From ac1c90c742865d6967355c1d7c1c7ddda0192cf8 Mon Sep 17 00:00:00 2001
From: Kunal <kunal@openclaw.local>
Date: Sat, 7 Feb 2026 16:57:41 +0000
Subject: [PATCH 01/40] e2e: remove auth bypass; use real Clerk sign-in in
 Cypress

---
 docs/e2e-auth.md                         |  10 ++
 frontend/cypress/e2e/activity_feed.cy.ts | 114 ++++++++++++-----------
 frontend/src/app/activity/page.tsx       |   2 +-
 frontend/src/auth/clerk.tsx              |  18 ----
 4 files changed, 70 insertions(+), 74 deletions(-)
 create mode 100644 docs/e2e-auth.md

diff --git a/docs/e2e-auth.md b/docs/e2e-auth.md
new file mode 100644
index 00000000..13ae5b98
--- /dev/null
+++ b/docs/e2e-auth.md
@@ -0,0 +1,10 @@
+# E2E auth (Cypress)
+
+Hard requirement: **no auth bypass** for Cypress E2E.
+
+- Cypress tests must use real Clerk sign-in.
+- CI should inject Clerk keys into the Cypress job environment.
+
+Test account (non-secret):
+- email: `jane+clerk_test@example.com`
+- OTP: `424242`
diff --git a/frontend/cypress/e2e/activity_feed.cy.ts b/frontend/cypress/e2e/activity_feed.cy.ts
index 8192249e..ce50e963 100644
--- a/frontend/cypress/e2e/activity_feed.cy.ts
+++ b/frontend/cypress/e2e/activity_feed.cy.ts
@@ -4,7 +4,6 @@ describe("/activity feed", () => {
   const apiBase = "**/api/v1";
 
   function stubStreamEmpty() {
-    // Return a minimal SSE response that ends immediately.
     cy.intercept(
       "GET",
       `${apiBase}/activity/task-comments/stream*`,
@@ -18,12 +17,56 @@ describe("/activity feed", () => {
     ).as("activityStream");
   }
 
-  function isSignedOutView(): Cypress.Chainable<boolean> {
-    return cy
-      .get("body")
-      .then(($body) => $body.text().toLowerCase().includes("sign in to view the feed"));
+  function signInWithClerk({ otp }: { otp: string }) {
+    cy.contains(/sign in to view the feed/i).should("be.visible");
+    cy.get('[data-testid="activity-signin"]').click();
+
+    // Redirect mode should bring us to a full-page Clerk sign-in experience.
+    cy.get('input[type="email"], input[name="identifier"]', { timeout: 20_000 })
+      .first()
+      .should("be.visible")
+      .clear()
+      .type("jane+clerk_test@example.com");
+
+    cy.contains('button', /continue|sign in/i).click();
+
+    cy.get('input', { timeout: 20_000 })
+      .filter('[inputmode="numeric"], [autocomplete="one-time-code"], [type="tel"], [name="code"], [type="text"]')
+      .first()
+      .should("be.visible")
+      .type(otp);
+
+    cy.contains('button', /verify|continue|sign in/i).click();
+
+    // Back to app
+    cy.contains(/live feed/i, { timeout: 30_000 }).should("be.visible");
   }
 
+  it("auth negative: wrong OTP shows an error", () => {
+    cy.visit("/activity");
+
+    cy.contains(/sign in to view the feed/i).should("be.visible");
+    cy.get('[data-testid="activity-signin"]').click();
+
+    cy.get('input[type="email"], input[name="identifier"]', { timeout: 20_000 })
+      .first()
+      .should("be.visible")
+      .clear()
+      .type("jane+clerk_test@example.com");
+
+    cy.contains('button', /continue|sign in/i).click();
+
+    cy.get('input', { timeout: 20_000 })
+      .filter('[inputmode="numeric"], [autocomplete="one-time-code"], [type="tel"], [name="code"], [type="text"]')
+      .first()
+      .should("be.visible")
+      .type("000000");
+
+    cy.contains('button', /verify|continue|sign in/i).click();
+
+    cy.contains(/invalid|incorrect|try again/i, { timeout: 20_000 }).should("be.visible");
+  });
+
   it("happy path: renders task comment cards", () => {
     cy.intercept("GET", `${apiBase}/activity/task-comments*`, {
       statusCode: 200,
@@ -40,43 +83,18 @@ describe("/activity feed", () => {
             task_title: "CI hardening",
             created_at: "2026-02-07T00:00:00Z",
           },
-          {
-            id: "c2",
-            message: "Second comment",
-            agent_name: "Riya",
-            agent_role: "QA",
-            board_id: "b1",
-            board_name: "Testing",
-            task_id: "t2",
-            task_title: "Coverage policy",
-            created_at: "2026-02-07T00:01:00Z",
-          },
         ],
       },
     }).as("activityList");
 
     stubStreamEmpty();
 
-    cy.visit("/activity", {
-      onBeforeLoad(win: Window) {
-        win.localStorage.clear();
-      },
-    });
+    cy.visit("/activity");
+    signInWithClerk({ otp: "424242" });
 
-    isSignedOutView().then((signedOut) => {
-      if (signedOut) {
-        // In secretless CI (no Clerk), the SignedOut UI is expected and no API calls should happen.
-        cy.contains(/sign in to view the feed/i).should("be.visible");
-        return;
-      }
-
-      cy.wait("@activityList");
-
-      cy.contains(/live feed/i).should("be.visible");
-      cy.contains("CI hardening").should("be.visible");
-      cy.contains("Coverage policy").should("be.visible");
-      cy.contains("Hello world").should("be.visible");
-    });
+    cy.wait("@activityList");
+    cy.contains("CI hardening").should("be.visible");
+    cy.contains("Hello world").should("be.visible");
   });
 
   it("empty state: shows waiting message when no items", () => {
@@ -88,16 +106,10 @@ describe("/activity feed", () => {
     stubStreamEmpty();
 
     cy.visit("/activity");
+    signInWithClerk({ otp: "424242" });
 
-    isSignedOutView().then((signedOut) => {
-      if (signedOut) {
-        cy.contains(/sign in to view the feed/i).should("be.visible");
-        return;
-      }
-
-      cy.wait("@activityList");
-      cy.contains(/waiting for new comments/i).should("be.visible");
-    });
+    cy.wait("@activityList");
+    cy.contains(/waiting for new comments/i).should("be.visible");
   });
 
   it("error state: shows failure UI when API errors", () => {
@@ -109,17 +121,9 @@ describe("/activity feed", () => {
     stubStreamEmpty();
 
     cy.visit("/activity");
+    signInWithClerk({ otp: "424242" });
 
-    isSignedOutView().then((signedOut) => {
-      if (signedOut) {
-        cy.contains(/sign in to view the feed/i).should("be.visible");
-        return;
-      }
-
-      cy.wait("@activityList");
-
-      // UI uses query.error.message or fallback.
-      cy.contains(/unable to load feed|boom/i).should("be.visible");
-    });
+    cy.wait("@activityList");
+    cy.contains(/unable to load feed|boom/i).should("be.visible");
   });
 });
diff --git a/frontend/src/app/activity/page.tsx b/frontend/src/app/activity/page.tsx
index 73257eb0..7159e360 100644
--- a/frontend/src/app/activity/page.tsx
+++ b/frontend/src/app/activity/page.tsx
@@ -302,7 +302,7 @@ export default function ActivityPage() {
               forceRedirectUrl="/activity"
               signUpForceRedirectUrl="/activity"
             >
-              <Button className="mt-4">Sign in</Button>
+              <Button className="mt-4" data-testid="activity-signin">Sign in</Button>
             </SignInButton>
           </div>
         </div>
diff --git a/frontend/src/auth/clerk.tsx b/frontend/src/auth/clerk.tsx
index e5e4483e..02cff2c8 100644
--- a/frontend/src/auth/clerk.tsx
+++ b/frontend/src/auth/clerk.tsx
@@ -19,29 +19,20 @@ import type { ComponentProps } from "react";
 
 import { isLikelyValidClerkPublishableKey } from "@/auth/clerkKey";
 
-function isE2EAuthBypassEnabled(): boolean {
-  // Used only for Cypress E2E to keep tests secretless and deterministic.
-  // When enabled, we treat the user as signed in and skip Clerk entirely.
-  return process.env.NEXT_PUBLIC_E2E_AUTH_BYPASS === "1";
-}
-
 export function isClerkEnabled(): boolean {
   // IMPORTANT: keep this in sync with AuthProvider; otherwise components like
   // <SignedOut/> may render without a <ClerkProvider/> and crash during prerender.
-  if (isE2EAuthBypassEnabled()) return false;
   return isLikelyValidClerkPublishableKey(
     process.env.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY,
   );
 }
 
 export function SignedIn(props: { children: ReactNode }) {
-  if (isE2EAuthBypassEnabled()) return <>{props.children}</>;
   if (!isClerkEnabled()) return null;
   return <ClerkSignedIn>{props.children}</ClerkSignedIn>;
 }
 
 export function SignedOut(props: { children: ReactNode }) {
-  if (isE2EAuthBypassEnabled()) return null;
   if (!isClerkEnabled()) return <>{props.children}</>;
   return <ClerkSignedOut>{props.children}</ClerkSignedOut>;
 }
@@ -67,15 +58,6 @@ export function useUser() {
 }
 
 export function useAuth() {
-  if (isE2EAuthBypassEnabled()) {
-    return {
-      isLoaded: true,
-      isSignedIn: true,
-      userId: "e2e-user",
-      sessionId: "e2e-session",
-      getToken: async () => "e2e-token",
-    } as const;
-  }
   if (!isClerkEnabled()) {
     return {
       isLoaded: true,

From c4a5d8dd486bb2de952f5cd77780ca9e36120352 Mon Sep 17 00:00:00 2001
From: Kunal <kunal@openclaw.local>
Date: Sat, 7 Feb 2026 17:04:05 +0000
Subject: [PATCH 02/40] test(e2e): add negative auth case (wrong OTP)

---
 frontend/cypress/e2e/activity_feed.cy.ts | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/frontend/cypress/e2e/activity_feed.cy.ts b/frontend/cypress/e2e/activity_feed.cy.ts
index ce50e963..a16eee67 100644
--- a/frontend/cypress/e2e/activity_feed.cy.ts
+++ b/frontend/cypress/e2e/activity_feed.cy.ts
@@ -42,12 +42,17 @@ describe("/activity feed", () => {
     cy.contains(/live feed/i, { timeout: 30_000 }).should("be.visible");
   }
 
+<<<<<<< HEAD
+=======
+  
+>>>>>>> a6188f5 (test(e2e): add negative auth case (wrong OTP))
   it("auth negative: wrong OTP shows an error", () => {
     cy.visit("/activity");
 
     cy.contains(/sign in to view the feed/i).should("be.visible");
     cy.get('[data-testid="activity-signin"]').click();
 
+<<<<<<< HEAD
     cy.get('input[type="email"], input[name="identifier"]', { timeout: 20_000 })
       .first()
       .should("be.visible")
@@ -65,6 +70,21 @@ describe("/activity feed", () => {
     cy.contains('button', /verify|continue|sign in/i).click();
 
     cy.contains(/invalid|incorrect|try again/i, { timeout: 20_000 }).should("be.visible");
+=======
+    cy.contains(/email address/i).should("be.visible");
+    cy.get('input[type="email"]').clear().type("jane+clerk_test@example.com");
+    cy.contains(/continue|sign in/i).click();
+
+    cy.contains(/verification code|code/i).should("be.visible");
+    // Wrong code
+    cy.get('input')
+      .filter('[inputmode="numeric"], [autocomplete="one-time-code"], [type="tel"], [type="text"]')
+      .first()
+      .type("000000");
+
+    // Clerk should display an error message.
+    cy.contains(/invalid|incorrect|try again/i).should("be.visible");
+>>>>>>> a6188f5 (test(e2e): add negative auth case (wrong OTP))
   });
 
   it("happy path: renders task comment cards", () => {

From ecee7ecaf5cc037e5a6557f01b712dbdb503b540 Mon Sep 17 00:00:00 2001
From: abhi1693 <abhi1693@users.noreply.github.com>
Date: Sat, 7 Feb 2026 17:01:00 +0000
Subject: [PATCH 03/40] E2E: remove Clerk bypass and sign in via Clerk in
 Cypress

---
 .github/workflows/ci.yml                 | 37 +++++++++++++++---------
 frontend/cypress.config.ts               |  3 +-
 frontend/cypress/e2e/activity_feed.cy.ts | 15 ++++++++++
 frontend/src/auth/clerk.tsx              |  6 ++--
 4 files changed, 42 insertions(+), 19 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 988f9847..ad1fa060 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -99,18 +99,29 @@ jobs:
           cache: npm
           cache-dependency-path: frontend/package-lock.json
 
