Commit Graph

7845 Commits

Author SHA1 Message Date
Peter Steinberger
a4d33fd81b docs: clarify container model auth 2026-05-27 19:04:04 +01:00
Andi Liao
085228c961 fix(auth): document paste-token stdin setup (#63050)
Document that automation should pipe `models auth paste-token` credentials over stdin instead of passing token material in argv, keeping the existing secret-handling path explicit in the CLI docs.

Also include accepted auth-profile credential types in invalid-profile warning logs so malformed local auth stores are easier to repair.

Fixes #63042.

Thanks @liaoandi.
2026-05-27 18:44:44 +01:00
Peter Steinberger
c3b7e91f26 docs: clarify device token admin gate 2026-05-27 18:35:27 +01:00
Ben Badejo
7691a8a9a3 docs(codex): clarify computer use setup (#87313)
Clarify the Codex Computer Use docs around inferred opt-in, read-only status checks, and marketplace root versus marketplace JSON path setup.

The docs now match current source-backed behavior: autoInstall opts Computer Use in, status does not mutate plugin setup, and marketplacePath is for a local marketplace JSON file while source registers a marketplace root.

Verification:
- pnpm docs:list
- GitHub CI check-docs passed
- Real behavior proof passed via maintainer proof override for this docs-only PR

Thanks @bdjben.

Co-authored-by: Benjamin Badejo <ben@benbadejo.com>
Co-authored-by: Sally O'Malley <somalley@redhat.com>
2026-05-27 18:35:21 +01:00
Dallin Romney
d638611684 feat: split diffs language pack
Split the diffs viewer Shiki language pack into an external publishable plugin.

The diffs plugin keeps the default curated syntax set, while the new @openclaw/diffs-language-pack package carries the extended Shiki languages for npm and ClawHub distribution. The install metadata includes the external ClawHub spec, and the curated C# alias set keeps both c# and cs supported without the language pack.

Co-authored-by: Dallin Romney <dallinromney@gmail.com>
2026-05-27 18:08:40 +01:00
Shadow
930d9f63ad docs: expand install deployment cards 2026-05-27 11:54:12 -05:00
Peter Steinberger
7aaca4a8a6 chore(release): prepare 2026.5.27 2026-05-27 16:53:50 +01:00
Agustin Rivera
0d0bddf032 fix(gateway): require admin for device role approvals (#87146)
* fix(gateway): require admin for device role approvals

* fix(gateway): add trusted-proxy approval proof
2026-05-27 08:08:51 -07:00
Pavan Kumar Gondhi
91590132f6 Block unsafe Node runtime env overrides [AI] (#87308)
* fix: block unsafe node runtime env overrides

* fix: block node env path redirects

* docs: add changelog entry for PR merge
2026-05-27 20:34:12 +05:30
Mariano
c9d4f7e35c Deprecate memory-specific embedding provider registration (#85072)
Merged via squash.

Prepared head SHA: 661eb99066
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com>
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com>
Reviewed-by: @mbelinky
2026-05-27 15:24:17 +02:00
Peter Steinberger
8e5183c60d refactor: move channel message sdk compat into core 2026-05-27 13:59:33 +01:00
Yuval Dinodia
ef77428c95 fix(openai): normalize responses replay tool ids
Fixes #74665.

Normalize replayed OpenAI Responses tool call identifiers before same-model pi-ai replay sends them back to the provider. This keeps canonical `call_*|fc_*` pairs intact when valid, rewrites overlong or malformed `function_call.call_id`, `function_call.id`, and matching `function_call_output.call_id` values into OpenAI's accepted 64-character shape, and preserves the reasoning replay path.

Verification:
- Live OpenAI E2E with maintainer key: raw replay payload failed with HTTP 400 for overlong `input[1].id`; normalized replay succeeded with HTTP 200 and `LIVE_OK`.
- `pnpm exec oxfmt --check --threads=1 src/agents/pi-embedded-helpers/openai.ts`
- `CI=1 OPENCLAW_VITEST_FS_MODULE_CACHE_PATH="$(mktemp -d /tmp/openclaw-vitest-cache.XXXXXX)" fnm exec --using 24.15.0 -- pnpm test src/agents/pi-embedded-runner/run/attempt.tool-call-normalization.test.ts -- --run --reporter=verbose --maxWorkers=1`
- `CI=1 OPENCLAW_VITEST_FS_MODULE_CACHE_PATH="$(mktemp -d /tmp/openclaw-vitest-cache.XXXXXX)" fnm exec --using 24.15.0 -- pnpm test src/agents/pi-embedded-runner.openai-tool-id-preservation.test.ts src/agents/openai-responses.reasoning-replay.test.ts -- --run --reporter=verbose --maxWorkers=2`
- `autoreview --mode branch --base origin/main`: clean, no accepted/actionable findings.
- GitHub CI green on c675b35ade.

