* feat(android): add Wear proxy protocol
Introduce a bounded, versioned phone/watch RPC contract and wire its test, lint, and build gates before either runtime endpoint lands.
Co-authored-by: Sebastian Schubotz <git@sibbl.de>
* test(android): lock Wear wire names
Cover every supported RPC method and event discriminator so phone and watch cannot silently drift.
Co-authored-by: Sebastian Schubotz <git@sibbl.net>
* fix(android): bound Wear JSON depth
Reject excessively nested Data Layer envelopes before kotlinx.serialization can recurse through them.
* fix(android): enforce Wear depth on encode
Keep outbound messages inside the same JSON nesting contract enforced by the decoder.
* fix(android): preflight Wear payload depth
Traverse arbitrary JSON payloads iteratively before serialization so deeply nested local trees fail safely.
---------
Co-authored-by: Sebastian Schubotz <git@sibbl.de>
Co-authored-by: Sebastian Schubotz <git@sibbl.net>
* feat(migrate): add Hermes memory-only import and a shared memory-import core
* feat(onboarding): offer detected memory imports during CLI setup and guided onboarding
* feat(ui): show a first-run memory-import offer in Control UI onboarding mode
* feat(linux-app): open the first-run dashboard in onboarding mode
* feat(macos): add the onboarding memory-import page
* docs: document the onboarding memory-import page across surfaces
* chore(i18n): translate onboarding memory-import strings for control-ui and native locales
* refactor: keep memory-import internals unexported for deadcode gates
* fix(ci): resolve lint findings in onboarding memory import
* chore(i18n): refresh native inventory after lint refactor
* fix(ci): skip updater artifacts in the unsigned Linux companion PR lane
* chore(i18n): reconcile locale artifacts after rebase
* feat(ios): render plugin approvals as native Allow/Deny notifications
Extend the iOS approval handling from exec to plugin approvals so the native
push the gateway now sends (#108505) shows a phone notification with Allow/Deny.
Extract a shared ApprovalNotificationBridge with exec/plugin wrappers owning
their own kind constants and category; tag the parsed prompt with its kind;
register the plugin category and route plugin pushes in the app delegate; add a
.plugin case that maps the plugin presentation (title/description/pluginId/
severity) into the existing prompt and widens the exec-only validation, current,
cache-restore, and resolve guards to accept plugin; parameterize the dialog copy
by kind. Watch snapshot publication stays exec-only; the phone notification still
mirrors to the watch via WatchConnectivity. Reuses the unified approval.get/
approval.resolve RPCs (already kind-generic); no server or protocol changes.
* chore(i18n): sync native inventory after rebase
* chore(ios): drop accidentally committed local Version.xcconfig build override
* fix(ios): sync Apple i18n catalog and remove dead approval-bridge methods
Sync apps/ios/Resources/Localizable.xcstrings for the new plugin-approval
strings (native inventory sync alone did not cover the Apple catalog).
Remove the superseded per-bridge registerCategory variants and the redundant
exec parseResolvedPush wrapper flagged by the iOS Periphery dead-code scan;
registration uses ApprovalNotificationBridge.registerCategories and the shared
parse helpers.
* chore(ios): drop generated SwiftSources filelist; reconcile native i18n inventory
* chore(ios): drop generated Xcode project from tracking
Codex generated OpenClaw.xcodeproj for its simulator test run and the initial
apps/ios directory commit force-added it; xcodegen regenerates it in CI, so it
must not be tracked (matches main).
* chore(ios): reconcile native i18n inventory after rebase
The gateway already broadcasts stream:"plan" agent events with typed
{step, status} snapshots; all three clients dropped them. Control UI now
renders an expandable checklist bar above the composer (run-scoped,
cleared on run lifecycle); the shared iOS/macOS chat UI mounts a
Liquid Glass pill (iOS 26 glassEffect, material fallback) between the
message list and composer; Android adds an expandable pill above the
composer bridged through ChatController/NodeRuntime/MainViewModel.
