Commit Graph

41143 Commits

Author SHA1 Message Date
Peter Steinberger
2e399e6f1a test(release): recover known Windows packaged upgrade timeout
(cherry picked from commit 8f7399e9e9)
2026-05-04 20:45:37 +01:00
Peter Steinberger
3921e1b0b7 fix(process): kill Windows command trees on timeout
(cherry picked from commit 9cc3ae100b)
2026-05-04 20:44:27 +01:00
Vincent Koc
a3f6f24b79 ci: gate slack live qa credentials 2026-05-04 12:13:43 -07:00
Peter Steinberger
2d849bbafa docs(changelog): credit group config migration fix
Credit @scoootscooob for #77465.
2026-05-04 20:02:13 +01:00
scoootscooob
ee314e4236 fix(doctor): restore group config drift migrations (#77465) 2026-05-04 12:00:05 -07:00
Vincent Koc
de4903ec7a fix(agents): refresh deferred subagent delivery text 2026-05-04 11:54:36 -07:00
Devin Robison
9aad2b82c3 Use trusted Windows browser helper root (#77469) 2026-05-04 12:51:26 -06:00
Vincent Koc
8c7ec5d1f9 docs(changelog): credit @NikolaFC and @MertBasar0 for gateway and main-session fixes
#76923 (Satoshi F. / @NikolaFC) added user-facing `gateway.restart.safe`
preflight alignment and #75280 (Mert Başar / @MertBasar0) added
user-facing main-session pending-delivery marker preservation, but both
entries landed without contributor attribution. Add the merging PR refs
and credit the human contributors per CLAUDE.md changelog-attribution
rules.
2026-05-04 11:49:02 -07:00
Devin Robison
edddb07f20 fix(qqbot): preserve framework command authorization (#77453)
* fix(qqbot): preserve framework command authorization

* Add changelog entry for PR #77453
2026-05-04 12:38:51 -06:00
hcl
dff437a1cb fix(active-memory): skip colon-containing session-store channels to prevent crash with QQ c2c agent IDs (#77402)
Summary:
- The PR filters colon-containing store-derived Active Memory channel values before embedded recall resolution, adds a QQ c2c regression test, and records the user-facing changelog entry.
- Reproducibility: yes. Source inspection on current main shows a stored colon-containing `lastChannel` or `ch ... come the strong embedded recall channel, and the downstream bundled-plugin directory validator rejects `:`.

Automerge notes:
- PR branch already contained follow-up commit before automerge: fixup! fix(active-memory): add changelog contributor credit (clawswee…
- PR branch already contained follow-up commit before automerge: fix(active-memory): skip colon-containing session-store channels

Validation:
- ClawSweeper review passed for head 4bf00dd6ac.
- Required merge gates passed before the squash merge.

Prepared head SHA: 4bf00dd6ac
Review: https://github.com/openclaw/openclaw/pull/77402#issuecomment-4372618783

Co-authored-by: HCL <chenglunhu@gmail.com>
Co-authored-by: clawsweeper <274271284+clawsweeper[bot]@users.noreply.github.com>
2026-05-04 18:37:05 +00:00
Vincent Koc
417660b662 docs(plugins): explain catalog install trust 2026-05-04 11:31:29 -07:00
Vincent Koc
daefb5e341 fix(plugins): trust catalog package installs 2026-05-04 11:30:36 -07:00
Vincent Koc
9dc38f37ea chore: ignore crabbox artifacts 2026-05-04 11:30:36 -07:00
Vincent Koc
841eb81baf chore: better explicit message on whatsapp 2026-05-04 11:30:36 -07:00
Vincent Koc
fc7e2a10c8 fix(plugins): reserve pending delivery session slots 2026-05-04 11:21:59 -07:00
Vincent Koc
2511be5244 test(release): skip restart in package upgrade lane 2026-05-04 11:21:59 -07:00
stain lu
74ab62c6a2 fix: pass claude cli thinking effort (#77410)
Summary:
- Adds a plugin-owned CLI backend argument rewrite hook and wires Anthropic `claude-cli` to translate non-off `/think` levels into Claude Code `--effort`, with docs, changelog, API baseline, and tests.
- Reproducibility: yes. Current main has a high-confidence source reproduction: choose `claude-cli`, set a non ... builds argv from backend args that contain no `--effort` even though `thinkLevel` exists on the run params.

