Peter Steinberger
733f7af92b
fix(heartbeat): keep requests-in-flight retries from drifting schedule ( #39182 , thanks @MumuTW)
...
Co-authored-by: MumuTW <clothl47364@gmail.com >
2026-03-07 22:10:51 +00:00
Peter Steinberger
cc7e61612a
fix(gateway): harden service-mode stale process cleanup ( #38463 , thanks @spirittechie)
...
Co-authored-by: Jesse Paul <drzin69@gmail.com >
2026-03-07 21:36:24 +00:00
Altay
97f9e25525
fix(ci): restore strip-ansi and typecheck fixtures ( #39146 )
...
* fix: restore strip-ansi and typecheck fixtures
* test: normalize windows install path assertions
2026-03-07 23:13:13 +03:00
Peter Steinberger
d72734946a
fix(security): harden install base drift cleanup
2026-03-07 19:23:01 +00:00
Peter Steinberger
e27bbe4982
fix(exec): block dangerous override-only env pivots
2026-03-07 19:18:05 +00:00
Peter Steinberger
6aa80844b8
fix(security): stage installs before publish
2026-03-07 19:11:07 +00:00
Peter Steinberger
74ecdec9ba
fix(security): harden fs-safe copy writes
2026-03-07 19:10:27 +00:00
Peter Steinberger
8928aba7ee
refactor: dedupe minimax provider auth test setup
2026-03-07 19:02:01 +00:00
Peter Steinberger
31acad4e8f
fix: harden zip extraction writes
2026-03-07 19:01:35 +00:00
Peter Steinberger
8bd0eb5424
fix(outbound): land #38944 from @Narcooo
...
Co-authored-by: Narcooo <Narcooo@users.noreply.github.com >
2026-03-07 18:46:48 +00:00
Vincent Koc
e4d80ed556
CI: restore main detect-secrets scan ( #38438 )
...
* Tests: stabilize detect-secrets fixtures
* Tests: fix rebased detect-secrets false positives
* Docs: keep snippets valid under detect-secrets
* Tests: finalize detect-secrets false-positive fixes
* Tests: reduce detect-secrets false positives
* Tests: keep detect-secrets pragmas inline
* Tests: remediate next detect-secrets batch
* Tests: tighten detect-secrets allowlists
* Tests: stabilize detect-secrets formatter drift
2026-03-07 10:06:35 -08:00
Peter Steinberger
a31d3cad96
refactor(fetch-guard): clarify cross-origin redirect header filtering
2026-03-07 17:58:05 +00:00
Peter Steinberger
46715371b0
fix(security): strip custom auth headers on cross-origin redirects
2026-03-07 17:34:42 +00:00
Josh Avant
8e20dd22d8
Secrets: harden SecretRef-safe models.json persistence ( #38955 )
2026-03-07 11:28:39 -06:00
Ayaan Zaidi
05c240fad6
fix: restart Windows gateway via Scheduled Task ( #38825 ) ( #38825 )
2026-03-07 18:00:38 +05:30
Peter Steinberger
3c71e2bd48
refactor(core): extract shared dedup helpers
2026-03-07 10:41:05 +00:00
Xinhua Gu
1a022a31de
fix(gateway): classify wrapped "fetch failed" messages as transient network errors (openclaw#38530)
...
Verified:
- pnpm build
- pnpm check
- pnpm test:macmini
Co-authored-by: xinhuagu <562450+xinhuagu@users.noreply.github.com >
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com >
2026-03-06 21:47:32 -06:00
Vincent Koc
42e3d8d693
Secrets: add inline allowlist review set ( #38314 )
...
