Commit Graph

66940 Commits

Author SHA1 Message Date
Agustin Rivera
587eefe5ad fix(imessage): require authorization for group actions (#97961) 2026-06-29 17:51:39 -07:00
dwc1997
28347ba51c test(globals): add unit tests for global CLI flag state helpers (#96735)
* test(globals): add unit tests for global CLI flag state helpers

Add unit tests for shouldLogVerbose, logVerbose, and logVerboseConsole
functions in src/globals.ts to verify verbose logging behavior.

Tests cover:
- shouldLogVerbose returns true when isVerbose is true
- shouldLogVerbose returns true when file log level is debug
- shouldLogVerbose returns false when both are false
- logVerbose does not log when shouldLogVerbose is false
- logVerbose logs to console when isVerbose is true
- logVerboseConsole does not log when isVerbose is false
- logVerboseConsole logs to console when isVerbose is true

* ci: trigger re-review

* test(globals): cover verbose logger behavior

---------

Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
2026-06-29 17:45:30 -07:00
Agustin Rivera
4aa07513fe fix(cron): scope agent wake targets (#97949)
* fix(cron): scope agent wake targets

* fix(cron): refresh prompt snapshots
2026-06-29 17:43:43 -07:00
Jason (Json)
455f813d6e fix(telegram): deliver durable reasoning when enabled
Preserve shared reasoning suppression by default while letting Telegram opt into durable reasoning payloads only when it has a deliverable reasoning lane. Covers persistent /reasoning on, separate reasoning stream lanes, and progress-stream suppression.\n\nVerification:\n- node scripts/run-vitest.mjs src/auto-reply/reply/dispatch-from-config.test.ts extensions/telegram/src/bot-message-dispatch.test.ts\n- git diff --check upstream/main...HEAD\n- .agents/skills/autoreview/scripts/autoreview --mode branch --base upstream/main --stream-engine-output\n- CI run 28411526182 green, including QA Smoke CI and check-test-types\n- Real behavior proof run 28411676681 passed\n\nPR: #97875
2026-06-29 17:31:06 -07:00
Agustin Rivera
6ead092302 fix(acp): require owner for runtime controls (#97953) 2026-06-29 17:29:08 -07:00
Hannes Rudolph
606bcc8d14 [codex] docs: add release notes placeholder (#97959) 2026-06-29 18:25:15 -06:00
Agustin Rivera
e87b0df675 fix(codex): restrict computer-use installation (#97955) 2026-06-29 17:17:49 -07:00
Agustin Rivera
2cf765f732 fix(browser): block node routes when sandbox host control is disabled (#97958) 2026-06-29 17:10:12 -07:00
Dallin Romney
fd3f354f46 test(qa): expand docker lane adapter (#97937)
* test(qa): expand docker lane adapter

* Extract QA Docker lane fixture
2026-06-29 17:08:43 -07:00
Vincent Koc
18b2ff683f docs(ci): update runner registration budget (#97943) 2026-06-29 16:27:32 -07:00
Dallin Romney
2acffd7f3d chore(ci): dedupe release QA credential check (#97948) 2026-06-29 16:23:34 -07:00
Dallin Romney
a107b95ee7 chore(ci): dedupe QA live credential check (#97947) 2026-06-29 16:23:32 -07:00
Jiaming Guo
456c48f368 fix(gateway): require admin scope for browser proxy invoke (#85916)
* fix(gateway): require admin scope for browser proxy invoke

* fix(gateway): document trusted node scopes

* fix(gateway): align browser scope test

* fix(gateway): satisfy node test lint

---------

Co-authored-by: Agustin Rivera <agustin@rivera-web.com>
2026-06-29 16:23:02 -07:00
Dallin Romney
4f95c6969b chore(ci): dedupe Crabbox Docker check (#97950) 2026-06-29 16:22:44 -07:00
Dallin Romney
a255fc6dc4 chore(ci): dedupe BuildKit pre-pull step (#97951) 2026-06-29 16:22:06 -07:00
Dallin Romney
0b2cd9cc41 chore(ci): dedupe workflow sanity checkout (#97946) 2026-06-29 16:21:41 -07:00
Josh Avant
052dc59526 fix: /pair qr fails to show QR code in chat surfaces (#97933)
* fix(pair): render qr per chat surface

* test(plugin-sdk): update reply helper surface budget

* fix(pair): keep qr metadata internal
2026-06-29 18:17:21 -05:00
Dallin Romney
f7cca686f7 ci: dedupe Linux checkout step (#97940) 2026-06-29 16:09:42 -07:00
Dallin Romney
5dae3d49e6 Update QA Lab Crabline integration (#97941)
* Update QA Lab Crabline integration

