f267a4f99b
fix(scripts): preserve UTF-16 surrogate pairs in firecrawl truncation ( #109561 )
...
* fix(scripts): preserve UTF-16 surrogate pairs in firecrawl truncation
* test(scripts): cover UTF-16-safe firecrawl truncation
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-20 18:50:03 -07:00
Peter Steinberger and GitHub
d5a8233e76
feat(gateway,ui): agent-scoped model provider credentials ( #111796 )
...
* feat: scope model provider credentials by agent
* fix: reject unknown model auth agent ids
* fix: discard stale model provider preload
* fix(gateway): reject whitespace-only explicit agent ids
* fix: scope model provider probes by agent
* fix: complete model provider agent scoping
* fix(ui): always clear the providers refresh flag on completion
* fix(ui): keep probe epochs monotonic across agent switches
* fix: derive agent scope for provider aborts
* fix: satisfy model provider CI checks
2026-07-20 16:22:09 -07:00
Jason (Json) and GitHub
e2bb04328f
fix(release): accept large tarball entry lists ( #111672 )
2026-07-20 13:21:27 -06:00
Peter Steinberger and GitHub
ea148e728d
fix(ui): restore startup JS budget headroom for sandbox diagnostics ( #111928 )
2026-07-20 10:52:51 -07:00
Peter Steinberger and GitHub
154a49a78b
feat(dashboard): widget capabilities — net CSP, host tools, hardened shared sandbox ( #111687 )
...
* feat(boards): enforce widget capability grants
* feat(ui): expose dashboard widget capabilities
* test(dashboard): align rebased gateway contracts
* refactor(dashboard): finish capability alignment
* chore: internalize unused board sandbox exports
* test(dashboard): bind grants to widget instances
* fix(dashboard): close widget authority lifetime gaps
* refactor(ui): preserve modular widget frame ownership
* test(ui): preserve explicit MCP App lease refresh
* test(ui): use shared dashboard sandbox server
* fix(ui): settle widget requests on reconnect
* fix(ui): retry transient widget document loads
* refactor(dashboard): document WebRTC egress residual
* fix(dashboard): clear landing checks
2026-07-20 06:54:44 -07:00
Peter Steinberger and GitHub
a971188a6d
build(client): make @openclaw/gateway-client publishable to npm ( #111707 )
2026-07-20 00:23:36 -07:00
Peter Steinberger and GitHub
e2e394e1ab
fix(ui): give roster rows their avatar-text gap and add presence mock fixtures ( #111689 )
...
* fix(ui): add avatar-text gap in roster menu and presence mock fixtures
* refactor(ui): keep presence snapshot helper out of the connect auth hunk
2026-07-19 23:38:40 -07:00
Peter Steinberger and GitHub
6b80b01369
chore(pr): warn when ci-dispatch targets a remote head behind local work ( #111694 )
2026-07-19 23:24:29 -07:00
Peter Steinberger and GitHub
fef846a3f0
build(protocol): make @openclaw/gateway-protocol publishable to npm ( #111664 )
...
* build(protocol): make @openclaw/gateway-protocol publishable to npm
* chore(mxc): align package version with release train
* fix(release): support gateway-only core packages
2026-07-19 23:18:24 -07:00
Peter Steinberger and GitHub
104128dd32
chore(pr): dev-wrapper opt-in — advisory subcommands may dogfood modified wrappers ( #111656 )
...
* chore(pr): dev-wrapper opt-in — advisory subcommands may dogfood modified wrappers
* fix(pr): hermetic dev-wrapper test fixture and type narrowing
2026-07-19 22:58:15 -07:00
Peter Steinberger and GitHub
bdf71d7d98
refactor(apple): unify offline client databases ( #111598 )
...
* refactor(apple): unify offline client databases
* refactor(apple): remove dead cache APIs
* fix(apple): satisfy native storage gates
* fix(apple): sync generated localization catalog
* Revert "fix(apple): sync generated localization catalog"
This reverts commit d0f5e7b74932e98ccc5f1984840e8f9d545edc2d.