* Secrets: add inline allowlist review set
* Secrets: narrow detect-secrets file exclusions
* Secrets: exclude Docker fingerprint false positive
* Secrets: allowlist test and docs false positives
* Secrets: refresh baseline after allowlist updates
* Secrets: fix gateway chat fixture pragma
* Secrets: format pre-commit config
* Android: keep talk mode fixture JSON valid
* Feishu: rely on client timeout injection
* Secrets: allowlist provider auth test fixtures
* Secrets: allowlist onboard search fixtures
* Secrets: allowlist onboard mode fixture
* Secrets: allowlist gateway auth mode fixture
* Secrets: allowlist APNS wake test key
* Secrets: allowlist gateway reload fixtures
* Secrets: allowlist moonshot video fixture
* Secrets: allowlist auto audio fixture
* Secrets: allowlist tiny audio fixture
* Secrets: allowlist embeddings fixtures
* Secrets: allowlist resolve fixtures
* Secrets: allowlist target registry pattern fixtures
* Secrets: allowlist gateway chat env fixture
* Secrets: refresh baseline after fixture allowlists
* Secrets: reapply gateway chat env allowlist
* Secrets: reapply gateway chat env allowlist
* Secrets: stabilize gateway chat env allowlist
* Secrets: allowlist runtime snapshot save fixture
* Secrets: allowlist oauth profile fixtures
* Secrets: allowlist compaction identifier fixture
* Secrets: allowlist model auth fixture
* Secrets: allowlist model status fixtures
* Secrets: allowlist custom onboarding fixture
* Secrets: allowlist mattermost token summary fixtures
* Secrets: allowlist gateway auth suite fixtures
* Secrets: allowlist channel summary fixture
* Secrets: allowlist provider usage auth fixtures
* Secrets: allowlist media proxy fixture
* Secrets: allowlist secrets audit fixtures
* Secrets: refresh baseline after final fixture allowlists
* Feishu: prefer explicit client timeout
* Feishu: test direct timeout precedence
2026-03-06 19:35:26 -05:00
Vincent Koc
455430a6f8
Dead code: remove unused helper modules ( #38318 )
...
* Dead code: remove unused provider runtime policy helper
* Dead code: remove unused shared env writer
* Dead code: remove unused auth store path collector
2026-03-06 17:53:02 -05:00
Vincent Koc
f392b81e95
Infra: require explicit opt-in for prerelease npm installs ( #38117 )
...
* Infra: tighten npm registry spec parsing
* Infra: block implicit prerelease npm installs
* Plugins: cover prerelease install policy
* Infra: add npm registry spec tests
* Hooks: cover prerelease install policy
* Docs: clarify plugin guide version policy
* Docs: clarify plugin install version policy
* Docs: clarify hooks install version policy
* Docs: clarify hook pack version policy
2026-03-06 11:13:30 -05:00
Octane
777af476cb
Respect source channel for agent event surfacing ( #36030 )
2026-03-06 01:14:00 -05:00
Josh Avant
0e4245063f
CLI: make read-only SecretRef status flows degrade safely ( #37023 )
...
* CLI: add read-only SecretRef inspection
* CLI: fix read-only SecretRef status regressions
* CLI: preserve read-only SecretRef status fallbacks
* Docs: document read-only channel inspection hook
* CLI: preserve audit coverage for read-only SecretRefs
* CLI: fix read-only status account selection
* CLI: fix targeted gateway fallback analysis
* CLI: fix Slack HTTP read-only inspection
* CLI: align audit credential status checks
* CLI: restore Telegram read-only fallback semantics
2026-03-05 23:07:13 -06:00
Vignesh Natarajan
05fb16d151
fix(agent): harden undici stream timeouts for long openai-completions runs
2026-03-05 19:44:11 -08:00
Vignesh Natarajan
604f22c42a
fix(heartbeat): pin HEARTBEAT.md reads to workspace path
2026-03-05 18:52:39 -08:00
zerone0x
94fdee2eac
fix(memory-flush): ban timestamped variant files in default flush prompt ( #34951 )
...
Merged via squash.