* Refresh docs map
2026-06-29 16:07:38 -07:00
Agustin Rivera
b7b2e1f77e fix(pdf): guard native provider requests (#97872)
* fix(pdf): guard native provider requests

* fix(pdf): preserve configured origin trust

* fix(pdf): preserve resolver compatibility
2026-06-29 15:51:26 -07:00
Yzx
3047e6c43d fix: Ollama Cloud tool calls fail on second turn (#96474)
Tested and it works.
2026-06-29 16:48:46 -06:00
Agustin Rivera
cbdbb22c60 fix(voice): require admin for voice set (#97874) 2026-06-29 15:41:26 -07:00
Agustin Rivera
825aafac57 fix(voicecall): redact read-scoped status payloads (#97870)
* fix(voicecall): redact read-scoped status payloads

* fix(voicecall): make status assertion lint-safe
2026-06-29 15:38:29 -07:00
Dallin Romney
843ad14364 feat(qa): add transport scenario requirements (#97915) 2026-06-29 14:53:19 -07:00
Dallin Romney
15de9d881a ci: retry platform checkout fetch timeouts (#97912) 2026-06-29 13:30:14 -07:00
Agustin Rivera
29f787f10e fix(memory): require privileged dreaming config changes (#97869)
* fix(memory): gate dreaming config changes

* fix(memory): document dreaming privilege gate

Explain that persistent dreaming toggles require channel owner status or Gateway admin scope, while status and help remain read-only.
2026-06-29 13:03:22 -07:00
Dallin Romney
05d83125c9 test: add hosted media provider QA live evidence (#97900) 2026-06-29 13:01:47 -07:00
Patrick Erichsen
d43366b4e3 ci: bump ClawHub package publish workflow (#97907) 2026-06-29 12:17:49 -07:00
Parvesh
82dfd89107 fix(agents): stop recording accepted sessions_spawn launches as tool failures (#96851)
* fix(agents): stop recording accepted sessions_spawn launches as tool failures

* fix(agents): stop recording accepted sessions_spawn launches as tool failures

* fix(clownfish): address review for live-pr-inventory-20260629T175323-001 (1)

---------

Co-authored-by: openclaw-clownfish[bot] <280122609+openclaw-clownfish[bot]@users.noreply.github.com>
2026-06-29 11:21:05 -07:00
Yuval Dinodia
38ab207591 fix(google-meet): fall back to manual OAuth paste when callback port is occupied (#96492)
The Google Meet OAuth login binds a fixed localhost:8085 callback listener
and let listener failures propagate, so meet auth login aborted entirely when
port 8085 was already in use. The sibling Gemini CLI OAuth path already
recovers by switching to the manual copy/paste flow on EADDRINUSE/listen
errors; bring Google Meet to parity by catching listener errors and reusing
the existing manual-paste handler instead of failing the login.
2026-06-29 11:20:21 -07:00
lin-hongkuan
2906d6c38f fix(auth): strip controls from masked API keys (#96445)
* fix(auth): strip controls from masked API keys

* test(auth): cover DEL and C1 masked key controls

* chore: retrigger PR checks

---------

Co-authored-by: lin-hongkuan <lin-hongkuan@users.noreply.github.com>
2026-06-29 11:15:55 -07:00
Dallin Romney
80a3c515fd test: add ClawHub release candidate QA proof (#97896)
* test: add ClawHub release candidate QA proof

* test: harden ClawHub release candidate evidence
2026-06-29 11:14:09 -07:00
Dallin Romney
5816e0194e feat(qa): wire crabline whatsapp transport (#95920) 2026-06-29 11:13:17 -07:00
Yuval Dinodia
e38d64c5f8 fix(cron): keep a due recurring run when an edit re-saves the same schedule (#96159)
* fix(cron): keep a due recurring run when an edit re-saves the same schedule

update() advanced state.nextRunAtMs to the next future slot whenever a
patch carried schedule or enabled, even when the schedule was unchanged,
dropping an already-due run and re-phasing every-job anchors to now. Gate
the advance on cronSchedulingInputsEqual so only a genuine schedule or
enabled change recomputes, and inherit the previous every anchor when a
re-save omits it, matching the add/remove maintenance recompute.