* fix(i18n): keep source validation pre-merge
* test(macos): isolate flaky suite state
* test(macos): isolate log locator on main actor
2026-07-19 22:14:12 -07:00
Peter Steinberger and GitHub
8f9e42f2a9
fix(cli): report honest SQLite store labels and consistent build SHA in help ( #111659 )
2026-07-19 22:07:44 -07:00
Peter Steinberger and GitHub
3564c1c795
fix(test): bound Matrix test process memory ( #111607 )
...
* test: bound Matrix test process memory
* test: align Matrix runner mock contract
2026-07-19 20:04:14 -07:00
Peter Steinberger and GitHub
64c82812a5
feat(dashboard): pinned MCP apps — board rendering, lease re-mint, durable tool grants ( #111524 )
...
* feat(boards): mint pinned MCP app views
* feat(ui): render pinned MCP apps on dashboards
* fix(dashboard): reconcile MCP app rebase
* fix(dashboard): align generated CI contracts
* test(gateway): record board.widget.appView release train
* fix(dashboard): revalidate pinned MCP app views
2026-07-19 19:51:26 -07:00
Peter Steinberger and GitHub
e0b1a39d2a
improve(i18n): generate native locales after merge ( #111557 )
...
* ci(i18n): move native locale generation post-merge
* fix(i18n): allow generated Android companions
2026-07-19 15:42:41 -07:00
Peter Steinberger and GitHub
50114c5163
fix(test): recognize CI env aliases ( #111521 )
2026-07-19 12:44:18 -07:00
Peter Steinberger and GitHub
5ec3b2dab4
fix(install): isolate source postinstall state ( #111514 )
2026-07-19 12:14:21 -07:00
Peter Steinberger and GitHub
40d31f3481
feat(control-ui): show relative commit age and hover-only copy button on About ( #111495 )
...
The About page commit row now embeds the commit's committer timestamp
(commitAt, advisory like branch/dirty) and renders it as an always-relative
age with the exact localized date-time on hover. The copy button becomes a
compact borderless icon revealed on hover/focus only where hover exists;
touch keeps it visible.
2026-07-19 11:13:25 -07:00
Peter Steinberger and GitHub
c7e7ac2728
refactor: remove expired plugin compatibility surfaces ( #111451 )
...
* docs(secrets): remove retired web credential paths
* refactor(web): remove retired provider compatibility paths
* refactor(providers): delete retired compatibility routes
* refactor(secrets): remove retired credential aliases
* refactor(plugin-sdk): delete retired compatibility surfaces
* docs(plugin-sdk): remove retired migration guidance
* chore(plugin-sdk): refresh rebased surface budgets
* chore(plugin-sdk): refresh API removal baseline
* refactor(compat): migrate retired internal callers
* chore(plugin-sdk): refresh current-main baselines
* test(config): migrate plugin-owned secret assertions
* test(gateway): narrow plugin secret refs
* fix(plugin-sdk): preserve private boundary type identity
* chore(compat): remove stale sweep references
* chore(lint): lower max-lines budget
* refactor(secrets): remove unused web helper
* build(plugin-sdk): drop removed compat entries
* chore(plugin-sdk): refresh rebased API baseline
* chore(plugin-sdk): use Linux API baseline hash
* fix(plugin-sdk): preserve private bundled build entries
* fix(plugin-sdk): package private runtime facades
* fix(plugins): preserve external credential contracts
2026-07-19 11:04:48 -07:00
Peter Steinberger and GitHub
83303f1ba8
feat(channels): batch 1 producers drop media placeholder bodies ( #111447 )
...
* feat(channels): batch 1 producers drop media placeholder bodies
Media-placeholder program batch 1: Google Chat, Zalo, LINE, and
Mattermost stop minting <media:kind> placeholder bodies. Media-only
messages carry an empty caption plus one structured fact per native
attachment (type-only when a download fails or is rejected, so payload
positions and kind signals stay aligned). The shared
formatMediaPlaceholderText SDK formatter renders text-only carriers
(Mattermost pending-room lines) from structured facts; per-channel
placeholder builders and the expected-count side channel are deleted.
* fix(mattermost): satisfy type, deadcode, and SDK manifest gates
2026-07-19 10:32:09 -07:00
Peter Steinberger and GitHub
197c4f5a04
feat: generic session discussion seam with Control UI panel ( #111337 )
...