Co-authored-by: Yuval Dinodia <yetvald@gmail.com>
2026-05-27 13:51:57 +01:00
Bob
4d89e00c50 feat(embeddings): add OpenAI-compatible core provider (#85269)
Merged via squash.

Prepared head SHA: dc9a5d5397
Co-authored-by: dutifulbob <261991368+dutifulbob@users.noreply.github.com>
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com>
Reviewed-by: @mbelinky
2026-05-27 14:37:17 +02:00
rendrag-git
e153eceea5 fix(vllm): wire configured thinking params
Move vLLM Qwen thinking control onto configured model compat metadata and carry it through catalog/model-selection/runtime thinking contexts.

Also migrate legacy provider/default request params in doctor and keep Pi/runtime model rows buildable with explicit reasoning defaults.

Thanks @rendrag-git.

Co-authored-by: rendrag-git <253747599+rendrag-git@users.noreply.github.com>
2026-05-27 13:32:18 +01:00
Mason Huang
75221e0550 fix(agents): separate heartbeat runtime template (#85416)
Summary:
- The PR moves the runtime `HEARTBEAT.md` bootstrap template into `src/agents/templates`, keeps docs templates ... or other workspace files, adds a legacy heartbeat-template doctor repair, and updates package guards/tests.
- PR surface: Source +281, Tests +283, Docs +11, Config +1, Other 0. Total +576 across 15 files.
- Reproducibility: yes. from source inspection: current main loads `HEARTBEAT.md` from the docs template, and  ... pty heartbeat file non-empty to the runtime. I did not run a live heartbeat repro in this read-only review.

Automerge notes:
- PR branch already contained follow-up commit before automerge: fix(doctor): recognize heartbeat docs boilerplate
- PR branch already contained follow-up commit before automerge: fix(agents): update heartbeat workspace test
- PR branch already contained follow-up commit before automerge: fix(doctor): tighten heartbeat template repair

Validation:
- ClawSweeper review passed for head e34e85864c.
- Required merge gates passed before the squash merge.

Prepared head SHA: e34e85864c
Review: https://github.com/openclaw/openclaw/pull/85416#issuecomment-4519851630

Co-authored-by: Mason Huang <masonxhuang@tencent.com>
Co-authored-by: clawsweeper[bot] <274271284+clawsweeper[bot]@users.noreply.github.com>
Approved-by: hxy91819
Co-authored-by: hxy91819 <8814856+hxy91819@users.noreply.github.com>
2026-05-27 12:30:22 +00:00
Peter Steinberger
3e351b718e fix(agents): honor OpenAI-compatible cache retention
Carry over #82973 and fix #81281 by preserving explicit cacheRetention for OpenAI-compatible completions providers that opt into prompt-cache-key support.

The change keeps explicit cacheRetention suppressed for OpenAI-compatible providers without compat.supportsPromptCacheKey, adds regression coverage for both paths, and updates prompt-caching docs for prompt_cache_key / prompt_cache_retention behavior.

Fixes #81281.
Supersedes #82973.

Co-authored-by: lonexreb <reach2shubhankar@gmail.com>
2026-05-27 13:21:23 +01:00
Peter Steinberger
517ce3df75 fix: require admin for node device approvals 2026-05-27 13:18:50 +01:00
Vincent Koc
53662094c3 chore(pixverse): publish as external plugin 2026-05-27 12:41:10 +02:00
Vincent Koc
b3083de4f2 feat(pixverse): add api region selection 2026-05-27 12:41:10 +02:00
Vincent Koc
c18370574e feat(pixverse): add video generation provider 2026-05-27 12:41:10 +02:00
Peter Steinberger
6c3740255f refactor: remove channel turn runtime aliases 2026-05-27 11:37:23 +01:00
Georgi Atsev
9e7c2b356b fix(deepinfra): load all DeepInfra models when user wants to browse t… (#84549)
* fix(deepinfra): load all DeepInfra models when user wants to browse them during onboarding