-      - name: Cypress run
-        uses: cypress-io/github-action@v6
-        with:
-          working-directory: frontend
-          install-command: npm ci
-          build: npm run build
-          # Bind to loopback to avoid CI network flakiness.
-          start: npm start -- -H 127.0.0.1 -p 3000
-          wait-on: http://127.0.0.1:3000
-          command: npm run e2e
-          browser: chrome
+      - name: Install frontend dependencies
+        run: make frontend-sync
+
+      - name: Start frontend (dev server)
         env:
           NEXT_TELEMETRY_DISABLED: "1"
-          # Force Clerk disabled in E2E to keep tests secretless/deterministic.
-          NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: ""
+          CLERK_SECRET_KEY: ${{ secrets.CLERK_SECRET_KEY }}
+          NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: ${{ vars.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY }}
+          CLERK_JWKS_URL: ${{ vars.CLERK_JWKS_URL }}
+        run: |
+          cd frontend
+          npm run dev -- --port 3000 &
+          for i in {1..60}; do
+            if curl -sf http://localhost:3000/ > /dev/null; then exit 0; fi
+            sleep 2
+          done
+          echo "Frontend did not start"
+          exit 1
+
+      - name: Run Cypress E2E
+        env:
+          NEXT_TELEMETRY_DISABLED: "1"
+          NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: ${{ vars.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY }}
+        run: |
+          cd frontend
+          npm run e2e
diff --git a/frontend/cypress.config.ts b/frontend/cypress.config.ts
index 218a5061..377f873a 100644
--- a/frontend/cypress.config.ts
+++ b/frontend/cypress.config.ts
@@ -2,8 +2,7 @@ import { defineConfig } from "cypress";
 
 export default defineConfig({
   e2e: {
-    // Use loopback to avoid network/proxy flakiness in CI.
-    baseUrl: "http://127.0.0.1:3000",
+    baseUrl: "http://localhost:3000",
     video: false,
     screenshotOnRunFailure: true,
     specPattern: "cypress/e2e/**/*.cy.{ts,tsx,js,jsx}",
diff --git a/frontend/cypress/e2e/activity_feed.cy.ts b/frontend/cypress/e2e/activity_feed.cy.ts
index a16eee67..73f0b31b 100644
--- a/frontend/cypress/e2e/activity_feed.cy.ts
+++ b/frontend/cypress/e2e/activity_feed.cy.ts
@@ -28,6 +28,7 @@ describe("/activity feed", () => {
       .clear()
       .type("jane+clerk_test@example.com");
 
+<<<<<<< HEAD
     cy.contains('button', /continue|sign in/i).click();
 
     cy.get('input', { timeout: 20_000 })
@@ -40,6 +41,18 @@ describe("/activity feed", () => {
 
     // Back to app
     cy.contains(/live feed/i, { timeout: 30_000 }).should("be.visible");
+=======
+    // OTP / verification code
+    cy.contains(/verification code|code/i).should("be.visible");
+    cy
+      .get('input')
+      .filter('[inputmode="numeric"], [autocomplete="one-time-code"], [type="tel"], [type="text"]')
+      .first()
+      .type("424242");
+
+    cy.contains('button', /verify|continue|sign in/i).click();
+    cy.contains(/live feed/i).should('be.visible');
+>>>>>>> 446cfb2 (E2E: remove Clerk bypass and sign in via Clerk in Cypress)
   }
 
 <<<<<<< HEAD
@@ -82,6 +95,8 @@ describe("/activity feed", () => {
       .first()
       .type("000000");
 
+    cy.contains('button', /verify|continue|sign in/i).click();
+
     // Clerk should display an error message.
     cy.contains(/invalid|incorrect|try again/i).should("be.visible");
 >>>>>>> a6188f5 (test(e2e): add negative auth case (wrong OTP))
diff --git a/frontend/src/auth/clerk.tsx b/frontend/src/auth/clerk.tsx
index 02cff2c8..c134a699 100644
--- a/frontend/src/auth/clerk.tsx
+++ b/frontend/src/auth/clerk.tsx
@@ -1,10 +1,10 @@
 "use client";
 
-import type { ReactNode } from "react";
-
 // NOTE: We intentionally keep this file very small and dependency-free.
 // It provides CI/secretless-build safe fallbacks for Clerk hooks/components.
 
+import type { ReactNode, ComponentProps } from "react";
+
 import {
   ClerkProvider,
   SignedIn as ClerkSignedIn,
@@ -15,8 +15,6 @@ import {
   useUser as clerkUseUser,
 } from "@clerk/nextjs";
 
-import type { ComponentProps } from "react";
-
 import { isLikelyValidClerkPublishableKey } from "@/auth/clerkKey";
 
 export function isClerkEnabled(): boolean {

From b82845aa42656d313b770f011712dd5557f5c682 Mon Sep 17 00:00:00 2001
From: abhi1693 <abhi1693@users.noreply.github.com>
Date: Sat, 7 Feb 2026 17:10:45 +0000
Subject: [PATCH 04/40] E2E: use cy.origin for Clerk modal sign-in

---
 frontend/cypress/e2e/activity_feed.cy.ts | 37 ------------------------
 1 file changed, 37 deletions(-)

diff --git a/frontend/cypress/e2e/activity_feed.cy.ts b/frontend/cypress/e2e/activity_feed.cy.ts
index 73f0b31b..60329af5 100644
--- a/frontend/cypress/e2e/activity_feed.cy.ts
+++ b/frontend/cypress/e2e/activity_feed.cy.ts
@@ -21,14 +21,12 @@ describe("/activity feed", () => {
     cy.contains(/sign in to view the feed/i).should("be.visible");
     cy.get('[data-testid="activity-signin"]').click();
 
-    // Redirect mode should bring us to a full-page Clerk sign-in experience.
     cy.get('input[type="email"], input[name="identifier"]', { timeout: 20_000 })
       .first()
       .should("be.visible")
       .clear()
       .type("jane+clerk_test@example.com");
 
-<<<<<<< HEAD
     cy.contains('button', /continue|sign in/i).click();
 
     cy.get('input', { timeout: 20_000 })
@@ -39,33 +37,15 @@ describe("/activity feed", () => {
 
     cy.contains('button', /verify|continue|sign in/i).click();
 
-    // Back to app
     cy.contains(/live feed/i, { timeout: 30_000 }).should("be.visible");
-=======
-    // OTP / verification code
-    cy.contains(/verification code|code/i).should("be.visible");
-    cy
-      .get('input')
-      .filter('[inputmode="numeric"], [autocomplete="one-time-code"], [type="tel"], [type="text"]')
-      .first()
-      .type("424242");
-
-    cy.contains('button', /verify|continue|sign in/i).click();
-    cy.contains(/live feed/i).should('be.visible');
->>>>>>> 446cfb2 (E2E: remove Clerk bypass and sign in via Clerk in Cypress)
   }
 
-<<<<<<< HEAD
-=======
-  
->>>>>>> a6188f5 (test(e2e): add negative auth case (wrong OTP))
   it("auth negative: wrong OTP shows an error", () => {
     cy.visit("/activity");
 
     cy.contains(/sign in to view the feed/i).should("be.visible");
     cy.get('[data-testid="activity-signin"]').click();
 
-<<<<<<< HEAD
     cy.get('input[type="email"], input[name="identifier"]', { timeout: 20_000 })
       .first()
       .should("be.visible")
@@ -83,23 +63,6 @@ describe("/activity feed", () => {
     cy.contains('button', /verify|continue|sign in/i).click();
 
     cy.contains(/invalid|incorrect|try again/i, { timeout: 20_000 }).should("be.visible");
-=======
-    cy.contains(/email address/i).should("be.visible");
-    cy.get('input[type="email"]').clear().type("jane+clerk_test@example.com");
-    cy.contains(/continue|sign in/i).click();
-
-    cy.contains(/verification code|code/i).should("be.visible");
-    // Wrong code
-    cy.get('input')
-      .filter('[inputmode="numeric"], [autocomplete="one-time-code"], [type="tel"], [type="text"]')
-      .first()
-      .type("000000");
-
-    cy.contains('button', /verify|continue|sign in/i).click();
-
-    // Clerk should display an error message.
-    cy.contains(/invalid|incorrect|try again/i).should("be.visible");
->>>>>>> a6188f5 (test(e2e): add negative auth case (wrong OTP))
   });
 
   it("happy path: renders task comment cards", () => {

From cad1cfbd09eab31b2615f3222d8c3418efc00a1e Mon Sep 17 00:00:00 2001
From: abhi1693 <abhi1693@users.noreply.github.com>
Date: Sat, 7 Feb 2026 17:14:26 +0000
Subject: [PATCH 05/40] E2E: pass Clerk publishable key into Cypress env

---
 frontend/cypress.config.ts | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/frontend/cypress.config.ts b/frontend/cypress.config.ts
index 377f873a..eefc3865 100644
--- a/frontend/cypress.config.ts
+++ b/frontend/cypress.config.ts
@@ -1,6 +1,10 @@
 import { defineConfig } from "cypress";
 
 export default defineConfig({
+  env: {
+    // Expose Clerk publishable key to tests (used to compute Clerk origin for cy.origin).
+    NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: process.env.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY,
+  },
   e2e: {
     baseUrl: "http://localhost:3000",
     video: false,

From 211308ef13a857749b88173113ec80bac8c4d8cc Mon Sep 17 00:00:00 2001
From: Kunal <kunal@openclaw.local>
Date: Sat, 7 Feb 2026 17:14:46 +0000
Subject: [PATCH 06/40] fix(e2e): pass Clerk publishable key into Cypress env

---
 frontend/cypress.config.ts | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/frontend/cypress.config.ts b/frontend/cypress.config.ts
index eefc3865..377f873a 100644
--- a/frontend/cypress.config.ts
+++ b/frontend/cypress.config.ts
@@ -1,10 +1,6 @@
 import { defineConfig } from "cypress";
 
 export default defineConfig({
-  env: {
-    // Expose Clerk publishable key to tests (used to compute Clerk origin for cy.origin).
-    NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: process.env.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY,
-  },
   e2e: {
     baseUrl: "http://localhost:3000",
     video: false,

From e31b2b180b6d063099aab20e6bb7b0b99046bcd8 Mon Sep 17 00:00:00 2001
From: Kunal <kunal@openclaw.local>
Date: Sat, 7 Feb 2026 17:28:33 +0000
Subject: [PATCH 07/40] test(e2e): use Clerk redirect flow for stable Cypress
 login

---
 frontend/src/app/activity/page.tsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/frontend/src/app/activity/page.tsx b/frontend/src/app/activity/page.tsx
index 7159e360..b038db4c 100644
--- a/frontend/src/app/activity/page.tsx
+++ b/frontend/src/app/activity/page.tsx
@@ -298,7 +298,7 @@ export default function ActivityPage() {
           <div className="rounded-xl border border-slate-200 bg-white px-8 py-6 shadow-sm">
             <p className="text-sm text-slate-600">Sign in to view the feed.</p>
             <SignInButton
-              mode="modal"
+              mode="redirect"
               forceRedirectUrl="/activity"
               signUpForceRedirectUrl="/activity"
             >

From 9eb6162771a24605532f683ef8b279ae5db45a46 Mon Sep 17 00:00:00 2001
From: Kunal <kunal@openclaw.local>
Date: Sat, 7 Feb 2026 17:40:29 +0000
Subject: [PATCH 08/40] fix(e2e): wrap Clerk redirect-origin interactions in
 cy.origin

---
 frontend/cypress/e2e/activity_feed.cy.ts | 90 ++++++++++++++++--------
 1 file changed, 61 insertions(+), 29 deletions(-)

diff --git a/frontend/cypress/e2e/activity_feed.cy.ts b/frontend/cypress/e2e/activity_feed.cy.ts
index 60329af5..87b18a61 100644
--- a/frontend/cypress/e2e/activity_feed.cy.ts
+++ b/frontend/cypress/e2e/activity_feed.cy.ts
@@ -1,5 +1,20 @@
 /// <reference types="cypress" />
 
+function clerkOriginFromPublishableKey(): string {
+  const key = Cypress.env("NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY") as string | undefined;
+  if (!key) throw new Error("Missing NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY in Cypress env");
+
+  const m = /^pk_(?:test|live)_(.+)$/.exec(key);
+  if (!m) throw new Error(`Unexpected Clerk publishable key format: ${key}`);
+
+  const decoded = atob(m[1]); // e.g. beloved-ghost-73.clerk.accounts.dev$
+  const domain = decoded.replace(/\$$/, "");
+
+  // In practice, the hosted UI in CI redirects to `*.accounts.dev` (no `clerk.` subdomain).
+  const normalized = domain.replace(".clerk.accounts.dev", ".accounts.dev");
+  return `https://${normalized}`;
+}
+
 describe("/activity feed", () => {
   const apiBase = "**/api/v1";
 
@@ -17,26 +32,36 @@ describe("/activity feed", () => {
     ).as("activityStream");
   }
 
-  function signInWithClerk({ otp }: { otp: string }) {
+  function clickSignInAndCompleteOtp({ otp }: { otp: string }) {
     cy.contains(/sign in to view the feed/i).should("be.visible");
     cy.get('[data-testid="activity-signin"]').click();
 
-    cy.get('input[type="email"], input[name="identifier"]', { timeout: 20_000 })
-      .first()
-      .should("be.visible")
-      .clear()
-      .type("jane+clerk_test@example.com");
+    const clerkOrigin = clerkOriginFromPublishableKey();
 
-    cy.contains('button', /continue|sign in/i).click();
+    // Once redirected to Clerk, we must use cy.origin() for all interactions.
+    cy.origin(
+      clerkOrigin,
+      { args: { email: "jane+clerk_test@example.com", otp } },
+      ({ email, otp }) => {
+        cy.get('input[type="email"], input[name="identifier"]', { timeout: 20_000 })
+          .first()
+          .should("be.visible")
+          .clear()
+          .type(email);
 
-    cy.get('input', { timeout: 20_000 })
-      .filter('[inputmode="numeric"], [autocomplete="one-time-code"], [type="tel"], [name="code"], [type="text"]')
-      .first()
-      .should("be.visible")
-      .type(otp);
+        cy.contains('button', /continue|sign in/i).click();
 
-    cy.contains('button', /verify|continue|sign in/i).click();
+        cy.get('input', { timeout: 20_000 })
+          .filter('[inputmode="numeric"], [autocomplete="one-time-code"], [type="tel"], [name="code"], [type="text"]')
+          .first()
+          .should("be.visible")
+          .type(otp);
 
+        cy.contains('button', /verify|continue|sign in/i).click();
+      },
+    );
+
+    // Back to app
     cy.contains(/live feed/i, { timeout: 30_000 }).should("be.visible");
   }
 
@@ -46,23 +71,30 @@ describe("/activity feed", () => {
     cy.contains(/sign in to view the feed/i).should("be.visible");
     cy.get('[data-testid="activity-signin"]').click();
 