* feat: add session discussion panel seam
* fix: keep discussion iframe cookie-capable and changelog release-owned
* test: cover cookie-capable discussion iframe sandbox
* fix: stretch discussion panel host so the embed fills the rail
* fix: keep provider failures retryable and probe discussion availability before showing the action
* fix: block same-origin discussion embeds, show action on catalog sessions, close stale panel on reconnect
* fix: scope discussion probes and panel callbacks to the issuing connection
* fix: dedupe in-flight discussion probes per session
* fix: retry superseded discussion probes and key-scope panel results
* fix: regenerate Swift protocol models and extend advertised-method expectations
* style: format chat-pane-header
* fix: regenerate Kotlin protocol models and date discussion methods in the 2026.7 train
* chore: restore release-owned changelog to main state
* chore: keep changelog untouched relative to merge-base
2026-07-19 09:47:47 -07:00
Peter Steinberger and GitHub
7aedca21b2
test(release): align built-in timing proofs ( #111483 )
2026-07-19 09:42:16 -07:00
Peter Steinberger and GitHub
87fbc19fe3
fix: complete lint toolchain reuse in worktrees ( #111467 )
...
* fix(scripts): complete worktree lint toolchain
* fix(scripts): prepare complete lint pipeline
2026-07-19 08:58:43 -07:00
Peter Steinberger and GitHub
ca3a1873a6
fix(test): make broad shard execution deterministic ( #111416 )
...
* fix(test): harden broad shard execution
* test: allow broad-profile contention
* style(telegram): remove redundant chat id cast
* style(test): preserve setup test spacing
2026-07-19 08:39:16 -07:00
Peter Steinberger and GitHub
1f507162ee
fix(ci): validate sticky importer restores ( #111444 )
2026-07-19 07:57:46 -07:00
Peter Steinberger and GitHub
adf02e8de4
refactor(plugin-sdk): retire global provider publication ( #111426 )
...
* refactor(plugin-sdk): retire global provider publication
* docs: refresh SDK migration map
2026-07-19 07:44:11 -07:00
Peter Steinberger and GitHub
783a5d21cf
refactor(config): purge numeric tuning knobs behind built-in defaults ( #111382 )
2026-07-19 07:35:45 -07:00
Peter Steinberger and GitHub
29ef6f8637
fix(scripts): resolve remaining repo tools through the worktree-aware helper ( #111417 )
...
Follow-up to #111393 : run-tsgo, check-tsgo-core-boundary, profile-tsgo,
and the format-docs oxfmt shim still resolved node_modules/.bin from the
current checkout only, so dependency-less linked worktrees died with
ENOENT before oxlint's boundary prep could run. All four now use
resolveRepoToolBinPath, completing local lint/typecheck tooling for
linked worktrees.
2026-07-19 06:47:32 -07:00
Peter Steinberger and GitHub
be831088e9
fix: local lint works in dependency-less worktrees ( #111393 )
...
* fix(scripts): resolve worktree oxlint toolchain
* fix(scripts): declare worktree tool resolver
2026-07-19 06:23:36 -07:00
Peter Steinberger and GitHub
6a8f16a69e
chore(pr): reuse green hosted CI from patch-identical pre-rebase heads ( #111335 )
...
* chore(pr): reuse green hosted CI from patch-identical pre-rebase heads (24h window)
* fix(pr): type-safe fixtures and lint cleanup for hosted-CI reuse tests
2026-07-19 05:34:48 -07:00
Peter Steinberger and GitHub
06f5f73e47
refactor: own model discovery by runtime lifecycle ( #111173 )
...
* refactor(agents): prepare model runtime catalogs
Build lifecycle-owned model and auth snapshots, carry prepared stores into hot agent paths, and serialize config/auth publication.
Credits @zeroaltitude's #90741 investigation and benchmark approach.
