Chore: harden A2UI bundle dependency resolution

* chore(deadcode): add deadcode scanning and remove unused lockfile deps

* chore(changelog): mention deadcode CI scan pass

* ci: disable deadcode job temporarily

* docs(changelog): add PR ref and thanks for deadcode scan entry

* ci: comment out deadcode job condition while keeping it disabled

* Deps: remove dead root dependency from package manifest

* Changelog: reference PR for deadcode dependency cleanup

* Deps: remove unused root signal-utils

* Chore: remove unused lit context deps

* Chore: remove unused root lit dependency

* Chore: remove root long and rolldown deps

* Chore: add changelog for root long/rolldown removal

* Chore: fix a2ui bundling after root lit dependency removal

* Chore: simplify a2ui bundle script dependencies

.github/workflows/ci.yml

@@ -259,7 +259,6 @@ jobs:
       - name: Check types and lint and oxfmt
         run: pnpm check
 
-
   # Report-only dead-code scans. Runs after scope detection and stores machine-readable
   # results as artifacts for later triage before we enable hard gates.
   # Temporarily disabled in CI while we process initial findings.

CHANGELOG.md

@@ -7,17 +7,18 @@ Docs: https://docs.openclaw.ai
 ### Changes
 
 - Docs: fix FAQ typos and add documentation spellcheck automation with a custom codespell dictionary/ignore list, including CI coverage. (#22457) Thanks @vincentkoc.
-- Dev tooling: add dead-code scans to CI via Knip/ts-prune/ts-unused-exports and report unused dependencies/exports in non-blocking checks. (#22468) Thanks @vincentkoc.
-- Dev tooling: move `@larksuiteoapi/node-sdk` out of root `package.json` and keep it scoped to `extensions/feishu` where it is used. (#22471) Thanks @vincentkoc.
-- Dev tooling: remove unused root dependency `signal-utils` from core manifest after confirming it was only used by extension-only paths. (#22471) Thanks @vincentkoc.
-- Dev tooling: remove unused root devDependency `ollama` now that native Ollama support uses local HTTP transport code paths only. (#22471) Thanks @vincentkoc.
-- Dev tooling: remove unused root devDependencies `@lit/context` and `@lit-labs/signals` flagged as unused by Knip dead-code reports. (#22471) Thanks @vincentkoc.
-- Dev tooling: remove unused root dependency `lit` that is now scoped to `ui/` package dependencies. (#22471) Thanks @vincentkoc.
-- Dev tooling: remove unused root dependencies `long` and `rolldown`; keep A2UI bundling functional by falling back to `pnpm dlx rolldown` when the binary is not locally installed. (#22481) Thanks @vincentkoc.
-- Dev tooling: fix A2UI bundle resolution for removed root `lit` deps by resolving `lit`, `@lit/context`, `@lit-labs/signals`, and `signal-utils` from UI workspace dependencies in `rolldown.config.mjs` during bundling. (#22481) Thanks @vincentkoc.
-- Dev tooling: simplify `canvas-a2ui` bundling script by removing temporary vendored `node_modules` symlink logic now that `ui` workspace dependencies are explicit. (#22481) Thanks @vincentkoc.
-- Dev tooling: remove unused `@microsoft/agents-hosting-express` and `@microsoft/agents-hosting-extensions-teams` from `extensions/msteams` because current code only uses `@microsoft/agents-hosting`. Thanks @vincentkoc.
-- Dev tooling: remove unused plugin-local `openclaw` devDependencies from `extensions/open-prose`, `extensions/lobster`, and `extensions/llm-task` after removing this dependency from build-time requirements. (#22482) Thanks @vincentkoc.
