Peter Steinberger
bb19d65446
fix(cli): keep remote gateway calls read-only ( #115664 )
2026-07-29 03:48:59 -04:00
Peter Steinberger
6ec84bc3bd
fix(models): expose custom max and ultra reasoning tiers ( #115690 )
...
* fix(models): honor custom advanced reasoning levels
* fix(ci): restore code mode matrix boundaries
2026-07-29 03:33:30 -04:00
Vincent Koc
1c36054494
feat(agents): add code mode model acceptance matrix ( #115305 )
...
* feat(agents): add code mode model acceptance matrix
* fix(qa): emit canonical Code Mode matrix evidence
* fix(qa): reserve code mode matrix output safely
* fix(qa): require fresh matrix builds
* fix(qa): protect matrix evidence paths
2026-07-29 14:12:20 +08:00
Peter Steinberger
ec4c90c455
fix(onboard): reject conflicting custom inputs ( #115595 )
2026-07-29 01:34:54 -04:00
Peter Steinberger
5cc9693507
fix(doctor): enable workspace suggestions by default ( #115512 )
...
Restore the documented default workspace health guidance and preserve the explicit opt-out. Add regression coverage for both real CLI registration modes. Fixes #109503 ; thanks @moguangyu5-design for reporting the bug and proposing #109504 .
2026-07-28 23:35:46 -04:00
Peter Steinberger
ba8bccb750
fix(cli): gateway health JSON connects before loading presentation code ( #115244 )
...
* fix(gateway): start one-shot CLI clients immediately
Closes #115243
* fix(cli): defer gateway health presentation imports
* style(cli): format gateway health loader
* test(cli): match gateway health call shape
* perf(cli): route gateway health JSON before Commander
* fix(cli): preserve routed health output contract
* test(cli): match routed JSON indentation
* fix(cli): guard routed health config resolution
* perf(cli): avoid duplicate health config bootstrap
2026-07-28 14:19:18 -04:00
Peter Steinberger
929a8cf641
fix(cli): preserve bootstrap for version-pinned skill commands ( #114924 )
2026-07-28 00:34:20 -04:00
Peter Steinberger
2b11203eb3
fix(cli): keep config file queries fast and read-only ( #114660 )
2026-07-27 13:56:00 -04:00
Peter Steinberger
269bc5c89e
fix(cli): preserve machine-readable stdout ( #113654 )
...
Co-authored-by: 1052326311 <65798732+1052326311@users.noreply.github.com >
2026-07-27 05:44:16 -04:00
Peter Steinberger
9eae43bd37
refactor(infra): move exec approvals into the shared SQLite state DB ( #114063 )
...
* refactor(infra): move exec approvals into the shared SQLite state DB
Delete the file-runtime exec-approvals store (exec-approvals.json + .lock
sidecar machinery) on both runtimes and make the reserved
exec_approvals_config singleton row canonical. Doctor owns the one-time
import with claim/verify/receipt discipline; runtime fails closed with a
doctor instruction while un-migrated legacy state exists. The wire CAS
contract, socket semantics, and gateway auth-token derivations are
unchanged. Kills the #113929 lock-contention bug class structurally and
nets around -2.9k lines.
* fix(infra): green CI gates and retire file-era exec approvals tests
Break the migration-type import cycle with a leaf contract, regenerate the
plugin-SDK API and native i18n baselines for the intentional surface change,
drop unused exports, and replace the macOS file-era approvals test suite with
SQLite-backed behavior coverage per the obsolete-internals test policy.
* chore: green max-lines ratchet, native i18n baseline, and unused-export scan
2026-07-26 06:39:23 -04:00
Peter Steinberger
69399b1cc3
feat(cli): add openclaw agent exec headless one-shot runner ( #113988 )
...
* feat(cli): add agent exec headless runner
* test(cli): align agent parent startup paths
* fix(cli): scope agent exec environment explicitly
2026-07-25 20:59:20 -07:00
Vincent Koc
8029b3bbb8
fix(update): repair plugin config during upgrade finalization ( #113324 )
...
