diff --git a/CHANGELOG.md b/CHANGELOG.md index 0180b4fa219..7fb5b796680 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -38,6 +38,7 @@ Docs: https://docs.openclaw.ai ### Fixes +- Onboarding/local setup: default unset local `tools.profile` to `coding` instead of `messaging`, restoring file/runtime tools for fresh local installs while preserving explicit user-set profiles. (from #38241, overlap with #34958) Thanks @cgdusek. - Gateway/Telegram stale-socket restart guard: only apply stale-socket restarts to channels that publish event-liveness timestamps, preventing Telegram providers from being misclassified as stale solely due to long uptime and avoiding restart/pairing storms after upgrade. (openclaw#38464) - Onboarding/headless Linux daemon probe hardening: treat `systemctl --user is-enabled` probe failures as non-fatal during daemon install flow so onboarding no longer crashes on SSH/headless VPS environments before showing install guidance. (#37297) Thanks @acarbajal-web. - Memory/QMD mcporter Windows spawn hardening: when `mcporter.cmd` launch fails with `spawn EINVAL`, retry via bare `mcporter` shell resolution so QMD recall can continue instead of falling back to builtin memory search. (#27402) Thanks @i0ivi0i. diff --git a/docs/gateway/configuration-reference.md b/docs/gateway/configuration-reference.md index 749b0d2b261..5dbd1f40bba 100644 --- a/docs/gateway/configuration-reference.md +++ b/docs/gateway/configuration-reference.md @@ -1676,7 +1676,7 @@ Defaults for Talk mode (macOS/iOS/Android). `tools.profile` sets a base allowlist before `tools.allow`/`tools.deny`: -Local onboarding defaults new local configs to `tools.profile: "messaging"` when unset (existing explicit profiles are preserved). +Local onboarding defaults new local configs to `tools.profile: "coding"` when unset (existing explicit profiles are preserved). | Profile | Includes | | ----------- | ----------------------------------------------------------------------------------------- | diff --git a/docs/reference/wizard.md b/docs/reference/wizard.md index a6bacc5f2a1..2e7a43bdecc 100644 --- a/docs/reference/wizard.md +++ b/docs/reference/wizard.md @@ -276,7 +276,7 @@ Typical fields in `~/.openclaw/openclaw.json`: - `agents.defaults.workspace` - `agents.defaults.model` / `models.providers` (if Minimax chosen) -- `tools.profile` (local onboarding defaults to `"messaging"` when unset; existing explicit values are preserved) +- `tools.profile` (local onboarding defaults to `"coding"` when unset; existing explicit values are preserved) - `gateway.*` (mode, bind, auth, tailscale) - `session.dmScope` (behavior details: [CLI Onboarding Reference](/start/wizard-cli-reference#outputs-and-internals)) - `channels.telegram.botToken`, `channels.discord.token`, `channels.signal.*`, `channels.imessage.*` diff --git a/docs/start/onboarding.md b/docs/start/onboarding.md index 3a5c86c360e..3e3401cad64 100644 --- a/docs/start/onboarding.md +++ b/docs/start/onboarding.md @@ -34,7 +34,7 @@ Security trust model: - By default, OpenClaw is a personal agent: one trusted operator boundary. - Shared/multi-user setups require lock-down (split trust boundaries, keep tool access minimal, and follow [Security](/gateway/security)). -- Local onboarding now defaults new configs to `tools.profile: "messaging"` so broad runtime/filesystem tools are opt-in. +- Local onboarding now defaults new configs to `tools.profile: "coding"` so fresh local setups keep filesystem/runtime tools without forcing the unrestricted `full` profile. - If hooks/webhooks or other untrusted content feeds are enabled, use a strong modern model tier and keep strict tool policy/sandboxing. diff --git a/docs/start/wizard-cli-reference.md b/docs/start/wizard-cli-reference.md index f9ff309be54..44f470ea73b 100644 --- a/docs/start/wizard-cli-reference.md +++ b/docs/start/wizard-cli-reference.md @@ -247,7 +247,7 @@ Typical fields in `~/.openclaw/openclaw.json`: - `agents.defaults.workspace` - `agents.defaults.model` / `models.providers` (if Minimax chosen) -- `tools.profile` (local onboarding defaults to `"messaging"` when unset; existing explicit values are preserved) +- `tools.profile` (local onboarding defaults to `"coding"` when unset; existing explicit values are preserved) - `gateway.*` (mode, bind, auth, tailscale) - `session.dmScope` (local onboarding defaults this to `per-channel-peer` when unset; existing explicit values are preserved) - `channels.telegram.botToken`, `channels.discord.token`, `channels.signal.*`, `channels.imessage.*` diff --git a/docs/start/wizard.md b/docs/start/wizard.md index 874dc4bf514..ef1fc52b31a 100644 --- a/docs/start/wizard.md +++ b/docs/start/wizard.md @@ -51,7 +51,7 @@ The wizard starts with **QuickStart** (defaults) vs **Advanced** (full control). - Workspace default (or existing workspace) - Gateway port **18789** - Gateway auth **Token** (auto‑generated, even on loopback) - - Tool policy default for new local setups: `tools.profile: "messaging"` (existing explicit profile is preserved) + - Tool policy default for new local setups: `tools.profile: "coding"` (existing explicit profile is preserved) - DM isolation default: local onboarding writes `session.dmScope: "per-channel-peer"` when unset. Details: [CLI Onboarding Reference](/start/wizard-cli-reference#outputs-and-internals) - Tailscale exposure **Off** - Telegram + WhatsApp DMs default to **allowlist** (you'll be prompted for your phone number) diff --git a/src/commands/onboard-config.test.ts b/src/commands/onboard-config.test.ts index 076f98a02f1..c5997345fe7 100644 --- a/src/commands/onboard-config.test.ts +++ b/src/commands/onboard-config.test.ts @@ -7,6 +7,10 @@ import { } from "./onboard-config.js"; describe("applyOnboardingLocalWorkspaceConfig", () => { + it("defaults local onboarding tool profile to coding", () => { + expect(ONBOARDING_DEFAULT_TOOLS_PROFILE).toBe("coding"); + }); + it("sets secure dmScope default when unset", () => { const baseConfig: OpenClawConfig = {}; const result = applyOnboardingLocalWorkspaceConfig(baseConfig, "/tmp/workspace"); diff --git a/src/commands/onboard-config.ts b/src/commands/onboard-config.ts index f2ae8991141..62b1006283e 100644 --- a/src/commands/onboard-config.ts +++ b/src/commands/onboard-config.ts @@ -3,7 +3,7 @@ import type { DmScope } from "../config/types.base.js"; import type { ToolProfileId } from "../config/types.tools.js"; export const ONBOARDING_DEFAULT_DM_SCOPE: DmScope = "per-channel-peer"; -export const ONBOARDING_DEFAULT_TOOLS_PROFILE: ToolProfileId = "messaging"; +export const ONBOARDING_DEFAULT_TOOLS_PROFILE: ToolProfileId = "coding"; export function applyOnboardingLocalWorkspaceConfig( baseConfig: OpenClawConfig, diff --git a/src/commands/onboard-non-interactive.gateway.test.ts b/src/commands/onboard-non-interactive.gateway.test.ts index 1d9e8bc5881..c5d29a12177 100644 --- a/src/commands/onboard-non-interactive.gateway.test.ts +++ b/src/commands/onboard-non-interactive.gateway.test.ts @@ -145,7 +145,7 @@ describe("onboard (non-interactive): gateway and remote auth", () => { }>(configPath); expect(cfg?.agents?.defaults?.workspace).toBe(workspace); - expect(cfg?.tools?.profile).toBe("messaging"); + expect(cfg?.tools?.profile).toBe("coding"); expect(cfg?.gateway?.auth?.mode).toBe("token"); expect(cfg?.gateway?.auth?.token).toBe(token); });