Commit Graph

13906 Commits

Author SHA1 Message Date
Peter Steinberger
2833b27f52 test: continue vitest threads migration 2026-03-24 08:37:00 +00:00
Val Alexander
b61a875d56 fix: widen installer regex allowlists and deduplicate safeExternalHref calls
- SAFE_GO_MODULE: allow uppercase in module paths (A-Z)
- SAFE_BREW_FORMULA: allow @ for versioned formulas (python@3.12)
- SAFE_UV_PACKAGE: allow extras [standard] and equality pins ==
- Cache safeExternalHref result in skills detail API key section
2026-03-24 01:46:33 -05:00
Val Alexander
cb58e45130 fix(security): resolve Aisle findings — skill installer validation, terminal sanitization, URL scheme allowlisting (#53471) thanks @BunsDev
Co-authored-by: BunsDev <68980965+BunsDev@users.noreply.github.com>
Co-authored-by: Nova <nova@openknot.ai>
2026-03-24 01:43:48 -05:00
Val Alexander
a710366e9e feat(ui): Control UI polish — skills revamp, markdown preview, agent workspace, macOS config tree (#53411) thanks @BunsDev
Co-authored-by: BunsDev <68980965+BunsDev@users.noreply.github.com>
Co-authored-by: Nova <nova@openknot.ai>
2026-03-24 01:21:13 -05:00
Peter Steinberger
ff2e9a52ff fix: preserve deferred TUI history sync (#53130) (thanks @joelnishanth) 2026-03-23 23:18:59 -07:00
joelnishanth
cc8ed8d25b fix(tui): preserve user message during slow model responses (#53115)
When a local run ends with an empty final event while another run is active,
skip history reload to prevent clearing the user's pending message from the
chat log. This fixes the 'message disappears' issue with slow models like Ollama.
2026-03-23 23:18:59 -07:00
Tak Hoffman
5e9ea804d4 fix: finalize deferred subagent expiry cleanup 2026-03-24 01:12:54 -05:00
Peter Steinberger
5dc42dfb17 fix: format subagent registry test 2026-03-24 06:10:55 +00:00
Peter Steinberger
fd0fa97952 refactor: centralize plugin install config policy 2026-03-23 23:07:40 -07:00
Tak Hoffman
c3744fbfc4 fix: finalize resumed subagent cleanup give-ups 2026-03-24 01:06:39 -05:00
Peter Steinberger
a2d3b9f317 fix: unblock live harness provider discovery 2026-03-23 23:02:44 -07:00
Tak Hoffman
ab8c834aab fix: report dropped subagent announce queue deliveries 2026-03-24 00:54:46 -05:00
Tak Hoffman
0fc27409c0 fix: preserve direct subagent dispatch failures on abort 2026-03-24 00:47:01 -05:00
Peter Steinberger
da10b6026a test: prune low-signal live model sweeps 2026-03-24 05:43:07 +00:00
Tak Hoffman
3689a82494 fix: preserve subagent ended hooks until runtime init 2026-03-24 00:31:48 -05:00
Peter Steinberger
0f84aac487 fix: stabilize matrix and teams ci assertions 2026-03-24 05:29:05 +00:00
Peter Steinberger
013385e5c2 refactor: polish trigger and manifest seams 2026-03-23 22:22:48 -07:00
Tak Hoffman
535b792808 fix: delete subagent runs after announce give-up 2026-03-24 00:20:22 -05:00
Catalin Lupuleti
cbb11b3662 fix(plugins): address review feedback for Matrix recovery paths (#52899) 2026-03-23 22:16:10 -07:00
Catalin Lupuleti
489797ceaf fix(plugins): address review feedback for Matrix recovery paths (#52899)
1. Narrow loadConfigForInstall() to catch only INVALID_CONFIG errors,
   letting real failures (fs permission, OOM) propagate.
2. Assert allow array is properly cleaned in stale-cleanup test.
3. Add comment clarifying version-resolution is already addressed via
   the shared VERSION constant.
4. Run cleanStaleMatrixPluginConfig() during install so
   persistPluginInstall() → writeConfigFile() does not fail validation
   on stale Matrix load paths.
2026-03-23 22:16:10 -07:00
Catalin Lupuleti
3ae100a8d7 fix(plugins): make Matrix recovery paths tolerate stale plugin config (#52899) 2026-03-23 22:16:10 -07:00
Peter Steinberger
5c9e4cd30a refactor: clarify doctor repair flow 2026-03-23 22:12:56 -07:00
Tak Hoffman
e8ba55adbb test: add exact-stem subagent seam tests 2026-03-24 00:09:36 -05:00
Peter Steinberger
2e1c88b728 refactor: tighten embedded prompt and sidecar guards 2026-03-23 22:09:22 -07:00
Sid Uppal
cd90130877 msteams: implement Teams AI agent UX best practices (#51808)
Migrates the Teams extension from @microsoft/agents-hosting to the official Teams SDK (@microsoft/teams.apps + @microsoft/teams.api) and implements Microsoft's AI UX best practices for Teams agents.