Prepared head SHA: efadda498839543393+zerone0x@users.noreply.github.com >
Co-authored-by: jalehman <550978+jalehman@users.noreply.github.com >
Reviewed-by: @jalehman
2026-03-05 18:15:13 -08:00
Gustavo Madeira Santana
6dfd39c32f
Harden Telegram poll gating and schema consistency ( #36547 )
...
Merged via squash.
Prepared head SHA: f77824419e5599352+gumadeiras@users.noreply.github.com >
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com >
Reviewed-by: @gumadeiras
2026-03-05 19:24:43 -05:00
Isis Anisoptera
432e0222dd
fix: restore auto-reply system events timeline ( #34794 ) (thanks @anisoptera) ( #34794 )
...
Co-authored-by: Ayaan Zaidi <zaidi@uplause.io >
2026-03-05 07:56:14 +05:30
Vincent Koc
2b98cb6d8b
Fix gateway restart false timeouts on Debian/systemd ( #34874 )
...
* daemon(systemd): target sudo caller user scope
* test(systemd): cover sudo user scope commands
* infra(ports): fall back to ss when lsof missing
* test(ports): verify ss fallback listener detection
* cli(gateway): use probe fallback for restart health
* test(gateway): cover restart-health probe fallback
2026-03-04 10:52:33 -08:00
Shakker
698c200eba
fix(outbound): fail media-only text-only adapter fallback
2026-03-04 18:42:21 +00:00
liuxiaopai-ai
bb07b2b93a
Outbound: avoid empty multi-media fallback sends
2026-03-04 18:42:21 +00:00
liuxiaopai-ai
efdf2ca0d7
Outbound: allow text-only plugin adapters
2026-03-04 18:42:21 +00:00
Gustavo Madeira Santana
76bfd9b5e6
Agents: add generic poll-vote action support
2026-03-04 11:36:14 -05:00
Josh Avant
646817dd80
fix(outbound): unify resolved cfg threading across send paths ( #33987 )
2026-03-04 00:20:44 -06:00
Vincent Koc
dfb4cb87f9
plugins: avoid peer auto-install dependency bloat ( #34017 )
...
* plugins/install: omit peer deps during plugin npm install
* tests: assert plugin install omits peer deps
* extensions/googlechat: mark openclaw peer optional
* extensions/memory-core: mark openclaw peer optional
2026-03-03 22:00:15 -08:00
Tak Hoffman
1be39d4250
fix(gateway): synthesize lifecycle robustness for restart and startup probes ( #33831 )
...
* fix(gateway): correct launchctl command sequence for gateway restart (closes #20030 )
* fix(restart): expand HOME and escape label in launchctl plist path
* fix(restart): poll port free after SIGKILL to prevent EADDRINUSE restart loop
When cleanStaleGatewayProcessesSync() kills a stale gateway process,
the kernel may not immediately release the TCP port. Previously the
function returned after a fixed 500ms sleep (300ms SIGTERM + 200ms
SIGKILL), allowing triggerOpenClawRestart() to hand off to systemd
before the port was actually free. The new systemd process then raced
the dying socket for port 18789, hit EADDRINUSE, and exited with
status 1, causing systemd to retry indefinitely — the zombie restart
loop reported in #33103 .
Fix: add waitForPortFreeSync() that polls lsof at 50ms intervals for
up to 2 seconds after SIGKILL. cleanStaleGatewayProcessesSync() now
blocks until the port is confirmed free (or the budget expires with a
warning) before returning. The increased SIGTERM/SIGKILL wait budgets
(600ms / 400ms) also give slow processes more time to exit cleanly.
Fixes #33103
Related: #28134
* fix: add EADDRINUSE retry and TIME_WAIT port-bind checks for gateway startup
* fix(ports): treat EADDRNOTAVAIL as non-retryable and fix flaky test
* fix(gateway): hot-reload agents.defaults.models allowlist changes
The reload plan had a rule for `agents.defaults.model` (singular) but
not `agents.defaults.models` (plural — the allowlist array). Because
`agents.defaults.models` does not prefix-match `agents.defaults.model.`,
it fell through to the catch-all `agents` tail rule (kind=none), so
allowlist edits in openclaw.json were silently ignored at runtime.
