Luke
|
7761e7626f
|
Providers: add Opencode Go support (#42313)
* feat(providers): add opencode-go provider support and onboarding
* Onboard: unify OpenCode auth handling openclaw#42313 thanks @ImLukeF
* Docs: merge OpenCode Zen and Go docs openclaw#42313 thanks @ImLukeF
* Update CHANGELOG.md
---------
Co-authored-by: Ubuntu <ubuntu@vps-90352893.vps.ovh.ca>
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
|
2026-03-11 01:31:06 -04:00 |
|
Josh Avant
|
0125ce1f44
|
Gateway: fail closed unresolved local auth SecretRefs (#42672)
* Gateway: fail closed unresolved local auth SecretRefs
* Docs: align node-host gateway auth precedence
* CI: resolve rebase breakages in checks lanes
* Tests: isolate LOCAL_REMOTE_FALLBACK_TOKEN env state
* Gateway: remove stale remote.enabled auth-surface semantics
* Changelog: note gateway SecretRef fail-closed fix
|
2026-03-10 21:41:56 -05:00 |
|
Josh Avant
|
a76e810193
|
fix(gateway): harden token fallback/reconnect behavior and docs (#42507)
* fix(gateway): harden token fallback and auth reconnect handling
* docs(gateway): clarify auth retry and token-drift recovery
* fix(gateway): tighten auth reconnect gating across clients
* fix: harden gateway token retry (#42507) (thanks @joshavant)
|
2026-03-10 17:05:57 -05:00 |
|
Mariano
|
8e3f3bc3cf
|
acp: enrich streaming updates for ide clients (#41442)
Merged via squash.
Prepared head SHA: 0764368e80
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com>
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com>
Reviewed-by: @mbelinky
|
2026-03-09 22:26:46 +01:00 |
|
Mariano
|
d346f2d9ce
|
acp: restore session context and controls (#41425)
Merged via squash.
Prepared head SHA: fcabdf7c31
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com>
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com>
Reviewed-by: @mbelinky
|
2026-03-09 22:17:19 +01:00 |
|
Mariano
|
e6e4169e82
|
acp: fail honestly in bridge mode (#41424)
Merged via squash.
Prepared head SHA: b5e6e13afe
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com>
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com>
Reviewed-by: @mbelinky
|
2026-03-09 22:01:30 +01:00 |
|
Mariano
|
d4e59a3666
|
Cron: enforce cron-owned delivery contract (#40998)
Merged via squash.
Prepared head SHA: 5877389e33
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com>
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com>
Reviewed-by: @mbelinky
|
2026-03-09 20:12:37 +01:00 |
|
Mariano
|
e3df94365b
|
ACP: add optional ingress provenance receipts (#40473)
Merged via squash.
Prepared head SHA: b63e46dd94
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com>
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com>
Reviewed-by: @mbelinky
|
2026-03-09 04:19:03 +01:00 |
|
Tyler Yust
|
38543d8196
|
fix(cron): consolidate announce delivery, fire-and-forget trigger, and minimal prompt mode (#40204)
* fix(cron): consolidate announce delivery and detach manual runs
* fix: queue detached cron runs (#40204)
|
2026-03-08 14:46:33 -07:00 |
|
shichangs
|
0ecfd37b44
|
feat: add local backup CLI (#40163)
Merged via squash.
Prepared head SHA: ed46625ae2
Co-authored-by: shichangs <46870204+shichangs@users.noreply.github.com>
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com>
Reviewed-by: @gumadeiras
|
2026-03-08 16:21:20 -04:00 |
|
arceus77-7
|
492fe679a7
|
feat(tui): infer workspace agent when launching TUI (#39591)
Merged via squash.
Prepared head SHA: 23533e24c4
Co-authored-by: arceus77-7 <261276524+arceus77-7@users.noreply.github.com>
Co-authored-by: altaywtf <9790196+altaywtf@users.noreply.github.com>
Reviewed-by: @altaywtf
|
2026-03-08 13:31:11 +03:00 |
|
Vincent Koc
|
4062aa5e5d
|
Gateway: add safer password-file input for gateway run (#39067)
* CLI: add gateway password-file option
* Docs: document safer gateway password input
* Update src/cli/gateway-cli/run.ts
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
* Tests: clean up gateway password temp dirs
* CLI: restore gateway password warning flow
* Security: harden secret file reads
---------
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
|
2026-03-07 18:20:17 -08:00 |
|
Josh Avant
|
25252ab5ab
|
gateway: harden shared auth resolution across systemd, discord, and node host
|
2026-03-07 18:28:32 -06:00 |
|
Josh Avant
|
8e20dd22d8
|
Secrets: harden SecretRef-safe models.json persistence (#38955)
|
2026-03-07 11:28:39 -06:00 |
|
Jason
|
786ec21b5a
|
docs(cli): improve memory command examples (#31803)
Merged via squash.