* fix(update): repair configured plugins during finalization
* fix(update): allow legacy config through migration
2026-07-25 00:18:59 +08:00
Peter Steinberger
a2be4efb63
refactor(transcripts): store meeting captures in SQLite ( #112910 )
...
* refactor(transcripts): move meeting transcripts to sqlite
* perf(transcripts): batch legacy utterance staging
* fix(transcripts): report recovery moves on migration failure
* fix(transcripts): refresh archive membership after recovery
* fix(transcripts): omit failed summary export paths
* fix(transcripts): type restore metadata tuple
* fix(transcripts): align migration contract gates
* fix(transcripts): verify case-aliased export ownership
* fix(transcripts): allowlist doctor verifier sqlite query
* fix(transcripts): preflight partial artifact recovery
* fix(transcripts): stabilize exports and legacy path checks
* fix(transcripts): resolve case-renamed doctor ownership
* fix(transcripts): harden canonical export recovery
* fix(transcripts): preserve pending import boundaries
* refactor(transcripts): split migration insert transaction
* perf(transcripts): query selected summary existence
2026-07-23 07:18:55 -04:00
Gio Della-Libera
88a7306308
Create Claw agent and root install record ( #101755 )
...
* Create Claw agent and root install record
* test(claws): cover consented agent creation
* docs(claws): document consented agent creation
* fix(claws): normalize agent collisions at commit
* test(claws): expect partial normalized collision
* test(claws): isolate normalized collision state
* test(claws): reject normalized agent collisions
* test(claws): align capability output expectation
* fix(claws): align add plan call with current schema
---------
Co-authored-by: Patrick Erichsen <patrick.a.erichsen@gmail.com >
2026-07-21 17:24:24 -07:00
Gio Della-Libera
138d2a5627
Add grouped Claw schema and read-only add plan ( #101328 )
...
* Add grouped Claw schema and read-only add plan
* test(claws): cover grouped schema and preview
* docs(claws): document experimental preview
* fix(claws): harden preview consent
* fix(claws): satisfy tool filter lint
* fix(claws): bind plans to validated sources
2026-07-21 14:50:36 -07:00
Peter Steinberger
6f43c50f37
fix(cli): preserve failure exit semantics ( #112210 )
2026-07-21 01:48:25 -07:00
Peter Steinberger
250e636ffd
fix(onboard): reject invalid setup options before writes ( #111680 )
...
* fix(onboard): validate setup options before mutation
* fix(onboard): keep flow helper type local
2026-07-19 23:05:23 -07:00
Peter Steinberger
6d39d3cf0b
fix(onboard): preserve gateway settings on rerun ( #111569 )
...
* fix(onboard): preserve gateway config on rerun
* fix(onboard): scope remote secrets to endpoint
* fix(onboard): honor rerun override boundaries
* fix(onboard): secure inherited tailscale auth
* fix(onboard): honor explicit token auth
* fix(onboard): enforce funnel auth on rerun
* fix(onboard): preserve env password on rerun
2026-07-19 20:18:34 -07:00
Peter Steinberger
171a3852ba
fix: install exact app recommendations and retry failures ( #111518 )
...
* fix(onboard): preserve recommendation install retries
* fix(onboard): preserve bootstrap recommendation retries
* fix(onboard): commit recommendation outcomes after config
* fix(onboard): guard recommendation state transitions
* fix(onboard): reconcile durable skill installs
* docs(clawhub): clarify search publisher contract
2026-07-19 14:10:50 -07:00
Peter Steinberger
1a574923cb
fix(onboard): honor remote flags in interactive setup ( #111517 )
...