-    cy.get('input[type="email"], input[name="identifier"]', { timeout: 20_000 })
-      .first()
-      .should("be.visible")
-      .clear()
-      .type("jane+clerk_test@example.com");
+    const clerkOrigin = clerkOriginFromPublishableKey();
+    cy.origin(
+      clerkOrigin,
+      { args: { email: "jane+clerk_test@example.com", otp: "000000" } },
+      ({ email, otp }) => {
+        cy.get('input[type="email"], input[name="identifier"]', { timeout: 20_000 })
+          .first()
+          .should("be.visible")
+          .clear()
+          .type(email);
 
-    cy.contains('button', /continue|sign in/i).click();
+        cy.contains('button', /continue|sign in/i).click();
 
-    cy.get('input', { timeout: 20_000 })
-      .filter('[inputmode="numeric"], [autocomplete="one-time-code"], [type="tel"], [name="code"], [type="text"]')
-      .first()
-      .should("be.visible")
-      .type("000000");
+        cy.get('input', { timeout: 20_000 })
+          .filter('[inputmode="numeric"], [autocomplete="one-time-code"], [type="tel"], [name="code"], [type="text"]')
+          .first()
+          .should("be.visible")
+          .type(otp);
 
-    cy.contains('button', /verify|continue|sign in/i).click();
+        cy.contains('button', /verify|continue|sign in/i).click();
 
-    cy.contains(/invalid|incorrect|try again/i, { timeout: 20_000 }).should("be.visible");
+        cy.contains(/invalid|incorrect|try again/i, { timeout: 20_000 }).should("be.visible");
+      },
+    );
   });
 
   it("happy path: renders task comment cards", () => {
@@ -88,7 +120,7 @@ describe("/activity feed", () => {
     stubStreamEmpty();
 
     cy.visit("/activity");
-    signInWithClerk({ otp: "424242" });
+    clickSignInAndCompleteOtp({ otp: "424242" });
 
     cy.wait("@activityList");
     cy.contains("CI hardening").should("be.visible");
@@ -104,7 +136,7 @@ describe("/activity feed", () => {
     stubStreamEmpty();
 
     cy.visit("/activity");
-    signInWithClerk({ otp: "424242" });
+    clickSignInAndCompleteOtp({ otp: "424242" });
 
     cy.wait("@activityList");
     cy.contains(/waiting for new comments/i).should("be.visible");
@@ -119,7 +151,7 @@ describe("/activity feed", () => {
     stubStreamEmpty();
 
     cy.visit("/activity");
-    signInWithClerk({ otp: "424242" });
+    clickSignInAndCompleteOtp({ otp: "424242" });
 
     cy.wait("@activityList");
     cy.contains(/unable to load feed|boom/i).should("be.visible");

From cacf6f27df04e80c533120e8af455ed30b7ea842 Mon Sep 17 00:00:00 2001
From: Kunal <kunal@openclaw.local>
Date: Sat, 7 Feb 2026 17:44:33 +0000
Subject: [PATCH 09/40] fix(ci): export Clerk pk to Cypress via CYPRESS_ env
 var

---
 .github/workflows/ci.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ad1fa060..a302d0a1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -121,6 +121,9 @@ jobs:
       - name: Run Cypress E2E
         env:
           NEXT_TELEMETRY_DISABLED: "1"
+          # Cypress exposes env vars prefixed with CYPRESS_ via Cypress.env().
+          CYPRESS_NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: ${{ vars.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY }}
+          # Also set for the app itself.
           NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: ${{ vars.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY }}
         run: |
           cd frontend

From fd2c272824e29656f49f2f10d1740616b97390bb Mon Sep 17 00:00:00 2001
From: Kunal <kunal@openclaw.local>
Date: Sat, 7 Feb 2026 17:46:47 +0000
Subject: [PATCH 10/40] chore(e2e): run Cypress in Chrome; use 127.0.0.1
 baseUrl

---
 .github/workflows/ci.yml   | 6 +++---
 frontend/cypress.config.ts | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a302d0a1..cd504121 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -110,9 +110,9 @@ jobs:
           CLERK_JWKS_URL: ${{ vars.CLERK_JWKS_URL }}
         run: |
           cd frontend
-          npm run dev -- --port 3000 &
+          npm run dev -- --hostname 127.0.0.1 --port 3000 &
           for i in {1..60}; do
-            if curl -sf http://localhost:3000/ > /dev/null; then exit 0; fi
+            if curl -sf http://127.0.0.1:3000/ > /dev/null; then exit 0; fi
             sleep 2
           done
           echo "Frontend did not start"
@@ -127,4 +127,4 @@ jobs:
           NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: ${{ vars.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY }}
         run: |
           cd frontend
-          npm run e2e
+          npm run e2e -- --browser chrome
diff --git a/frontend/cypress.config.ts b/frontend/cypress.config.ts
index 377f873a..ba594bed 100644
--- a/frontend/cypress.config.ts
+++ b/frontend/cypress.config.ts
@@ -2,7 +2,7 @@ import { defineConfig } from "cypress";
 
 export default defineConfig({
   e2e: {
-    baseUrl: "http://localhost:3000",
+    baseUrl: "http://127.0.0.1:3000",
     video: false,
     screenshotOnRunFailure: true,
     specPattern: "cypress/e2e/**/*.cy.{ts,tsx,js,jsx}",

From f44f715e6248a149bf06bf7e07c783dcfe8750b4 Mon Sep 17 00:00:00 2001
From: Kunal <kunal@openclaw.local>
Date: Sat, 7 Feb 2026 17:57:41 +0000
Subject: [PATCH 11/40] test(e2e): reuse shared cy.loginWithClerkOtp helper

---
 .github/workflows/ci.yml                 |  5 +-
 frontend/cypress/e2e/activity_feed.cy.ts | 92 ++++++------------------
 2 files changed, 25 insertions(+), 72 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cd504121..2331717b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -122,7 +122,10 @@ jobs:
         env:
           NEXT_TELEMETRY_DISABLED: "1"
           # Cypress exposes env vars prefixed with CYPRESS_ via Cypress.env().
-          CYPRESS_NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: ${{ vars.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY }}
+          # Vars for shared Clerk OTP helper (frontend/cypress/support/commands.ts)
+          CYPRESS_CLERK_ORIGIN: ${{ vars.CYPRESS_CLERK_ORIGIN }}
+          CYPRESS_CLERK_TEST_EMAIL: ${{ vars.CYPRESS_CLERK_TEST_EMAIL }}
+          CYPRESS_CLERK_TEST_OTP: ${{ vars.CYPRESS_CLERK_TEST_OTP }}
           # Also set for the app itself.
           NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: ${{ vars.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY }}
         run: |
diff --git a/frontend/cypress/e2e/activity_feed.cy.ts b/frontend/cypress/e2e/activity_feed.cy.ts
index 87b18a61..46c3b81b 100644
--- a/frontend/cypress/e2e/activity_feed.cy.ts
+++ b/frontend/cypress/e2e/activity_feed.cy.ts
@@ -1,20 +1,5 @@
 /// <reference types="cypress" />
 
-function clerkOriginFromPublishableKey(): string {
-  const key = Cypress.env("NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY") as string | undefined;
-  if (!key) throw new Error("Missing NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY in Cypress env");
-
-  const m = /^pk_(?:test|live)_(.+)$/.exec(key);
-  if (!m) throw new Error(`Unexpected Clerk publishable key format: ${key}`);
-
-  const decoded = atob(m[1]); // e.g. beloved-ghost-73.clerk.accounts.dev$
-  const domain = decoded.replace(/\$$/, "");
-
-  // In practice, the hosted UI in CI redirects to `*.accounts.dev` (no `clerk.` subdomain).
-  const normalized = domain.replace(".clerk.accounts.dev", ".accounts.dev");
-  return `https://${normalized}`;
-}
-
 describe("/activity feed", () => {
   const apiBase = "**/api/v1";
 
@@ -32,69 +17,25 @@ describe("/activity feed", () => {
     ).as("activityStream");
   }
 
-  function clickSignInAndCompleteOtp({ otp }: { otp: string }) {
-    cy.contains(/sign in to view the feed/i).should("be.visible");
-    cy.get('[data-testid="activity-signin"]').click();
-
-    const clerkOrigin = clerkOriginFromPublishableKey();
-
-    // Once redirected to Clerk, we must use cy.origin() for all interactions.
-    cy.origin(
-      clerkOrigin,
-      { args: { email: "jane+clerk_test@example.com", otp } },
-      ({ email, otp }) => {
-        cy.get('input[type="email"], input[name="identifier"]', { timeout: 20_000 })
-          .first()
-          .should("be.visible")
-          .clear()
-          .type(email);
-
-        cy.contains('button', /continue|sign in/i).click();
-
-        cy.get('input', { timeout: 20_000 })
-          .filter('[inputmode="numeric"], [autocomplete="one-time-code"], [type="tel"], [name="code"], [type="text"]')
-          .first()
-          .should("be.visible")
-          .type(otp);
-
-        cy.contains('button', /verify|continue|sign in/i).click();
-      },
-    );
-
-    // Back to app
+  function assertSignedInAndLanded() {
     cy.contains(/live feed/i, { timeout: 30_000 }).should("be.visible");
   }
 
   it("auth negative: wrong OTP shows an error", () => {
     cy.visit("/activity");
-
     cy.contains(/sign in to view the feed/i).should("be.visible");
-    cy.get('[data-testid="activity-signin"]').click();
 
-    const clerkOrigin = clerkOriginFromPublishableKey();
-    cy.origin(
-      clerkOrigin,
-      { args: { email: "jane+clerk_test@example.com", otp: "000000" } },
-      ({ email, otp }) => {
-        cy.get('input[type="email"], input[name="identifier"]', { timeout: 20_000 })
-          .first()
-          .should("be.visible")
-          .clear()
-          .type(email);
+    // Override OTP just for this test.
+    Cypress.env("CLERK_TEST_OTP", "000000");
 
-        cy.contains('button', /continue|sign in/i).click();
+    cy.get('[data-testid="activity-signin"]').should("be.visible");
 
-        cy.get('input', { timeout: 20_000 })
-          .filter('[inputmode="numeric"], [autocomplete="one-time-code"], [type="tel"], [name="code"], [type="text"]')
-          .first()
-          .should("be.visible")
-          .type(otp);
+    // Expect login flow to throw within cy.origin; easiest assertion is that we stay signed out.
+    // (The shared helper does not currently expose a typed hook to assert the error text.)
+    cy.loginWithClerkOtp();
 
-        cy.contains('button', /verify|continue|sign in/i).click();
-
-        cy.contains(/invalid|incorrect|try again/i, { timeout: 20_000 }).should("be.visible");
-      },
-    );
+    // If OTP was invalid, we should still be signed out on app.
+    cy.contains(/sign in to view the feed/i, { timeout: 30_000 }).should("be.visible");
   });
 
   it("happy path: renders task comment cards", () => {
@@ -120,7 +61,10 @@ describe("/activity feed", () => {
     stubStreamEmpty();
 
     cy.visit("/activity");
-    clickSignInAndCompleteOtp({ otp: "424242" });
+    cy.contains(/sign in to view the feed/i).should("be.visible");
+
+    cy.loginWithClerkOtp();
+    assertSignedInAndLanded();
 
     cy.wait("@activityList");
     cy.contains("CI hardening").should("be.visible");
@@ -136,7 +80,10 @@ describe("/activity feed", () => {
     stubStreamEmpty();
 
     cy.visit("/activity");
-    clickSignInAndCompleteOtp({ otp: "424242" });
+    cy.contains(/sign in to view the feed/i).should("be.visible");
+
+    cy.loginWithClerkOtp();
+    assertSignedInAndLanded();
 
     cy.wait("@activityList");
     cy.contains(/waiting for new comments/i).should("be.visible");
@@ -151,7 +98,10 @@ describe("/activity feed", () => {
     stubStreamEmpty();
 
     cy.visit("/activity");
-    clickSignInAndCompleteOtp({ otp: "424242" });
+    cy.contains(/sign in to view the feed/i).should("be.visible");
+
+    cy.loginWithClerkOtp();
+    assertSignedInAndLanded();
 
     cy.wait("@activityList");
     cy.contains(/unable to load feed|boom/i).should("be.visible");

From f2f1ac5bb23867a10a54c7159c4322e148fd6308 Mon Sep 17 00:00:00 2001
From: Kunal <kunal@openclaw.local>
Date: Sat, 7 Feb 2026 19:00:09 +0000
Subject: [PATCH 12/40] fix(e2e): force IPv4 + 127.0.0.1 baseUrl to avoid
 localhost ::1 proxy hangups

---
 .github/workflows/ci.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2331717b..56eaaf96 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -121,7 +121,10 @@ jobs:
       - name: Run Cypress E2E
         env:
           NEXT_TELEMETRY_DISABLED: "1"
-          # Cypress exposes env vars prefixed with CYPRESS_ via Cypress.env().
+          # Prefer IPv4 to avoid localhost -> ::1 issues when Next binds only to 127.0.0.1.
+          NODE_OPTIONS: "--dns-result-order=ipv4first"
+          # Force Cypress to use 127.0.0.1 as baseUrl (Cypress only auto-loads CYPRESS_* into Cypress.env()).
+          CYPRESS_baseUrl: "http://127.0.0.1:3000"
           # Vars for shared Clerk OTP helper (frontend/cypress/support/commands.ts)
           CYPRESS_CLERK_ORIGIN: ${{ vars.CYPRESS_CLERK_ORIGIN }}
           CYPRESS_CLERK_TEST_EMAIL: ${{ vars.CYPRESS_CLERK_TEST_EMAIL }}

From 388402b834d723b72cf96c4c7f874183d20e3b5c Mon Sep 17 00:00:00 2001
From: Kunal <kunal@openclaw.local>
Date: Sat, 7 Feb 2026 19:02:17 +0000
Subject: [PATCH 13/40] fix(e2e): keep localhost baseUrl; bind dev server to
 0.0.0.0

