Summary

• Problem: sync-upstream.yml workflow 使用 --ours 策略解决 src/* 冲突，导致上游所有源码更新被丢弃，fork 用户无法获得新功能和 bug 修复
• Why it matters: Fork 的核心原则是"体验对齐"——用户体验应尽可能与官方 openclaw 一致，阻断上游更新违背了这一原则
• What changed: 将 src/* 冲突解决策略改为 --theirs（接受上游），然后通过 14 个幂等 node -e patch 脚本重新注入 CodeBuddy 特有代码；冲突白名单改用 glob 模式匹配
• What did NOT change (scope boundary): CodeBuddy 适配层核心代码（codebuddy-stream-adapter.ts）未改动；上游功能逻辑未额外修改

Change Type (select all)

• Bug fix
• Feature
• Refactor
• Docs
• Security hardening
• Chore/infra

Scope (select all touched areas)

• Gateway / orchestration
• Skills / tool execution
• Auth / tokens
• Memory / storage
• Integrations
• API / contracts
• UI / DX
• CI/CD / infra

Linked Issue/PR

• Closes #
• Related #

User-visible / Behavior Changes

• 同步上游 v2026.2.14 后，用户将获得上游的所有新功能、安全修复和性能优化
• CodeBuddy provider 功能保持不变（onboard、model 选择、stream adapter 等）

Security Impact (required)

• New permissions/capabilities? No
• Secrets/tokens handling changed? No
• New/changed network calls? No
• Command/tool execution surface changed? No — patch 脚本仅在 CI 环境中运行，操作范围与原 workflow 一致
• Data access scope changed? No

Repro + Verification

Environment

• OS: macOS (Darwin 25.2.0 ARM64)
• Runtime/container: Node.js v24.13.0, pnpm v10.23.0
• Model/provider: N/A (CI workflow change)
• Integration/channel (if any): GitHub Actions
• Relevant config (redacted): sync-upstream.yml

Steps

1. 在 fix/sync-upstream-theirs-strategy 分支上模拟完整同步流程：git merge --no-commit --no-ff v2026.2.14
2. 按 workflow 逻辑解决 6 个冲突（src/* 用 --theirs，deps 用 --theirs）
3. 执行所有 14 个 patch 脚本
4. 运行 pnpm install && pnpm build && pnpm test

Expected

• 所有冲突正确解决，10 个目标文件包含 CodeBuddy 代码
• 构建和测试全部通过

Actual

• 6 个冲突全部解决，5 个 patch 成功注入，10 个跳过（auto-merge 已保留），0 个失败
• pnpm build 通过（219 个输出文件）
• pnpm test 通过（694 个测试文件，4964 个测试用例）

Evidence

• Failing test/log before + passing after
• Trace/log snippets

Patch 执行日志：

⊘ onboard-types.ts: already contains codebuddy, skipping
⊘ register.onboard.ts: uses dynamic AUTH_CHOICE_HELP, skipping patch
⊘ register.onboard.ts: no three-arg --auth-choice found, skipping
⊘ onboard-auth.credentials.ts: already contains setCodeBuddyProfile, skipping
⊘ onboard-auth.ts: already contains setCodeBuddyProfile, skipping
✓ Added codebuddy to auth-choice-options.ts
⊘ auth-choice.preferred-provider.ts: already contains codebuddy, skipping
⊘ auth-choice.apply.ts: already contains codebuddy, skipping
⊘ model-auth.ts: already contains codebuddy, skipping
✓ Patched providers.ts: injected CODEBUDDY_DEFAULT_COST
✓ Patched providers.ts: injected buildCodeBuddyProvider()
✓ Patched providers.ts: injected codebuddy registration in resolveImplicitProviders
⊘ attempt.ts: already has codebuddy-stream-adapter import, skipping
⊘ attempt.ts: already has isCodeBuddyProvider check, skipping
✓ Patched test file: updated test name and assertions for codebuddy

=== All patches completed ===

测试结果：

Test Files  694 passed (694)
     Tests  4964 passed (4964)

Human Verification (required)

• Verified scenarios:
  • 完整 merge + patch + build + test 流程在本地执行通过
  • 所有 10 个 patch 目标文件逐一验证包含正确的 CodeBuddy 代码
  • 幂等性验证：auto-merge 已保留的文件被正确跳过
  • Case-sensitivity 检查：修复了 onboard-auth.ts 和 onboard-auth.credentials.ts 的 content.includes() 大小写不匹配问题
  • 上游 API 变更适配：register.onboard.ts 检测到 formatAuthChoiceChoicesForCli 动态生成后正确跳过
• Edge cases checked:
  • 上游新增冲突文件（glob 模式 src/* 自动匹配）
  • @tencent-ai/agent-sdk 依赖恢复（workflow 中 package.json patch 处理）
  • patch 锚点不存在时的 process.exit(1) 错误处理
• What you did not verify:
  • 实际 GitHub Actions 环境中的端到端运行（需要触发真实的 upstream tag）
  • e2e 测试（models-config.skips-writing-models-json-no-env-token.e2e.test.ts）需在有完整环境的 CI 中验证

Compatibility / Migration

• Backward compatible? Yes
• Config/env changes? No
• Migration needed? No

Failure Recovery (if this breaks)

• How to disable/revert this change quickly: git revert <commit> 回退到旧 workflow，或手动将 sync-upstream.yml 中 src/* 的 --theirs 改回 --ours
• Files/config to restore: .github/workflows/sync-upstream.yml
• Known bad symptoms reviewers should watch for:
  • Workflow 日志中出现 "anchor not found" 表示上游重构了目标文件结构，需更新对应 patch 的锚点
  • 构建失败可能表示 patch 注入位置不对或上游 API 发生了不兼容变更

Risks and Mitigations

• Risk: 上游大幅重构某个被 patch 的文件，导致锚点（content.indexOf(anchor)）找不到
  • Mitigation: 每个 patch 都有 process.exit(1) 错误处理，workflow 会在 patch 阶段失败并报告具体是哪个文件/锚点出问题，便于快速定位修复
• Risk: 上游新增了需要 CodeBuddy 适配的文件（如新的 provider 注册点）
  • Mitigation: 新文件不会被自动 patch，需要人工添加对应的 patch 脚本；但这种情况在旧 --ours 策略下同样存在

Agent-Signoff: lobster-upstream-surfer