path()
 	local node_bin = install_path .. "/node/bin/node"
 	local oc_entry = ""

@ -1326,17 +1335,6 @@ function action_wechat_install()
 		http.write_json({ status = "ok", message = "微信插件安装已在后台启动..." })
 		return
 	end
-	if sys.exec("command -v python3 2>/dev/null"):gsub("%s+", "") == "" then
-		write_wechat_log_and_exit(
-			"/tmp/openclaw-wechat-install.log",
-			"/tmp/openclaw-wechat-install.exit",
-			"开始安装微信插件...\n安装路径: " .. install_path .. "\n❌ 错误: 未检测到 python3。\n请先安装依赖: opkg update && opkg install python3\n",
-			127
-		)
-		http.prepare_content("application/json")
-		http.write_json({ status = "ok", message = "微信插件安装已在后台启动..." })
-		return
-	end
 	if not ensure_openclaw_user(oc_data) then
 		write_wechat_log_and_exit(
 			"/tmp/openclaw-wechat-install.log",
@ -1360,6 +1358,7 @@ function action_wechat_install()
 		"echo '开始安装微信插件...' > /tmp/openclaw-wechat-install.log; " ..
 		"echo '安装路径: %s' >> /tmp/openclaw-wechat-install.log; " ..
 		"echo 'npx 路径: %s' >> /tmp/openclaw-wechat-install.log; " ..
+		wechat_python3_bootstrap_cmd("/tmp/openclaw-wechat-install.log") ..
 		"mkdir -p %s/.npm %s/.tmp %s/.openclaw/extensions; " ..
 		"if [ ! -w %s/.openclaw/extensions ]; then chown -R openclaw:openclaw %s/.openclaw/extensions 2>/dev/null; fi; " ..
 		"chown -R openclaw:openclaw %s/.npm %s/.tmp %s/.openclaw 2>/dev/null; " ..
@ -1496,7 +1495,11 @@ function action_wechat_login()
                "( " ..
                "echo '正在启动微信登录...' > /tmp/openclaw-wechat-qrcode.txt; " ..
                "echo '安装路径: %s' >> /tmp/openclaw-wechat-qrcode.txt; " ..
-                "mkdir -p %s/.npm %s/.tmp %s/.openclaw; chown -R openclaw:openclaw %s/.npm %s/.tmp %s/.openclaw 2>/dev/null; " ..
+                "mkdir -p %s/.npm %s/.tmp %s/.openclaw/openclaw-weixin; " ..
+                "touch %s/.openclaw/openclaw.json 2>/dev/null || true; " ..
+                "chown -R openclaw:openclaw %s/.npm %s/.tmp %s/.openclaw/openclaw-weixin 2>/dev/null; " ..
+                "chown openclaw:openclaw %s/.openclaw %s/.openclaw/openclaw.json 2>/dev/null; " ..
+                "su -s /bin/sh openclaw -c 'test -w %s/.npm && test -w %s/.tmp && test -w %s/.openclaw && test -w %s/.openclaw/openclaw-weixin && test -w %s/.openclaw/openclaw.json' || { echo '❌ openclaw 用户无法写入微信登录目录，请检查数据目录权限' >> /tmp/openclaw-wechat-qrcode.txt; echo 1 > /tmp/openclaw-wechat-login.exit; exit 0; }; " ..
                "cd %s && " ..
                "su -s /bin/sh openclaw -c 'HOME=%s OPENCLAW_HOME=%s OPENCLAW_STATE_DIR=%s/.openclaw OPENCLAW_CONFIG_PATH=%s/.openclaw/openclaw.json " ..
                "NPM_CONFIG_CACHE=%s/.npm npm_config_cache=%s/.npm TMPDIR=%s/.tmp PATH=%s/node/bin:%s/global/bin:$PATH " ..
@ -1504,9 +1507,10 @@ function action_wechat_login()
                "echo $? > /tmp/openclaw-wechat-login.exit; " ..
                ") >/dev/null 2>&1 & echo $! > /tmp/openclaw-wechat-login.pid",
                install_path,
-                oc_data, oc_data, oc_data, oc_data, oc_data, oc_data,
-                oc_data, oc_data, oc_data, oc_data, oc_data,
-                oc_data, oc_data, oc_data, install_path, install_path, node_bin, oc_entry
+                oc_data, oc_data, oc_data, oc_data, oc_data, oc_data, oc_data,
+                oc_data, oc_data, oc_data, oc_data, oc_data, oc_data, oc_data,
+                oc_data, oc_data, oc_data, oc_data, oc_data, oc_data, oc_data, oc_data,
+                install_path, install_path, node_bin, oc_entry
        )	sys.exec(login_cmd)

