vultr/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-04-29 10:02:04 +00:00
Code Issues Packages Projects Releases Wiki Activity
29,466 Commits 1,785 Branches 147 Tags
46b1ecd6ed126419c9e2e1fff5dd75fc23ba0684
Commit Graph

29466 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Frank Yang
46b1ecd6ed docs: add changelog entry for FirePass Kimi fix 2026-04-09 17:27:02 +08:00
Peter Steinberger
828c64e6b5 style: format web fetch ssrf test 2026-04-09 10:18:32 +01:00
Peter Steinberger
8be3a4466c fix(feishu): read webhook bodies through pre-auth guard 2026-04-09 10:18:07 +01:00
Aftab
fa2fab7060 fix(plugins): prevent schema load from re-activating plugin registry (#54971) 
Merged via squash.

Prepared head SHA: dd1ed1d519
Co-authored-by: Aftabbs <112916888+Aftabbs@users.noreply.github.com>
Co-authored-by: altaywtf <9790196+altaywtf@users.noreply.github.com>
Reviewed-by: @altaywtf
 2026-04-09 10:17:26 +01:00
Peter Steinberger
fbbb4f02d1 test: allow slower CLI metadata help rendering 2026-04-09 10:13:20 +01:00
Peter Steinberger
7497abc124 test: stabilize gateway background tests 2026-04-09 10:13:20 +01:00
Justin Song
1b24560392 fix(status): show configured fallback models in /status output (#33111) 
Merged via squash.

Prepared head SHA: 5e590aa68c
Co-authored-by: AnCoSONG <32268203+AnCoSONG@users.noreply.github.com>
Co-authored-by: altaywtf <9790196+altaywtf@users.noreply.github.com>
Reviewed-by: @altaywtf
 2026-04-09 10:13:09 +01:00
WarrenJones
905e56d191 fix: treat zero nextRunAtMs as invalid (#63507) (thanks @WarrenJones) 
* fix(cron): repair nextRunAtMs=0 on non-schedule edits

Treat nextRunAtMs <= 0 as invalid during non-schedule updates so editing
a description or other metadata field recomputes the next run time instead
of silently keeping the corrupt value.

Made-with: Cursor

* fix(cron): treat zero nextRunAtMs as invalid

* fix: treat zero nextRunAtMs as invalid (#63507) (thanks @WarrenJones)

---------

Co-authored-by: WarrenJones <8704779+WarrenJones@users.noreply.github.com>
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
 2026-04-09 14:39:53 +05:30
Frank Yang
3e062acbcb fix(fireworks): disable FirePass Kimi reasoning leak (#63607) 
* fix: disable FirePass Kimi reasoning leak

* fix: preserve Fireworks wrapper fallbacks

* fix: harden Fireworks Kimi model matching

* fix: restore Fireworks payload sanitization
 2026-04-09 17:09:17 +08:00
WarrenJones
40c5edb5b1 fix: preserve safe gateway env vars on reinstall (#63136) (thanks @WarrenJones) 
* fix(daemon): preserve safe env vars on gateway reinstall

Pass the existing service environment into gateway reinstall planning so safe custom variables survive LaunchAgent rewrites and existing PATH entries are merged instead of being silently dropped.

Made-with: Cursor

* fix(daemon): track managed env keys on reinstall

* fix: preserve safe gateway env vars on reinstall (#63136) (thanks @WarrenJones)

* fix: validate preserved PATH entries on reinstall (#63136) (thanks @WarrenJones)

---------

Co-authored-by: WarrenJones <8704779+WarrenJones@users.noreply.github.com>
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
 2026-04-09 14:29:54 +05:30
Davanum Srinivas
08ae021d1f fix(qqbot): guard image-size probe against SSRF (#63495) 
* fix(qqbot): replace raw fetch in image-size probe with SSRF-guarded fetchRemoteMedia

Replace the bare fetch() in getImageSizeFromUrl() with fetchRemoteMedia()
from the plugin SDK, closing the blind SSRF via markdown image dimension
probing (GHSA-2767-2q9v-9326).

fetchRemoteMedia options: maxBytes 65536, maxRedirects 0, generic
public-network-only SSRF policy (no hostname allowlist, blocks
private/reserved/loopback/link-local/metadata IPs after DNS resolution).

Also fixes the repo-root resolution in scripts/lib/ts-guard-utils.mjs
which caused lint:tmp:no-raw-channel-fetch to miss extension files
entirely. The guard now walks up to .git instead of hardcoding two parent
traversals, and the allowlist is refreshed with all pre-existing raw
fetch callsites that became visible.

* fix(qqbot): guard image-size probe against SSRF (#63495) (thanks @dims)

---------

Co-authored-by: sliverp <870080352@qq.com>
 2026-04-09 16:48:04 +08:00
HollyChou
ab49afcd27 fix: surface specific sub-issue for config validation union errors (#40841) 
Merged via squash.