Add a dedicated reload rule so changes to the models allowlist trigger
a heartbeat restart, which re-reads the config and serves the updated
list to clients.
Fixes #33600
Co-authored-by: HCL <chenglunhu@gmail.com >
Signed-off-by: HCL <chenglunhu@gmail.com >
* test(restart): 100% branch coverage — audit round 2
Audit findings fixed:
- remove dead guard: terminateStaleProcessesSync pids.length===0 check was
unreachable (only caller cleanStaleGatewayProcessesSync already guards)
- expose __testing.callSleepSyncRaw so sleepSync's real Atomics.wait path
can be unit-tested directly without going through the override
- fix broken sleepSync Atomics.wait test: previous test set override=null
but cleanStaleGatewayProcessesSync returned before calling sleepSync —
replaced with direct callSleepSyncRaw calls that actually exercise L36/L42-47
- fix pid collision: two tests used process.pid+304 (EPERM + dead-at-SIGTERM);
EPERM test changed to process.pid+305
- fix misindented tests: 'deduplicates pids' and 'lsof status 1 container
edge case' were outside their intended describe blocks; moved to correct
scopes (findGatewayPidsOnPortSync and pollPortOnce respectively)
- add missing branch tests:
- status 1 + non-empty stdout with zero openclaw pids → free:true (L145)
- mid-loop non-openclaw cmd in &&-chain (L67)
- consecutive p-lines without c-line between them (L67)
- invalid PID in p-line (p0 / pNaN) — ternary false branch (L67)
- unknown lsof output line (else-if false branch L69)
Coverage: 100% stmts / 100% branch / 100% funcs / 100% lines (36 tests)
* test(restart): fix stale-pid test typing for tsgo
* fix(gateway): address lifecycle review findings
* test(update): make restart-helper path assertions windows-safe
---------
Signed-off-by: HCL <chenglunhu@gmail.com >
Co-authored-by: Glucksberg <markuscontasul@gmail.com >
Co-authored-by: Efe Büken <efe@arven.digital >
Co-authored-by: Riccardo Marino <rmarino@apple.com >
Co-authored-by: HCL <chenglunhu@gmail.com >
2026-03-03 21:31:12 -06:00
Gustavo Madeira Santana
21e8d88c1d
build: fix ineffective dynamic imports with lazy boundaries ( #33690 )
...
Merged via squash.
Prepared head SHA: 38b3c23d6f5599352+gumadeiras@users.noreply.github.com >
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com >
Reviewed-by: @gumadeiras
2026-03-03 20:14:41 -05:00
Shadow
ca307c3fdf
fix: harden Discord channel resolution ( #33142 ) (thanks @thewilloftheshadow) ( #33142 )
2026-03-03 09:31:26 -06:00
Altay
627813aba4
fix(heartbeat): scope exec wake dispatch to session key ( #32724 )
...
Merged via squash.
Prepared head SHA: 563fee0e659790196+altaywtf@users.noreply.github.com >
Co-authored-by: altaywtf <9790196+altaywtf@users.noreply.github.com >
Reviewed-by: @altaywtf
2026-03-03 14:47:40 +03:00
Liu Xiaopai
ae29842158
Gateway: fix stale self version in status output ( #32655 )
...
Merged via squash.
Prepared head SHA: b9675d1f9073659136+liuxiaopai-ai@users.noreply.github.com >
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com >
Reviewed-by: @gumadeiras
2026-03-03 02:41:52 -05:00
Peter Steinberger
f7f0caa5c7
fix(ci): tighten type signatures in gateway params validation
2026-03-03 03:04:13 +00:00
Josh Avant
806803b7ef
feat(secrets): expand SecretRef coverage across user-supplied credentials ( #29580 )
...