 	http.prepare_content("application/json")
@ -1594,35 +1598,60 @@ function action_wechat_uninstall()
 	local sys = require "luci.sys"

 	local install_path = get_install_path()
+	local node_bin = install_path .. "/node/bin/node"
+	local oc_data = install_path .. "/data"

-	-- 删除微信插件目录
-	local wechat_ext_dir = install_path .. "/data/.openclaw/extensions/openclaw-weixin"
-	if wechat_ext_dir == install_path .. "/data/.openclaw/extensions/openclaw-weixin" then
-		sys.exec("rm -rf " .. shellquote(wechat_ext_dir) .. " 2>/dev/null")
+	-- 删除微信插件目录和账号状态。所有路径都限制在当前 OpenClaw 数据目录下。
+	local wechat_ext_dir = oc_data .. "/.openclaw/extensions/openclaw-weixin"
+	local wechat_state_dir = oc_data .. "/.openclaw/openclaw-weixin"
+	local npm_projects = oc_data .. "/.openclaw/npm/projects"
+	sys.exec("rm -rf " .. shellquote(wechat_ext_dir) .. " " .. shellquote(wechat_state_dir) .. " 2>/dev/null")
+	if nixio.fs.stat(npm_projects, "type") then
+		sys.exec("find " .. shellquote(npm_projects) .. " -path '*/node_modules/@tencent-weixin/openclaw-weixin' -type d -prune -exec rm -rf {} + 2>/dev/null")
+		sys.exec("find " .. shellquote(npm_projects) .. " -path '*/node_modules/@tencent-weixin/openclaw-weixin-cli' -type d -prune -exec rm -rf {} + 2>/dev/null")
 	end

 	-- 从配置中删除微信相关配置
-	local config_file = install_path .. "/data/.openclaw/openclaw.json"
+	local config_file = oc_data .. "/.openclaw/openclaw.json"
 	if nixio.fs.stat(config_file, "type") then
-		-- 读取配置
+		local cleanup_js = [[
+const fs = require('fs');
+const p = process.env.OC_CONFIG;
+let d = {};
+try { d = JSON.parse(fs.readFileSync(p, 'utf8')); } catch (e) { process.exit(0); }
+function drop(o, k) { if (o && typeof o === 'object') delete o[k]; }
+function dropChannel(o) { drop(o, 'openclaw-weixin'); drop(o, 'weixin'); }
+if (d.plugins && Array.isArray(d.plugins.allow)) {
+  d.plugins.allow = d.plugins.allow.filter((x) => x !== 'openclaw-weixin' && x !== 'weixin');
+}
+if (d.plugins) {
+  dropChannel(d.plugins.installs);
+  dropChannel(d.plugins.entries);
+}
+dropChannel(d.channels);
+dropChannel(d.channel);
+dropChannel(d);
+fs.writeFileSync(p, JSON.stringify(d, null, 2));
+]]
+		if nixio.fs.stat(node_bin, "type") then
+			sys.exec("OC_CONFIG=" .. shellquote(config_file) .. " " .. shellquote(node_bin) .. " -e " .. shellquote(cleanup_js) .. " 2>/dev/null")
+		else
 			local cf = io.open(config_file, "r")
 			local content = ""
 			if cf then
 				content = cf:read("*a") or ""
 				cf:close()
 			end
-
-		-- 删除微信配置块 (简单字符串替换)
 			content = content:gsub(',?%s*"openclaw%-weixin"%s*:%s*%b{}', "")
 			content = content:gsub('"openclaw%-weixin"%s*:%s*%b{}%s*,?', "")
-
-		-- 写回配置
 			local wf = io.open(config_file, "w")
 			if wf then
 				wf:write(content)
 				wf:close()
 			end
 		end
+		sys.exec("chown openclaw:openclaw " .. shellquote(config_file) .. " 2>/dev/null")
+	end

