Vincent Koc
8042ec4cb8
fix(qa): scope runtime parity mock requests
2026-06-11 05:19:10 +09:00
Vincent Koc
797aab5ab7
test(memory): create rem preview source fixture
2026-06-11 03:52:40 +09:00
Vincent Koc
5d2eb3c3e1
fix(release): stabilize candidate validation
2026-06-11 03:04:02 +09:00
Hemant Sudarshan
2e4bf410a2
fix(browser): honor cdp url for default session profile ( #80143 )
2026-06-10 12:36:11 -04:00
Vincent Koc
dbcae5b78d
fix(memory): keep ignored-name QMD roots watchable
...
Fix QMD watcher ignore handling for explicitly configured roots whose directory names are normally ignored, and prefer the most-specific configured watch root for overlapping collections.
Validated with focused QMD/tooling tests, full core support boundary tests, green CI, and ClawSweeper re-review.
2026-06-11 00:12:15 +09:00
Peter Steinberger
0e7b5c3429
feat(anthropic): support Claude Fable 5 adaptive thinking ( #91882 )
...
* feat(anthropic): support Claude Fable 5
* test(anthropic): tighten Fable stream fixtures
* fix(anthropic): preserve Vertex input types
* test(anthropic): use provider-ready Vertex effort
* fix(anthropic): support Fable deployment aliases
* fix(anthropic): discard incomplete Fable output
* feat(anthropic): support Fable on Bedrock
* fix(anthropic): preserve Fable reasoning contracts
* refactor(anthropic): unify canonical Claude model policy
* fix(anthropic): satisfy extension thinking types
* test(anthropic): complete canonical alias fixture
* fix(bedrock): scope thinking case declarations
2026-06-10 08:08:35 -07:00
Agustin Rivera
ade5ac0350
fix(browser): validate discovered CDP websocket URLs ( #91747 )
...
* fix(browser): validate discovered cdp websocket urls
* fix(browser): validate cdp tab creation websockets
* fix(browser): guard termination cdp websocket
* fix(browser): use .toString() instead of String() to satisfy oxlint no-base-to-string
* fix(browser): avoid cdp termination assertion stringification
* fix(browser): preserve cdp ssrf policy
2026-06-10 07:59:29 -07:00
lifuyue
ac21e89c13
Support existing-session browser CDP endpoints ( #91736 )
...
* Support existing-session browser CDP endpoints
* Fix browser existing-session test fixture type
---------
Co-authored-by: OpenAI Codex <codex@openai.com >
2026-06-10 10:44:35 -04:00
brokemac79
b71d8e1c32
fix(sandbox): use materialized skill paths in startup prompts ( #91791 )
...
* fix(sandbox): use materialized skill paths in command prompts
* fix(sandbox): resolve backend prompt workdirs
* fix(sandbox): preserve custom backend prompt fallback
---------
Co-authored-by: Vincent Koc <vincentkoc@ieee.org >
2026-06-10 23:35:34 +09:00
Ayaan Zaidi
7200c316e5
refactor(telegram): drop NO_REPLY precount debug logging
2026-06-10 16:30:25 +05:30
Ayaan Zaidi
3078a8335d
refactor(telegram): trust grammy api contract in handler seams
2026-06-10 16:30:25 +05:30
Ayaan Zaidi
709855d623
fix(telegram): delete retired dispatch dedupe buckets after doctor import
2026-06-10 16:30:25 +05:30
Ayaan Zaidi
272b599369
feat(telegram): size block-mode preview chunks from streaming.preview.chunk
2026-06-10 16:30:25 +05:30
Sally O'Malley
05a3b44c93
fix(telegram): block unauthorized DM text from cache and prompt context ( #91478 )
...
Move Telegram inbound authorization into a single pre-cache gate so unauthorized DM text is never recorded into the reply-chain cache or dispatch-dedupe state before allowlist/pairing checks run. The gate covers fresh messages, edited messages, group edits, and edited channel posts; edits are authorized silently and never trigger pairing challenges, and requireTopic root DMs are dropped before pairing challenges.
Fixes #91209 .
Thanks @sallyom!