All parsers accept typed and legacy string steps, enforce the
single-in_progress invariant, and scope snapshots and clears to the
owning run. Locale artifacts, Android resources, and the iOS string
catalog carry generated translations for the pill strings.
* feat(mac): mascot accessory pack — nightcap, grad cap, hat-tip exit
New accessory channel for the shared mascot: sleepy (and auto-dozing)
Clawd wears a floppy blue nightcap; the final onboarding page tops the
celebration with a graduation cap whose tassel swings with the body;
and leaving the working mood plays a hat-tip — claw to the brim, small
bow, hard hat lifts away. Headwear drawing moves to its own canvas
extension file.
* fix(mac): one hat at a time and no phantom hat tips
The working hard hat (including its hat-tip exit) suppresses any mood-
or consumer-requested accessory until it is fully gone, and the hat-tip
plays only when the hat actually seated — a working state cancelled
mid-don exits through the normal entrance instead of synthesizing a
full hat just to lift it.
* chore(i18n): refresh native inventory lines for mascot view
* feat(ios): mascot moods for onboarding and gateway quick setup
The activation glyph now takes a mood: the onboarding welcome step
shows the hard-hat working mascot while connecting, the success step
celebrates, and the gateway quick-setup header derives working/sad/
curious/idle from its connect state.
* fix(ios): quick-setup mood reflects app-level gateway problems too
The sheet renders two error surfaces — the local connect error and the
app-level gateway problem banner — and the mascot now goes sad for
either instead of only the sheet-local failure.
Two one-shot micro-beats for the 18pt menu-bar critter: a happy-eyes
ear-wiggle when the Gateway comes back from a failure (judged against
the last settled status, so failed -> starting -> running still reads
as a comeback while cold starts and deliberate stop/start cycles stay
quiet), and a brief celebration when sustained work (>= 10s) finishes.
Short blips stay silent so the menu bar never gets noisy.
* fix(gateway): allow clearing agent model overrides
* fix(protocol): preserve Swift agent model compatibility
* fix(protocol): preserve null when Swift decodes agent updates
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* feat(mac): playful hard-hat working mascot during setup and updates
The mascot gets a new .working mood: it dons a safety hard hat, hammers
away with impact sparks while setup work is in flight, and pauses every
few seconds to wipe its brow. Used on the onboarding "Getting things
ready" page and the post-update window instead of the generic thinking
mood. Lives in shared OpenClawKit so iOS can adopt it too.
* chore(i18n): refresh native inventory line for mascot view
* fix(android): stop killing long chat runs with hardcoded timeouts
Two independent timeouts made any agent turn longer than ~2 minutes fail
when started from the Android app, while the same turn worked over
Telegram (#106863):
- chat.send hardcoded timeoutMs=30000, which the gateway turns into the
server-side run expiry; the maintenance sweep then aborts longer runs
("CLI run aborted" / "Embedded agent failed before reply"). Omit the
override so app runs get the configured default like other channels.
- armPendingRunTimeout declared a timeout after 120s even when the
refreshed history snapshot confirmed the run was still in flight,
showing a spurious error and dropping the optimistic bubble mid-run.
Re-arm the timer in that case; terminal events and the server-side
expiry remain the liveness backstop.
Fixes#106863
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* chore(i18n): sync native inventory after ChatController line shifts
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test(android): run ChatController on backgroundScope in reconnect tests
The pending-run watchdog now re-arms while a run is confirmed in flight,
so reconnect scenarios that end with a restored in-flight run keep a
timer coroutine alive. Launch the controller on runTest's
backgroundScope so that timer is cancelled at test end instead of
failing the suite with UncompletedCoroutinesError.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(android): bound pending-run watchdog recovery
Distinguish applied, superseded, and failed history refreshes so recovered runs neither expire during a newer authoritative load nor rearm forever after refresh failure.
Co-authored-by: Léandre Chamberland-Dozois <lchamberland-dozois@hotmail.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
Sparkle-parity self-update for the apps/linux companion: tauri-plugin-updater +
process, checked silently on launch and from a "Check for Updates" tray item /
manual trigger. AppImage installs download, verify the signed update, and wait
for a user-confirmed restart; package-managed (deb) installs get a release-page
notice instead of replacing files the system package manager owns. The
linux-app release workflow signs the AppImage and publishes a signed latest.json
manifest that the app verifies with the committed minisign public key.