 	-- 清理临时文件
 	sys.exec("rm -f /tmp/openclaw-wechat-*.log /tmp/openclaw-wechat-*.pid /tmp/openclaw-wechat-*.exit /tmp/openclaw-wechat-qrcode.txt")
@ -1717,17 +1746,6 @@ function action_wechat_upgrade_plugin()
 		http.write_json({ status = "ok", message = "微信插件升级已在后台启动..." })
 		return
 	end
-	if sys.exec("command -v python3 2>/dev/null"):gsub("%s+", "") == "" then
-		write_wechat_log_and_exit(
-			"/tmp/openclaw-wechat-install.log",
-			"/tmp/openclaw-wechat-install.exit",
-			"正在升级微信插件...\n安装路径: " .. install_path .. "\n❌ 错误: 未检测到 python3。\n请先安装依赖: opkg update && opkg install python3\n",
-			127
-		)
-		http.prepare_content("application/json")
-		http.write_json({ status = "ok", message = "微信插件升级已在后台启动..." })
-		return
-	end
 	if not ensure_openclaw_user(oc_data) then
 		write_wechat_log_and_exit(
 			"/tmp/openclaw-wechat-install.log",
@ -1751,6 +1769,7 @@ function action_wechat_upgrade_plugin()
 		"echo '正在升级微信插件...' > /tmp/openclaw-wechat-install.log; " ..
 		"echo '安装路径: %s' >> /tmp/openclaw-wechat-install.log; " ..
 		"echo 'npx 路径: %s' >> /tmp/openclaw-wechat-install.log; " ..
+		wechat_python3_bootstrap_cmd("/tmp/openclaw-wechat-install.log") ..
 		"mkdir -p %s/.npm %s/.tmp %s/.openclaw/extensions; " ..
 		"if [ ! -w %s/.openclaw/extensions ]; then chown -R openclaw:openclaw %s/.openclaw/extensions 2>/dev/null; fi; " ..
 		"chown -R openclaw:openclaw %s/.npm %s/.tmp %s/.openclaw 2>/dev/null; " ..
--- a/luci-app-openclaw/root/usr/bin/openclaw-env
+++ b/luci-app-openclaw/root/usr/bin/openclaw-env
@ -7,19 +7,19 @@
 #   openclaw-env upgrade   — 升级 OpenClaw 到最新版
 #   openclaw-env node      — 仅下载/更新 Node.js
 # 环境变量:
-#   OC_VERSION  — 指定 OpenClaw 版本 (如 2026.6.1)，不设置则安装已测试稳定版
+#   OC_VERSION  — 指定 OpenClaw 版本 (如 2026.6.11)，不设置则安装已测试稳定版
 # ============================================================================
 set -e

 # ── Node.js 版本策略 (双版本兼容) ──
-# V2: 当前推荐版本，用于 OpenClaw v2026.6.1+ (要求 >= 22.19.0，使用 Alpine musl LTS 包确保可运行)
+# V2: 当前推荐版本，用于 OpenClaw v2026.6.11+ (要求 >= 22.19.0，使用 Alpine musl LTS 包确保可运行)
 # V1: 旧版兼容，用于 OpenClaw v2026.3.8 及更早版本
-NODE_VERSION_V2="22.22.2"
+NODE_VERSION_V2="22.23.0"
 NODE_VERSION_V1="22.15.1"
 # 默认使用 V2 版本 (可通过 NODE_VERSION 环境变量覆盖)
 NODE_VERSION="${NODE_VERSION:-${NODE_VERSION_V2}}"
 # 经过验证的 OpenClaw 稳定版本 (更新此值需同步测试)
-OC_TESTED_VERSION="2026.6.1"
+OC_TESTED_VERSION="2026.6.11"
 # OpenClaw 2026.6.x package.json engines.node 的最低要求。
 # 如果未来上游提高要求，安装成功后还会从 package.json 再做一次强校验。
 OC_NODE_MIN_VERSION="${OC_NODE_MIN_VERSION:-22.19.0}"
--- a/luci-app-openclaw/tests/test_node_packaging_contract.sh
+++ b/luci-app-openclaw/tests/test_node_packaging_contract.sh
@ -20,7 +20,7 @@ fi