* fix(onboard): honor interactive remote flags
* fix(onboard): clear credentials for changed gateway
* fix(onboard): validate remote URL before probe
* test(onboard): mark synthetic remote tokens
* test(onboard): avoid literal credential fixtures
* refactor(onboard): name remote probe auth role
* refactor(onboard): keep remote probe seed canonical
* test(onboard): type remote URL validator mock
2026-07-19 13:25:46 -07:00
Peter Steinberger
a876451d8b
fix(qa): avoid touching operator state during private QA runs ( #111446 )
...
* fix(qa): isolate commands from operator state
* fix(qa): isolate runner discovery from operator state
* fix(qa): keep discovery scope internal
2026-07-19 09:52:21 -07:00
Peter Steinberger
a8b7290f34
feat(gateway): durable user profiles with email aliases and avatars ( #111224 )
...
* feat(gateway): durable user profiles with email aliases and avatars
* fix(gateway): compress merge tombstones, content-hash avatar ETags, users CLI json output
* fix(gateway): lean profile listing, scoped avatar routing, typed email validation
* fix(gateway): protocol-complete profile payloads and consistent store reads
* fix(gateway): mark profile schema ensured only after commit
* fix(gateway): avatar endpoint HEAD support and RFC If-None-Match
* fix(gateway): profiles CI conformance — bindings, lint, knip, sql boundary
* feat(gateway): self-service profile edits for authenticated users
* fix(gateway): users.self bootstrap, tombstone-aware ownership, escaped CLI output
* fix(gateway): raw-DDL allowlist entry and lean profile exports
2026-07-19 00:58:43 -07:00
Peter Steinberger
a2ccbdfa96
feat(cli): list and resolve pending approvals headlessly ( #111060 )
...
* feat(cli): manage pending approvals
* fix(cli): show terminal-safe approval ids raw, reserve id64 tokens for hostile ids
* fix(cli): preserve opaque approval ids verbatim
* fix(cli): tokenize leading-hyphen approval ids for pasteability
* fix(cli): lossless utf16 id64 tokens for opaque approval ids
* fix(cli): resolve approval ids verbatim, no input trim
* fix(cli): scope-only approval auth, reviewer-safe system-agent summaries, skip ill-formed ids
* fix(cli): validate pending approval ids
* fix(cli): align approvals catalog and docs map
2026-07-18 23:23:49 -07:00
Yuval Dinodia
6ff963eb46
fix(transcripts): imported text can inject terminal escapes through transcripts show ( #110060 )
...
* fix(transcripts): imported text can inject terminal escapes through transcripts show
Imported transcript text, speaker labels, and session titles were rendered
into summary.md unsanitized, and openclaw transcripts show writes that file
directly to stdout, so a transcript could clear the terminal or spoof
colored status text. Sanitize external strings with the terminal-core
sanitizer when the summary is built, so summary.json, summary.md, and the
CLI output stay free of control bytes while transcript.jsonl keeps the raw
capture.
* fix(transcripts): protect terminal output boundaries
* fix(transcripts): keep canonical session identity separate from terminal presentation
* fix(transcripts): escape C1 control characters in transcripts json output
2026-07-18 20:20:13 -06:00
cxbAsDev
05fb8e6e61
fix(cli): bound --message-file reads for agent command ( #101442 )
...
* fix(cli): bound --message-file reads for agent command
* fix(cli): preserve symlinked --message-file paths with bounded reads
* fix(cli): preserve FIFO message files with bounded reads, document 4 MiB cap
* fix(cli): accept FIFO --message-file targets via bounded descriptor read
* test(cli): drop duplicate FIFO message-file read test
* docs(cli): note 4 MiB --message-file cap in agent help text
* style(commands): format agent-via-gateway test
* fix(cli): preserve procfs message-file reads
Co-authored-by: 陈宪彪0668000387 <chen.xianbiao@xydigit.com >
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
Co-authored-by: Peter Steinberger <peter@steipete.me >
2026-07-18 12:29:33 +01:00
Peter Steinberger
1710313596
fix(cli): offer config repair after invalid startup ( #110533 )
...