* refactor: finish lifecycle-owned model discovery
* fix: align prepared model catalog contracts
* test: align lifecycle catalog mocks
* test: fix prepared catalog type fixtures
* refactor: split prepared model runtime ownership
* fix: import prepared runtime replacement gate type
* test: split media runtime coverage
* test: preserve image auth fixture key types
* test: isolate lifecycle gate fixtures
* chore: keep release changelog owned
* refactor: finish prepared model catalog migration
* test: keep catalog review fixtures scanner-safe
* refactor: preserve lifecycle model runtime ownership
* fix: close prepared runtime lifecycle races
* fix: preserve compaction workspace fallback
* chore: document btw generation rebinding
* fix: preserve prepared generation boundaries
* fix: keep model-list discovery flag explicit
* fix: serialize standalone model runtime activation
* refactor: migrate subagent model catalog lookup
* refactor: clarify doctor catalog lookup seam
* chore: refresh plugin sdk api baseline
* test: migrate swarm catalog dependency
* refactor(telegram): rename runtime catalog seam
* refactor: extract model-aware tool context
* test(models): isolate lifecycle catalog fixtures
* refactor(agents): avoid btw parameter rebinding
* fix(net-policy): align root ipaddr dependency
* fix(build): keep net policy dependency bundled
* fix(deadcode): document net policy compile dependency
2026-07-19 05:30:54 -07:00
Peter Steinberger and GitHub
3b84a55d99
refactor(protocol): pre-publish cheat-window cleanup and vintage tracking ( #111041 )
...
* fix(codex): drain dynamic-tool handlers before side-thread cleanup
* refactor(protocol): rename question ids to questionId and flatten answer maps
* refactor(protocol): slim worker stack and unify session-catalog shapes
* refactor(protocol): delete dead public surface and polish packaging
* feat(protocol): track release-train vintage on gateway methods and schemas
* fix(apps): align question surfaces merged from main with reshaped protocol
* test(health): shape secret fixtures to scanner-safe token names
* test(health): use scanner-safe token fixtures
* fix(apps): align question surfaces merged from main with reshaped protocol
* fix(ci): prove reshaped protocol in shallow checks
* fix(ui): align sidebar question fixtures with protocol
* fix(apps): read flat Swift question answers
* fix(apps): align question surfaces merged from main with reshaped protocol
* fix(apps): refresh native question inventory
* fix(apps): align macOS snapshot fixtures with protocol
* fix(ui): align narration question fixture with protocol
2026-07-19 04:07:15 -07:00
Peter Steinberger and GitHub
bbcfec9e96
fix(channels): prevent outbound echoes and expose native login ( #111341 )
...
* fix(channels): centralize outbound echo suppression
* chore(plugin-sdk): refresh channel outbound surface
* test(commands): avoid native plugin fallback loading
* refactor(channels): separate outbound echo state
* docs(changelog): note channel action decisions
* fix(discord): align webhook preflight call
* fix(discord): use type-only thread binding import
* fix(channels): stream login blocks and widen turn results
* test(channels): narrow drop-capable turn results
* fix(channels): address echo and reply edge cases
2026-07-19 03:49:11 -07:00
Peter Steinberger
b9c9140034
fix(ci): declare injectable now param on runPrCiSweeper
2026-07-19 03:31:25 -07:00
Peter Steinberger
e2930422d0
fix(ci): make pr-ci-sweeper clock injectable so lookback fixtures cannot rot
2026-07-19 03:26:50 -07:00
Peter Steinberger and GitHub
b3bb40551b
fix(mac): opening General Settings crashes in packaged app ( #111300 )
...
* fix(macos): package KeyboardShortcuts resources
* fix(macos): keep dependency patch whitespace-safe
* fix(macos): preserve locked Swift resolution
* fix(macos): guard Swift lock across builds
* fix(macos): simplify KeyboardShortcuts packaging
2026-07-19 02:30:49 -07:00
Peter Steinberger and GitHub
84e54ab264
chore(pr): landing-UX — aggregated validation, lock classes, ci-dispatch, committer guard ( #111287 )
...
* chore(pr): landing-UX — aggregate artifact validation, lock classes, ci-dispatch, committer worktree guard
* fix(pr): CI lane cleanup for landing-ux — lint causes, hermetic tests, private helpers
* chore(deadcode): register pr-lib CLI entries in knip config
2026-07-19 02:09:55 -07:00
Mason Huang and GitHub
c26d3cfbd0
fix(ci): skip Periphery scans for unrelated PR changes ( #107991 )
...
* fix(ci): scope Periphery to PR merge changes
* test(ci): align Periphery changed-test routing
2026-07-19 16:52:44 +08:00
Peter Steinberger and GitHub
f07a1fb502
refactor: centralize bounded file reads in fs-safe ( #111104 )
...