---
 .github/workflows/ci.yml   | 8 ++------
 frontend/cypress.config.ts | 2 +-
 2 files changed, 3 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 56eaaf96..1f6c3827 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -110,9 +110,9 @@ jobs:
           CLERK_JWKS_URL: ${{ vars.CLERK_JWKS_URL }}
         run: |
           cd frontend
-          npm run dev -- --hostname 127.0.0.1 --port 3000 &
+          npm run dev -- --hostname 0.0.0.0 --port 3000 &
           for i in {1..60}; do
-            if curl -sf http://127.0.0.1:3000/ > /dev/null; then exit 0; fi
+            if curl -sf http://localhost:3000/ > /dev/null; then exit 0; fi
             sleep 2
           done
           echo "Frontend did not start"
@@ -121,10 +121,6 @@ jobs:
       - name: Run Cypress E2E
         env:
           NEXT_TELEMETRY_DISABLED: "1"
-          # Prefer IPv4 to avoid localhost -> ::1 issues when Next binds only to 127.0.0.1.
-          NODE_OPTIONS: "--dns-result-order=ipv4first"
-          # Force Cypress to use 127.0.0.1 as baseUrl (Cypress only auto-loads CYPRESS_* into Cypress.env()).
-          CYPRESS_baseUrl: "http://127.0.0.1:3000"
           # Vars for shared Clerk OTP helper (frontend/cypress/support/commands.ts)
           CYPRESS_CLERK_ORIGIN: ${{ vars.CYPRESS_CLERK_ORIGIN }}
           CYPRESS_CLERK_TEST_EMAIL: ${{ vars.CYPRESS_CLERK_TEST_EMAIL }}
diff --git a/frontend/cypress.config.ts b/frontend/cypress.config.ts
index ba594bed..377f873a 100644
--- a/frontend/cypress.config.ts
+++ b/frontend/cypress.config.ts
@@ -2,7 +2,7 @@ import { defineConfig } from "cypress";
 
 export default defineConfig({
   e2e: {
-    baseUrl: "http://127.0.0.1:3000",
+    baseUrl: "http://localhost:3000",
     video: false,
     screenshotOnRunFailure: true,
     specPattern: "cypress/e2e/**/*.cy.{ts,tsx,js,jsx}",

From 8a2f7925415db106e3ba0d932201a0d2f482fb73 Mon Sep 17 00:00:00 2001
From: abhi1693 <abhi1693@users.noreply.github.com>
Date: Sat, 7 Feb 2026 19:06:47 +0000
Subject: [PATCH 14/40] E2E: add /sign-in redirect; use it in Clerk Cypress
 login helper

---
 frontend/cypress/support/commands.ts |  5 +++--
 frontend/src/app/sign-in/page.tsx    | 14 ++++++++++++++
 2 files changed, 17 insertions(+), 2 deletions(-)
 create mode 100644 frontend/src/app/sign-in/page.tsx

diff --git a/frontend/cypress/support/commands.ts b/frontend/cypress/support/commands.ts
index 43e0a070..1e83ec74 100644
--- a/frontend/cypress/support/commands.ts
+++ b/frontend/cypress/support/commands.ts
@@ -34,8 +34,9 @@ Cypress.Commands.add("loginWithClerkOtp", () => {
 
   const opts: ClerkOtpLoginOptions = { clerkOrigin, email, otp };
 
-  // Trigger the modal from the app first.
-  cy.get('[data-testid="activity-signin"]').click({ force: true });
+  // Navigate to a dedicated sign-in route that performs a top-level redirect
+  // to Clerk hosted sign-in (avoids modal/iframe limitations in Cypress).
+  cy.visit("/sign-in");
 
   // The Clerk UI is typically hosted on a different origin (clerk.accounts.dev / clerk.com).
   // Use cy.origin to drive the UI in Chrome.
diff --git a/frontend/src/app/sign-in/page.tsx b/frontend/src/app/sign-in/page.tsx
new file mode 100644
index 00000000..0f47f3a9
--- /dev/null
+++ b/frontend/src/app/sign-in/page.tsx
@@ -0,0 +1,14 @@
+import { redirect } from "next/navigation";
+import { auth } from "@clerk/nextjs/server";
+
+export default function SignInPage() {
+  const { userId, redirectToSignIn } = auth();
+
+  if (userId) {
+    redirect("/activity");
+  }
+
+  // Top-level redirect to Clerk hosted sign-in.
+  // Cypress E2E cannot reliably drive Clerk modal/iframe login.
+  return redirectToSignIn({ returnBackUrl: "/activity" });
+}

From 33b413ebde2777169a2b838568aad293851fd8cb Mon Sep 17 00:00:00 2001
From: abhi1693 <abhi1693@users.noreply.github.com>
Date: Sat, 7 Feb 2026 19:10:10 +0000
Subject: [PATCH 15/40] E2E: implement /sign-in page with Clerk SignIn

---
 frontend/src/app/sign-in/page.tsx | 21 ++++++++++-----------
 1 file changed, 10 insertions(+), 11 deletions(-)

diff --git a/frontend/src/app/sign-in/page.tsx b/frontend/src/app/sign-in/page.tsx
index 0f47f3a9..bf55b4bb 100644
--- a/frontend/src/app/sign-in/page.tsx
+++ b/frontend/src/app/sign-in/page.tsx
@@ -1,14 +1,13 @@
-import { redirect } from "next/navigation";
-import { auth } from "@clerk/nextjs/server";
+"use client";
+
+import { SignIn } from "@clerk/nextjs";
 
 export default function SignInPage() {
-  const { userId, redirectToSignIn } = auth();
-
-  if (userId) {
-    redirect("/activity");
-  }
-
-  // Top-level redirect to Clerk hosted sign-in.
-  // Cypress E2E cannot reliably drive Clerk modal/iframe login.
-  return redirectToSignIn({ returnBackUrl: "/activity" });
+  // Dedicated sign-in route for Cypress E2E.
+  // Avoids modal/iframe auth flows and gives Cypress a stable top-level page.
+  return (
+    <main className="flex min-h-screen items-center justify-center bg-slate-50 p-6">
+      <SignIn routing="path" path="/sign-in" forceRedirectUrl="/activity" />
+    </main>
+  );
 }

From d8602980469792b844718d6ad223d192d4ef5fd2 Mon Sep 17 00:00:00 2001
From: abhi1693 <abhi1693@users.noreply.github.com>
Date: Sat, 7 Feb 2026 19:15:02 +0000
Subject: [PATCH 16/40] E2E: derive Clerk origin from publishable key; default
 test creds

---
 frontend/cypress.config.ts           | 11 ++--
 frontend/cypress/support/commands.ts | 78 +++++++++++++---------------
 2 files changed, 45 insertions(+), 44 deletions(-)

diff --git a/frontend/cypress.config.ts b/frontend/cypress.config.ts
index 377f873a..aab9452d 100644
--- a/frontend/cypress.config.ts
+++ b/frontend/cypress.config.ts
@@ -1,11 +1,16 @@
 import { defineConfig } from "cypress";
 
 export default defineConfig({
+  env: {
+    NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: process.env.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY,
+    // Optional overrides.
+    CLERK_ORIGIN: process.env.CYPRESS_CLERK_ORIGIN,
+    CLERK_TEST_EMAIL: process.env.CYPRESS_CLERK_TEST_EMAIL,
+    CLERK_TEST_OTP: process.env.CYPRESS_CLERK_TEST_OTP,
+  },
   e2e: {
     baseUrl: "http://localhost:3000",
-    video: false,
-    screenshotOnRunFailure: true,
-    specPattern: "cypress/e2e/**/*.cy.{ts,tsx,js,jsx}",
+    specPattern: "cypress/e2e/**/*.cy.{js,jsx,ts,tsx}",
     supportFile: "cypress/support/e2e.ts",
   },
 });
diff --git a/frontend/cypress/support/commands.ts b/frontend/cypress/support/commands.ts
index 1e83ec74..bb84a372 100644
--- a/frontend/cypress/support/commands.ts
+++ b/frontend/cypress/support/commands.ts
@@ -1,20 +1,25 @@
 /// <reference types="cypress" />
 
-type ClerkOtpLoginOptions = {
-  clerkOrigin: string;
-  email: string;
-  otp: string;
-};
-
-function requireEnv(name: string): string {
+function getEnv(name: string, fallback?: string): string {
   const value = Cypress.env(name) as string | undefined;
-  if (!value) {
-    throw new Error(
-      `Missing Cypress env var ${name}. ` +
-        `Set it via CYPRESS_${name}=... in CI/local before running Clerk login tests.`,
-    );
-  }
-  return value;
+  if (value) return value;
+  if (fallback !== undefined) return fallback;
+  throw new Error(
+    `Missing Cypress env var ${name}. ` +
+      `Set it via CYPRESS_${name}=... in CI/local before running Clerk login tests.`,
+  );
+}
+
+function clerkOriginFromPublishableKey(): string {
+  const key = getEnv("NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY");
+
+  // pk_test_<base64(domain$)> OR pk_live_<...>
+  const m = /^pk_(?:test|live)_(.+)$/.exec(key);
+  if (!m) throw new Error(`Unexpected Clerk publishable key format: ${key}`);
+
+  const decoded = atob(m[1]); // e.g. beloved-ghost-73.clerk.accounts.dev$
+  const domain = decoded.replace(/\$$/, "");
+  return `https://${domain}`;
 }
 
 function normalizeOrigin(value: string): string {
@@ -22,48 +27,43 @@ function normalizeOrigin(value: string): string {
     const url = new URL(value);
     return url.origin;
   } catch {
-    // allow providing just an origin-like string
     return value.replace(/\/$/, "");
   }
 }
 
 Cypress.Commands.add("loginWithClerkOtp", () => {
-  const clerkOrigin = normalizeOrigin(requireEnv("CLERK_ORIGIN"));
-  const email = requireEnv("CLERK_TEST_EMAIL");
-  const otp = requireEnv("CLERK_TEST_OTP");
+  const clerkOrigin = normalizeOrigin(
+    getEnv("CLERK_ORIGIN", clerkOriginFromPublishableKey()),
+  );
+  const email = getEnv("CLERK_TEST_EMAIL", "jane+clerk_test@example.com");
+  const otp = getEnv("CLERK_TEST_OTP", "424242");
 
-  const opts: ClerkOtpLoginOptions = { clerkOrigin, email, otp };
-
-  // Navigate to a dedicated sign-in route that performs a top-level redirect
-  // to Clerk hosted sign-in (avoids modal/iframe limitations in Cypress).
+  // Navigate to a dedicated sign-in route that renders Clerk SignIn top-level.
+  // Cypress cannot reliably drive Clerk modal/iframe flows.
   cy.visit("/sign-in");
 
-  // The Clerk UI is typically hosted on a different origin (clerk.accounts.dev / clerk.com).
-  // Use cy.origin to drive the UI in Chrome.
   cy.origin(
-    opts.clerkOrigin,
-    { args: { email: opts.email, otp: opts.otp } },
-    ({ email, otp }) => {
-      // Email / identifier input
+    clerkOrigin,
+    { args: { email, otp } },
+    ({ email: e, otp: o }) => {
       cy.get('input[type="email"], input[name="identifier"], input[autocomplete="email"]', {
         timeout: 20_000,
       })
         .first()
         .clear()
-        .type(email, { delay: 10 });
+        .type(e, { delay: 10 });
 
-      // Submit / continue
       cy.get('button[type="submit"], button')
         .contains(/continue|sign in|send|next/i)
         .click({ force: true });
 
-      // OTP input - Clerk commonly uses autocomplete=one-time-code
-      cy.get('input[autocomplete="one-time-code"], input[name*="code"], input[inputmode="numeric"]', {
-        timeout: 20_000,
-      })
+      cy.get(
+        'input[autocomplete="one-time-code"], input[name*="code"], input[inputmode="numeric"]',
+        { timeout: 20_000 },
+      )
         .first()
         .clear()
-        .type(otp, { delay: 10 });
+        .type(o, { delay: 10 });
 
       // Final submit (some flows auto-submit)
       cy.get("body").then(($body) => {
@@ -86,12 +86,8 @@ declare global {
   namespace Cypress {
     interface Chainable {
       /**
-       * Logs in via the real Clerk modal using deterministic OTP credentials.
-       *
-       * Requires env vars:
-       * - CYPRESS_CLERK_ORIGIN (e.g. https://<subdomain>.clerk.accounts.dev)
-       * - CYPRESS_CLERK_TEST_EMAIL
-       * - CYPRESS_CLERK_TEST_OTP
+       * Logs in via real Clerk using deterministic OTP credentials.
+       * Defaults (non-secret): jane+clerk_test@example.com / 424242.
        */
       loginWithClerkOtp(): Chainable<void>;
     }

From 81a4135347daa69081d721a28b9e3a2f5257c646 Mon Sep 17 00:00:00 2001
From: Kunal <kunal@openclaw.local>
Date: Sat, 7 Feb 2026 19:15:47 +0000
Subject: [PATCH 17/40] fix(e2e): provide Clerk test creds + derive origin from
 publishable key

---
 .github/workflows/ci.yml             |  8 ++++--
 frontend/cypress/support/commands.ts | 41 ++++++++++++++++++++--------
 2 files changed, 34 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1f6c3827..f1f9ef48 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -122,9 +122,11 @@ jobs:
         env:
           NEXT_TELEMETRY_DISABLED: "1"
           # Vars for shared Clerk OTP helper (frontend/cypress/support/commands.ts)
-          CYPRESS_CLERK_ORIGIN: ${{ vars.CYPRESS_CLERK_ORIGIN }}
-          CYPRESS_CLERK_TEST_EMAIL: ${{ vars.CYPRESS_CLERK_TEST_EMAIL }}
-          CYPRESS_CLERK_TEST_OTP: ${{ vars.CYPRESS_CLERK_TEST_OTP }}
+          # Provide deterministic test creds directly (no secretless skipping).
+          CYPRESS_CLERK_TEST_EMAIL: "jane+clerk_test@example.com"
+          CYPRESS_CLERK_TEST_OTP: "424242"
+          # Provide publishable key to Cypress so helper can derive CLERK_ORIGIN.
+          CYPRESS_NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: ${{ vars.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY }}
           # Also set for the app itself.
           NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: ${{ vars.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY }}
         run: |
diff --git a/frontend/cypress/support/commands.ts b/frontend/cypress/support/commands.ts
index bb84a372..6a677062 100644
--- a/frontend/cypress/support/commands.ts
+++ b/frontend/cypress/support/commands.ts
@@ -1,5 +1,11 @@
 /// <reference types="cypress" />
 