* fix(cli): offer doctor recovery for invalid config
* fix(cli): preserve invalid config overrides
* fix(cli): keep invalid config recovery controlled
2026-07-18 09:30:27 +01:00
Peter Steinberger
4186691885
feat(onboard): extend browser handoff and refresh recommendations ( #110484 )
...
* feat(onboard): enable browser handoff cross-platform
* feat(onboard): add recommendations refresh
* test(onboard): keep guided handoff coverage focused
2026-07-18 07:49:09 +01:00
Peter Steinberger
9a93a52a8a
feat(onboard): recommendations store with once-semantics and self-naming bootstrap ( #110173 )
...
* feat(onboarding): persist app recommendations once
* feat(onboarding): add self-naming birth sequence
* chore(wizard): hoist bootstrap-defer imports to the top of the module
* docs(bootstrap): persist agreed identity into IDENTITY.md and SOUL.md as well
* docs: regenerate docs map after onboarding plan merge
* fix(wizard): reuse a pending stored offer instead of rescanning apps
* fix(onboard): deduplicate bootstrap recommendations
2026-07-17 23:42:01 +01:00
Peter Steinberger
198e3b37b2
feat(onboard): browser-first guided handoff ( #110054 )
...
* feat(onboard): add browser-first guided handoff
* chore: drop release-only CHANGELOG edit from browser-handoff branch
* fix(onboard): make browser handoff reach the gateway on real installs
The presence probe connected as a raw shared-auth client with a possibly
SecretRef-managed token, which the gateway rejects as an unpaired Control UI
client ("device identity required"), so the handoff never fired and always
fell through to the terminal hatch. Read presence as a CLI-mode loopback client
(the trusted path every openclaw command uses) so operator.read is granted, and
share that one auth path between the reachability gate and the wait loop. Also
short-circuit when gateway.controlUi.enabled is false so onboarding does not open
a dead dashboard URL and block for the full timeout.
* fix(onboard): share resolved target between handoff gate and wait
The reachability preflight now resolves the same target (and shared secret) the
wait loop uses, and presents the configured secret to the CLI-mode presence
read. Known remaining limitation: on fresh quickstart gateways whose auth token
is written to config but resolved differently at runtime, the presence read is
rejected with a token mismatch and the handoff falls back to the terminal hatch.
Tracked for follow-up before enabling the browser handoff by default.
* docs(onboarding): mark phase 3 browser handoff as held with diagnosis
* docs(onboarding): phase 3 proven end-to-end; token-mismatch hold was a test artifact
* fix(onboard): satisfy docs-map and test-type gates for the handoff branch
* refactor(onboard): split guided manual stage
2026-07-17 18:57:57 +01:00
Peter Steinberger
5366b6de81
refactor: store gateway restart recovery in SQLite ( #110014 )
...
* refactor: move restart sentinel state to sqlite
* fix: satisfy restart sentinel architecture gates
* test: avoid cold startup migration timeout
* fix: bound durable restart notice retries
* test: type restart notice contention mock
* fix: detect legacy restart sentinel before reads
* fix: keep delivery attempt result internal
* fix: narrow restart sentinel preflight guard
2026-07-17 17:43:22 +01:00
Peter Steinberger
8fe4eeea9e
fix(exec): stop isolated state dirs from moving live approvals ( #108742 )
...
* fix(exec): isolate approval state directories
* chore: drop release-owned changelog entry
* chore: refresh native i18n inventory
* fix(ci): pin XcodeGen for Periphery scans
2026-07-16 08:57:32 -07:00
Peter Steinberger
69e9254e0e
fix(ci): regen rename-affected generated surfaces and fix e2e entrypoint
...
native i18n inventory + per-locale artifacts resynced for the OpenClaw
strings; Kotlin gateway protocol enum regenerated instead of hand-edited;
deadcode baseline re-sorted; lint suppression allowlist entries moved to
sorted position; setup TTY check drops redundant boolean compares;
ring-zero first-run e2e calls the real 'openclaw setup' subcommand.