Prepared head SHA: 6d7da51629
Co-authored-by: Hollychou924 <128659251+Hollychou924@users.noreply.github.com>
Co-authored-by: altaywtf <9790196+altaywtf@users.noreply.github.com>
Reviewed-by: @altaywtf
 2026-04-09 09:40:22 +01:00
Vincent Koc
89acb92011 test(boundary): guard src imports from bundled plugin paths 2026-04-09 09:30:45 +01:00
Vincent Koc
38100a098e fix(qa): route cli registration through facade 2026-04-09 09:27:55 +01:00
Vincent Koc
3f7e6c7c64 fix(feishu): remove runtime api type cycle 2026-04-09 09:23:52 +01:00
Vincent Koc
60a3733f12 fix(bluebubbles): remove status type barrel cycle 2026-04-09 09:22:11 +01:00
Vincent Koc
2a372577d4 fix(memory-core): route bundled helpers through facade 2026-04-09 09:21:33 +01:00
Ayaan Zaidi
68781bf2c2 fix: add web_fetch RFC2544 SSRF opt-in (#61830) (thanks @xing-xing-coder) 2026-04-09 13:50:18 +05:30
Ayaan Zaidi
ac3999ac8c refactor(web-fetch): distill rfc2544 policy handling 2026-04-09 13:50:18 +05:30
xing-xing-coder
9ed448088b fix(web-fetch): finalize RFC2544 SSRF policy support 2026-04-09 13:50:18 +05:30
Vincent Koc
ce32697250 fix(openshell): split fs bridge backend types 2026-04-09 09:17:29 +01:00
Vincent Koc
62eca3770f test(boundary): guard sdk and package imports from bundled plugin paths 2026-04-09 09:10:05 +01:00
Vincent Koc
c87994bc9a fix(plugins): split registry type surface 2026-04-09 09:05:11 +01:00
Vincent Koc
7d6af7e154 fix(agents): split sandbox backend handle types 2026-04-09 08:52:14 +01:00
Vincent Koc
f374fff3bd fix(browser): move browser sdk helper seams into core 2026-04-09 08:48:49 +01:00
Vincent Koc
77e0e3bac5 fix(memory): split embedding provider types 2026-04-09 08:32:32 +01:00
Vincent Koc
c1969ebf2a fix(agents): split sandbox fs bridge types 2026-04-09 08:26:41 +01:00
Vincent Koc
dbcc574e1f fix(agents): split embedded run shared types 2026-04-09 08:24:22 +01:00
Peter Steinberger
8a07ac510b test: isolate tasks reply registry state 2026-04-09 08:23:53 +01:00
Vincent Koc
5342cc49b1 fix(memory-host-sdk): route ollama shim through sdk runtime facade 2026-04-09 08:23:06 +01:00
Vincent Koc
3d60ed0544 fix(infra): split restart attempt types 2026-04-09 08:17:53 +01:00
Vincent Koc
04f9cc9f6c fix(config): remove schema hints type cycle 2026-04-09 08:15:04 +01:00
Vincent Koc
2ac71d9488 fix(config): split plugin auto enable types 2026-04-09 08:13:41 +01:00
Luke
7c72b694f1 macOS: add MLX Talk provider MVP (#63539) 
Merged via squash.

Prepared head SHA: da43563513
Co-authored-by: ImLukeF <92253590+ImLukeF@users.noreply.github.com>
Co-authored-by: ImLukeF <92253590+ImLukeF@users.noreply.github.com>
Reviewed-by: @ImLukeF
 2026-04-09 17:13:34 +10:00
Vincent Koc
2729c91ad5 test(boundary): route security audit helper through public plugin surfaces 2026-04-09 08:10:27 +01:00
Vincent Koc
714adcb124 fix(commands): split doctor allow-from mode types 2026-04-09 08:08:25 +01:00
Peter Steinberger
03d056989a test: isolate discord model picker dispatch mock 2026-04-09 08:04:53 +01:00
Vincent Koc
5ece17a865 fix(plugin-sdk): route opencode shim through core onboard helper 2026-04-09 07:57:12 +01:00
Vincent Koc
a81dc153c6 fix(cron): split isolated run result types 2026-04-09 07:50:14 +01:00
Vincent Koc
b7cc36161c fix(agents): split skill install result types 2026-04-09 07:45:18 +01:00
Vincent Koc
ea54beb08a fix(gateway): split hook channel types 2026-04-09 07:41:40 +01:00
Gustavo Madeira Santana
1801702ed9 Matrix: gate legacy crypto migration on inspector availability 2026-04-09 01:38:58 -04:00
manuel-claw
e30d0cffc4 fix(whatsapp): drain reconnect queue after WhatsApp reconnects (#30806) (#46299) 
Merged via squash.

Prepared head SHA: 5ce763406e
Co-authored-by: manuel-claw <268194568+manuel-claw@users.noreply.github.com>
Co-authored-by: mcaxtr <7562095+mcaxtr@users.noreply.github.com>
Reviewed-by: @mcaxtr
 2026-04-09 02:33:36 -03:00
Gustavo Madeira Santana
b7c28f3e1f Matrix: trim dead client config exports 2026-04-09 01:28:03 -04:00
Gustavo Madeira Santana
cc6654a055 Matrix: remove native approval wrapper 2026-04-09 01:28:03 -04:00
Gustavo Madeira Santana
4fd65616d2 Matrix: drop dead helper aliases 2026-04-09 01:28:03 -04:00
Gustavo Madeira Santana
66e52a3e5d matrix: break migration runtime import cycle 2026-04-09 01:20:46 -04:00
Peter Steinberger
0461341613 test: avoid provider runtime in models list e2e 2026-04-09 06:20:13 +01:00
Peter Steinberger
9b8eb10196 test: isolate doctor state integrity note capture 2026-04-09 06:16:03 +01:00
Peter Steinberger
2ee39fab83 test: run Ollama stream coverage inside plugin 2026-04-09 06:13:39 +01:00