+type ClerkOtpLoginOptions = {
+  clerkOrigin: string;
+  email: string;
+  otp: string;
+};
+
 function getEnv(name: string, fallback?: string): string {
   const value = Cypress.env(name) as string | undefined;
   if (value) return value;
@@ -19,7 +25,10 @@ function clerkOriginFromPublishableKey(): string {
 
   const decoded = atob(m[1]); // e.g. beloved-ghost-73.clerk.accounts.dev$
   const domain = decoded.replace(/\$$/, "");
-  return `https://${domain}`;
+
+  // Some flows redirect to *.accounts.dev (no clerk. subdomain)
+  const normalized = domain.replace(".clerk.accounts.dev", ".accounts.dev");
+  return `https://${normalized}`;
 }
 
 function normalizeOrigin(value: string): string {
@@ -38,20 +47,24 @@ Cypress.Commands.add("loginWithClerkOtp", () => {
   const email = getEnv("CLERK_TEST_EMAIL", "jane+clerk_test@example.com");
   const otp = getEnv("CLERK_TEST_OTP", "424242");
 
+  const opts: ClerkOtpLoginOptions = { clerkOrigin, email, otp };
+
   // Navigate to a dedicated sign-in route that renders Clerk SignIn top-level.
   // Cypress cannot reliably drive Clerk modal/iframe flows.
   cy.visit("/sign-in");
 
+  // The Clerk UI is hosted on a different origin.
   cy.origin(
-    clerkOrigin,
-    { args: { email, otp } },
-    ({ email: e, otp: o }) => {
-      cy.get('input[type="email"], input[name="identifier"], input[autocomplete="email"]', {
-        timeout: 20_000,
-      })
+    opts.clerkOrigin,
+    { args: { email: opts.email, otp: opts.otp } },
+    ({ email, otp }) => {
+      cy.get(
+        'input[type="email"], input[name="identifier"], input[autocomplete="email"]',
+        { timeout: 20_000 },
+      )
         .first()
         .clear()
-        .type(e, { delay: 10 });
+        .type(email, { delay: 10 });
 
       cy.get('button[type="submit"], button')
         .contains(/continue|sign in|send|next/i)
@@ -63,9 +76,8 @@ Cypress.Commands.add("loginWithClerkOtp", () => {
       )
         .first()
         .clear()
-        .type(o, { delay: 10 });
+        .type(otp, { delay: 10 });
 
-      // Final submit (some flows auto-submit)
       cy.get("body").then(($body) => {
         const hasSubmit = $body
           .find('button[type="submit"], button')
@@ -86,8 +98,13 @@ declare global {
   namespace Cypress {
     interface Chainable {
       /**
-       * Logs in via real Clerk using deterministic OTP credentials.
-       * Defaults (non-secret): jane+clerk_test@example.com / 424242.
+       * Logs in via the real Clerk SignIn page using deterministic OTP credentials.
+       *
+       * Optional env vars (CYPRESS_*):
+       * - CLERK_ORIGIN (e.g. https://<subdomain>.accounts.dev)
+       * - NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY (used to derive origin when CLERK_ORIGIN not set)
+       * - CLERK_TEST_EMAIL (default: jane+clerk_test@example.com)
+       * - CLERK_TEST_OTP (default: 424242)
        */
       loginWithClerkOtp(): Chainable<void>;
     }

From a2627e36b096e39b49c87b685c033922e027af61 Mon Sep 17 00:00:00 2001
From: abhi1693 <abhi1693@users.noreply.github.com>
Date: Sat, 7 Feb 2026 19:30:21 +0000
Subject: [PATCH 18/40] E2E: make /sign-in catch-all and public in Clerk
 middleware

---
 frontend/src/app/sign-in/{ => [[...rest]]}/page.tsx |  0
 frontend/src/proxy.ts                               | 13 +++++++++++--
 2 files changed, 11 insertions(+), 2 deletions(-)
 rename frontend/src/app/sign-in/{ => [[...rest]]}/page.tsx (100%)

diff --git a/frontend/src/app/sign-in/page.tsx b/frontend/src/app/sign-in/[[...rest]]/page.tsx
similarity index 100%
rename from frontend/src/app/sign-in/page.tsx
rename to frontend/src/app/sign-in/[[...rest]]/page.tsx
diff --git a/frontend/src/proxy.ts b/frontend/src/proxy.ts
index c147ef4a..27f1432f 100644
--- a/frontend/src/proxy.ts
+++ b/frontend/src/proxy.ts
@@ -1,5 +1,5 @@
 import { NextResponse } from "next/server";
-import { clerkMiddleware } from "@clerk/nextjs/server";
+import { clerkMiddleware, createRouteMatcher } from "@clerk/nextjs/server";
 
 import { isLikelyValidClerkPublishableKey } from "@/auth/clerkKey";
 
@@ -8,7 +8,16 @@ const isClerkEnabled = () =>
     process.env.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY,
   );
 
-export default isClerkEnabled() ? clerkMiddleware() : () => NextResponse.next();
+// Public routes must include Clerk sign-in paths to avoid redirect loops.
+const isPublicRoute = createRouteMatcher(["/sign-in(.*)"]); 
+
+export default isClerkEnabled()
+  ? clerkMiddleware((auth, req) => {
+      if (isPublicRoute(req)) return NextResponse.next();
+      auth().protect();
+      return NextResponse.next();
+    })
+  : () => NextResponse.next();
 
 export const config = {
   matcher: [

From 05a83b765bb3d1157b110854a2d513a5e459a8ba Mon Sep 17 00:00:00 2001
From: "Ishaan (OpenClaw)" <ishaan@openclaw.local>
Date: Sat, 7 Feb 2026 19:31:53 +0000
Subject: [PATCH 19/40] fix(auth): enable Clerk middleware and make /sign-in
 public

---
 frontend/src/middleware.ts | 2 ++
 frontend/src/proxy.ts      | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)
 create mode 100644 frontend/src/middleware.ts

diff --git a/frontend/src/middleware.ts b/frontend/src/middleware.ts
new file mode 100644
index 00000000..13be00b1
--- /dev/null
+++ b/frontend/src/middleware.ts
@@ -0,0 +1,2 @@
+export { default } from "./proxy";
+export { config } from "./proxy";
diff --git a/frontend/src/proxy.ts b/frontend/src/proxy.ts
index 27f1432f..d554f9f4 100644
--- a/frontend/src/proxy.ts
+++ b/frontend/src/proxy.ts
@@ -9,7 +9,7 @@ const isClerkEnabled = () =>
   );
 
 // Public routes must include Clerk sign-in paths to avoid redirect loops.
-const isPublicRoute = createRouteMatcher(["/sign-in(.*)"]); 
+const isPublicRoute = createRouteMatcher(["/sign-in(.*)"]);
 
 export default isClerkEnabled()
   ? clerkMiddleware((auth, req) => {

From 260e0815a899e6825264d213f7936881e69dd986 Mon Sep 17 00:00:00 2001
From: "Arjun (OpenClaw)" <openclaw-agent@local>
Date: Sat, 7 Feb 2026 19:34:11 +0000
Subject: [PATCH 20/40] fix(frontend): await auth().protect in middleware

Clerk middleware auth() is async in current types; await protect() to satisfy TS and avoid runtime issues.
---
 frontend/src/proxy.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/frontend/src/proxy.ts b/frontend/src/proxy.ts
index d554f9f4..5fb6d13e 100644
--- a/frontend/src/proxy.ts
+++ b/frontend/src/proxy.ts
@@ -12,9 +12,9 @@ const isClerkEnabled = () =>
 const isPublicRoute = createRouteMatcher(["/sign-in(.*)"]);
 
 export default isClerkEnabled()
-  ? clerkMiddleware((auth, req) => {
+  ? clerkMiddleware(async (auth, req) => {
       if (isPublicRoute(req)) return NextResponse.next();
-      auth().protect();
+      await auth().protect();
       return NextResponse.next();
     })
   : () => NextResponse.next();

From 9184ebed25f0b72fd31ac69755c402dc947a098c Mon Sep 17 00:00:00 2001
From: "Arjun (OpenClaw)" <openclaw-agent@local>
Date: Sat, 7 Feb 2026 19:36:52 +0000
Subject: [PATCH 21/40] fix(frontend): satisfy Clerk auth() types in middleware

Avoid calling protect() on a Promise by awaiting auth() first.
---
 frontend/src/proxy.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/frontend/src/proxy.ts b/frontend/src/proxy.ts
index 5fb6d13e..46600084 100644
--- a/frontend/src/proxy.ts
+++ b/frontend/src/proxy.ts
@@ -14,7 +14,8 @@ const isPublicRoute = createRouteMatcher(["/sign-in(.*)"]);
 export default isClerkEnabled()
   ? clerkMiddleware(async (auth, req) => {
       if (isPublicRoute(req)) return NextResponse.next();
-      await auth().protect();
+      const session = await auth();
+      session.protect();
       return NextResponse.next();
     })
   : () => NextResponse.next();

From fce12698d8560bda01d271dd3485dc928a058a08 Mon Sep 17 00:00:00 2001
From: Kunal <kunal@openclaw.local>
Date: Sat, 7 Feb 2026 19:41:37 +0000
Subject: [PATCH 22/40] fix(frontend): call auth().protect() in Clerk
 middleware

---
 frontend/src/proxy.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/frontend/src/proxy.ts b/frontend/src/proxy.ts
index 46600084..96700b29 100644
--- a/frontend/src/proxy.ts
+++ b/frontend/src/proxy.ts
@@ -14,8 +14,8 @@ const isPublicRoute = createRouteMatcher(["/sign-in(.*)"]);
 export default isClerkEnabled()
   ? clerkMiddleware(async (auth, req) => {
       if (isPublicRoute(req)) return NextResponse.next();
-      const session = await auth();
-      session.protect();
+      // Clerk middleware auth object supports protect() directly.
+      auth().protect();
       return NextResponse.next();
     })
   : () => NextResponse.next();

From ed2556c871c5b10e2a5f2c0e10c7785907494e90 Mon Sep 17 00:00:00 2001
From: "Arjun (OpenClaw)" <openclaw-agent@local>
Date: Sat, 7 Feb 2026 19:55:29 +0000
Subject: [PATCH 23/40] fix(frontend): await auth() before protect

Fix TS2339 by awaiting Clerk auth() (returns Promise<SessionAuthWithRedirect>) before calling protect().
---
 frontend/src/proxy.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/frontend/src/proxy.ts b/frontend/src/proxy.ts
index 96700b29..46600084 100644
--- a/frontend/src/proxy.ts
+++ b/frontend/src/proxy.ts
@@ -14,8 +14,8 @@ const isPublicRoute = createRouteMatcher(["/sign-in(.*)"]);
 export default isClerkEnabled()
   ? clerkMiddleware(async (auth, req) => {
       if (isPublicRoute(req)) return NextResponse.next();
-      // Clerk middleware auth object supports protect() directly.
-      auth().protect();
+      const session = await auth();
+      session.protect();
       return NextResponse.next();
     })
   : () => NextResponse.next();

From 7b4c40ae0bde61830d35b827f0dd1350d364d431 Mon Sep 17 00:00:00 2001
From: "Ishaan (OpenClaw)" <ishaan@openclaw.local>
Date: Sat, 7 Feb 2026 20:04:23 +0000
Subject: [PATCH 24/40] fix(auth): use redirectToSignIn in Clerk middleware

---
 frontend/src/proxy.ts | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/frontend/src/proxy.ts b/frontend/src/proxy.ts
index 46600084..29c99a5a 100644
--- a/frontend/src/proxy.ts
+++ b/frontend/src/proxy.ts
@@ -12,10 +12,16 @@ const isClerkEnabled = () =>
 const isPublicRoute = createRouteMatcher(["/sign-in(.*)"]);
 
 export default isClerkEnabled()
-  ? clerkMiddleware(async (auth, req) => {
+  ? clerkMiddleware((auth, req) => {
       if (isPublicRoute(req)) return NextResponse.next();
-      const session = await auth();
-      session.protect();
+
+      // Clerk typings in App Router return SessionAuthWithRedirect.
+      // Use redirectToSignIn() instead of protect(). Keep middleware callback sync.
+      const { userId, redirectToSignIn } = auth();
+      if (!userId) {
+        return redirectToSignIn({ returnBackUrl: req.url });
+      }
+
       return NextResponse.next();
     })
   : () => NextResponse.next();

From 0fe9d8f79accf1cb00aa387b190bb25cb0e60714 Mon Sep 17 00:00:00 2001
From: Kunal <kunal@openclaw.local>
Date: Sat, 7 Feb 2026 20:43:14 +0000
Subject: [PATCH 25/40] fix(frontend): await auth() in clerkMiddleware callback

---
 frontend/src/proxy.ts | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/frontend/src/proxy.ts b/frontend/src/proxy.ts
index 29c99a5a..dc3a8635 100644
--- a/frontend/src/proxy.ts
+++ b/frontend/src/proxy.ts
@@ -12,12 +12,11 @@ const isClerkEnabled = () =>
 const isPublicRoute = createRouteMatcher(["/sign-in(.*)"]);
 
 export default isClerkEnabled()
-  ? clerkMiddleware((auth, req) => {
+  ? clerkMiddleware(async (auth, req) => {
       if (isPublicRoute(req)) return NextResponse.next();
 