* fix(ios): attach EKAlarm to reminders.add so due-time notifications fire
EKReminder.dueDateComponents only sets the deadline; without an explicit
EKAlarm, iOS does not produce lock-screen or banner notifications.
Closes#105523
* fix(ios): configure reminder due alerts
Co-authored-by: xialonglee <li.xialong@xydigit.com>
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
The bundle/tray icon (icon.svg, icon-tile.svg and the generated
32/128/256/512 PNGs + icon.ico) still used the abstract two-pill
claw-mark. The product logo is the Clawd lobster mascot (already used in
the app header and ui/public/favicon.svg), so the app icon shown in the
Dock, taskbar, window, and tray now matches it: a static mascot on the
dark brand tile (transparent mascot for the tray). Regenerated from the
mascot SVG via rsvg-convert; build accepts the icon set.
Final review findings:
- Wrap the operator-approval copy/drop/rename in a single immediate
transaction so a crash mid-migration cannot strand or lose rows.
- The inference fallback marked a provider attempted before probing, so a
stale requester credential blocked another agent's valid same-provider
route. Dedup by credential owner and only retire a whole provider on
provider-wide failures (auth/billing may differ per credential owner).
Refs #107237
Phase 3 of #107237. Removes config.apply/config.patch/restart from the
regular-agent gateway tool (mirroring Phase 2's update.run removal); only
config.get and config.schema.lookup reads remain. Persistent config changes
and restarts now go exclusively through the human-approved openclaw
delegation path — closing the last unmediated agent config-write surface.
gateway stays owner-only/control-plane gated (config reads expose secrets and
host topology). Legacy setups can re-enable writes via the existing per-agent
tool allowlist; no new config key. Net -2271 LOC.
Refs #107237
New openclaw delegation tool relays to openclaw.chat in-process; persistent
writes surface through the existing durable operator-approval registry as a
third system-agent kind (no parallel store), armed only by a human operator
in the Control UI — a delegated agent can never self-approve. Setup wizards
(channel/model/open-setup/open-tui) are refused in delegated mode so a
machine agent cannot complete setup or persist credentials unattended.
Vendor-neutral inference fallback ladder (requester route first, then other
authed providers by provider id). update.run removed from the gateway tool.
Caveman system-prompt fragment steers config/channels/plugins/agents/updates
to the openclaw tool. Doctor-owned state migration widens the approval-kind
constraint; runtime stays canonical-only.
Refs #107237
New discovery.rs browses _openclaw-gw._tcp with a lifetime mdns-sd
browser, keeps a fullname-keyed snapshot (resolved updates replace,
goodbye/TTL removes), and mirrors the native clients' TXT contract and
direct-selection gate (resolved SRV endpoint routing; tailnetDns is a
hint only). The bootstrap page lists discovered gateways and connecting
navigates the dashboard WebView to the resolved endpoint, validated
against the live snapshot; remote selection cancels the local watchdog
so an in-flight local bootstrap cannot steal the WebView back.
The desktop companion crate was Linux-only. All platform-specific code
lives in canvas.rs (WebKitGTK, cairo, unix sockets, SO_PEERCRED), so:
move webkit2gtk/cairo-rs/libc under linux target dependencies, gate the
canvas module, its protocol registration, invoke handler, and exit
shutdown to Linux, add a USERPROFILE home fallback and an explicit
no-op installer error for Windows, and add the multi-size icon.ico
Windows resource. Linux behavior is unchanged; macOS/Windows builds are
for testing (macOS cargo build+test green locally; Windows aarch64-msvc
built and launched in a Windows 11 ARM VM).
* fix(macos): stabilize menu bar click routing
* chore(macos): refresh native i18n inventory
* test(macos): avoid global menu event dispatch
* fix(macos): initialize status mouse router
* test(macos): avoid bare status button fixture
* test(macos): isolate status click routing
