Commit Graph

2341 Commits

Author SHA1 Message Date
Peter Steinberger
8cf6e4b5df fix(plugin-sdk): unblock gateway test surfaces 2026-04-04 21:02:04 +09:00
Peter Steinberger
65fcf7e104 fix(gateway): scope browser-origin auth throttling 2026-04-04 20:30:39 +09:00
Peter Steinberger
c70b10460c style(auth): normalize auth choice formatting 2026-04-04 12:19:08 +01:00
Peter Steinberger
605f48556b refactor(browser): share lifecycle cleanup helpers 2026-04-04 12:17:46 +01:00
Peter Steinberger
39bcf695dc fix(cron): reject unsafe custom session targets earlier 2026-04-04 20:13:39 +09:00
Peter Steinberger
bbb0b574c4 refactor: centralize gateway method policy helpers 2026-04-04 20:07:18 +09:00
Peter Steinberger
7ffbbd8586 fix: reserve admin gateway method prefixes 2026-04-04 20:04:48 +09:00
Peter Steinberger
3b09b58c5d test: cover browser cleanup for cron and subagents (#60146) (thanks @BrianWang1990) 2026-04-04 20:03:57 +09:00
BrianWang1990
e697838899 style: fix import order in server-cron.ts
Move plugin-sdk import after cron/* imports per alphabetical convention.
2026-04-04 20:03:57 +09:00
BrianWang1990
72b2e413d6 fix(browser): clean up browser tabs/processes when cron tasks and subagents complete
When cron tasks or subagents use browser automation, the browser
processes were not cleaned up after the task completed. This caused
orphaned Chrome processes (PPID=1) to accumulate over time.

Root cause: closeTrackedBrowserTabsForSessions was only called during
session-reset/session-delete (via ensureSessionRuntimeCleanup), but
isolated cron runs and subagent completions never triggered these paths.

Fix: Add browser tab cleanup in two places:
1. server-cron.ts: wrap runCronIsolatedAgentTurn in try/finally to
   ensure browser tabs are cleaned up after every cron run.
2. subagent-registry-lifecycle.ts: call closeTrackedBrowserTabsForSessions
   when a subagent run completes, before the announce cleanup flow.

Both cleanup calls are best-effort (caught errors) so they never mask
the actual task result or break the completion flow.

Fixes #60104
2026-04-04 20:03:57 +09:00
Peter Steinberger
e4ea3c03cf fix: scope live model switch pending state (#60266) (thanks @kiranvk-2011) 2026-04-04 19:45:53 +09:00
Peter Steinberger
87d840e9ee fix: tighten Teams and device typing 2026-04-04 19:39:22 +09:00
Peter Steinberger
4e099689c0 feat: stream Claude CLI JSONL output 2026-04-04 19:33:08 +09:00
Peter Steinberger
10e0592ed0 refactor: extract device token rotate target guard 2026-04-04 19:32:25 +09:00
Peter Steinberger
6b82140336 fix: land device token role guard follow-up (#60462) (thanks @eleqtrizit) 2026-04-04 19:27:10 +09:00
Agustin Rivera
7cda9df4cb fix(device): reject unapproved token roles 2026-04-04 19:27:10 +09:00
Peter Steinberger
ca2fdcc45f fix: enforce node pairing approval scopes end-to-end (#60461) (thanks @eleqtrizit) 2026-04-04 19:13:48 +09:00
Agustin Rivera
0089d0e2e6 fix(pairing): require pairing scope for node approvals 2026-04-04 19:13:48 +09:00
Peter Steinberger
be15805a84 refactor(runtime): lazy-load control-ui and channel-config surfaces 2026-04-04 08:59:56 +01:00
Peter Steinberger
926c107fe5 fix: narrow plugin route runtime scope fallback (#59815) (thanks @pgondhi987) 2026-04-04 16:57:44 +09:00
Pavan Kumar Gondhi
0e04ca36b9 fix: finalize issue changes 2026-04-04 16:57:44 +09:00
Pavan Kumar Gondhi
74270762ff fix: address review feedback 2026-04-04 16:57:44 +09:00
Pavan Kumar Gondhi
b02b2c3a0b fix: address issue 2026-04-04 16:57:44 +09:00
Peter Steinberger
b4e9802ef3 test: tidy gateway scope forwarding coverage 2026-04-04 16:48:26 +09:00
Peter Steinberger
9bbedf3caa test: replace hanging pair approve poc coverage 2026-04-04 16:42:46 +09:00
Peter Steinberger
14cfcdba1a docs(test): refresh stale model refs 2026-04-04 08:05:49 +01:00
Peter Steinberger
20266ff7dd fix: preserve mobile bootstrap auth fallback (#60238) (thanks @ngutman) 2026-04-04 15:57:38 +09:00
Nimrod Gutman
a9140abea6 fix(auth): hand off qr bootstrap to bounded device tokens 2026-04-04 15:57:38 +09:00
Vincent Koc
c4597992ca fix(config): remove remaining legacy surface leaks (#60726) 2026-04-04 15:55:31 +09:00
Peter Steinberger
25b069a6f3 refactor(gateway): split MCP loopback transport helpers 2026-04-04 15:34:13 +09:00
Vincent Koc
6fc69f5d33 fix(secrets): drop legacy talk apiKey target surface (#60717) 2026-04-04 15:22:41 +09:00
Peter Steinberger
3de09fbe74 fix: restore claude cli loopback mcp bridge (#35676) (thanks @mylukin) 2026-04-04 15:16:20 +09:00
Peter Steinberger
1ab37d7a12 refactor(gateway): classify pairing locality 2026-04-04 06:47:14 +01:00
Peter Steinberger
40da986b21 fix: preserve docker cli pairing locality (#55113) (thanks @sar618) 2026-04-04 14:36:30 +09:00
sar618
224fceee1a fix(gateway): skip device pairing for authenticated CLI connections in Docker
CLI connections with valid shared auth (token/password) now bypass device
pairing, fixing the chicken-and-egg problem where Docker CLI commands fail
with 'pairing required' (1008) despite sharing the gateway's network
namespace and auth token.