 grep -Fq 'verify_prefix /opt/openclaw/node' "$BUILD_SCRIPT" || fail "build script should verify default install path"
 grep -Fq 'verify_prefix /tmp/custom-openclaw-root/openclaw/node' "$BUILD_SCRIPT" || fail "build script should verify custom install path"
-grep -Fq 'NODE_VER="22.22.2"' "$WORKFLOW" || fail "workflow should build current musl-compatible Node.js"
+grep -Fq 'NODE_VER="22.23.0"' "$WORKFLOW" || fail "workflow should build current musl-compatible Node.js"
 grep -Fq 'BUILD_MODE=apk' "$WORKFLOW" || fail "workflow should use apk mode for ARM64 musl package"
 grep -Fq 'PKG_TYPE=lts' "$WORKFLOW" || fail "workflow should use Alpine LTS Node.js package"

--- a/luci-app-openclaw/tests/test_openclaw_contracts.sh
+++ b/luci-app-openclaw/tests/test_openclaw_contracts.sh
@ -6,8 +6,8 @@ fail() {
 	exit 1
 }

-grep -q "OC_TESTED_VERSION=\"2026.6.1\"" root/usr/bin/openclaw-env || fail "tested OpenClaw version not pinned"
-grep -q "NODE_VERSION_V2=\"22.22.2\"" root/usr/bin/openclaw-env || fail "default Node.js version not pinned"
+grep -q "OC_TESTED_VERSION=\"2026.6.11\"" root/usr/bin/openclaw-env || fail "tested OpenClaw version not pinned"
+grep -q "NODE_VERSION_V2=\"22.23.0\"" root/usr/bin/openclaw-env || fail "default Node.js version not pinned"
 grep -q "OC_NODE_MIN_VERSION=\"\${OC_NODE_MIN_VERSION:-22.19.0}\"" root/usr/bin/openclaw-env || fail "minimum Node.js version not pinned"
 grep -q "oc_assert_node_min_version" root/usr/bin/openclaw-env || fail "Node.js minimum version check missing"
 grep -q 'oc_node_version_ge "$from_pkg" "$required"' root/usr/bin/openclaw-env || fail "package Node.js requirement must not lower static minimum"
@ -33,9 +33,12 @@ grep -q "is_safe_openclaw_root" luasrc/controller/openclaw.lua || fail "uninstal
 grep -q "local q_install_path = shellquote(install_path)" luasrc/controller/openclaw.lua || fail "uninstall rm must shellquote install_path"
 grep -q "rm -rf \" .. q_install_path" luasrc/controller/openclaw.lua || fail "uninstall rm must use quoted install_path"

-grep -q "command -v python3" luasrc/controller/openclaw.lua || fail "wechat install must check python3"
+grep -q "opkg install python3-light" luasrc/controller/openclaw.lua || fail "wechat install must auto install python3-light"
 grep -q "ensure_openclaw_user" luasrc/controller/openclaw.lua || fail "wechat install must ensure openclaw user"
 grep -q "NPM_CONFIG_CACHE" luasrc/controller/openclaw.lua || fail "wechat install must set npm cache"
+grep -q "openclaw 用户无法写入微信登录目录" luasrc/controller/openclaw.lua || fail "wechat login writable preflight missing"
+grep -q "node_modules/@tencent-weixin/openclaw-weixin" luasrc/controller/openclaw.lua || fail "wechat uninstall must remove npm project plugin"
+grep -q "dropChannel(d.plugins.installs)" luasrc/controller/openclaw.lua || fail "wechat uninstall must clean plugin installs"
 grep -q "openclaw-weixin" root/etc/init.d/openclaw || fail "weixin channel migration missing"
 grep -q "delete d.plugins.entries\\['openclaw-weixin'\\]" root/etc/init.d/openclaw || fail "weixin duplicate entries cleanup missing"
 grep -q "npm/projects" root/etc/init.d/openclaw || fail "npm plugin project ownership fix missing"
--- a/luci-app-openclaw/tests/test_openclaw_node.sh
+++ b/luci-app-openclaw/tests/test_openclaw_node.sh
@ -8,10 +8,10 @@ fail() {
 	exit 1
 }