+- Security/Unused Dependencies: add dead-code scans to CI via Knip/ts-prune/ts-unused-exports and report unused dependencies/exports in non-blocking checks. (#22468) Thanks @vincentkoc.
+- Security/Unused Dependencies: move `@larksuiteoapi/node-sdk` out of root `package.json` and keep it scoped to `extensions/feishu` where it is used. (#22471) Thanks @vincentkoc.
+- Security/Unused Dependencies: remove unused root dependency `signal-utils` from core manifest after confirming it was only used by extension-only paths. (#22471) Thanks @vincentkoc.
+- Security/Unused Dependencies: remove unused root devDependency `ollama` now that native Ollama support uses local HTTP transport code paths only. (#22471) Thanks @vincentkoc.
+- Security/Unused Dependencies: remove unused root devDependencies `@lit/context` and `@lit-labs/signals` flagged as unused by Knip dead-code reports. (#22471) Thanks @vincentkoc.
+- Security/Unused Dependencies: remove unused root dependency `lit` that is now scoped to `ui/` package dependencies. (#22471) Thanks @vincentkoc.
+- Security/Unused Dependencies: remove unused root dependencies `long` and `rolldown`; keep A2UI bundling functional by falling back to `pnpm dlx rolldown` when the binary is not locally installed. (#22481) Thanks @vincentkoc.
+- Security/Unused Dependencies: harden A2UI bundling dependency resolution by resolving `lit`, `@lit/context`, `@lit-labs/signals`, and `signal-utils` from UI workspace or repo-root dependency locations to tolerate Docker layout differences without root-only assumptions. (#22504) Thanks @vincentkoc.
+- Security/Unused Dependencies: fix A2UI bundle resolution for removed root `lit` deps by resolving `lit`, `@lit/context`, `@lit-labs/signals`, and `signal-utils` from UI workspace dependencies in `rolldown.config.mjs` during bundling. (#22481) Thanks @vincentkoc.
+- Security/Unused Dependencies: simplify `canvas-a2ui` bundling script by removing temporary vendored `node_modules` symlink logic now that `ui` workspace dependencies are explicit. (#22481) Thanks @vincentkoc.
+- Security/Unused Dependencies: remove unused `@microsoft/agents-hosting-express` and `@microsoft/agents-hosting-extensions-teams` from `extensions/msteams` because current code only uses `@microsoft/agents-hosting`. Thanks @vincentkoc.
+- Security/Unused Dependencies: remove unused plugin-local `openclaw` devDependencies from `extensions/open-prose`, `extensions/lobster`, and `extensions/llm-task` after removing this dependency from build-time requirements. (#22495) Thanks @vincentkoc.
 - Agents/Subagents: default subagent spawn depth now uses shared `maxSpawnDepth=2`, enabling depth-1 orchestrator spawning by default while keeping depth policy checks consistent across spawn and prompt paths. (#22223) Thanks @tyler6204.
 - Channels/CLI: add per-account/channel `defaultTo` outbound routing fallback so `openclaw agent --deliver` can send without explicit `--reply-to` when a default target is configured. (#16985) Thanks @KirillShchetinin.
 - iOS/Chat: clean chat UI noise by stripping inbound untrusted metadata/timestamp prefixes, formatting tool outputs into concise summaries/errors, compacting the composer while typing, and supporting tap-to-dismiss keyboard in chat view. (#22122) thanks @mbelinky.