* docs(deepinfra): align TTS default

* fix(deepinfra): refresh video fallbacks

* fix(deepinfra): share credential-aware catalog discovery

* test(deepinfra): narrow catalog regression types

* test(deepinfra): keep catalog narrowing across callback

* fix(deepinfra): preserve default model in live catalog

* fix(deepinfra): align default model pricing

* fix(deepinfra): keep pixverse as video default

* docs(deepinfra): match video fallback default

* fix(deepinfra): honor config api keys for live catalog

* test(e2e): wait for watchdog stdio close

* test(media): align live harness provider expectation

* fix(deepinfra): always augment custom catalogs

* test(e2e): resolve watchdog commands before spawning

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-05-27 10:43:37 +01:00
Peter Steinberger
c89298f9f8 fix: preserve channel runResolved mock compatibility 2026-05-27 10:36:33 +01:00
Sebastien Tardif
527b7c2eed fix(install): skip Homebrew until macOS packages need it
Keep macOS Homebrew setup lazy so users with supported Node and Git can install without admin/Homebrew, while still installing Homebrew before macOS Node or Git package installs.

Updates installer docs and adds focused install.sh coverage for the lazy Git path. Also aligns the live-media provider expectation with current main so built-artifact checks stay green.

Fixes #83232

Co-authored-by: Sebastien Tardif <sebtardif@ncf.ca>
2026-05-27 09:48:04 +01:00
Peter Steinberger
1507a9701b refactor: centralize inbound supplemental context
* refactor: centralize inbound supplemental context

* refactor: trim supplemental finalizer typing

* docs: clarify supplemental context projection

* refactor: move inbound finalization into core

* refactor: simplify channel inbound facts

* refactor: fold supplemental media into inbound finalizer

* refactor: migrate channel inbound callers to builder

* docs: mark inbound finalizer compat types deprecated

* refactor: wire runtime turn context builder

* refactor: replace channel turn runtime API

* fix: respect discord quote visibility

* fix: avoid deprecated line dispatch helper

* refactor: deprecate channel message SDK seams

* docs: trim channel outbound SDK page

* test: migrate irc inbound assertion

* refactor: deprecate outbound SDK facades

* refactor: deprecate channel helper SDK facades

* refactor: deprecate channel streaming SDK facade

* refactor: move direct dm helpers into inbound SDK

* chore: mark legacy test-utils SDK alias deprecated

* refactor: remove unused allow-from read helper

* refactor: route remaining channel dispatch through core

* refactor: enforce modern extension SDK imports

* test: give slow image root tests more time

* ci: support node fallback on windows

* fix: add transcripts tool display metadata

* refactor: trim legacy channel test seams

* fix: preserve channel compat after rebase

* fix: keep deprecated channel inbound aliases

* fix: preserve discord thread context visibility

* fix: clean final rebase conflicts

* fix: preserve channel message dispatch aliases

* fix: sync channel refactor after rebase

* fix: sync channel refactor after latest main

* fix: dedupe memory-core subagent mock

* test: align clickclack inbound dispatch assertions

* fix: sync plugin sdk api hash after rebase

* fix: sync channel refactor after latest main

* fix: sync plugin sdk api hash after rebase

* fix: sync plugin sdk api hash after latest main

* test: remove stale inbound context awaits
2026-05-27 09:26:06 +01:00
Shubhankar Tripathy
717003aaff docs(providers/openai): clarify OpenAI Realtime Platform credits
Clarify that OpenAI Realtime voice is billed through OpenAI Platform credits, not Codex/ChatGPT subscription quota, for Voice Call and Control UI Talk.

Document the direct Platform API key path, the `openai-codex` OAuth client-secret path, the quota symptom, and the Platform billing fix. Keep the changelog note crediting @lonexreb.

Closes #76498.

Co-authored-by: lonexreb <reach2shubhankar@gmail.com>
2026-05-27 08:51:26 +01:00
Agustin Rivera
08a73dbe4b fix(qqbot): gate fallback approval buttons (#87154)
QQBot fallback approval buttons now reuse the same slash-command authorization path as real commands, including access groups and default-account config merging.

Verification:
- node scripts/test-extension.mjs qqbot
- node --max-old-space-size=8192 --import tsx scripts/generate-plugin-sdk-api-baseline.ts --check && git diff --check
- pnpm lint --threads=8
- node scripts/run-vitest.mjs src/agents/agent-command.live-model-switch.test.ts
- GitHub PR checks for 7cc0f15031: passed

Thanks @eleqtrizit.

Co-authored-by: Agustin Rivera <agustin@rivera-web.com>
2026-05-27 08:44:55 +01:00
clawsweeper[bot]
f4e20f806e fix(agents): avoid duplicate Claude CLI skill prompts
Fix Claude CLI skill prompt handling so native skill plugin materialization is prepared before prompt suppression, with the prompt fallback preserved when plugin args are unavailable. Also keeps direct prepared-run callers covered by an execute-time fallback.