-[ "$(oc_normalize_node_version v22.22.2)" = "22.22.2" ] || fail "normalize v"
+[ "$(oc_normalize_node_version v22.23.0)" = "22.23.0" ] || fail "normalize v"
 oc_node_version_ge 22.19.0 22.19.0 || fail "exact version"
 oc_node_version_ge 22.19.1 22.19.0 || fail "patch version"
-oc_node_version_ge 22.22.2 22.19.0 || fail "supported LTS version"
+oc_node_version_ge 22.23.0 22.19.0 || fail "supported LTS version"
 if oc_node_version_ge 22.18.1 22.19.0; then
 	fail "older minor accepted"
 fi
--- a/luci-app-smartdns/Makefile
+++ b/luci-app-smartdns/Makefile
@ -7,7 +7,7 @@ include $(TOPDIR)/rules.mk
 PKG_LICENSE:=GPL-3.0-or-later
 PKG_MAINTAINER:=Nick Peng <pymumu@gmail.com>
 PKG_VERSION:=1.2025.47.2
-PKG_RELEASE:=9
+PKG_RELEASE:=10

 LUCI_TITLE:=LuCI for smartdns
 LUCI_DESCRIPTION:=Provides Luci for smartdns
--- a/luci-app-smartdns/htdocs/luci-static/resources/view/smartdns/smartdns.js
+++ b/luci-app-smartdns/htdocs/luci-static/resources/view/smartdns/smartdns.js
@ -46,12 +46,6 @@ function getServiceStatus() {
 		});
 }

-function smartdnsServiceStatus() {
-	return Promise.all([
-		getServiceStatus()
-	]);
-}
-
 function smartdnsRenderStatus(isRunning) {
 	let renderHTML = "";

@ -70,7 +64,7 @@ function smartdnsRenderStatus(isRunning) {
 			const protocol = window.location.protocol;
 			const hostname = window.location.hostname;
 			const uiLink = protocol + "//" + hostname + ":" + uiPort;
-			renderHTML += "&#160; <a class=\"btn cbi-button\" style=\"margin-left: 10px; background-color: black; color: white; border-color: #333;\" href=\"" + uiLink + "\" target=\"_blank\">" + _("Open the WebUI") + "</a>";
+			renderHTML += '&#160; <a class="btn cbi-button" ' +  'href="' + uiLink + '" target="_blank">' +  _("Open the WebUI") +  '</a>';
 		}
 	} else {
 		renderHTML += "<span style=\"color:red;font-weight:bold\">SmartDNS - " + _("NOT RUNNING") + "</span>";
@ -125,7 +119,7 @@ return view.extend({
 		s.anonymous = true;
 		s.render = function (section_id) {
 			const renderStatus = function () {
-				return L.resolveDefault(smartdnsServiceStatus()).then(function (res) {
+				return L.resolveDefault(getServiceStatus()).then(function (res) {
 					const view = document.getElementById("service_status");
 					if (view == null) {
 						return;
@ -223,6 +217,8 @@ return view.extend({
 		o.value("ping,tcp:443,tcp:80");
 		o.value("tcp:80,tcp:443,ping");
 		o.value("tcp:443,tcp:80,ping");
+		o.value("tcp-syn:80,tcp-syn:443,ping");
+		o.value("tcp-syn:443,tcp-syn:80,ping");
 		o.value("none", _("None"));
 		o.validate = function (section_id, value) {
 			if (value == "") {
@ -248,6 +244,15 @@ return view.extend({
 					continue;
 				}

+				if (cm.indexOf("tcp-syn:") == 0) {
+					const port = cm.split(":")[1];
+					if (port == "") {
+						return _("TCP SYN port is empty");
+					}
+
+					continue;
+				}
+
 				return _("Speed check mode is invalid.");
 			}