* refactor: use fs-safe bounded descriptor reads
* build: update fs-safe to 0.4.2
* build: refresh root npm shrinkwrap
* fix: satisfy bounded read return paths
* fix: update fs-safe integration for latest main
* fix: adopt fs-safe overflow compatibility release
* build: complete fs-safe lockfile update
* build: update fs-safe to 0.4.4
* build: refresh plugin SDK API baseline
* test: follow fs-safe bounded read seam
2026-07-19 01:29:23 -07:00
xingzhou and GitHub
59124313f4
fix(release): plugin npm preflight no longer hangs on stalled registries ( #110862 )
...
* fix(release): bound plugin npm freshness lookups
* fix(release): fail closed on npm view timeouts
* test(release): fix npm timeout mock types
2026-07-19 16:10:49 +08:00
Peter Steinberger and GitHub
3a5da4faa8
feat(ui): live agent activity subtitles on running sidebar sessions ( #111221 )
...
* feat(ui): live agent activity subtitles on running sidebar sessions
* refactor(ui): lazy-load narration controller off the startup chunk, unexport test-only symbols
* chore(ui): raise startup JS budget to 312 KiB for the lazy narration feature
* test(ui): restore real timers after narration controller cases
2026-07-19 01:08:06 -07:00
4efcea1fd2
feat(browser): send pages to OpenClaw from the Chrome extension ( #111158 )
...
* feat(browser): send pages to the main session from the Chrome extension
One-click page share in the OpenClaw Chrome extension: toolbar popup with an
optional note, page/selection context menu, and Alt+Shift+S. Capture is
selection-first with a readability heuristic, X/Twitter thread extraction, and
Google Docs plain-text export via the user's session cookies. Payloads ride the
existing paired relay WebSocket as a new pageShare message; the gateway-only
page-share sink wraps page text in the external-content safety boundary, then
enqueues a main-session system event and requests an immediate heartbeat
(hooks/wake semantics). Node-hosted relays report a clear unsupported error.
Capture heuristics adapted from Nat Eliason's MIT-licensed send-to-openclaw.
Co-authored-by: Codex <codex@openai.com >
* fix(browser): keep page-controlled metadata inside the share safety boundary
Review findings: move title/URL inside wrapExternalContent (a hostile <title>
must not become trusted header text), prefer the user's selection over the
full Google Docs export, and pass the context-menu selectionText through so
iframe selections and selections cleared during relay reconnect still win.
* fix(browser): bind context-menu shares to the click-time document
Selection shares from the context menu now send the click snapshot directly
(no recapture), so navigations during relay reconnect cannot mislabel the
source and iframe selections are preserved. The Google Docs selection probe
scans all accessible frames before falling back to the full-document export.
* test(browser): expect the page-share handler in relay server args
* fix(browser): probe only the main frame for Google Docs selections
All-frame injection rejects wholesale when one frame is inaccessible and
returns child frames in nondeterministic order, so the probe now reads the
main frame only. Child-frame selections still share correctly through the
context menu's click-time selectionText; toolbar/shortcut entry sends the
full page for that case (named tradeoff in the code comment).
* fix(browser): satisfy page-share CI gates
---------
Co-authored-by: Codex <codex@openai.com >
2026-07-19 01:07:28 -07:00
Peter Steinberger and GitHub
a8b7290f34
feat(gateway): durable user profiles with email aliases and avatars ( #111224 )
...
* feat(gateway): durable user profiles with email aliases and avatars
* fix(gateway): compress merge tombstones, content-hash avatar ETags, users CLI json output
* fix(gateway): lean profile listing, scoped avatar routing, typed email validation
* fix(gateway): protocol-complete profile payloads and consistent store reads
* fix(gateway): mark profile schema ensured only after commit
* fix(gateway): avatar endpoint HEAD support and RFC If-None-Match
* fix(gateway): profiles CI conformance — bindings, lint, knip, sql boundary
* feat(gateway): self-service profile edits for authenticated users
* fix(gateway): users.self bootstrap, tombstone-aware ownership, escaped CLI output
* fix(gateway): raw-DDL allowlist entry and lean profile exports
2026-07-19 00:58:43 -07:00
Peter Steinberger and GitHub
58452de711
refactor(config): config-surface reduction tranche 1 — retire dead keys, dedupe channel schemas, add growth ratchet ( #111142 )
...