Fixes #87063.

Co-authored-by: uday <udaymanish.thumma@gmail.com>
2026-05-27 08:34:34 +01:00
Dallin Romney
780bc79147 fix(plugin-sdk): stop exporting vitest test helpers (#87120) 2026-05-26 23:10:41 -07:00
Agustin Rivera
2c88547254 fix(prompt): route untrusted group prompts outside system prompt [AI] (#87144)
* fix(prompt): route untrusted group prompts outside system prompt

* fix(prompt): align untrusted group prompt helpers
2026-05-26 22:47:54 -07:00
Pablo Guardiola
0c867eef75 feat: expose plugin approval action metadata
Expose plugin approval action metadata so plugins can describe richer approval actions across gateway, SDK, channel, and UI surfaces.
2026-05-26 22:46:09 -07:00
Agustin Rivera
e72621e566 fix(hooks): enforce default hook agent allowlist
Enforce hook allowedAgentIds against the effective default agent when hook payloads omit or blank agentId, while preserving omitted-agent dispatch semantics for default/global routing.

Also updates the affected generated hook config docs from the contributor change and fixes the current-main memory-core test mock after rebasing the PR branch.

Verification:
- pnpm format:check extensions/memory-core/src/dreaming.test.ts src/gateway/hooks.ts src/gateway/hooks.test.ts src/gateway/server/hooks-request-handler.ts src/gateway/server.hooks.test.ts && git diff --check
- node scripts/run-vitest.mjs run --config test/vitest/vitest.gateway-server.config.ts src/gateway/hooks.test.ts src/gateway/server.hooks.test.ts --reporter=dot --pool=forks --no-file-parallelism --testTimeout=120000
- node scripts/run-tsgo.mjs -p test/tsconfig/tsconfig.extensions.test.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/extensions-test-local-pr87124.tsbuildinfo
- pnpm check:test-types
- .agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main
- GitHub PR merge state CLEAN; CodeQL Critical Quality rerun succeeded after first runner checkout wedged

Co-authored-by: Agustin Rivera <agustin@rivera-web.com>
2026-05-27 05:05:18 +01:00
Peter Steinberger
231a812276 build(codex): update Codex CLI to 0.134.0 2026-05-27 04:42:12 +01:00
Peter Steinberger
0cfccdb0c7 fix(codex): keep WebChat delivery hints out of user requests
Land PR #87003 from @ragesaq with a maintainer fix for routed room events.

Co-authored-by: Forge <forge@psiclawops.dev>
2026-05-27 03:44:27 +01:00
Samuel Soares da Silva
286964cd6a fix(diagnostics): recover orphaned session activity
Recover idle queued sessions whose diagnostic activity retained stale ownerless model or tool calls by classifying them as recoverable session.stuck after the usual recovery gates. Yield the event loop before stale session-lock process inspection so sync process lookup cannot monopolize lock contention paths.

Docs now describe the widened session.stuck telemetry contract for recoverable stale bookkeeping, including ownerless activity. Thanks @samuelsoaress.

Refs #84903.

Co-authored-by: samuelsoaress <samuelsoares177778@gmail.com>
2026-05-27 02:47:42 +01:00
uday
0f18d52f16 fix(codex): raise dynamic tool timeout 2026-05-27 01:25:48 +01:00
Peter Steinberger
a1934e9d0e fix(cli): handle Bun launcher module misses
Fixes #86198.

Co-authored-by: Gio Della-Libera <giodl73@gmail.com>
2026-05-27 01:20:14 +01:00
Peter Steinberger
69d84d775b fix(docs): use Cloudflare docs search API 2026-05-27 00:58:09 +01:00
Abdel Gomez-Perez
474b1e0386 fix(cli-runner): scale Claude CLI reseed history automatically
Remove the proposed public `maxReseedHistoryChars` config surface and scale Claude CLI reseed history automatically from the resolved context tier instead.

Claude CLI 200K-context runs now keep a 64K-character reseed slice, 1M Opus/Sonnet runs use the bounded 256KiB cap, and non-Claude CLI backends keep the existing 12KiB default. This preserves the intended long-context behavior without adding another config option.