@ -386,8 +391,8 @@ return view.extend({
 				return true;
 			}

-			var ipset = value.split(",")
-			for (var i = 0; i < ipset.length; i++) {
+			let ipset = value.split(",")
+			for (let i = 0; i < ipset.length; i++) {
 				if (!ipset[i].match(/^(#[4|6]:)?[a-zA-Z0-9\-_]+$/)) {
 					return _("ipset name format error, format: [#[4|6]:]ipsetname");
 				}
@ -427,9 +432,9 @@ return view.extend({
 				return true;
 			}

-			var nftset = value.split(",")
-			for (var i = 0; i < nftset.length; i++) {
-				if (!nftset[i].match(/^#[4|6]:[a-zA-Z0-9\-_]+#[a-zA-Z0-9\-_]+#[a-zA-Z0-9\-_]+$/)) {
+			const nftset = value.split(",")
+			for (let nfts of nftset) {
+				if (!nfts.match(/^#[4|6]:[a-zA-Z0-9\-_]+#[a-zA-Z0-9\-_]+#[a-zA-Z0-9\-_]+$/)) {
 					return _("NFTset name format error, format: [#[4|6]:[family#table#set]]");
 				}
 			}
@ -496,7 +501,7 @@ return view.extend({
 			}

 			if (df.type != 'config') {
-				continue
+				continue;
 			}

 			o.value(df.name);
@ -504,16 +509,16 @@ return view.extend({

 		o = s.taboption("advanced", form.DynamicList, "hosts_files", _("Hosts File"), _("Include hosts file."));
 		o.rmempty = true;
-		for (var i = 0; i < download_files.length; i++) {
-			if (download_files[i].type == undefined) {
+		for (let df of download_files) {
+			if (df.type == undefined) {
 				continue;
 			}

-			if (download_files[i].type != 'other') {
-				continue
+			if (df.type != 'other') {
+				continue;
 			}

-			o.value(download_files[i].name);
+			o.value(df.name);
 		}

 		///////////////////////////////////////
@ -671,7 +676,7 @@ return view.extend({
 		o.depends('enable_auto_update', '1');

 		o = s.taboption('files', form.ListValue, 'auto_update_day_time', _("Update time (every day)"));
-		for (var i = 0; i < 24; i++)
+		for (let i = 0; i < 24; i++)
 			o.value(i, i + ':00');
 		o.default = '5';
 		o.depends('enable_auto_update', '1');
@ -831,7 +836,7 @@ return view.extend({
 				})
 			}, [_("View Log")]);
 		}
-		var log_levels = ["debug", "info", "notice", "warn", "error", "fatal"];
+		const log_levels = ["debug", "info", "notice", "warn", "error", "fatal"];
 		log_levels.forEach(function(level) {
 			o.depends({ log_output_mode: "file", log_level: level });
 		});
@ -1112,9 +1117,9 @@ return view.extend({
 				return true;
 			}

-			var val = uci.sections('smartdns', 'server');
-			for (var i = 0; i < val.length; i++) {
-				if (value == val[i].server_group) {
+			const val = uci.sections('smartdns', 'server');
+			for (let i of val) {
+				if (value == i.server_group) {
 					return true;
 				}
 			}
@ -1132,6 +1137,8 @@ return view.extend({
 		o.value("ping,tcp:443,tcp:80");
 		o.value("tcp:80,tcp:443,ping");
 		o.value("tcp:443,tcp:80,ping");
+		o.value("tcp-syn:80,tcp-syn:443,ping");
+		o.value("tcp-syn:443,tcp-syn:80,ping");
 		o.value("none", _("None"));
 		o.validate = function (section_id, value) {
 			if (value == "") {
@ -1142,14 +1149,14 @@ return view.extend({
 				return true;
 			}

-			var check_mode = value.split(",")
-			for (var i = 0; i < check_mode.length; i++) {
-				if (check_mode[i] == "ping") {
+			const check_mode = value.split(",")
+			for (let cm of check_mode) {
+				if (cm == "ping") {
 					continue;
 				}

-				if (check_mode[i].indexOf("tcp:") == 0) {
-					var port = check_mode[i].split(":")[1];
+				if (cm.indexOf("tcp:") == 0) {
+					const port = cm.split(":")[1];
 					if (port == "") {
 						return _("TCP port is empty");
 					}
@ -1157,6 +1164,15 @@ return view.extend({
 					continue;
 				}