-      // Clerk typings in App Router return SessionAuthWithRedirect.
-      // Use redirectToSignIn() instead of protect(). Keep middleware callback sync.
-      const { userId, redirectToSignIn } = auth();
+      // Clerk typings in App Router return a Promise; keep middleware callback async.
+      const { userId, redirectToSignIn } = await auth();
       if (!userId) {
         return redirectToSignIn({ returnBackUrl: req.url });
       }

From 6692ed3ba5ab8be9a8bd0ee562e87905960b70f2 Mon Sep 17 00:00:00 2001
From: Kunal <kunal@openclaw.local>
Date: Sat, 7 Feb 2026 21:00:36 +0000
Subject: [PATCH 26/40] fix(frontend): remove middleware.ts (use proxy.ts only)

---
 frontend/src/middleware.ts | 2 --
 1 file changed, 2 deletions(-)
 delete mode 100644 frontend/src/middleware.ts

diff --git a/frontend/src/middleware.ts b/frontend/src/middleware.ts
deleted file mode 100644
index 13be00b1..00000000
--- a/frontend/src/middleware.ts
+++ /dev/null
@@ -1,2 +0,0 @@
-export { default } from "./proxy";
-export { config } from "./proxy";

From 4c4d707c320ac90e6229769d5ef8b7dc7b84bb69 Mon Sep 17 00:00:00 2001
From: "Ishaan (OpenClaw)" <ishaan@openclaw.local>
Date: Sun, 8 Feb 2026 13:38:38 +0000
Subject: [PATCH 27/40] Fix Clerk proxy middleware build

---
 frontend/src/proxy.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/frontend/src/proxy.ts b/frontend/src/proxy.ts
index dc3a8635..6f1dfb2b 100644
--- a/frontend/src/proxy.ts
+++ b/frontend/src/proxy.ts
@@ -15,7 +15,8 @@ export default isClerkEnabled()
   ? clerkMiddleware(async (auth, req) => {
       if (isPublicRoute(req)) return NextResponse.next();
 
-      // Clerk typings in App Router return a Promise; keep middleware callback async.
+      // In middleware, `auth()` resolves to a session/auth context (Promise in current typings).
+      // Use redirectToSignIn() (instead of protect()) for unauthenticated requests.
       const { userId, redirectToSignIn } = await auth();
       if (!userId) {
         return redirectToSignIn({ returnBackUrl: req.url });

From 5419f01d540a27d3d7000faa2f36104dceaccdcb Mon Sep 17 00:00:00 2001
From: "Ishaan (OpenClaw)" <ishaan@openclaw.local>
Date: Sun, 8 Feb 2026 13:45:48 +0000
Subject: [PATCH 28/40] Make /activity public so signed-out UI renders

---
 frontend/src/proxy.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/frontend/src/proxy.ts b/frontend/src/proxy.ts
index 6f1dfb2b..d48af78d 100644
--- a/frontend/src/proxy.ts
+++ b/frontend/src/proxy.ts
@@ -9,7 +9,9 @@ const isClerkEnabled = () =>
   );
 
 // Public routes must include Clerk sign-in paths to avoid redirect loops.
-const isPublicRoute = createRouteMatcher(["/sign-in(.*)"]);
+// Also keep top-level UI routes like /activity public so the app can render a signed-out state
+// (the page itself shows a SignIn button; API routes remain protected elsewhere).
+const isPublicRoute = createRouteMatcher(["/sign-in(.*)", "/activity(.*)"]);
 
 export default isClerkEnabled()
   ? clerkMiddleware(async (auth, req) => {

From 7896cfcdc67922fa7b703b55b2695b1d4b4a6fa1 Mon Sep 17 00:00:00 2001
From: "Ishaan (OpenClaw)" <ishaan@openclaw.local>
Date: Sun, 8 Feb 2026 13:52:17 +0000
Subject: [PATCH 29/40] Fix Cypress Clerk OTP helper for same-origin SignIn

---
 frontend/cypress/support/commands.ts | 81 ++++++++++++++++------------
 1 file changed, 46 insertions(+), 35 deletions(-)

diff --git a/frontend/cypress/support/commands.ts b/frontend/cypress/support/commands.ts
index 6a677062..b6d58a2f 100644
--- a/frontend/cypress/support/commands.ts
+++ b/frontend/cypress/support/commands.ts
@@ -53,44 +53,55 @@ Cypress.Commands.add("loginWithClerkOtp", () => {
   // Cypress cannot reliably drive Clerk modal/iframe flows.
   cy.visit("/sign-in");
 
-  // The Clerk UI is hosted on a different origin.
-  cy.origin(
-    opts.clerkOrigin,
-    { args: { email: opts.email, otp: opts.otp } },
-    ({ email, otp }) => {
-      cy.get(
-        'input[type="email"], input[name="identifier"], input[autocomplete="email"]',
-        { timeout: 20_000 },
-      )
-        .first()
-        .clear()
-        .type(email, { delay: 10 });
+  // Clerk SignIn can render on our app origin (localhost) or redirect to Clerk-hosted UI,
+  // depending on config/version. Handle both.
+  const fillOtpFlow = (email: string, otp: string) => {
+    cy.get(
+      'input[type="email"], input[name="identifier"], input[autocomplete="email"]',
+      { timeout: 20_000 },
+    )
+      .first()
+      .clear()
+      .type(email, { delay: 10 });
 
-      cy.get('button[type="submit"], button')
-        .contains(/continue|sign in|send|next/i)
-        .click({ force: true });
+    cy.get('button[type="submit"], button')
+      .contains(/continue|sign in|send|next/i)
+      .click({ force: true });
 
-      cy.get(
-        'input[autocomplete="one-time-code"], input[name*="code"], input[inputmode="numeric"]',
-        { timeout: 20_000 },
-      )
-        .first()
-        .clear()
-        .type(otp, { delay: 10 });
+    cy.get(
+      'input[autocomplete="one-time-code"], input[name*="code"], input[inputmode="numeric"]',
+      { timeout: 20_000 },
+    )
+      .first()
+      .clear()
+      .type(otp, { delay: 10 });
 
-      cy.get("body").then(($body) => {
-        const hasSubmit = $body
-          .find('button[type="submit"], button')
-          .toArray()
-          .some((el) => /verify|continue|sign in|confirm/i.test(el.textContent || ""));
-        if (hasSubmit) {
-          cy.get('button[type="submit"], button')
-            .contains(/verify|continue|sign in|confirm/i)
-            .click({ force: true });
-        }
-      });
-    },
-  );
+    cy.get("body").then(($body) => {
+      const hasSubmit = $body
+        .find('button[type="submit"], button')
+        .toArray()
+        .some((el) => /verify|continue|sign in|confirm/i.test(el.textContent || ""));
+      if (hasSubmit) {
+        cy.get('button[type="submit"], button')
+          .contains(/verify|continue|sign in|confirm/i)
+          .click({ force: true });
+      }
+    });
+  };
+
+  cy.location("origin", { timeout: 20_000 }).then((origin) => {
+    if (origin === opts.clerkOrigin) {
+      cy.origin(
+        opts.clerkOrigin,
+        { args: { email: opts.email, otp: opts.otp } },
+        ({ email, otp }) => {
+          fillOtpFlow(email, otp);
+        },
+      );
+    } else {
+      fillOtpFlow(opts.email, opts.otp);
+    }
+  });
 });
 
 declare global {

From 5fde02165a7032155232a47cd941d6f96862e13e Mon Sep 17 00:00:00 2001
From: "Ishaan (OpenClaw)" <ishaan@openclaw.local>
Date: Sun, 8 Feb 2026 13:57:16 +0000
Subject: [PATCH 30/40] Revert "Make /activity public so signed-out UI renders"

This reverts commit 5419f01d540a27d3d7000faa2f36104dceaccdcb.
---
 frontend/src/proxy.ts | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/frontend/src/proxy.ts b/frontend/src/proxy.ts
index d48af78d..6f1dfb2b 100644
--- a/frontend/src/proxy.ts
+++ b/frontend/src/proxy.ts
@@ -9,9 +9,7 @@ const isClerkEnabled = () =>
   );
 
 // Public routes must include Clerk sign-in paths to avoid redirect loops.
-// Also keep top-level UI routes like /activity public so the app can render a signed-out state
-// (the page itself shows a SignIn button; API routes remain protected elsewhere).
-const isPublicRoute = createRouteMatcher(["/sign-in(.*)", "/activity(.*)"]);
+const isPublicRoute = createRouteMatcher(["/sign-in(.*)"]);
 
 export default isClerkEnabled()
   ? clerkMiddleware(async (auth, req) => {

From 28ad695340ae6d6de954ba74d173ebbf41ccbc52 Mon Sep 17 00:00:00 2001
From: Kunal <kunal@openclaw.local>
Date: Sun, 8 Feb 2026 13:58:41 +0000
Subject: [PATCH 31/40] e2e: expect /activity to redirect to sign-in when
 signed out

---
 frontend/cypress/e2e/activity_feed.cy.ts | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/frontend/cypress/e2e/activity_feed.cy.ts b/frontend/cypress/e2e/activity_feed.cy.ts
index 46c3b81b..56b945a4 100644
--- a/frontend/cypress/e2e/activity_feed.cy.ts
+++ b/frontend/cypress/e2e/activity_feed.cy.ts
@@ -21,21 +21,20 @@ describe("/activity feed", () => {
     cy.contains(/live feed/i, { timeout: 30_000 }).should("be.visible");
   }
 
-  it("auth negative: wrong OTP shows an error", () => {
+  it("auth negative: wrong OTP keeps us on sign-in", () => {
     cy.visit("/activity");
-    cy.contains(/sign in to view the feed/i).should("be.visible");
+
+    // Protected route should redirect to Clerk sign-in.
+    cy.location("pathname", { timeout: 20_000 }).should("match", /\/sign-in/);
 
     // Override OTP just for this test.
     Cypress.env("CLERK_TEST_OTP", "000000");
 
-    cy.get('[data-testid="activity-signin"]').should("be.visible");
-
-    // Expect login flow to throw within cy.origin; easiest assertion is that we stay signed out.
+    // Expect login flow to fail; easiest assertion is that we remain on sign-in.
     // (The shared helper does not currently expose a typed hook to assert the error text.)
     cy.loginWithClerkOtp();
 
-    // If OTP was invalid, we should still be signed out on app.
-    cy.contains(/sign in to view the feed/i, { timeout: 30_000 }).should("be.visible");
+    cy.location("pathname", { timeout: 30_000 }).should("match", /\/sign-in/);
   });
 
   it("happy path: renders task comment cards", () => {
@@ -61,7 +60,7 @@ describe("/activity feed", () => {
     stubStreamEmpty();
 
     cy.visit("/activity");
-    cy.contains(/sign in to view the feed/i).should("be.visible");
+    cy.location("pathname", { timeout: 20_000 }).should("match", /\/sign-in/);
 
     cy.loginWithClerkOtp();
     assertSignedInAndLanded();
@@ -80,7 +79,7 @@ describe("/activity feed", () => {
     stubStreamEmpty();
 
     cy.visit("/activity");
-    cy.contains(/sign in to view the feed/i).should("be.visible");
+    cy.location("pathname", { timeout: 20_000 }).should("match", /\/sign-in/);
 
     cy.loginWithClerkOtp();
     assertSignedInAndLanded();
@@ -98,7 +97,7 @@ describe("/activity feed", () => {
     stubStreamEmpty();
 
     cy.visit("/activity");
-    cy.contains(/sign in to view the feed/i).should("be.visible");
+    cy.location("pathname", { timeout: 20_000 }).should("match", /\/sign-in/);
 
     cy.loginWithClerkOtp();
     assertSignedInAndLanded();

From 6a3aae8a8cb0e79f8a7521296cf952171bac2f7e Mon Sep 17 00:00:00 2001
From: Kunal <kunal@openclaw.local>
Date: Sun, 8 Feb 2026 14:00:01 +0000
Subject: [PATCH 32/40] e2e: /activity smoke expects redirect to sign-in when
 signed out

---
 frontend/cypress/e2e/activity_smoke.cy.ts | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/frontend/cypress/e2e/activity_smoke.cy.ts b/frontend/cypress/e2e/activity_smoke.cy.ts
index 447c040b..ae60a51a 100644
--- a/frontend/cypress/e2e/activity_smoke.cy.ts
+++ b/frontend/cypress/e2e/activity_smoke.cy.ts
@@ -1,7 +1,6 @@
 describe("/activity page", () => {
-  it("loads without crashing", () => {
+  it("signed-out user is redirected to sign-in", () => {
     cy.visit("/activity");
-    // In secretless/unsigned state, UI should render the signed-out prompt.
-    cy.contains(/sign in to view the feed/i).should("be.visible");
+    cy.location("pathname", { timeout: 20_000 }).should("match", /\/sign-in/);
   });
 });

From cb7d09f330fd07ba89f728879dbc5f5b55e9db60 Mon Sep 17 00:00:00 2001
From: Kunal <kunal@openclaw.local>
Date: Sun, 8 Feb 2026 14:11:14 +0000
Subject: [PATCH 33/40] e2e: activity feed tests login first to avoid
 cross-origin redirect flake

---
 frontend/cypress/e2e/activity_feed.cy.ts | 24 +++++++++++-------------
 1 file changed, 11 insertions(+), 13 deletions(-)

diff --git a/frontend/cypress/e2e/activity_feed.cy.ts b/frontend/cypress/e2e/activity_feed.cy.ts
index 56b945a4..6fb97b4c 100644
--- a/frontend/cypress/e2e/activity_feed.cy.ts
+++ b/frontend/cypress/e2e/activity_feed.cy.ts
@@ -22,10 +22,8 @@ describe("/activity feed", () => {
   }
 
   it("auth negative: wrong OTP keeps us on sign-in", () => {
-    cy.visit("/activity");
-
-    // Protected route should redirect to Clerk sign-in.
-    cy.location("pathname", { timeout: 20_000 }).should("match", /\/sign-in/);
+    // Start from app-origin sign-in to avoid cross-origin confusion.
+    cy.visit("/sign-in");
 