Verification:
- `node scripts/run-vitest.mjs src/agents/cli-runner/session-history.test.ts src/agents/cli-runner/prepare.test.ts`
- `node scripts/run-vitest.mjs src/agents/cli-runner/prepare.test.ts -t "automatic Claude CLI cap"`
- `node scripts/run-oxlint.mjs src/agents/cli-runner/prepare.ts src/agents/cli-runner/prepare.test.ts src/agents/cli-runner/session-history.ts src/agents/cli-runner/session-history.test.ts src/config/types.agent-defaults.ts src/config/zod-schema.core.ts`
- `pnpm check:changed` via Testbox `tbx_01kska2twjxb925xft9dj82hvb`
- GitHub PR checks green

Closes #83985
Co-authored-by: Abdel Gomez-Perez <nabdel07@icloud.com>
2026-05-27 00:41:01 +01:00
Eric Milgram, PhD
678a0ee944 fix(config): render transform-backed config schema inputs (#67328)
Generate the public config JSON Schema from accepted input shapes so transform-backed fields remain renderable in the Control UI. Keep transform output schemas representable with explicit string pipes, align analyzer metadata handling, and cover the generated schema plus browser-safe UI render shapes.

Co-authored-by: Altay <altay@hey.com>

Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-05-27 00:36:13 +01:00
fuller-stack-dev
40fa750b4f docs: explain bundled plugin npm override 2026-05-26 23:51:53 +01:00
Kevin Lin
7d6b7f434c feat(plugin-sdk): add reaction approval helpers (#86735)
* feat(plugin-sdk): add reaction approval helpers

* fix(signal): register target approval reactions

* Remove legacy WhatsApp approval reaction appender

* refactor(plugin-sdk): share native exec prompt suppression

* revert(discord): keep exec prompt suppression local

* refactor(plugin-sdk): share native approval fallback suppression

* fix(whatsapp): bind outbound approval reactions

* chore(plugin-sdk): refresh api baseline

* revert(imessage): defer reaction approval changes
2026-05-26 15:28:50 -07:00
Vincent Koc
3127808473 fix(cli): default logs to local timestamps (#85387) 2026-05-26 21:14:47 +01:00
Mark
e070519f43 fix(updater): exclude prerelease tags from stable git channel (#86559)
Preserve legacy numeric stable git tags while excluding named semver prerelease tags from stable git channel detection and status display.

Thanks @goldmar.
2026-05-26 21:11:38 +01:00
Keshav's Bot
21c25bbb9d fix(codex): gate profiler timing and startup setup 2026-05-26 20:51:00 +01:00
alexph-dev
aa117ec4de fix(telegram): derive DM topics from bot capability
Remove the Telegram DM thread reply policy config and use Telegram bot capability as the single source of truth for DM topic session splitting.

DM messages with message_thread_id now split into thread-scoped sessions only when Telegram getMe reports has_topics_enabled for the bot. Doctor removes retired dm.threadReplies and direct.*.threadReplies keys, docs explain the upgrade behavior, and startup keeps cached bot info as a non-auth fallback when a fresh probe fails.

Refs #86513.
Thanks @alexph-dev.

Verification:
- pnpm docs:list
- pnpm exec oxfmt --check --threads=1 extensions/telegram/src/channel.ts extensions/telegram/src/channel.gateway.test.ts extensions/telegram/src/doctor-contract.ts extensions/telegram/src/doctor.test.ts
- git diff --check
- node scripts/run-vitest.mjs extensions/telegram/src/channel.gateway.test.ts extensions/telegram/src/doctor.test.ts extensions/telegram/src/bot/helpers.test.ts extensions/telegram/src/bot-message-context.dm-threads.test.ts extensions/telegram/src/config-schema.test.ts
- pnpm config:channels:check
- pnpm config:docs:check
- .agents/skills/autoreview/scripts/autoreview --mode local
- GitHub Actions: CI 26468039803, Workflow Sanity 26468040057, OpenGrep 26468039472, Real behavior proof 26468036483, CodeQL 26468039466, CodeQL Critical Quality 26468039473

Known CI caveat: checks-windows-node-test failed before tests because Windows runner setup left Node 22.19.0 active while the job requested Node 24.x; the same setup failure is present on current main CI run 26468063947.
2026-05-26 19:52:17 +01:00
Peter Steinberger
4007df7f60 fix: improve discord voice playback and wake replies 2026-05-26 19:40:12 +01:00
Fermin Quant
598aad4f66 fix(agents): disclose scoped session list results (#86944)
* fix(agents): disclose scoped session list results

* fix(agents): clarify scoped session count warning
2026-05-26 18:40:36 +01:00
Vincent Koc
8685dbd547 fix(test): default Vitest stall watchdog 2026-05-26 16:17:13 +02:00
Vincent Koc
4d4e2ec256 fix(qa): require genai otel model spans (#86920) 2026-05-26 14:51:50 +01:00