Automerge notes:
- No ClawSweeper repair was needed after automerge opt-in.

Validation:
- ClawSweeper review passed for head be17754009.
- Required merge gates passed before the squash merge.

Prepared head SHA: be17754009
Review: https://github.com/openclaw/openclaw/pull/77410#issuecomment-4372812685

Co-authored-by: stainlu <stainlu@newtype-ai.org>
2026-05-04 18:13:53 +00:00
Satoshi F.
103cdd9d96 fix(gateway): add safe restart coordinator (#76923)
Add a safe restart coordinator that preflights active Gateway work before restart.

- expose gateway.restart.preflight and gateway.restart.request RPC methods
- add explicit openclaw gateway restart --safe / openclaw daemon restart --safe path
- narrow restart blockers to running non-ended tasks so queued records no longer block indefinitely
- keep existing restart behavior unchanged; --force remains the immediate override

Co-authored-by: NikolaFC <54186359+NikolaFC@users.noreply.github.com>
Co-authored-by: galiniliev <5711535+galiniliev@users.noreply.github.com>
2026-05-04 10:58:36 -07:00
Pavan Kumar Gondhi
0e702f1063 fix(gateway): clamp unbound websocket auth scopes [AI] (#77413)
* fix: clamp unapproved trusted proxy websocket scopes

* addressing claude review

* addressing claude review

* addressing ci

* addressing ci

* docs: add changelog entry for PR merge
2026-05-04 23:16:07 +05:30
Mert Başar
c240e718e9 Feat/main session durable delivery pr (#75280)
* feat: generalize pending-final-delivery for subagents and main session

(cherry picked from commit 677fcbfaf87c8cd6de8b5bd02099b29b7d49e916)

* feat(agents): implement Phase 2 durable final delivery for main sessions

(cherry picked from commit b4e39f0ddf6dbd3f0d3b9226df8e714ad722f751)

* fix(agents): narrow heartbeat deferral to pending final delivery

* fix(agents): clear final delivery after dispatch

* fix(agents): gate durable delivery retry capture

---------

Co-authored-by: Mert Basar <MertBasar0@users.noreply.github.com>
2026-05-05 01:44:11 +08:00
Michael Appel
7b8315d18e fix: block SystemRoot/WINDIR in workspace .env and harden reg.exe path resolution [AI-assisted] (#74454)
* fix: address issue

* fix: address PR review feedback

* Add changelog entry for PR #74454

---------

Co-authored-by: Devin Robison <drobison@nvidia.com>
2026-05-04 11:39:00 -06:00
Pavan Kumar Gondhi
ea75cd8971 Gate zalouser startup name matching [AI] (#77411)
* fix: gate zalouser startup name matching

* addressing codex review

* docs: add changelog entry for PR merge
2026-05-04 22:47:19 +05:30
Pavan Kumar Gondhi
37c0520a0b fix(device-pair): require pairing scope for pair command [AI] (#76377)
* fix: restrict device pairing command access

