fix(openclaw): strip quotes from mnemonic import, show word count in errors

Author: tenequm

CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.11.2] - 2026-04-02
+
+### Fixed
+
+- Strip surrounding quotes from mnemonic in `/x_wallet setup import` (Telegram copy-paste)
+- Show actual word count in mnemonic validation errors
+
 ## [0.11.1] - 2026-04-02
 
 ### Fixed
@@ -37,6 +44,7 @@ All notable changes to this project will be documented in this file.
 - Strip `outputSchema` from proxied MCP tool definitions
 - Downgrade @modelcontextprotocol/sdk to 1.27.1 for compatibility
 
+[0.11.2]: https://github.com/cascade-protocol/x402-proxy/compare/v0.11.1...v0.11.2
 [0.11.1]: https://github.com/cascade-protocol/x402-proxy/compare/v0.11.0...v0.11.1
 [0.11.0]: https://github.com/cascade-protocol/x402-proxy/compare/v0.10.12...v0.11.0
 [0.10.12]: https://github.com/cascade-protocol/x402-proxy/releases/tag/v0.10.12

packages/x402-proxy/package.json

@@ -1,7 +1,7 @@
 {
   "name": "x402-proxy",
   "private": true,
-  "version": "0.11.1",
+  "version": "0.11.2",
   "description": "curl for x402 paid APIs. Auto-pays any endpoint on Base, Solana, and Tempo.",
   "type": "module",
   "sideEffects": false,

packages/x402-proxy/src/openclaw/commands.test.ts

@@ -0,0 +1,66 @@
+import { describe, expect, it } from "vitest";
+import { parseMnemonicImport } from "./commands.js";
+
+const VALID_12 =
+  "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about";
+const VALID_24 =
+  "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon art";
+
+describe("parseMnemonicImport", () => {
+  it("accepts valid 12-word mnemonic as bare words", () => {
+    const result = parseMnemonicImport(VALID_12.split(" "));
+    expect(result).toEqual({ mnemonic: VALID_12 });
+  });
+
+  it("accepts valid 24-word mnemonic as bare words", () => {
+    const result = parseMnemonicImport(VALID_24.split(" "));
+    expect(result).toEqual({ mnemonic: VALID_24 });
+  });
+
+  it("strips surrounding double quotes (Telegram copy-paste)", () => {
+    const result = parseMnemonicImport([`"${VALID_12}"`]);
+    expect(result).toEqual({ mnemonic: VALID_12 });
+  });
+
+  it("strips surrounding single quotes", () => {
+    const result = parseMnemonicImport([`'${VALID_12}'`]);
+    expect(result).toEqual({ mnemonic: VALID_12 });
+  });
+
+  it("strips surrounding smart quotes", () => {
+    const result = parseMnemonicImport([`\u201C${VALID_12}\u201D`]);
+    expect(result).toEqual({ mnemonic: VALID_12 });
+  });
+
+  it("handles quoted mnemonic split across args by Telegram", () => {
+    // Telegram may split: ['"abandon', 'abandon', ..., 'about"']
+    const words = VALID_12.split(" ");
+    words[0] = `"${words[0]}`;
+    words[words.length - 1] = `${words[words.length - 1]}"`;
+    const result = parseMnemonicImport(words);
+    expect(result).toEqual({ mnemonic: VALID_12 });
+  });
+
+  it("rejects wrong word count with count in error", () => {
+    const result = parseMnemonicImport("one two three four five six seven eight".split(" "));
+    expect("error" in result && result.error).toContain("got 8");
+  });
+
+  it("rejects 16-word input", () => {
+    const sixteenWords = VALID_24.split(" ").slice(0, 16);
+    const result = parseMnemonicImport(sixteenWords);
+    expect("error" in result && result.error).toContain("got 16");
+  });
+
+  it("rejects invalid BIP-39 words with correct count", () => {
+    const invalid =
+      "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon zzzzz";
+    const result = parseMnemonicImport(invalid.split(" "));
+    expect("error" in result && result.error).toContain("Invalid BIP-39");
+  });
+
+  it("rejects empty input", () => {
+    const result = parseMnemonicImport([]);
+    expect("error" in result && result.error).toContain("got 0");
+  });
+});

packages/x402-proxy/src/openclaw/commands.ts

@@ -203,23 +203,32 @@ function handleHistory(histPath: string, page: number): { text: string } {
   return { text: lines.join("\n") };
 }
 
+/** Parse mnemonic from import args, stripping surrounding quotes. Returns error string or clean mnemonic. */
+export function parseMnemonicImport(parts: string[]): { mnemonic: string } | { error: string } {
+  const raw = parts.join(" ").replace(/^["'""\u201C\u201D]+|["'""\u201C\u201D]+$/g, "");
+  const words = raw.split(/\s+/).filter(Boolean);
+  if (words.length !== 12 && words.length !== 24) {
+    return {
+      error: `Mnemonic must be 12 or 24 words (got ${words.length}).\nUsage: \`/x_wallet setup import word1 word2 ... word24\``,
+    };
+  }
+  const mnemonic = words.join(" ");
+  if (!isValidMnemonic(mnemonic)) {
+    return { error: "Invalid BIP-39 mnemonic. Check the words and try again." };
+  }
+  return { mnemonic };
+}
+
 async function handleSetup(ctx: CommandContext, parts: string[]): Promise<{ text: string }> {
   const action = parts[0]?.toLowerCase();
 
   let mnemonic: string | null = null;
   if (action === "generate") {
     mnemonic = generateMnemonic();
   } else if (action === "import") {
-    const words = parts.slice(1);
-    if (words.length !== 12 && words.length !== 24) {
-      return {
-        text: "Mnemonic must be 12 or 24 words.\nUsage: `/x_wallet setup import word1 word2 ... word24`",
-      };
-    }
-    mnemonic = words.join(" ");
-    if (!isValidMnemonic(mnemonic)) {
-      return { text: "Invalid BIP-39 mnemonic. Check the words and try again." };
-    }
+    const result = parseMnemonicImport(parts.slice(1));
+    if ("error" in result) return { text: result.error };
+    mnemonic = result.mnemonic;
   }
 
   if (!mnemonic) {