Refs #107237
2026-07-14 11:03:02 -07:00
Peter Steinberger
eaaeeef19b
refactor(cli): type-safe option reads in setup command
...
Replace blind string casts with an optionalString reader and rename the
options record; blind token/password casts also false-positived secret
scanners on every future diff of this file.
Refs #107237
2026-07-14 11:03:02 -07:00
Peter Steinberger
a6a0716486
feat(setup): rename Crestodian to OpenClaw system agent
...
User-facing name is now OpenClaw (the system speaks); internal code name is
system-agent. Gateway methods crestodian.* -> openclaw.chat/openclaw.setup.*,
agent tool -> openclaw, reserved agent ids openclaw + retired crestodian.
openclaw setup routes: onboarding flags -> onboard, -m/--yes -> system agent,
bare configured interactive -> OpenClaw chat, unconfigured -> onboarding.
Hidden crestodian CLI and /crestodian TUI aliases kept; docs moved to
docs/cli/openclaw.md with redirect stub. macOS/Android strings in lockstep.
Refs #107237
2026-07-14 11:03:02 -07:00
Peter Steinberger
f81f9d8570
chore: enforce max-lines suppression ratchet ( #107315 )
...
* ci: enforce max-lines suppression ratchet
* chore: prune stale max-lines suppression
* fix: close max-lines ratchet enforcement gaps
* fix: harden max-lines ratchet checks
* fix(ci): satisfy max-lines ratchet checks
* style: format max-lines declarations
* fix(ci): match oxlint suppression grammar
* test: isolate max-lines git fixtures
* chore: prune resolved max-lines debt
* test: skip newline path fixture on Windows
* fix: harden max-lines suppression ratchet
* chore: refresh max-lines baseline
* fix: close max-lines ratchet bypasses
* fix: derive ratchet base from PR merge tree
* fix: support older Git in staged ratchet
* fix: align max-lines declarations and baseline
* chore: refresh max-lines baseline for current main
* fix: exclude generated wizard locales from max-lines
* chore: prune resolved max-lines debt
2026-07-14 09:27:02 -07:00
Peter Steinberger
673b163b72
refactor(cli): use Commander native APIs
2026-07-14 02:45:52 -07:00
Peter Steinberger
a965d28e04
refactor(cli): trim internal command exports ( #106426 )
2026-07-13 06:47:02 -07:00
Peter Steinberger
0d1573e9a2
perf(gateway): preserve pristine startup facts ( #106282 )
2026-07-13 05:50:36 -07:00
Peter Steinberger
5e1f920a36
refactor(cli): use Commander argv for lazy reparses ( #106382 )
2026-07-13 05:30:37 -07:00
Peter Steinberger
0bab08510e
feat: Linux desktop companion app with auto-install, Gateway lifecycle, and Control UI window ( #106352 )
...
* feat(linux): add Tauri desktop companion app and openclaw dashboard --json
* test(dashboard): assemble fake token fixture to satisfy secret scanners
* test(dashboard): avoid secret-scanner-shaped mock factory line
* fix(linux): actionable error when installed CLI predates dashboard --json
* docs: regenerate docs map for linux platform heading change
2026-07-13 05:17:27 -07:00
Peter Steinberger
801ec63f92
refactor(cli): rely on Commander contracts ( #106366 )
2026-07-13 05:05:31 -07:00
Peter Steinberger
6cd1133858
feat(cloud-workers): openclaw worker mode running the embedded loop on the box ( #105865 )
...