* refactor(config): retire dead and aliased config keys via doctor migrations
* refactor(config): dedupe bundled channel config schemas into shared builders
* feat(config): add config-surface count ratchet to doc-baseline check
* test(config): drop stale fixtures for retired config keys
* fix(doctor): migrate only positive finite MCP timeout aliases
* fix(migrate-hermes): emit canonical MCP timeouts only
* fix(config): satisfy lint and contract gates
2026-07-19 00:52:37 -07:00
Peter Steinberger and GitHub
8028288f05
fix(docs): make Mintlify anchor audit reliable ( #111265 )
2026-07-19 00:15:40 -07:00
Peter Steinberger and GitHub
ea54060223
feat(codex): fork upstream-linked sessions at a message via thread/fork ( #111149 )
...
* feat(codex): fork upstream-linked sessions at a message via thread/fork
* fix(gateway): fail closed for rewind and branch switch on upstream-linked sessions
* fix(codex): fail closed on first-message forks, image-only prompts, and orphan archival
* fix(codex): baseline retained history and reject paginated threads on upstream fork
* fix(codex): validate the full fork prefix and fail closed across crash windows
* fix(codex): treat all non-text inputs as unverifiable in fork drift checks
* fix(codex): support first-message forks as empty-history upstream cuts
* fix(codex): reject source-id reuse and unverifiable hidden inputs in fork boundaries
* refactor(codex): materialize upstream forks from verified thread read-back
* fix(codex): satisfy strict type lanes and knip for upstream fork
2026-07-19 00:11:10 -07:00
Peter Steinberger and GitHub
ccb147518c
feat(agents): Swarm core — collector spawn, agents_wait, structured output, caps (gated) ( #110932 )
...
* docs: add Swarm implementation spec
* feat(agents): Swarm core — collector spawn, agents_wait, structured output, fastMode, caps
Implements docs/plan/swarms.md §4-6: tools.swarm config gate (default off),
collector-mode sessions_spawn (collect/outputSchema/fastMode/groupId), fail-closed
child approvals, agents_wait race-semantics tool, per-group FIFO scheduler with
maxConcurrent/maxChildrenPerGroup/maxTotalPerGroup caps, additive registry and
state-schema columns (no schema-version bump), and colocated tests.
Part of #110325
* fix(agents): rebase reconciliation — preserve swarm state columns
* fix(agents): O(1) collector session index, cheap-first preflight, collector start lifecycle hooks
Autoreview findings: replace the per-request full registry scan with an
index-maintaining run map and gate the persisted-store fallback behind
isSubagentSessionKey; emit subagent_progress/subagent_spawned from the swarm
scheduler start callback so collector children produce balanced plugin
lifecycle events.
* chore(protocol): regenerate Swift gateway models for swarm fields
* fix(agents): lint cleanup — typed catch, explicit microtask flush, no executor return
* fix(agents): knip/test-support/max-lines cleanup for swarm surfaces
* fix(agents): keep tool-catalog ui-safe — callers pass prepared swarmEnabled fact
resolveSwarmConfig value-import in tool-catalog dragged the server graph into
the Control UI bundle via tool-policy-shared (UNLOADABLE_DEPENDENCY on
subpath aliases). Catalog stays pure; the gateway tools-catalog handler
resolves the gate and passes the boolean.
* fix(agents): reconcile swarm spawn pipeline
* fix(agents): refresh swarm tool metadata
* fix(apps): sync swarm tool localization
* style(agents): compact tool display metadata
* fix(plugin-sdk): account for swarm config surface
2026-07-18 23:30:11 -07:00
Jason (Json) and GitHub
baa8b9b24f
test(telegram): add MCP App Funnel proof fixture ( #111238 )
2026-07-19 00:14:36 -06:00
Peter Steinberger and GitHub
16e967eb7f
fix(gateway): reject unknown session agents ( #111178 )
2026-07-18 21:15:57 -07:00
Peter Steinberger and GitHub
b57660d024
fix(apps): call chat sessions threads ( #111038 )
...
* fix(apps): call chat sessions threads
* test(apps): update thread wording expectations
* fix(i18n): guard retained Android translations
2026-07-18 20:34:12 -07:00