Prepared head SHA: 15dcda3027
Co-authored-by: JasonOA888 <101583541+JasonOA888@users.noreply.github.com>
Co-authored-by: altaywtf <9790196+altaywtf@users.noreply.github.com>
Reviewed-by: @altaywtf
|
2026-03-07 19:03:23 +03:00 |
|
Vincent Koc
|
f392b81e95
|
Infra: require explicit opt-in for prerelease npm installs (#38117)
* Infra: tighten npm registry spec parsing
* Infra: block implicit prerelease npm installs
* Plugins: cover prerelease install policy
* Infra: add npm registry spec tests
* Hooks: cover prerelease install policy
* Docs: clarify plugin guide version policy
* Docs: clarify plugin install version policy
* Docs: clarify hooks install version policy
* Docs: clarify hook pack version policy
|
2026-03-06 11:13:30 -05:00 |
|
Josh Avant
|
0e4245063f
|
CLI: make read-only SecretRef status flows degrade safely (#37023)
* CLI: add read-only SecretRef inspection
* CLI: fix read-only SecretRef status regressions
* CLI: preserve read-only SecretRef status fallbacks
* Docs: document read-only channel inspection hook
* CLI: preserve audit coverage for read-only SecretRefs
* CLI: fix read-only status account selection
* CLI: fix targeted gateway fallback analysis
* CLI: fix Slack HTTP read-only inspection
* CLI: align audit credential status checks
* CLI: restore Telegram read-only fallback semantics
|
2026-03-05 23:07:13 -06:00 |
|
Vincent Koc
|
98aecab7bd
|
Docs: cover heartbeat, cron, and plugin route updates
|
2026-03-05 17:05:21 -05:00 |
|
Josh Avant
|
72cf9253fc
|
Gateway: add SecretRef support for gateway.auth.token with auth-mode guardrails (#35094)
|
2026-03-05 12:53:56 -06:00 |
|
Josh Avant
|
806803b7ef
|
feat(secrets): expand SecretRef coverage across user-supplied credentials (#29580)
* feat(secrets): expand secret target coverage and gateway tooling
* docs(secrets): align gateway and CLI secret docs
* chore(protocol): regenerate swift gateway models for secrets methods
* fix(config): restore talk apiKey fallback and stabilize runner test
* ci(windows): reduce test worker count for shard stability
* ci(windows): raise node heap for test shard stability
* test(feishu): make proxy env precedence assertion windows-safe
* fix(gateway): resolve auth password SecretInput refs for clients
* fix(gateway): resolve remote SecretInput credentials for clients
* fix(secrets): skip inactive refs in command snapshot assignments
* fix(secrets): scope gateway.remote refs to effective auth surfaces
* fix(secrets): ignore memory defaults when enabled agents disable search
* fix(secrets): honor Google Chat serviceAccountRef inheritance
* fix(secrets): address tsgo errors in command and gateway collectors
* fix(secrets): avoid auth-store load in providers-only configure
* fix(gateway): defer local password ref resolution by precedence
* fix(secrets): gate telegram webhook secret refs by webhook mode
* fix(secrets): gate slack signing secret refs to http mode
* fix(secrets): skip telegram botToken refs when tokenFile is set
* fix(secrets): gate discord pluralkit refs by enabled flag
* fix(secrets): gate discord voice tts refs by voice enabled
* test(secrets): make runtime fixture modes explicit
* fix(cli): resolve local qr password secret refs
* fix(cli): fail when gateway leaves command refs unresolved
* fix(gateway): fail when local password SecretRef is unresolved
* fix(gateway): fail when required remote SecretRefs are unresolved
* fix(gateway): resolve local password refs only when password can win
* fix(cli): skip local password SecretRef resolution on qr token override
* test(gateway): cast SecretRef fixtures to OpenClawConfig
* test(secrets): activate mode-gated targets in runtime coverage fixture
* fix(cron): support SecretInput webhook tokens safely
* fix(bluebubbles): support SecretInput passwords across config paths
* fix(msteams): make appPassword SecretInput-safe in onboarding/token paths
* fix(bluebubbles): align SecretInput schema helper typing
* fix(cli): clarify secrets.resolve version-skew errors
* refactor(secrets): return structured inactive paths from secrets.resolve
* refactor(gateway): type onboarding secret writes as SecretInput
* chore(protocol): regenerate swift models for secrets.resolve