* feat(cloud-workers): add restricted worker runtime
* test(cloud-workers): cover worker runtime contracts
* docs(cloud-workers): document worker mode
* fix(worker): bound connection lifecycle
* fix(worker): serialize transcript flushes
* fix(worker): fail stop stale transcript bases
* fix(worker): degrade lossy live streaming
* test(worker): cover inference reconnect fencing
* refactor(worker): split RPC clients
* refactor(worker): split connection transport
* refactor(worker): split embedded runtime
* refactor(worker): narrow worker module exports
2026-07-13 02:34:31 -07:00
Peter Steinberger
843e3c7878
improve(gateway): speed up pristine plugin-heavy startup [AI] ( #106195 )
...
* perf(gateway): skip absent core startup migrations
* fix(gateway): revalidate recovered startup config
2026-07-13 02:32:24 -07:00
Peter Steinberger
e2ec8283c4
refactor(deadcode): trim mid-size src exports ( #105888 )
...
* refactor(deadcode): trim auto-reply and CLI exports
* refactor(deadcode): trim cron and task exports
* refactor(deadcode): trim fleet and process exports
* test(deadcode): exercise live task and process seams
* test(fleet): cover stream redaction through owner module
* refactor(security): trim dead internal exports
* refactor(secrets): trim dead internal exports
* refactor(deadcode): trim remaining src exports
* refactor(deadcode): remove test-only runtime exports
* refactor(deadcode): trim pairing test exports
* refactor(deadcode): reconcile refreshed baseline
* test(auto-reply): deduplicate queue state imports
2026-07-13 00:42:56 -07:00
Vincent Koc
f33ab243cf
fix(sqlite): reject runtimes vulnerable to WAL corruption ( #106065 )
...
* fix(sqlite): require WAL-reset-safe Node runtime
* docs(sqlite): document safe Node runtime floor
* fix(sqlite): defer runtime library validation until use
* fix(ci): align startup memory with Node 24.15
2026-07-13 13:59:00 +08:00
Peter Steinberger
a0e5c15988
refactor(errors): consolidate shared error formatting ( #105927 )
...
* refactor(errors): consolidate shared formatting
* fix(errors): preserve structured diagnostic details
* fix(errors): preserve nested cause compatibility
* chore(ci): ratchet reduced formatter files
2026-07-12 22:48:55 -07:00
Peter Steinberger
6aca7ca48f
improve: start Gateway and first agent turn faster ( #105801 )
...
* perf(gateway): streamline cold startup and first turn
* test(gateway): cover startup fast-path contracts
2026-07-12 18:16:18 -07:00
Vincent Koc
2f25e9cba3
feat(backup): add verified SQLite snapshots ( #105718 )
...
* feat(backup): expose verified SQLite snapshots
Co-authored-by: Gio Della-Libera <giodl73@gmail.com >
* feat(sqlite): add verified snapshot repository (#105525 )
Co-authored-by: Gio Della-Libera <giodl73@gmail.com >
* test(sqlite): use canonical snapshot schemas
* fix(backup): restrict SQLite snapshot roles
* fix(sqlite): harden snapshot staging paths
Co-authored-by: Gio Della-Libera <giodl73@gmail.com >
* fix(sqlite): pin snapshot repository paths
Co-authored-by: Gio Della-Libera <giodl73@gmail.com >
* fix(sqlite): secure Windows snapshot staging
Co-authored-by: Gio Della-Libera <giodl73@gmail.com >
* fix(sqlite): validate macOS ACL captures
* test(sqlite): preserve stat uid type
* style(sqlite): satisfy snapshot lint
---------
Co-authored-by: Gio Della-Libera <giodl73@gmail.com >
2026-07-13 06:27:14 +08:00
Vincent Koc
6d2eabc9ea
refactor(cli): remove config guard testing alias ( #105506 )
2026-07-12 18:04:09 +02:00
Peter Steinberger
1b313dc4d4
chore(tooling): enforce indexed access in core tests ( #105375 )
...
* test(tooling): enforce indexed access in core tests
* test(tui): constrain theme environment overrides
* test(doctor): enforce indexed access in migration fixtures
2026-07-12 14:29:52 +01:00