+				if (cm.indexOf("tcp-syn:") == 0) {
+					const port = cm.split(":")[1];
+					if (port == "") {
+						return _("TCP SYN port is empty");
+					}
+
+					continue;
+				}
+
 				return _("Speed check mode is invalid.");
 			}

@ -1189,9 +1205,9 @@ return view.extend({
 				return true;
 			}

-			var ipset = value.split(",")
-			for (var i = 0; i < ipset.length; i++) {
-				if (!ipset[i].match(/^(#[4|6]:)?[a-zA-Z0-9\-_]+$/)) {
+			const ipset = value.split(",")
+			for (let ips of ipset) {
+				if (!ips.match(/^(#[4|6]:)?[a-zA-Z0-9\-_]+$/)) {
 					return _("ipset name format error, format: [#[4|6]:]ipsetname");
 				}
 			}
@ -1209,9 +1225,9 @@ return view.extend({
 				return true;
 			}

-			var nftset = value.split(",")
-			for (var i = 0; i < nftset.length; i++) {
-				if (!nftset[i].match(/^#[4|6]:[a-zA-Z0-9\-_]+#[a-zA-Z0-9\-_]+#[a-zA-Z0-9\-_]+$/)) {
+			const nftset = value.split(",")
+			for (let nfts of nftset) {
+				if (!nfts.match(/^#[4|6]:[a-zA-Z0-9\-_]+#[a-zA-Z0-9\-_]+#[a-zA-Z0-9\-_]+$/)) {
 					return _("NFTset name format error, format: [#[4|6]:[family#table#set]]");
 				}
 			}
@ -1223,16 +1239,16 @@ return view.extend({
 		download_files = uci.sections('smartdns', 'download-file');
 		o = s.taboption("advanced", form.DynamicList, "conf_files", _("Include Config Files<br>/etc/smartdns/conf.d"),
 			_("Include other config files from /etc/smartdns/conf.d or custom path, can be downloaded from the download page."));
-		for (var i = 0; i < download_files.length; i++) {
-			if (download_files[i].type == undefined) {
+		for (let df of download_files) {
+			if (df.type == undefined) {
 				continue;
 			}

-			if (download_files[i].type != 'config') {
-				continue
+			if (df.type != 'config') {
+				continue;
 			}

-			o.value(download_files[i].name);
+			o.value(df.name);
 		}

 		o = s.taboption("block", form.FileUpload, "block_domain_set_file", _("Domain List File"), _("Upload domain list file."));
@ -1291,6 +1307,8 @@ return view.extend({
 		o.value("ping,tcp:443,tcp:80");
 		o.value("tcp:80,tcp:443,ping");
 		o.value("tcp:443,tcp:80,ping");
+		o.value("tcp-syn:80,tcp-syn:443,ping");
+		o.value("tcp-syn:443,tcp-syn:80,ping");
 		o.value("none", _("None"));
 		o.validate = function (section_id, value) {
 			if (value == "") {
@ -1301,14 +1319,14 @@ return view.extend({
 				return true;
 			}

-			var check_mode = value.split(",")
-			for (var i = 0; i < check_mode.length; i++) {
-				if (check_mode[i] == "ping") {
+			const check_mode = value.split(",")
+			for (let cm of check_mode) {
+				if (cm == "ping") {
 					continue;
 				}

-				if (check_mode[i].indexOf("tcp:") == 0) {
-					var port = check_mode[i].split(":")[1];
+				if (cm.indexOf("tcp:") == 0) {
+					const port = cm.split(":")[1];
 					if (port == "") {
 						return _("TCP port is empty");
 					}
@ -1316,6 +1334,15 @@ return view.extend({
 					continue;
 				}

+				if (cm.indexOf("tcp-syn:") == 0) {
+					const port = cm.split(":")[1];
+					if (port == "") {
+						return _("TCP SYN port is empty");
+					}
+
+					continue;
+				}
+
 				return _("Speed check mode is invalid.");
 			}