* addressing review-skill

* addressing review-skill

* addressing codex review

* address codex review feedback

* addressing codex review

* addressing codex review

* addressing codex review

* addressing codex review

* docs: add changelog entry for PR merge
2026-05-04 22:12:06 +05:30
Vincent Koc
30e259b9c5 test(qa-lab): accept native Windows paths 2026-05-04 09:20:03 -07:00
Vincent Koc
9008031e96 fix(qa-channel): settle aborted bus polls 2026-05-04 09:20:03 -07:00
Vincent Koc
6c2573e37a test(anthropic-vertex): accept native ADC home paths 2026-05-04 09:20:03 -07:00
Vincent Koc
2fe2dbdb7d test(openshell): accept native symlink targets 2026-05-04 09:20:02 -07:00
Vincent Koc
3d3b0dad77 test(whatsapp): accept native Windows auth paths 2026-05-04 09:20:02 -07:00
Vincent Koc
15b9966781 test(telegram): accept native Windows session file paths 2026-05-04 09:20:02 -07:00
Vincent Koc
0dd30c804c test(memory): cover native Windows paths and locks 2026-05-04 09:20:02 -07:00
Vincent Koc
fa1d826a41 test(matrix): cover native Windows file semantics 2026-05-04 09:20:02 -07:00
Vincent Koc
7c6bf331b8 test(feishu): accept native oversized body resets 2026-05-04 09:20:02 -07:00
Vincent Koc
4f2f5e0461 test(feishu): cover native Windows webhook and workspace paths 2026-05-04 09:20:02 -07:00
Vincent Koc
48a3a23d40 test(discord): accept native voice temp paths 2026-05-04 09:20:02 -07:00
Vincent Koc
40f92b8d78 test(diffs): use native viewer asset file URLs 2026-05-04 09:20:02 -07:00
Vincent Koc
981767516d test(bluebubbles): accept native contact database paths 2026-05-04 09:20:02 -07:00
Vincent Koc
03d04c243b test(acpx): cover Windows extension test paths 2026-05-04 09:20:02 -07:00
Michael Appel
c1da0ddd54 fix(security): block workspace env from overriding Windows system root paths [AI] (#74458)
* fix: address issue

* fix: address PR review feedback

* fix: address PR review feedback

* fix: address PR review feedback

* fix: address codex review feedback

* fix: address codex review feedback

* changelog: PR #74458

---------

Co-authored-by: Devin Robison <drobison@nvidia.com>
2026-05-04 10:13:50 -06:00
zhang-guiping
1df2ac442a fix #77296: [Bug]: Plugin manifest skills field not published to agent skill discovery paths (#77328)
Summary:
- The PR publishes enabled plugin-declared skill directories into a generated `~/.openclaw/plugin-skills` syml ... plugin-skill precedence, cleans stale generated links, adds regression coverage, and updates the changelog.
- Reproducibility: yes. source-based. Current main resolves plugin-declared skill directories for prompt loadi ... ble generated discovery path, and the linked issue provides a concrete ENOENT path for a plugin `SKILL.md`.

Automerge notes:
- Ran the ClawSweeper repair loop before final review.
- Included post-review commit in the final squash: fix: resolve issue #77296
- Included post-review commit in the final squash: fix: publish plugin manifest skills for agent discovery
- Included post-review commit in the final squash: fix(clawsweeper): address review for automerge-openclaw-openclaw-7732…

Validation:
- ClawSweeper review passed for head 0f52865ee3.
- Required merge gates passed before the squash merge.

Prepared head SHA: 0f52865ee3
Review: https://github.com/openclaw/openclaw/pull/77328#issuecomment-4371415857

Co-authored-by: zhang-guiping <zhang.guiping@xydigit.com>
Co-authored-by: clawsweeper <274271284+clawsweeper[bot]@users.noreply.github.com>
2026-05-04 15:31:53 +00:00
Eva
cb38535875 [plugin sdk] Project session extension slots (#75609)
Merged via squash.

Prepared head SHA: d9b670a867
Co-authored-by: 100yenadmin <239388517+100yenadmin@users.noreply.github.com>
Co-authored-by: jalehman <550978+jalehman@users.noreply.github.com>
Reviewed-by: @jalehman
2026-05-04 08:04:27 -07:00
Pavan Kumar Gondhi
e3364ae3bd fix(qqbot): keep private commands off framework surface [AI] (#77212)
* fix: keep private qqbot commands off framework surface

* addressing codex review

* docs: add changelog entry for PR merge
2026-05-04 20:23:51 +05:30
hcl
d5edeae6ee fix(memory): prevent memory-hit starvation in corpus=all by capping per-corpus results (#77337) (#77356)
Summary:
- The PR adds balanced, backfilled all-corpus result merging for `memory_search` and `wiki_search`, regression tests, and a changelog entry for #77337.
- Reproducibility: yes. Current main is source-reproducible: both affected paths fetch both corpora for `corpus=all`, raw-sort wiki integer scores against memory similarity scores, and slice to `maxResults`.

Automerge notes:
- Ran the ClawSweeper repair loop before final review.
- Included post-review commit in the final squash: fix(memory): prevent all-corpus memory hit starvation

Validation:
- ClawSweeper review passed for head a5b4f6a932.
- Required merge gates passed before the squash merge.