* feat(secrets): expand secret target coverage and gateway tooling
* docs(secrets): align gateway and CLI secret docs
* chore(protocol): regenerate swift gateway models for secrets methods
* fix(config): restore talk apiKey fallback and stabilize runner test
* ci(windows): reduce test worker count for shard stability
* ci(windows): raise node heap for test shard stability
* test(feishu): make proxy env precedence assertion windows-safe
* fix(gateway): resolve auth password SecretInput refs for clients
* fix(gateway): resolve remote SecretInput credentials for clients
* fix(secrets): skip inactive refs in command snapshot assignments
* fix(secrets): scope gateway.remote refs to effective auth surfaces
* fix(secrets): ignore memory defaults when enabled agents disable search
* fix(secrets): honor Google Chat serviceAccountRef inheritance
* fix(secrets): address tsgo errors in command and gateway collectors
* fix(secrets): avoid auth-store load in providers-only configure
* fix(gateway): defer local password ref resolution by precedence
* fix(secrets): gate telegram webhook secret refs by webhook mode
* fix(secrets): gate slack signing secret refs to http mode
* fix(secrets): skip telegram botToken refs when tokenFile is set
* fix(secrets): gate discord pluralkit refs by enabled flag
* fix(secrets): gate discord voice tts refs by voice enabled
* test(secrets): make runtime fixture modes explicit
* fix(cli): resolve local qr password secret refs
* fix(cli): fail when gateway leaves command refs unresolved
* fix(gateway): fail when local password SecretRef is unresolved
* fix(gateway): fail when required remote SecretRefs are unresolved
* fix(gateway): resolve local password refs only when password can win
* fix(cli): skip local password SecretRef resolution on qr token override
* test(gateway): cast SecretRef fixtures to OpenClawConfig
* test(secrets): activate mode-gated targets in runtime coverage fixture
* fix(cron): support SecretInput webhook tokens safely
* fix(bluebubbles): support SecretInput passwords across config paths
* fix(msteams): make appPassword SecretInput-safe in onboarding/token paths
* fix(bluebubbles): align SecretInput schema helper typing
* fix(cli): clarify secrets.resolve version-skew errors
* refactor(secrets): return structured inactive paths from secrets.resolve
* refactor(gateway): type onboarding secret writes as SecretInput
* chore(protocol): regenerate swift models for secrets.resolve
* feat(secrets): expand extension credential secretref support
* fix(secrets): gate web-search refs by active provider
* fix(onboarding): detect SecretRef credentials in extension status
* fix(onboarding): allow keeping existing ref in secret prompt
* fix(onboarding): resolve gateway password SecretRefs for probe and tui
* fix(onboarding): honor secret-input-mode for local gateway auth
* fix(acp): resolve gateway SecretInput credentials
* fix(secrets): gate gateway.remote refs to remote surfaces
* test(secrets): cover pattern matching and inactive array refs
* docs(secrets): clarify secrets.resolve and remote active surfaces
* fix(bluebubbles): keep existing SecretRef during onboarding
* fix(tests): resolve CI type errors in new SecretRef coverage
* fix(extensions): replace raw fetch with SSRF-guarded fetch
* test(secrets): mark gateway remote targets active in runtime coverage
* test(infra): normalize home-prefix expectation across platforms
* fix(cli): only resolve local qr password refs in password mode
* test(cli): cover local qr token mode with unresolved password ref
* docs(cli): clarify local qr password ref resolution behavior
* refactor(extensions): reuse sdk SecretInput helpers
* fix(wizard): resolve onboarding env-template secrets before plaintext
* fix(cli): surface secrets.resolve diagnostics in memory and qr
* test(secrets): repair post-rebase runtime and fixtures
* fix(gateway): skip remote password ref resolution when token wins
* fix(secrets): treat tailscale remote gateway refs as active