* feat(secrets): expand extension credential secretref support
* fix(secrets): gate web-search refs by active provider
* fix(onboarding): detect SecretRef credentials in extension status
* fix(onboarding): allow keeping existing ref in secret prompt
* fix(onboarding): resolve gateway password SecretRefs for probe and tui
* fix(onboarding): honor secret-input-mode for local gateway auth
* fix(acp): resolve gateway SecretInput credentials
* fix(secrets): gate gateway.remote refs to remote surfaces
* test(secrets): cover pattern matching and inactive array refs
* docs(secrets): clarify secrets.resolve and remote active surfaces
* fix(bluebubbles): keep existing SecretRef during onboarding
* fix(tests): resolve CI type errors in new SecretRef coverage
* fix(extensions): replace raw fetch with SSRF-guarded fetch
* test(secrets): mark gateway remote targets active in runtime coverage
* test(infra): normalize home-prefix expectation across platforms
* fix(cli): only resolve local qr password refs in password mode
* test(cli): cover local qr token mode with unresolved password ref
* docs(cli): clarify local qr password ref resolution behavior
* refactor(extensions): reuse sdk SecretInput helpers
* fix(wizard): resolve onboarding env-template secrets before plaintext
* fix(cli): surface secrets.resolve diagnostics in memory and qr
* test(secrets): repair post-rebase runtime and fixtures
* fix(gateway): skip remote password ref resolution when token wins
* fix(secrets): treat tailscale remote gateway refs as active
* fix(gateway): allow remote password fallback when token ref is unresolved
* fix(gateway): ignore stale local password refs for none and trusted-proxy
* fix(gateway): skip remote secret ref resolution on local call paths
* test(cli): cover qr remote tailscale secret ref resolution
* fix(secrets): align gateway password active-surface with auth inference
* fix(cli): resolve inferred local gateway password refs in qr
* fix(gateway): prefer resolvable remote password over token ref pre-resolution
* test(gateway): cover none and trusted-proxy stale password refs
* docs(secrets): sync qr and gateway active-surface behavior
* fix: restore stability blockers from pre-release audit
* Secrets: fix collector/runtime precedence contradictions
* docs: align secrets and web credential docs
* fix(rebase): resolve integration regressions after main rebase
* fix(node-host): resolve gateway secret refs for auth
* fix(secrets): harden secretinput runtime readers
* gateway: skip inactive auth secretref resolution
* cli: avoid gateway preflight for inactive secret refs
* extensions: allow unresolved refs in onboarding status
* tests: fix qr-cli module mock hoist ordering
* Security: align audit checks with SecretInput resolution
* Gateway: resolve local-mode remote fallback secret refs
* Node host: avoid resolving inactive password secret refs
* Secrets runtime: mark Slack appToken inactive for HTTP mode
* secrets: keep inactive gateway remote refs non-blocking
* cli: include agent memory secret targets in runtime resolution
* docs(secrets): sync docs with active-surface and web search behavior
* fix(secrets): keep telegram top-level token refs active for blank account tokens
* fix(daemon): resolve gateway password secret refs for probe auth
* fix(secrets): skip IRC NickServ ref resolution when NickServ is disabled
* fix(secrets): align token inheritance and exec timeout defaults
* docs(secrets): clarify active-surface notes in cli docs
* cli: require secrets.resolve gateway capability
* gateway: log auth secret surface diagnostics
* secrets: remove dead provider resolver module
* fix(secrets): restore gateway auth precedence and fallback resolution
* fix(tests): align plugin runtime mock typings
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
|
2026-03-03 02:58:20 +00:00 |
|
Peter Steinberger
|
6b85ec3022
|
docs: tighten subscription guidance and update MiniMax M2.5 refs
|
2026-03-03 00:02:37 +00:00 |
|
Peter Steinberger
|
ad12d1fbce
|
fix(plugins): prefer bundled plugin ids over bare npm specs
|
2026-03-02 20:49:50 +00:00 |
|
Sid
|
3002f13ca7
|
feat(config): add openclaw config validate and improve startup error messages (#31220)
Merged via squash.