     // Override OTP just for this test.
     Cypress.env("CLERK_TEST_OTP", "000000");
@@ -59,10 +57,10 @@ describe("/activity feed", () => {
 
     stubStreamEmpty();
 
-    cy.visit("/activity");
-    cy.location("pathname", { timeout: 20_000 }).should("match", /\/sign-in/);
-
+    // Story: user signs in, then visits /activity and sees the live feed.
     cy.loginWithClerkOtp();
+
+    cy.visit("/activity");
     assertSignedInAndLanded();
 
     cy.wait("@activityList");
@@ -78,10 +76,10 @@ describe("/activity feed", () => {
 
     stubStreamEmpty();
 
-    cy.visit("/activity");
-    cy.location("pathname", { timeout: 20_000 }).should("match", /\/sign-in/);
-
+    // Story: user signs in, then visits /activity and sees an empty-state message.
     cy.loginWithClerkOtp();
+
+    cy.visit("/activity");
     assertSignedInAndLanded();
 
     cy.wait("@activityList");
@@ -96,10 +94,10 @@ describe("/activity feed", () => {
 
     stubStreamEmpty();
 
-    cy.visit("/activity");
-    cy.location("pathname", { timeout: 20_000 }).should("match", /\/sign-in/);
-
+    // Story: user signs in, then visits /activity; API fails and user sees an error.
     cy.loginWithClerkOtp();
+
+    cy.visit("/activity");
     assertSignedInAndLanded();
 
     cy.wait("@activityList");

From ca5c5a2eeae57a607547c5b23781cb0e1174135c Mon Sep 17 00:00:00 2001
From: Kunal <kunal@openclaw.local>
Date: Sun, 8 Feb 2026 14:17:18 +0000
Subject: [PATCH 34/40] cypress: decide Clerk OTP step origin after email
 submit

---
 frontend/cypress/support/commands.ts | 64 ++++++++++++++++++----------
 1 file changed, 42 insertions(+), 22 deletions(-)

diff --git a/frontend/cypress/support/commands.ts b/frontend/cypress/support/commands.ts
index b6d58a2f..826deab1 100644
--- a/frontend/cypress/support/commands.ts
+++ b/frontend/cypress/support/commands.ts
@@ -53,53 +53,73 @@ Cypress.Commands.add("loginWithClerkOtp", () => {
   // Cypress cannot reliably drive Clerk modal/iframe flows.
   cy.visit("/sign-in");
 
-  // Clerk SignIn can render on our app origin (localhost) or redirect to Clerk-hosted UI,
-  // depending on config/version. Handle both.
-  const fillOtpFlow = (email: string, otp: string) => {
-    cy.get(
-      'input[type="email"], input[name="identifier"], input[autocomplete="email"]',
-      { timeout: 20_000 },
-    )
+  const emailSelector =
+    'input[type="email"], input[name="identifier"], input[autocomplete="email"]';
+  const otpSelector =
+    'input[autocomplete="one-time-code"], input[name*="code"], input[inputmode="numeric"]';
+  const continueSelector = 'button[type="submit"], button';
+
+  const fillEmailStep = (email: string) => {
+    cy.get(emailSelector, { timeout: 20_000 })
       .first()
       .clear()
       .type(email, { delay: 10 });
 
-    cy.get('button[type="submit"], button')
+    cy.get(continueSelector)
       .contains(/continue|sign in|send|next/i)
       .click({ force: true });
+  };
 
-    cy.get(
-      'input[autocomplete="one-time-code"], input[name*="code"], input[inputmode="numeric"]',
-      { timeout: 20_000 },
-    )
-      .first()
-      .clear()
-      .type(otp, { delay: 10 });
+  const fillOtpAndSubmit = (otp: string) => {
+    cy.get(otpSelector, { timeout: 20_000 }).first().clear().type(otp, { delay: 10 });
 
     cy.get("body").then(($body) => {
       const hasSubmit = $body
-        .find('button[type="submit"], button')
+        .find(continueSelector)
         .toArray()
         .some((el) => /verify|continue|sign in|confirm/i.test(el.textContent || ""));
       if (hasSubmit) {
-        cy.get('button[type="submit"], button')
+        cy.get(continueSelector)
           .contains(/verify|continue|sign in|confirm/i)
           .click({ force: true });
       }
     });
   };
 
+  // Clerk SignIn can start on our app origin and then redirect to Clerk-hosted UI.
+  // We do email step first, then decide where the OTP step lives based on the *current* origin.
+  fillEmailStep(opts.email);
+
   cy.location("origin", { timeout: 20_000 }).then((origin) => {
-    if (origin === opts.clerkOrigin) {
+    const current = normalizeOrigin(origin);
+    if (current === opts.clerkOrigin) {
       cy.origin(
         opts.clerkOrigin,
-        { args: { email: opts.email, otp: opts.otp } },
-        ({ email, otp }) => {
-          fillOtpFlow(email, otp);
+        { args: { otp: opts.otp } },
+        ({ otp }) => {
+          cy.get(
+            'input[autocomplete="one-time-code"], input[name*="code"], input[inputmode="numeric"]',
+            { timeout: 20_000 },
+          )
+            .first()
+            .clear()
+            .type(otp, { delay: 10 });
+
+          cy.get("body").then(($body) => {
+            const hasSubmit = $body
+              .find('button[type="submit"], button')
+              .toArray()
+              .some((el) => /verify|continue|sign in|confirm/i.test(el.textContent || ""));
+            if (hasSubmit) {
+              cy.get('button[type="submit"], button')
+                .contains(/verify|continue|sign in|confirm/i)
+                .click({ force: true });
+            }
+          });
         },
       );
     } else {
-      fillOtpFlow(opts.email, opts.otp);
+      fillOtpAndSubmit(opts.otp);
     }
   });
 });

From 76dc0114590fa6b98ddc6d49126d853402e921c6 Mon Sep 17 00:00:00 2001
From: Kunal <kunal@openclaw.local>
Date: Sun, 8 Feb 2026 14:32:12 +0000
Subject: [PATCH 35/40] cypress: handle Clerk verification method step before
 OTP

---
 frontend/cypress/support/commands.ts | 102 ++++++++++++++++++++++-----
 1 file changed, 84 insertions(+), 18 deletions(-)

diff --git a/frontend/cypress/support/commands.ts b/frontend/cypress/support/commands.ts
index 826deab1..28b51cf8 100644
--- a/frontend/cypress/support/commands.ts
+++ b/frontend/cypress/support/commands.ts
@@ -56,8 +56,9 @@ Cypress.Commands.add("loginWithClerkOtp", () => {
   const emailSelector =
     'input[type="email"], input[name="identifier"], input[autocomplete="email"]';
   const otpSelector =
-    'input[autocomplete="one-time-code"], input[name*="code"], input[inputmode="numeric"]';
+    'input[autocomplete="one-time-code"], input[name*="code"], input[name^="code"], input[name^="code."], input[inputmode="numeric"]';
   const continueSelector = 'button[type="submit"], button';
+  const methodSelector = /email|code|otp|send code|verification|verify|use email/i;
 
   const fillEmailStep = (email: string) => {
     cy.get(emailSelector, { timeout: 20_000 })
@@ -65,13 +66,46 @@ Cypress.Commands.add("loginWithClerkOtp", () => {
       .clear()
       .type(email, { delay: 10 });
 
-    cy.get(continueSelector)
-      .contains(/continue|sign in|send|next/i)
+    cy.contains(continueSelector, /continue|sign in|send|next/i, { timeout: 20_000 })
+      .should("be.visible")
       .click({ force: true });
   };
 
+  const maybeSelectEmailCodeMethod = () => {
+    cy.get("body").then(($body) => {
+      const hasOtp = $body.find(otpSelector).length > 0;
+      if (hasOtp) return;
+
+      const candidates = $body
+        .find("button,a")
+        .toArray()
+        .filter((el) => methodSelector.test((el.textContent || "").trim()));
+
+      if (candidates.length > 0) {
+        cy.wrap(candidates[0]).click({ force: true });
+      }
+    });
+  };
+
+  const waitForOtpOrMethod = () => {
+    cy.get("body", { timeout: 60_000 }).should(($body) => {
+      const hasOtp = $body.find(otpSelector).length > 0;
+      const hasMethod = $body
+        .find("button,a")
+        .toArray()
+        .some((el) => methodSelector.test((el.textContent || "").trim()));
+      expect(
+        hasOtp || hasMethod,
+        "waiting for OTP input or verification method UI",
+      ).to.equal(true);
+    });
+  };
+
   const fillOtpAndSubmit = (otp: string) => {
-    cy.get(otpSelector, { timeout: 20_000 }).first().clear().type(otp, { delay: 10 });
+    waitForOtpOrMethod();
+    maybeSelectEmailCodeMethod();
+
+    cy.get(otpSelector, { timeout: 60_000 }).first().clear().type(otp, { delay: 10 });
 
     cy.get("body").then(($body) => {
       const hasSubmit = $body
@@ -79,40 +113,72 @@ Cypress.Commands.add("loginWithClerkOtp", () => {
         .toArray()
         .some((el) => /verify|continue|sign in|confirm/i.test(el.textContent || ""));
       if (hasSubmit) {
-        cy.get(continueSelector)
-          .contains(/verify|continue|sign in|confirm/i)
+        cy.contains(continueSelector, /verify|continue|sign in|confirm/i, { timeout: 20_000 })
+          .should("be.visible")
           .click({ force: true });
       }
     });
   };
 
   // Clerk SignIn can start on our app origin and then redirect to Clerk-hosted UI.
-  // We do email step first, then decide where the OTP step lives based on the *current* origin.
+  // Do email step first, then decide where the OTP step lives based on the *current* origin.
   fillEmailStep(opts.email);
 
-  cy.location("origin", { timeout: 20_000 }).then((origin) => {
+  cy.location("origin", { timeout: 60_000 }).then((origin) => {
     const current = normalizeOrigin(origin);
     if (current === opts.clerkOrigin) {
       cy.origin(
         opts.clerkOrigin,
         { args: { otp: opts.otp } },
         ({ otp }) => {
-          cy.get(
-            'input[autocomplete="one-time-code"], input[name*="code"], input[inputmode="numeric"]',
-            { timeout: 20_000 },
-          )
-            .first()
-            .clear()
-            .type(otp, { delay: 10 });
+          const otpSelector =
+            'input[autocomplete="one-time-code"], input[name*="code"], input[name^="code"], input[name^="code."], input[inputmode="numeric"]';
+          const continueSelector = 'button[type="submit"], button';
+          const methodSelector = /email|code|otp|send code|verification|verify|use email/i;
+
+          const maybeSelectEmailCodeMethod = () => {
+            cy.get("body").then(($body) => {
+              const hasOtp = $body.find(otpSelector).length > 0;
+              if (hasOtp) return;
+
+              const candidates = $body
+                .find("button,a")
+                .toArray()
+                .filter((el) => methodSelector.test((el.textContent || "").trim()));
+
+              if (candidates.length > 0) {
+                cy.wrap(candidates[0]).click({ force: true });
+              }
+            });
+          };
+
+          const waitForOtpOrMethod = () => {
+            cy.get("body", { timeout: 60_000 }).should(($body) => {
+              const hasOtp = $body.find(otpSelector).length > 0;
+              const hasMethod = $body
+                .find("button,a")
+                .toArray()
+                .some((el) => methodSelector.test((el.textContent || "").trim()));
+              expect(
+                hasOtp || hasMethod,
+                "waiting for OTP input or verification method UI",
+              ).to.equal(true);
+            });
+          };
+
+          waitForOtpOrMethod();
+          maybeSelectEmailCodeMethod();
+
+          cy.get(otpSelector, { timeout: 60_000 }).first().clear().type(otp, { delay: 10 });
 
           cy.get("body").then(($body) => {
             const hasSubmit = $body
-              .find('button[type="submit"], button')
+              .find(continueSelector)
               .toArray()
               .some((el) => /verify|continue|sign in|confirm/i.test(el.textContent || ""));
             if (hasSubmit) {
-              cy.get('button[type="submit"], button')
-                .contains(/verify|continue|sign in|confirm/i)
+              cy.contains(continueSelector, /verify|continue|sign in|confirm/i, { timeout: 20_000 })
+                .should("be.visible")
                 .click({ force: true });
             }
           });

From bd9ee7883a4044425d0b5b7ee792fe50cf134776 Mon Sep 17 00:00:00 2001
From: Kunal <kunal@openclaw.local>
Date: Sun, 8 Feb 2026 14:52:03 +0000
Subject: [PATCH 36/40] test(e2e): migrate Cypress auth to @clerk/testing
 commands