The existing shouldSkipBackendSelfPairing only matched gateway-client/backend
mode. CLI connections use cli/cli mode and were excluded. Additionally,
isLocalDirectRequest produces false negatives in Docker (host networking,
network_mode sharing) even when remoteAddress is 127.0.0.1, so CLI connections
with valid shared auth skip the locality check entirely — the token is the
trust anchor.

Closes #55067
Related: #12210, #23471, #30740
2026-04-04 14:36:30 +09:00
Vincent Koc
561db47566 docs(boundaries): add import-topology guardrails 2026-04-04 14:06:18 +09:00
Vignesh Natarajan
f8c4777515 Dreaming: move setup controls to header and tighten status plumbing 2026-04-03 21:58:46 -07:00
Peter Steinberger
53b5b1b32d fix(ci): repair redundant channel union types 2026-04-04 05:08:02 +01:00
Vignesh
4c1022c73b feat(memory-core): add dreaming promotion with weighted recall thresholds (#60569)
* memory-core: add dreaming promotion flow with weighted thresholds

* docs(memory): mark dreaming as experimental

* memory-core: address dreaming promotion review feedback

* memory-core: harden short-term promotion concurrency

* acpx: make abort-process test timer-independent

* memory-core: simplify dreaming config with mode presets

* memory-core: add /dreaming command and tighten recall tracking

* ui: add Dreams tab with sleeping lobster animation

Adds a new Dreams tab to the gateway UI under the Agent group.
The tab is gated behind the memory-core dreaming config — it only
appears in the sidebar when dreaming.mode is not 'off'.

Features:
- Sleeping vector lobster with breathing animation
- Floating Z's, twinkling starfield, moon glow
- Rotating dream phrase bubble (17 whimsical phrases)
- Memory stats bar (short-term, long-term, promoted)
- Active/idle visual states
- 14 unit tests

* plugins: fix --json stdout pollution from hook runner log

The hook runner initialization message was using log.info() which
writes to stdout via console.log, breaking JSON.parse() in the
Docker smoke test for 'openclaw plugins list --json'. Downgrade to
log.debug() so it only appears when debugging is enabled.

* ui: keep Dreams tab visible when dreaming is off

* tests: fix contracts and stabilize extension shards

* memory-core: harden dreaming recall persistence and locking

* fix: stabilize dreaming PR gates (#60569) (thanks @vignesh07)

* test: fix rebase drift in telegram and plugin guards
2026-04-03 20:26:53 -07:00
Peter Steinberger
a23ab9b906 refactor: move voice-call realtime providers into extensions 2026-04-04 12:07:23 +09:00
Peter Steinberger
7e69c2f6a7 test: trim remaining mock drift 2026-04-04 04:04:12 +01:00
Peter Steinberger
306fe841f5 fix(cli): add local logs fallback 2026-04-04 08:17:11 +09:00
Peter Steinberger
ab318de8b7 test(plugins): finish moving contract coverage 2026-04-04 00:11:39 +01:00
Peter Steinberger
e4b5027c5e refactor(plugins): move extension seams into extensions 2026-04-04 00:10:16 +01:00
Peter Steinberger
0204b8dd28 fix: stabilize live and docker test lanes 2026-04-03 21:43:36 +01:00
mappel-nv
21e53aea9e Gateway: refresh websocket auth after secrets reload (#60323)
* Gateway: refresh websocket auth after secrets reload

* Gateway: always restore auth reload test globals

* chore: add changelog for websocket auth reload

---------

Co-authored-by: Devin Robison <drobison@nvidia.com>
2026-04-03 14:35:31 -06:00
Peter Steinberger
4c0f51df81 test: trim gateway and infra partial mocks 2026-04-03 21:03:54 +01:00
Peter Steinberger
7db148706a test: trim more runtime partial mocks 2026-04-03 20:46:57 +01:00
Peter Steinberger
3f86972e46 test: trim sandbox and gateway partial mocks 2026-04-03 20:40:27 +01:00
Vincent Koc
516e9054de fix(types): align portable runtime helpers 2026-04-04 03:57:47 +09:00