@ -1515,6 +1542,8 @@ return view.extend({
 		so.value("ping,tcp:443,tcp:80");
 		so.value("tcp:80,tcp:443,ping");
 		so.value("tcp:443,tcp:80,ping");
+		so.value("tcp-syn:80,tcp-syn:443,ping");
+		so.value("tcp-syn:443,tcp-syn:80,ping");
 		so.value("none", _("None"));
 		so.validate = function (section_id, value) {
 			if (value == "") {
@ -1540,6 +1569,15 @@ return view.extend({
 					continue;
 				}

+				if (cm.indexOf("tcp-syn:") == 0) {
+					const port = cm.split(":")[1];
+					if (port == "") {
+						return _("TCP SYN port is empty");
+					}
+
+					continue;
+				}
+
 				return _("Speed check mode is invalid.");
 			}

--- a/luci-app-smartdns/po/zh_Hans/smartdns.po
+++ b/luci-app-smartdns/po/zh_Hans/smartdns.po
--- a/luci-app-ssr-plus/Makefile
+++ b/luci-app-ssr-plus/Makefile
@ -4,7 +4,7 @@ LUCI_TITLE:=luci-app-ssr-plus
 LUCI_PKGARCH:=all
 PKG_NAME:=luci-app-ssr-plus
 PKG_VERSION:=196
-PKG_RELEASE:=38
+PKG_RELEASE:=39

 PKG_CONFIG_DEPENDS:= \
 	CONFIG_PACKAGE_$(PKG_NAME)_Iptables_Transparent_Proxy \
--- a/luci-app-ssr-plus/root/usr/share/shadowsocksr/update.lua
+++ b/luci-app-ssr-plus/root/usr/share/shadowsocksr/update.lua
@ -43,7 +43,7 @@ local excluded_domain = {
 local mydnsip = '127.0.0.1'
 local mydnsport = '5335'
 local ipsetname = 'gfwlist'
-local new_appledns = uci:get_first("shadowsocksr", "global", "apple_dns")
+local new_appledns = uci:get_first("shadowsocksr", "global", "apple_dns", "")
 local bc = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'
 -- base64decoding
 local function base64_dec(data)
@ -111,8 +111,8 @@ local function generate_apple(type)
 			end
 		end
 	end
-	for _, domain in ipairs(domains) do
 	if new_appledns and new_appledns ~= "" then
+		for _, domain in ipairs(domains) do
 			out:write(string.format("server=/%s/%s\n", domain, new_appledns))
 		end
 	end
@ -180,6 +180,8 @@ local function update(url, file, type, file2)
 			apple:close()
 			if new_appledns and new_appledns ~= "" then
 				generate_apple(type)
+			else
+				os.remove("/tmp/ssr-update.tmp")
 			end
 		end
 		if type == "ad_data" then
--- a/naiveproxy/Makefile
+++ b/naiveproxy/Makefile
@ -1,7 +1,7 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=naiveproxy
-PKG_VERSION:=149.0.7827.114
+PKG_VERSION:=150.0.7871.63
 PKG_RELEASE:=1

 ARCH_PREBUILT:=$(ARCH_PACKAGES)
--- a/quectel_MHI/Makefile
+++ b/quectel_MHI/Makefile
@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk

 PKG_NAME:=pcie_mhi
 PKG_VERSION:=1.3.8
-PKG_RELEASE:=29
+PKG_RELEASE:=30

 include $(INCLUDE_DIR)/kernel.mk
 include $(INCLUDE_DIR)/package.mk
--- a/torrserver/Makefile
+++ b/torrserver/Makefile
@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=torrserver
-PKG_VERSION:=MatriX.141.10
-PKG_RELEASE:=11
+PKG_VERSION:=MatriX.142
+PKG_RELEASE:=12

 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/YouROK/TorrServer.git
-PKG_SOURCE_VERSION:=394c915bfc64c8448a7da166e909da074420172e
+PKG_SOURCE_VERSION:=f0585eb7dfc92e0e5fdcb17a7e7eead212201e7d
 PKG_MIRROR_HASH:=skip

 PKG_MAINTAINER:=Konstantine Shevlakov <shevlakov@132lan.ru>
 @ -1 +1 @@
 .0.6
 .0.8