Prepared head SHA: 4598f2a541
Co-authored-by: Sid-Qin <201593046+Sid-Qin@users.noreply.github.com>
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com>
Reviewed-by: @gumadeiras
|
2026-03-02 00:45:51 -05:00 |
|
Ayaan Zaidi
|
548a502c69
|
docs: sync android node docs with current pairing and capabilities
|
2026-03-02 11:08:51 +05:30 |
|
Alberto Leal
|
449511484d
|
fix(gateway): allow ws:// to private network addresses (#28670)
* fix(gateway): allow ws:// to RFC 1918 private network addresses
resolve ws-private-network conflicts
* gateway: keep ws security strict-by-default with private opt-in
* gateway: apply private ws opt-in in connection detail guard
* gateway: apply private ws opt-in in websocket client
* onboarding: gate private ws urls behind explicit opt-in
* gateway tests: enforce strict ws defaults with private opt-in
* onboarding tests: validate private ws opt-in behavior
* gateway client tests: cover private ws env override
* gateway call tests: cover private ws env override
* changelog: add ws strict-default security entry for pr 28670
* docs(onboard): document private ws break-glass env
* docs(gateway): add private ws env to remote guide
* docs(docker): add private ws break-glass env var
* docs(security): add private ws break-glass guidance
* docs(config): document OPENCLAW_ALLOW_PRIVATE_WS
* Update CHANGELOG.md
* gateway: normalize private-ws host classification
* test(gateway): cover non-unicast ipv6 private-ws edges
* changelog: rename insecure private ws break-glass env
* docs(onboard): rename insecure private ws env
* docs(gateway): rename insecure private ws env in config reference
* docs(gateway): rename insecure private ws env in remote guide
* docs(security): rename insecure private ws env
* docs(docker): rename insecure private ws env
* test(onboard): rename insecure private ws env
* onboard: rename insecure private ws env
* test(gateway): rename insecure private ws env in call tests
* gateway: rename insecure private ws env in call flow
* test(gateway): rename insecure private ws env in client tests
* gateway: rename insecure private ws env in client
* docker: pass insecure private ws env to services
* docker-setup: persist insecure private ws env
---------
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
|
2026-03-01 20:49:45 -08:00 |
|
cyb1278588254
|
96ffbb5aaf
|
CLI: add config path subcommand to print active config file path (#26256)
Merged via squash.
Prepared head SHA: b11c593a34
Co-authored-by: cyb1278588254 <48212932+cyb1278588254@users.noreply.github.com>
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com>
Reviewed-by: @gumadeiras
|
2026-03-01 23:33:20 -05:00 |
|
Vincent Koc
|
b7615e0ce3
|
Exec/ACP: inject OPENCLAW_SHELL into child shell env (#31271)
* exec: mark runtime shell context in exec env
* tests(exec): cover OPENCLAW_SHELL in gateway exec
* tests(exec): cover OPENCLAW_SHELL in pty mode
* acpx: mark runtime shell context for spawned process
* tests(acpx): log OPENCLAW_SHELL in runtime fixture
* tests(acpx): assert OPENCLAW_SHELL in runtime prompt
* docs(env): document OPENCLAW_SHELL runtime markers
* docs(exec): describe OPENCLAW_SHELL exec marker
* docs(acp): document OPENCLAW_SHELL acp marker
* docs(gateway): note OPENCLAW_SHELL for background exec
* tui: tag local shell runs with OPENCLAW_SHELL
* tests(tui): assert OPENCLAW_SHELL in local shell runner
* acp client: tag spawned bridge env with OPENCLAW_SHELL
* tests(acp): cover acp client OPENCLAW_SHELL env helper
* docs(env): include acp-client and tui-local shell markers
* docs(acp): document acp-client OPENCLAW_SHELL marker