* fix(gateway): allow remote password fallback when token ref is unresolved
* fix(gateway): ignore stale local password refs for none and trusted-proxy
* fix(gateway): skip remote secret ref resolution on local call paths
* test(cli): cover qr remote tailscale secret ref resolution
* fix(secrets): align gateway password active-surface with auth inference
* fix(cli): resolve inferred local gateway password refs in qr
* fix(gateway): prefer resolvable remote password over token ref pre-resolution
* test(gateway): cover none and trusted-proxy stale password refs
* docs(secrets): sync qr and gateway active-surface behavior
* fix: restore stability blockers from pre-release audit
* Secrets: fix collector/runtime precedence contradictions
* docs: align secrets and web credential docs
* fix(rebase): resolve integration regressions after main rebase
* fix(node-host): resolve gateway secret refs for auth
* fix(secrets): harden secretinput runtime readers
* gateway: skip inactive auth secretref resolution
* cli: avoid gateway preflight for inactive secret refs
* extensions: allow unresolved refs in onboarding status
* tests: fix qr-cli module mock hoist ordering
* Security: align audit checks with SecretInput resolution
* Gateway: resolve local-mode remote fallback secret refs
* Node host: avoid resolving inactive password secret refs
* Secrets runtime: mark Slack appToken inactive for HTTP mode
* secrets: keep inactive gateway remote refs non-blocking
* cli: include agent memory secret targets in runtime resolution
* docs(secrets): sync docs with active-surface and web search behavior
* fix(secrets): keep telegram top-level token refs active for blank account tokens
* fix(daemon): resolve gateway password secret refs for probe auth
* fix(secrets): skip IRC NickServ ref resolution when NickServ is disabled
* fix(secrets): align token inheritance and exec timeout defaults
* docs(secrets): clarify active-surface notes in cli docs
* cli: require secrets.resolve gateway capability
* gateway: log auth secret surface diagnostics
* secrets: remove dead provider resolver module
* fix(secrets): restore gateway auth precedence and fallback resolution
* fix(tests): align plugin runtime mock typings
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-03-03 02:58:20 +00:00
Peter Steinberger
3ff0cf262d
refactor(infra): dedupe update startup test setup
2026-03-03 02:53:14 +00:00
Peter Steinberger
a50dd0bb06
refactor(infra): dedupe ssrf fetch guard test fixtures
2026-03-03 02:53:13 +00:00
Peter Steinberger
8b4cdbb21d
refactor(infra): dedupe exec approval allowlist evaluation flow
2026-03-03 02:53:13 +00:00
Peter Steinberger
b5350bf46f
refactor(outbound): unify channel selection and action input normalization
2026-03-03 01:37:39 +00:00
Peter Steinberger
71cd337137
fix(gateway): harden message action channel fallback and startup grace
...
Take the safe, tested subset from #32367:\n- per-channel startup connect grace in health monitor\n- tool-context channel-provider fallback for message actions\n\nCo-authored-by: Munem Hashmi <munem.hashmi@gmail.com >
2026-03-03 01:17:27 +00:00
Peter Steinberger
a48a3dbdda
refactor(tests): dedupe tool, projector, and delivery fixtures
2026-03-03 01:06:00 +00:00
Gustavo Madeira Santana
f26853f14c
CLI: dedupe config validate errors and expose allowed values
2026-03-02 20:05:12 -05:00
velamints2
61be533ad4
fix(restart): deduplicate reason line in restart sentinel message
...
When gateway.restart is triggered with a reason but no separate note,
the payload sets both message and stats.reason to the same text.
formatRestartSentinelMessage() then emits both the message line and a
redundant 'Reason: <same text>' line, doubling the restart reason in
the notification delivered to the agent session.
Skip the 'Reason:' line when stats.reason matches the already-emitted
message text. Add regression tests for both duplicate and distinct
reason scenarios.
2026-03-03 00:30:34 +00:00
Peter Steinberger
6bf84ac28c
perf(runtime): reduce hot-path config and routing overhead
2026-03-03 00:20:46 +00:00