2026-06-10 15:50:32 +05:30
Ayaan Zaidi
c84e521920
refactor(discord): distill reply hydration tests
2026-06-10 14:54:32 +05:30
FullerStackDev
86215c9634
test(discord): avoid unbound hydration mock
2026-06-10 14:54:32 +05:30
FullerStackDev
514ac29d03
test(discord): cover reply hydration fetch failures
2026-06-10 14:54:32 +05:30
FullerStackDev
b08eef0508
fix(discord): hydrate reply context metadata
2026-06-10 14:54:32 +05:30
Ayaan Zaidi
9c6186de43
fix(telegram): bound dispatch dedupe state
2026-06-10 14:52:22 +05:30
Ayaan Zaidi
0d41316bcc
fix(state): preserve ttl for plugin-state imports
2026-06-10 14:52:22 +05:30
Ayaan Zaidi
9297c20a85
fix(telegram): use SDK dispatch replay dedupe
2026-06-10 14:52:22 +05:30
Vincent Koc
7d3e8dc963
test(qa): restore memory fallback config safely
2026-06-10 18:03:15 +09:00
Vincent Koc
0766a5c2ec
fix(qa): corrupt Matrix idb state in sqlite
2026-06-10 17:49:59 +09:00
Vincent Koc
87abb8defb
fix(qa): preserve Matrix recovery state in sqlite
2026-06-10 17:35:41 +09:00
Ayaan Zaidi
b9095bf70d
refactor(channel): share draft chunking resolver
2026-06-10 13:35:19 +05:30
Ayaan Zaidi
049c3c4877
test(telegram): cover callback API metadata
2026-06-10 13:29:11 +05:30
Ayaan Zaidi
1265da2a5c
fix(telegram): use concrete callback API calls
2026-06-10 13:29:11 +05:30
Ayaan Zaidi
05a0dfdd08
refactor(extensions): split channel contract sidecars
2026-06-10 13:05:24 +05:30
Vincent Koc
7f1d82ab25
revert(sessions): defer session metadata sqlite
...
Reverts 538d36eaaa
2026-06-10 16:34:06 +09:00
Andy Ye
9408380ae7
fix(memory-core): keep qmd json search one-shot ( #91837 )
2026-06-10 16:30:15 +09:00
Vincent Koc
0a3aa5f278
fix(test): add session ids to Slack fixtures
2026-06-10 16:18:43 +09:00
Vincent Koc
7cb2571a99
test(sessions): migrate fixtures to sqlite store
2026-06-10 15:35:10 +09:00
Vincent Koc
7b7e8f6e88
test(memory): stop asserting private sync return
2026-06-10 15:23:58 +09:00
Vincent Koc
60459d4061
test(chutes): normalize discovery request headers
2026-06-10 15:22:43 +09:00
Vincent Koc
54288a1e7c
test(imessage): align echo cache assertion
2026-06-10 15:20:05 +09:00
brokemac79
de4b8d8ebf
feat(plugins): allow installed trusted policy contracts
...
Allow explicitly enabled installed plugins to register declared trusted tool policies and agent tool result middleware, with trusted policy ids scoped by plugin owner.\n\nVerification covered targeted plugin/agent tests, typecheck, build, lint, local autoreview, and a Blacksmith Testbox runtime proof (tbx_01ktr1nq0rhq47fjkwrepm7fd3).
2026-06-10 16:18:23 +10:00
Vincent Koc
92418fc9da
fix(memory-core): filter stale recall entries in REM harness preview
2026-06-10 14:35:44 +09:00
Vincent Koc
69a73b6278
chore(codex): bump app-server to 0.139.0
2026-06-10 14:14:53 +09:00
Patrick Erichsen
e9671ed603
feat: feature openrouter in onboarding provider picker
2026-06-09 21:59:56 -07:00
kenny
b9280d5863
feat: add OpenRouter OAuth login
...
(cherry picked from commit dccfb60656
2026-06-09 21:59:56 -07:00
Vincent Koc
b4cdd92119
fix(codex): avoid guardian review for local models ( #88630 )
...