* docs(tui): document tui-local OPENCLAW_SHELL marker
* exec: keep shell runtime env string-only for docker args
* changelog: note OPENCLAW_SHELL runtime markers
|
2026-03-01 20:31:06 -08:00 |
|
Philipp Spiess
|
d320b30b9b
|
Docs: expand ACP first-use naming and link protocol site
|
2026-02-27 00:33:58 +01:00 |
|
Peter Steinberger
|
297cca0565
|
docs(cli): improve secrets command guide
|
2026-02-27 00:20:02 +01:00 |
|
Peter Steinberger
|
0ec7711bc2
|
fix(agents): harden compaction and reset safety
Co-authored-by: jaden-clovervnd <91520439+jaden-clovervnd@users.noreply.github.com>
Co-authored-by: Sid <201593046+Sid-Qin@users.noreply.github.com>
Co-authored-by: Marcus Widing <245375637+widingmarcus-cyber@users.noreply.github.com>
|
2026-02-26 17:41:24 +01:00 |
|
Peter Steinberger
|
4380d74d49
|
docs(secrets): add dedicated apply plan contract page
|
2026-02-26 14:47:22 +00:00 |
|
joshavant
|
14897e8de7
|
docs(secrets): clarify partial migration guidance
|
2026-02-26 14:47:22 +00:00 |
|
joshavant
|
06290b49b2
|
feat(secrets): finalize mode rename and validated exec docs
|
2026-02-26 14:47:22 +00:00 |
|
joshavant
|
f413e314b9
|
feat(secrets): replace migrate flow with audit/configure/apply
|
2026-02-26 14:47:22 +00:00 |
|
joshavant
|
bde9cbb058
|
docs(secrets): align provider model and add exec resolver coverage
|
2026-02-26 14:47:22 +00:00 |
|
joshavant
|
5e3a86fd2f
|
feat(secrets): expand onboarding secret-ref flows and custom-provider parity
|
2026-02-26 14:47:22 +00:00 |
|
joshavant
|
e8637c79b3
|
fix(secrets): harden sops migration sops rule matching
|
2026-02-26 14:47:22 +00:00 |
|
joshavant
|
0e69660c41
|
feat(secrets): finalize external secrets runtime and migration hardening
|
2026-02-26 14:47:22 +00:00 |
|
joshavant
|
c5b89fbaea
|
Docs: address review feedback on secrets docs
|
2026-02-26 14:47:22 +00:00 |
|
joshavant
|
9203d583f9
|
Docs: add secrets and CLI secrets reference pages
|
2026-02-26 14:47:22 +00:00 |
|
joshavant
|
c0a3801086
|
Docs: document secrets refs runtime and migration
|
2026-02-26 14:47:22 +00:00 |
|
Gustavo Madeira Santana
|
dfa0b5b4fc
|
Channels: move single-account config into accounts.default (#27334)
Merged via /review-pr -> /prepare-pr -> /merge-pr.
Prepared head SHA: 50b5771808
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com>
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com>
Reviewed-by: @gumadeiras
|
2026-02-26 04:06:03 -05:00 |
|
Gustavo Madeira Santana
|
96c7702526
|
Agents: add account-scoped bind and routing commands (#27195)
Merged via /review-pr -> /prepare-pr -> /merge-pr.
Prepared head SHA: ad35a458a5
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com>
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com>
Reviewed-by: @gumadeiras
|
2026-02-26 02:36:56 -05:00 |
|
Peter Steinberger
|
42f455739f
|
fix(security): clarify denyCommands exact-match guidance
|
2026-02-26 00:55:35 +01:00 |
|
Peter Steinberger
|
c2a837565c
|
docs: fix configure section example
|
2026-02-25 02:44:49 +00:00 |
|
Peter Steinberger
|
bfafec2271
|
docs: expand doctor and devices CLI references
|
2026-02-25 02:41:13 +00:00 |
|
Peter Steinberger
|
a12cbf8994
|
docs: refresh CLI and trusted-proxy docs
|
2026-02-25 02:40:12 +00:00 |
|
Peter Steinberger
|
14b6eea6e3
|
feat(sandbox): block container namespace joins by default
|
2026-02-24 23:20:34 +00:00 |
|
Peter Steinberger
|
8cc841766c
|
docs(security): enumerate dangerous config parameters
|
2026-02-24 14:25:43 +00:00 |
|
Peter Steinberger
|
4d124e4a9b
|
feat(security): warn on likely multi-user trust-model mismatch
|
2026-02-24 14:03:19 +00:00 |
|