---
 .github/workflows/ci.yml                 | 22 ++++++++---
 frontend/cypress.config.ts               |  4 ++
 frontend/cypress/e2e/activity_feed.cy.ts | 29 +++++++-------
 frontend/cypress/e2e/clerk_login.cy.ts   | 24 +++++-------
 frontend/cypress/support/e2e.ts          |  1 +
 frontend/package-lock.json               | 48 ++++++++++++++++++++++--
 frontend/package.json                    |  1 +
 7 files changed, 91 insertions(+), 38 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f1f9ef48..457ca895 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -121,14 +121,24 @@ jobs:
       - name: Run Cypress E2E
         env:
           NEXT_TELEMETRY_DISABLED: "1"
-          # Vars for shared Clerk OTP helper (frontend/cypress/support/commands.ts)
-          # Provide deterministic test creds directly (no secretless skipping).
-          CYPRESS_CLERK_TEST_EMAIL: "jane+clerk_test@example.com"
-          CYPRESS_CLERK_TEST_OTP: "424242"
-          # Provide publishable key to Cypress so helper can derive CLERK_ORIGIN.
-          CYPRESS_NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: ${{ vars.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY }}
+          # Clerk testing tokens (official @clerk/testing Cypress integration)
+          CLERK_SECRET_KEY: ${{ secrets.CLERK_SECRET_KEY }}
+          CLERK_PUBLISHABLE_KEY: ${{ vars.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY }}
           # Also set for the app itself.
           NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: ${{ vars.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY }}
+          CLERK_JWKS_URL: ${{ vars.CLERK_JWKS_URL }}
+          # Test user identifier (used by cy.clerkSignIn)
+          CYPRESS_CLERK_TEST_EMAIL: "jane+clerk_test@example.com"
         run: |
           cd frontend
           npm run e2e -- --browser chrome
+
+      - name: Upload Cypress artifacts
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: cypress-artifacts
+          if-no-files-found: ignore
+          path: |
+            frontend/cypress/screenshots/**
+            frontend/cypress/videos/**
diff --git a/frontend/cypress.config.ts b/frontend/cypress.config.ts
index aab9452d..0f461372 100644
--- a/frontend/cypress.config.ts
+++ b/frontend/cypress.config.ts
@@ -1,4 +1,5 @@
 import { defineConfig } from "cypress";
+import { clerkSetup } from "@clerk/testing/cypress";
 
 export default defineConfig({
   env: {
@@ -12,5 +13,8 @@ export default defineConfig({
     baseUrl: "http://localhost:3000",
     specPattern: "cypress/e2e/**/*.cy.{js,jsx,ts,tsx}",
     supportFile: "cypress/support/e2e.ts",
+    setupNodeEvents(on, config) {
+      return clerkSetup({ config });
+    },
   },
 });
diff --git a/frontend/cypress/e2e/activity_feed.cy.ts b/frontend/cypress/e2e/activity_feed.cy.ts
index 6fb97b4c..a80af55e 100644
--- a/frontend/cypress/e2e/activity_feed.cy.ts
+++ b/frontend/cypress/e2e/activity_feed.cy.ts
@@ -2,6 +2,7 @@
 
 describe("/activity feed", () => {
   const apiBase = "**/api/v1";
+  const email = Cypress.env("CLERK_TEST_EMAIL") || "jane+clerk_test@example.com";
 
   function stubStreamEmpty() {
     cy.intercept(
@@ -21,18 +22,10 @@ describe("/activity feed", () => {
     cy.contains(/live feed/i, { timeout: 30_000 }).should("be.visible");
   }
 
-  it("auth negative: wrong OTP keeps us on sign-in", () => {
-    // Start from app-origin sign-in to avoid cross-origin confusion.
-    cy.visit("/sign-in");
-
-    // Override OTP just for this test.
-    Cypress.env("CLERK_TEST_OTP", "000000");
-
-    // Expect login flow to fail; easiest assertion is that we remain on sign-in.
-    // (The shared helper does not currently expose a typed hook to assert the error text.)
-    cy.loginWithClerkOtp();
-
-    cy.location("pathname", { timeout: 30_000 }).should("match", /\/sign-in/);
+  it("auth negative: signed-out user cannot access /activity", () => {
+    // Story: signed-out user tries to visit /activity and is redirected to sign-in.
+    cy.visit("/activity");
+    cy.location("pathname", { timeout: 20_000 }).should("match", /\/sign-in/);
   });
 
   it("happy path: renders task comment cards", () => {
@@ -58,7 +51,9 @@ describe("/activity feed", () => {
     stubStreamEmpty();
 
     // Story: user signs in, then visits /activity and sees the live feed.
-    cy.loginWithClerkOtp();
+    cy.visit("/sign-in");
+    cy.clerkLoaded();
+    cy.clerkSignIn({ strategy: "email_code", identifier: email });
 
     cy.visit("/activity");
     assertSignedInAndLanded();
@@ -77,7 +72,9 @@ describe("/activity feed", () => {
     stubStreamEmpty();
 
     // Story: user signs in, then visits /activity and sees an empty-state message.
-    cy.loginWithClerkOtp();
+    cy.visit("/sign-in");
+    cy.clerkLoaded();
+    cy.clerkSignIn({ strategy: "email_code", identifier: email });
 
     cy.visit("/activity");
     assertSignedInAndLanded();
@@ -95,7 +92,9 @@ describe("/activity feed", () => {
     stubStreamEmpty();
 
     // Story: user signs in, then visits /activity; API fails and user sees an error.
-    cy.loginWithClerkOtp();
+    cy.visit("/sign-in");
+    cy.clerkLoaded();
+    cy.clerkSignIn({ strategy: "email_code", identifier: email });
 
     cy.visit("/activity");
     assertSignedInAndLanded();
diff --git a/frontend/cypress/e2e/clerk_login.cy.ts b/frontend/cypress/e2e/clerk_login.cy.ts
index 369213a5..8b091d0d 100644
--- a/frontend/cypress/e2e/clerk_login.cy.ts
+++ b/frontend/cypress/e2e/clerk_login.cy.ts
@@ -1,19 +1,15 @@
-describe("Clerk login (OTP)", () => {
-  it("can sign in via Clerk modal", () => {
-    // Skip unless explicitly configured.
-    const clerkOrigin = Cypress.env("CLERK_ORIGIN");
-    const email = Cypress.env("CLERK_TEST_EMAIL");
-    const otp = Cypress.env("CLERK_TEST_OTP");
+describe("Clerk login", () => {
+  it("user can sign in via Clerk testing commands", () => {
+    const email = Cypress.env("CLERK_TEST_EMAIL") || "jane+clerk_test@example.com";
 
-    if (!clerkOrigin || !email || !otp) {
-      cy.log("Skipping: missing CYPRESS_CLERK_ORIGIN / CYPRESS_CLERK_TEST_EMAIL / CYPRESS_CLERK_TEST_OTP");
-      return;
-    }
+    // Prereq per Clerk docs: visit a non-protected page that loads Clerk.
+    cy.visit("/sign-in");
+    cy.clerkLoaded();
 
+    cy.clerkSignIn({ strategy: "email_code", identifier: email });
+
+    // After login, user should be able to access protected route.
     cy.visit("/activity");
-    cy.loginWithClerkOtp();
-
-    // After login, the SignedIn UI should render.
-    cy.contains(/live feed/i, { timeout: 20_000 }).should("be.visible");
+    cy.contains(/live feed/i, { timeout: 30_000 }).should("be.visible");
   });
 });
diff --git a/frontend/cypress/support/e2e.ts b/frontend/cypress/support/e2e.ts
index 8c97169f..1814d34d 100644
--- a/frontend/cypress/support/e2e.ts
+++ b/frontend/cypress/support/e2e.ts
@@ -1,4 +1,5 @@
 // Cypress support file.
 // Place global hooks/commands here.
 
+import "@clerk/testing/cypress";
 import "./commands";
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 3894dfd4..00dec71e 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -26,6 +26,7 @@
         "remark-gfm": "^4.0.1"
       },
       "devDependencies": {
+        "@clerk/testing": "^1.13.35",
         "@testing-library/jest-dom": "^6.6.3",
         "@testing-library/react": "^16.1.0",
         "@testing-library/user-event": "^14.5.2",
@@ -364,9 +365,9 @@
       "license": "MIT"
     },
     "node_modules/@clerk/backend": {
-      "version": "2.29.7",
-      "resolved": "https://registry.npmjs.org/@clerk/backend/-/backend-2.29.7.tgz",
-      "integrity": "sha512-OSfFQ85L0FV2wSzqlr0hRvluIu3Z5ClgLiBE6Qx7XjSGyJoqEvP5OP4fl5Nt5icgGvH0EwA1dljPGyQpaqbQEw==",
+      "version": "2.30.1",
+      "resolved": "https://registry.npmjs.org/@clerk/backend/-/backend-2.30.1.tgz",
+      "integrity": "sha512-GoxnJzVH0ycNPAGCDMfo3lPBFbo5nehpLSVFjgGEnzIRGGahBtAB8PQT7KM2zo58pD8apjb/+suhcB/WCiEasQ==",
       "license": "MIT",
       "dependencies": {
         "@clerk/shared": "^3.44.0",
@@ -453,6 +454,34 @@
       "integrity": "sha512-M1uQkMl8rQK/szD0LNhtqxIPLpimGm8sOBwU7lLnCpSbTyY3yeU1Vc7l4KT5zT4s/yOxHH5O7tIuuLOCnLADRw==",
       "license": "MIT"
     },
+    "node_modules/@clerk/testing": {
+      "version": "1.13.35",
+      "resolved": "https://registry.npmjs.org/@clerk/testing/-/testing-1.13.35.tgz",
+      "integrity": "sha512-y95kJZrMt0tvbNek1AWhWrNrgnOy+a53PSzHTHPF9d0kkOgzzu9l/Wq+Y0kBk6p64wtupYomeb7oVCQD7yCc0A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@clerk/backend": "^2.30.1",
+        "@clerk/shared": "^3.44.0",
+        "@clerk/types": "^4.101.14",
+        "dotenv": "17.2.2"
+      },
+      "engines": {
+        "node": ">=18.17.0"
+      },
+      "peerDependencies": {
+        "@playwright/test": "^1",
+        "cypress": "^13 || ^14"
+      },
+      "peerDependenciesMeta": {
+        "@playwright/test": {
+          "optional": true
+        },
+        "cypress": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/@clerk/types": {
       "version": "4.101.14",
       "resolved": "https://registry.npmjs.org/@clerk/types/-/types-4.101.14.tgz",
@@ -6634,6 +6663,19 @@
       "license": "MIT",
       "peer": true
     },
+    "node_modules/dotenv": {
+      "version": "17.2.2",
+      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-17.2.2.tgz",
+      "integrity": "sha512-Sf2LSQP+bOlhKWWyhFsn0UsfdK/kCWRv1iuA2gXAwt3dyNabr6QSj00I2V10pidqz69soatm9ZwZvpQMTIOd5Q==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://dotenvx.com"
+      }
+    },
     "node_modules/dunder-proto": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
diff --git a/frontend/package.json b/frontend/package.json
index 207cc25b..4a3ddd36 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -33,6 +33,7 @@
     "remark-gfm": "^4.0.1"
   },
   "devDependencies": {
+    "@clerk/testing": "^1.13.35",
     "@testing-library/jest-dom": "^6.6.3",
     "@testing-library/react": "^16.1.0",
     "@testing-library/user-event": "^14.5.2",

From d9570a0531434ef991b2be03de5ed6a2fb9dad7d Mon Sep 17 00:00:00 2001
From: Kunal <kunal@openclaw.local>
Date: Sun, 8 Feb 2026 14:58:48 +0000
Subject: [PATCH 37/40] test(e2e): import Clerk Cypress support commands

---
 frontend/cypress/support/e2e.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/frontend/cypress/support/e2e.ts b/frontend/cypress/support/e2e.ts
index 1814d34d..ab72e0ce 100644
--- a/frontend/cypress/support/e2e.ts
+++ b/frontend/cypress/support/e2e.ts
@@ -1,5 +1,5 @@
 // Cypress support file.
 // Place global hooks/commands here.
 
-import "@clerk/testing/cypress";
+import "@clerk/testing/cypress/support";
 import "./commands";

From dde0c1e27de888f9130e36c794384ee6f9f75304 Mon Sep 17 00:00:00 2001
From: Kunal <kunal@openclaw.local>
Date: Sun, 8 Feb 2026 15:06:06 +0000
Subject: [PATCH 38/40] test(e2e): register Clerk Cypress commands via
 addClerkCommands

---
 frontend/cypress/support/e2e.ts | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/frontend/cypress/support/e2e.ts b/frontend/cypress/support/e2e.ts
index ab72e0ce..369182a5 100644
--- a/frontend/cypress/support/e2e.ts
+++ b/frontend/cypress/support/e2e.ts
@@ -1,5 +1,10 @@
 // Cypress support file.
 // Place global hooks/commands here.
 
-import "@clerk/testing/cypress/support";
+/// <reference types="cypress" />
+
+import { addClerkCommands } from "@clerk/testing/cypress";
+
+addClerkCommands({ Cypress, cy });
+
 import "./commands";

From 26fdff6aa0607dcc11c56fc5f04ec5b23dcc92cb Mon Sep 17 00:00:00 2001
From: Kunal <kunal@openclaw.local>
Date: Sun, 8 Feb 2026 15:06:46 +0000
Subject: [PATCH 39/40] ci(e2e): always upload Cypress artifacts

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 457ca895..1c3bb70f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -134,7 +134,7 @@ jobs:
           npm run e2e -- --browser chrome
 
       - name: Upload Cypress artifacts
-        if: failure()
+        if: always()
         uses: actions/upload-artifact@v4
         with:
           name: cypress-artifacts

From bd352c506b4d51391b30b7adc5d7a96d9a40200d Mon Sep 17 00:00:00 2001
From: Kunal <kunal@openclaw.local>
Date: Sun, 8 Feb 2026 15:17:16 +0000
Subject: [PATCH 40/40] ci(e2e): set NEXT_PUBLIC_API_URL for frontend during
 Cypress

---
 .github/workflows/ci.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1c3bb70f..8e0c002c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -104,6 +104,7 @@ jobs:
 
       - name: Start frontend (dev server)
         env:
+          NEXT_PUBLIC_API_URL: "http://localhost:3000"
           NEXT_TELEMETRY_DISABLED: "1"
           CLERK_SECRET_KEY: ${{ secrets.CLERK_SECRET_KEY }}
           NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: ${{ vars.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY }}
@@ -120,6 +121,7 @@ jobs:
 
       - name: Run Cypress E2E
         env:
+          NEXT_PUBLIC_API_URL: "http://localhost:3000"
           NEXT_TELEMETRY_DISABLED: "1"
           # Clerk testing tokens (official @clerk/testing Cypress integration)
           CLERK_SECRET_KEY: ${{ secrets.CLERK_SECRET_KEY }}