* fix(codex): avoid guardian review for local models
* fix(codex): route app-server auto exec review
* fix(codex): make guardian requirements provider-aware
* fix(codex): block unrouted bound approvals
* fix(channels): satisfy ingress queue lint
* fix(codex): use local-model policy for side forks
* fix(extensions): satisfy ingress lint
* fix(codex): require trusted exec reviewer model
* fix(exec): share control command approval guards
* fix(codex): fail closed for unknown guardian model provider
* fix(codex): reject custom exec reviewer endpoints
* fix(codex): preserve bound providers on app-server reuse
* fix(codex): prefer qualified app-server model providers
* fix(codex): preserve guardian on model control switches
* fix(codex): retain local providers across model switches
* fix(codex): distrust aliased reviewer model refs
* fix(codex): preserve providers after thread rotation
* fix(codex): clear stale providers on qualified model switches
* fix(codex): prefer qualified models over legacy providers
* fix(codex): validate reviewer trust before auto approvals
* fix(codex): recompute reviewer policy after binding rotation
* fix(codex): normalize reviewer aliases before trust checks
* fix(codex): retain bound providers for slashed local models
* fix(codex): normalize provider trust checks for exec review
* fix(codex): ignore stale bindings for explicit providers
* fix(codex): share trusted reviewer endpoint policy
* fix(codex): keep network approvals on plugin path
* fix(codex): route provider-qualified model refs
* fix(codex): reject blank masked OpenAI base overrides
* fix(codex): scope exec reviewer alias trust
* fix(codex): distrust exec reviewer transport overrides
2026-06-09 21:38:22 -07:00
Colin Johnson
bf89552e67
Improve iPad and iPhone control surfaces ( #91557 )
...
* feat(ios): expand iPad layout support
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
* feat: improve iPad and iPhone control surfaces
* fix: preserve workboard dispatch compatibility
* fix: keep Talk reachable on iPad
* fix: add universal iPad app icons
* fix: address ready-review iOS feedback
* fix: avoid workboard board id shadowing
* fix ios sidebar separators
---------
Co-authored-by: Solvely-Colin <211764741+Solvely-Colin@users.noreply.github.com >
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
Co-authored-by: joshavant <830519+joshavant@users.noreply.github.com >
2026-06-09 21:46:02 -05:00
Josh Avant
a8d33f23a0
Fix context-engine compaction ownership for Codex sessions ( #91590 )
...
* fix(agents): keep context-engine compaction primary
* fix(codex): request native compaction after context engines
* test: cover 90496 compaction and reset edge cases
* fix(codex): guard secondary native compaction binding
* fix(codex): keep native compaction hint internal
* fix(codex): wait for active native turns before resume
2026-06-09 21:33:00 -05:00
Omar Shahine
6c045c5ca3
fix(imessage): surface inbound startup diagnostics ( #91785 )
...
Merged via squash.
Prepared head SHA: 597684c365
2026-06-09 19:10:09 -07:00
Omar Shahine
bfccbc3fee
fix(imessage): harden outbound send transport ( #91783 )
...
Merged via squash.
Prepared head SHA: 39ea25767b
2026-06-09 19:09:15 -07:00
Vincent Koc
48ec58a584
fix(security): remediate openclaw alerts
2026-06-10 09:02:00 +09:00
openclaw-clownfish[bot]
c0a4a7890d
fix(doctor): keep TTS legacy migration on supported paths ( #91787 )
...
Co-authored-by: openclaw-clownfish[bot] <280122609+openclaw-clownfish[bot]@users.noreply.github.com>
2026-06-10 08:54:36 +09:00
Agustin Rivera
f0d8048aa3
fix(search): enforce native web search tool policy ( #91750 )
...
* fix(search): enforce native web search tool policy
* fix(search): apply session policy to native web search
* fix(search): gate direct OpenAI native search
* fix(search): redact native web search provider context
2026-06-09 16:25:15 -07:00
colmbrogan
3a9ea1d85b
fix(imessage): skip idle approval discovery scans ( #88530 )
...
* fix(imessage): bound idle approval discovery scans
* fix(imessage): complete bounded approval discovery
---------
Co-authored-by: Omar Shahine <10343873+omarshahine@users.noreply.github.com >
2026-06-09 16:03:48 -07:00
Agustin Rivera
21410d1c32
fix(codex): guard sandbox http requests ( #91752 )
...
* fix(codex): guard sandbox http requests
* fix(codex): align sandbox http policy
2026-06-09 13:54:24 -07:00