apps/shared/OpenClawKit/Tools/CanvasA2UI/rolldown.config.mjs

@@ -5,6 +5,7 @@ import { defineConfig } from "rolldown";
 
 const here = path.dirname(fileURLToPath(import.meta.url));
 const repoRoot = path.resolve(here, "../../../../..");
+const uiRoot = path.resolve(repoRoot, "ui");
 const fromHere = (p) => path.resolve(here, p);
 const outputFile = path.resolve(
   here,
@@ -17,17 +18,26 @@ const outputFile = path.resolve(
 
 const a2uiLitDist = path.resolve(repoRoot, "vendor/a2ui/renderers/lit/dist/src");
 const a2uiThemeContext = path.resolve(a2uiLitDist, "0.8/ui/context/theme.js");
-const a2uiNodeModules = path.resolve(repoRoot, "ui/node_modules");
-const rootNodeModules = path.resolve(repoRoot, "node_modules");
+const uiNodeModules = path.resolve(uiRoot, "node_modules");
+const repoNodeModules = path.resolve(repoRoot, "node_modules");
 
-const resolveA2uiDep = (pkg, rel = "") => {
-  const uiPath = path.resolve(a2uiNodeModules, pkg, rel);
-  if (existsSync(uiPath)) {
-    return uiPath;
+function resolveUiDependency(moduleId) {
+  const candidates = [
+    path.resolve(uiNodeModules, moduleId),
+    path.resolve(repoNodeModules, moduleId),
+  ];
+  for (const candidate of candidates) {
+    if (existsSync(candidate)) {
+      return candidate;
+    }
   }
 
-  return path.resolve(rootNodeModules, pkg, rel);
-};
+  const fallbackCandidates = candidates.join(", ");
+  throw new Error(
+    `A2UI bundle config cannot resolve ${moduleId}. Checked: ${fallbackCandidates}. ` +
+      "Keep dependency installed in ui workspace or repo root before bundling.",
+  );
+}
 
 export default defineConfig({
   input: fromHere("bootstrap.js"),
@@ -40,13 +50,13 @@ export default defineConfig({
       "@a2ui/lit": path.resolve(a2uiLitDist, "index.js"),
       "@a2ui/lit/ui": path.resolve(a2uiLitDist, "0.8/ui/ui.js"),
       "@openclaw/a2ui-theme-context": a2uiThemeContext,
-      "@lit/context": resolveA2uiDep("@lit/context", "index.js"),
-      "@lit/context/": resolveA2uiDep("@lit/context"),
-      "@lit-labs/signals": resolveA2uiDep("@lit-labs/signals", "index.js"),
-      "@lit-labs/signals/": resolveA2uiDep("@lit-labs/signals"),
-      lit: resolveA2uiDep("lit", "index.js"),
-      "lit/": resolveA2uiDep("lit"),
-      "signal-utils/": resolveA2uiDep("signal-utils"),
+      "@lit/context": resolveUiDependency("@lit/context"),
+      "@lit/context/": resolveUiDependency("@lit/context/"),
+      "@lit-labs/signals": resolveUiDependency("@lit-labs/signals"),
+      "@lit-labs/signals/": resolveUiDependency("@lit-labs/signals/"),
+      lit: resolveUiDependency("lit"),
+      "lit/": resolveUiDependency("lit/"),
+      "signal-utils": resolveUiDependency("signal-utils"),
     },
   },
   output: {

scripts/bundle-a2ui.sh

@@ -89,7 +89,7 @@ pnpm -s exec tsc -p "$A2UI_RENDERER_DIR/tsconfig.json"
 if command -v rolldown >/dev/null 2>&1; then
   rolldown -c "$A2UI_APP_DIR/rolldown.config.mjs"
 else
-  pnpm dlx "rolldown@1.0.0-rc.5" -c "$A2UI_APP_DIR/rolldown.config.mjs"
+  pnpm -s dlx rolldown -c "$A2UI_APP_DIR/rolldown.config.mjs"
 fi
 
 echo "$current_hash" > "$HASH_FILE"

src/telegram/sent-message-cache.ts

@@ -6,7 +6,6 @@
 const TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
 
 type CacheEntry = {
-  messageIds: Set<number>;
   timestamps: Map<number, number>;
 };
 
@@ -20,7 +19,6 @@ function cleanupExpired(entry: CacheEntry): void {
   const now = Date.now();
   for (const [msgId, timestamp] of entry.timestamps) {
     if (now - timestamp > TTL_MS) {
-      entry.messageIds.delete(msgId);
       entry.timestamps.delete(msgId);
     }
   }
@@ -33,13 +31,12 @@ export function recordSentMessage(chatId: number | string, messageId: number): v
   const key = getChatKey(chatId);
   let entry = sentMessages.get(key);
   if (!entry) {
-    entry = { messageIds: new Set(), timestamps: new Map() };
+    entry = { timestamps: new Map() };
     sentMessages.set(key, entry);
   }
-  entry.messageIds.add(messageId);
   entry.timestamps.set(messageId, Date.now());
   // Periodic cleanup
-  if (entry.messageIds.size > 100) {
+  if (entry.timestamps.size > 100) {
     cleanupExpired(entry);
   }
 }
@@ -55,7 +52,7 @@ export function wasSentByBot(chatId: number | string, messageId: number): boolea
   }
   // Clean up expired entries on read
   cleanupExpired(entry);
-  return entry.messageIds.has(messageId);
+  return entry.timestamps.has(messageId);
 }
 
 /**