Prepared head SHA: a5b4f6a932
Review: https://github.com/openclaw/openclaw/pull/77356#issuecomment-4371767658

Co-authored-by: HCL <chenglunhu@gmail.com>
Co-authored-by: clawsweeper <274271284+clawsweeper[bot]@users.noreply.github.com>
2026-05-04 14:49:14 +00:00
Kevin Lin
89db1e5440 feat(cron): surface run diagnostics in status (#75928)
* feat(cron): surface run diagnostics in status

* docs: add cron diagnostics changelog

* fix(cron): preserve latest run diagnostics

* test(cron): update diagnostics regression deps
2026-05-04 07:05:28 -07:00
Eva
8afc9ef73c [plugin sdk] Harden finalize retry and run context cleanup (#75600)
Merged via squash.

Prepared head SHA: ec58a6212b
Co-authored-by: 100yenadmin <239388517+100yenadmin@users.noreply.github.com>
Co-authored-by: jalehman <550978+jalehman@users.noreply.github.com>
Reviewed-by: @jalehman
2026-05-04 07:04:22 -07:00
Val Alexander
042d7b8823 fix(telegram): clean up tool-only previews 2026-05-04 08:55:41 -05:00
Dallin Romney
fc1f1f4fdf fix(tui): preserve code spans, code blocks, and dotted/hyphenated identifiers from long-token sanitizer (#77335)
The display sanitizer's long-token chunker (`\S{33,}` -> 32-char chunks
joined by spaces) was injecting literal spaces inside inline code spans,
fenced code blocks, and bare identifiers it didn't recognize. Tokens like
`requireConfirmationForMutatingActions`, `ubuntu-budgie-desktop-environment`,
and `binary_sensor.sense_energy_monitor_power` rendered with mid-word
spaces, contaminating copy/paste of package names, entity IDs, and shell
line-continuations.

Fix:

- Make sanitizer code-aware: split text into fenced/inline-code segments
  and prose, and only run the chunker on prose segments. Code regions
  pass through verbatim.
- Widen `isCopySensitiveToken` to use the punctuation-stripped candidate
  for all classification, and accept any `FILE_LIKE_RE` token that
  contains `_`, `-`, or `.` (covers package names, dotted IDs, kebab
  flags). Picks up the goals of #69340 and #39565.
- Skip chunking for symbol-only runs (box-drawing rows, dashes, equals)
  so table borders aren't corrupted.
- Preserve the original goal of narrow-terminal protection: long
  unidentifiable prose tokens (e.g. accidental base64 dumps) are still
  chunked so they don't blow out terminal layout.

Security ordering preserved: ANSI strip / control-char strip / binary
redaction still run on the whole string before segmentation, so code
regions cannot smuggle escapes, control characters, or binary garbage
past the sanitizer.

16 new regression tests cover: camelCase config keys in inline code,
hyphenated package names (bare and in code), dotted entity IDs (bare
and in code), backtick and tilde fenced blocks, base64-like blobs in
code, prose-token chunking unchanged, prose-around-code mixed content,
box-drawing horizontal rules, multi-line shell `\\` continuations,
plus three explicit security-ordering tests asserting ANSI/control/
binary stripping still runs inside code segments.

Fixes #48432, #39505.
Supersedes #69340, #39565 (carries forward both ideas in a more
general fix). Carries forward the code-fence-aware approach from the
closed #48445.
2026-05-04 21:50:40 +08:00
Josh Lehman
0b3a86cab0 docs(changelog): restore 2026.5.3 release notes 2026-05-04 06:49:27 -07:00
Dallin Romney
5f373ae4d3 fix(tui): abort run during pre-event waiting gap (#77199)
* fix(tui): abort run during pre-event waiting gap

Track the runId returned from chat.send so pressing Esc while `activeChatRunId` is still null aborts the in-flight run instead of repeatedly printing "no active run". Identified in #1296.

* fix(tui): drop redundant comment on pendingChatRunId set
2026-05-04 21:36:52 +08:00
Vincent Koc
a90be474f4 test: repair current main checks 2026-05-04 05:09:21 -07:00
github-actions[bot]
c59c20e9fd chore(ui): refresh fa control ui locale 2026-05-04 12:05:27 +00:00