- AI-generated label on all bot messages (Teams native badge + thumbs up/down)
- Streaming responses in 1:1 chats via Teams streaminfo protocol
- Welcome card with configurable prompt starters on bot install
- Feedback with reflective learning (negative feedback triggers background reflection)
- Typing indicators for personal + group chats (disabled for channels)
- Informative status updates (progress bar while LLM processes)
- JWT validation via Teams SDK createServiceTokenValidator
- User-Agent: teams.ts[apps]/<sdk-version> OpenClaw/<version> on outbound requests
- Fix copy-pasted image downloads (smba.trafficmanager.net auth allowlist)
- Pre-parse auth gate (reject unauthenticated requests before body parsing)
- Reflection dispatcher lifecycle fix (prevent leaked dispatchers)
- Colon-safe session filenames (Windows compatibility)
- Cooldown cache eviction (prevent unbounded memory growth)

Closes #51806
2026-03-23 22:03:39 -07:00
Peter Steinberger
ea62655e19 fix: land cron heartbeat prompt suppression (#53152) (thanks @Protocol-zero-0) 2026-03-23 21:55:34 -07:00
Protocol-zero-0
9f863140d5 test(agents): cover additional heartbeat prompt triggers
Document that default-agent heartbeat prompt injection still applies to memory-triggered and triggerless runs while cron remains excluded.

Made-with: Cursor
2026-03-23 21:55:34 -07:00
Protocol-zero-0
9d21be4193 fix(agents): suppress heartbeat prompt for cron-triggered embedded runs
Prevent cron-triggered embedded runs from inheriting the default heartbeat prompt so non-cron session targets stop reading HEARTBEAT.md and polluting scheduled turns.

Made-with: Cursor
2026-03-23 21:55:34 -07:00
Peter Steinberger
5ab3782215 fix: add config clobber forensics 2026-03-24 04:50:30 +00:00
giulio-leone
67c7f98c32 fix(doctor): skip service config repairs during updates
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-03-23 21:48:18 -07:00
giulio-leone
d8aada9d45 Preserve no-restart during update doctor fixes
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-03-23 21:48:18 -07:00
giulio-leone
3359dcfdcf fix(doctor): honor --fix in non-interactive mode
Ensure repair-mode doctor prompts auto-accept recommended fixes even when running non-interactively, while still requiring --force for aggressive rewrites.

This restores the expected behavior for upgrade/doctor flows that rely on 'openclaw doctor --fix --non-interactive' to repair stale gateway service configuration such as entrypoint drift after global updates.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-03-23 21:48:18 -07:00
Tak Hoffman
8c89d0e7cd tests: add boundary coverage for media delivery (#53361)
* tests: add boundary coverage for media delivery

* tests: isolate telegram outbound adapter transport

* tests: harden telegram webhook certificate assertion

* tests: fix guardrail false positives on rebased branch
2026-03-23 23:37:34 -05:00
Peter Steinberger
e864421d83 fix: unify live model auth gating 2026-03-24 04:28:53 +00:00
Peter Steinberger
e28e520379 refactor: simplify provider inference and zoned parsing helpers 2026-03-23 21:22:30 -07:00
Peter Steinberger
26365f7daf fix: hash inline scripts with data-src attributes 2026-03-23 21:14:55 -07:00
Peter Steinberger
0857447a5d fix: reject nonexistent zoned cron at-times 2026-03-23 21:14:55 -07:00
Peter Steinberger
69a317995d fix: fail closed when provider inference drops errored allowlists 2026-03-23 21:14:55 -07:00
Peter Steinberger
dc4d2ca263 build: prepare 2026.3.24 2026-03-23 21:05:59 -07:00
Peter Steinberger
ce49d8bca9 fix: verify global npm correction installs 2026-03-23 21:04:08 -07:00
Tak Hoffman
50d996a6ec tests: cron coverage and NO_REPLY delivery fixes (#53366)
* tools: extend seam audit inventory

* tools: audit cron seam coverage gaps

* test: add cron seam coverage tests

* fix: avoid marking NO_REPLY cron deliveries as delivered

* fix: clean up delete-after-run NO_REPLY cron sessions
2026-03-23 22:52:13 -05:00
Peter Steinberger
483dc90f05 test: harden linux runtime smoke guards 2026-03-24 03:23:52 +00:00
Ayaan Zaidi
17c1ee7716 fix: preserve command auth resolution errors on empty inferred allowlists 2026-03-24 08:38:27 +05:30
Peter Steinberger
38137b0cf8 refactor: split tracked ClawHub update flows 2026-03-23 20:01:51 -07:00
Taras Lukavyi
7ffe7e4822 fix: populate currentThreadTs in threading tool context fallback for Telegram DM topics (#52217)
When a channel plugin lacks a custom buildToolContext (e.g. Telegram),
the fallback path in buildThreadingToolContext did not set currentThreadTs
from the inbound MessageThreadId. This caused resolveTelegramAutoThreadId
to return undefined, so message tool sends without explicit threadId
would route to the main chat instead of the originating DM topic.

Fixes #52217
2026-03-24 08:27:03 +05:30
Peter Steinberger
3ae5d33799 refactor: extract cron schedule and test runner helpers 2026-03-23 19:53:43 -07:00
Taras Lukavyi
d4e3babdcc fix: command auth SecretRef resolution (#52791) (thanks @Lukavyi)
* fix(command-auth): handle unresolved SecretRef in resolveAllowFrom

* fix(command-auth): fall back to config allowlists

* fix(command-auth): avoid duplicate resolution fallback

* fix(command-auth): fail closed on invalid allowlists

* fix(command-auth): isolate fallback resolution errors

* fix: record command auth SecretRef landing notes (#52791) (thanks @Lukavyi)

---------

Co-authored-by: Ayaan Zaidi <hi@obviy.us>
2026-03-24 08:21:30 +05:30
Peter Steinberger
0cbf6d5fed fix: land cron tz one-shot handling and prerelease config warnings (#53224) (thanks @RolfHegr) 2026-03-23 19:38:04 -07:00
Rolfy
9aac5582d6 fix(cron): make --tz work with --at for one-shot jobs
Previously, `--at` with an offset-less ISO datetime (e.g. `2026-03-23T23:00:00`)
was always interpreted as UTC, even when `--tz` was provided. This caused one-shot
jobs to fire at the wrong time.

Changes:
- `parseAt()` now accepts an optional `tz` parameter
- When `--tz` is provided with `--at`, offset-less datetimes are interpreted in
  that IANA timezone using Intl.DateTimeFormat
- Datetimes with explicit offsets (e.g. `+01:00`, `Z`) are unaffected
- Removed the guard in cron-edit that blocked `--tz` with `--at`
- Updated `--at` help text to mention `--tz` support
- Added 2 tests verifying timezone resolution and offset preservation
2026-03-23 19:38:04 -07:00
Peter Steinberger
7f373823b0 refactor: separate exec policy and execution targets 2026-03-23 19:36:44 -07:00