* fix(cron): re-anchor every-job to edit time on a genuine interval change

Only inherit the previous cadence anchor for an unchanged-interval every
re-save. A real everyMs change (UI omits anchorMs) now re-anchors to the
edit time, matching the prior update semantics, while idempotent re-saves
still preserve a due slot and phase. Adds a regression test for the
interval-change path.
2026-06-29 11:08:11 -07:00
Glenn-Agent
7e428797ec docs: add generated docs map (#95954)
* docs: add generated docs map

* docs: format docs map headings

* docs: separate docs map sections

* fix: satisfy docs map checks
2026-06-29 11:05:58 -07:00
Zaid
aa5ec51af0 fix(line): preserve uploaded file names for media detection (#96403)
* fix(line): preserve file upload filenames

* test(line): fail unexpected media downloads
2026-06-29 11:03:30 -07:00
Dallin Romney
2cc43aec2d feat(qa): wire crabline slack transport (#97891) 2026-06-29 10:57:17 -07:00
lin-hongkuan
bc7f0f1223 fix(secrets): strip control characters from secret input (#96444)
* fix(secrets): strip control characters from secret input

* chore: retrigger PR checks

* fix(web-content): strip controls from provider secrets

---------

Co-authored-by: lin-hongkuan <lin-hongkuan@users.noreply.github.com>
2026-06-29 10:51:08 -07:00
dwc1997
f92ec2d4e8 test(shared): add unit tests for surrogate-safe UTF-16 string slicing helpers (#97805)
* test(shared): add unit tests for surrogate-safe UTF-16 string slicing helpers

Add unit tests for sliceUtf16Safe and truncateUtf16Safe functions in
src/shared/utf16-slice.ts to verify UTF-16 string slicing behavior.

Tests cover:
- sliceUtf16Safe slices ASCII string normally
- sliceUtf16Safe handles negative start/end
- sliceUtf16Safe handles start/end beyond length
- sliceUtf16Safe swaps start and end when start > end
- sliceUtf16Safe preserves emoji with surrogate pairs
- sliceUtf16Safe avoids splitting surrogate pair at start/end
- truncateUtf16Safe returns input when shorter than limit
- truncateUtf16Safe truncates when longer than limit
- truncateUtf16Safe handles zero/negative limit
- truncateUtf16Safe floors decimal limit
- truncateUtf16Safe preserves emoji with surrogate pairs
- truncateUtf16Safe avoids splitting surrogate pair

* fix: replace tautological surrogate assertions with exact output checks

Replace vague 'result.length >= 0' assertions with exact expected output
checks for surrogate pair boundary cases. The helper returns empty string
when slicing at surrogate pair boundaries.
2026-06-29 10:50:58 -07:00
pick-cat
09167523bf fix(nextcloud-talk): bound bot preflight error reads (#97811)
Co-authored-by: Pick-cat <266665499+Pick-cat@users.noreply.github.com>
2026-06-29 10:50:47 -07:00
pick-cat
eb5fb2aa69 fix(microsoft-foundry): bound connection test error reads (#97812)
Co-authored-by: Pick-cat <266665499+Pick-cat@users.noreply.github.com>
2026-06-29 10:50:38 -07:00
Dallin Romney
2ec6708980 fix(whatsapp): validate WebSocket URL env (#97697) 2026-06-29 10:50:16 -07:00
pick-cat
9949f6bd85 fix(chutes): bound OAuth token error response reads (#97808)
* fix(chutes): bound OAuth token error response reads

* ci: re-trigger checks (fs-safe unhandled-rejection flake on prior run)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Pick-cat <266665499+Pick-cat@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-29 10:48:05 -07:00
maweibin
84cd3aa7f5 fix(cli): call process.exit(1) in root help and version fast path error handlers (#97793) (#97807)
The error handler in tryHandleRootHelpFastPath only set process.exitCode=1
without calling process.exit(). When dangling async handles exist (timers,
connections, promises), the Node event loop stays open and the CLI hangs
indefinitely instead of returning to the terminal.

In tryHandleRootVersionFastPath, the default onError handler called
process.exit(1) directly, bypassing the injected exit seam that the
success path already uses. Changed to exit(1) (deps.exit ?? process.exit)
so tests and embedded callers can observe and control exit on failure.

Added rejection-path tests for version fast path: injected exit called
on resolveVersion rejection, and caller-supplied onError honored.

Fixes #97793.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-29 10:47:55 -07:00
Yuval Dinodia
24626e5266 fix(compaction): count bashExecution and summary turns in pre-prompt overflow precheck (#97861)
estimateMessageTokenPressure special-cased toolResult, tool, and
assistant roles and otherwise read record.content. bashExecution stores
its payload in command/output and branchSummary/compactionSummary store
theirs in summary, so record.content was undefined and those turns
scored as bare boundary overhead. The provider request expands them via
convertToLlm into full user text, so bash-heavy sessions skipped the
preflight overflow gate and submitted oversized prompts.

Estimate each affected role from the exact text convertToLlm renders:
bashExecutionToText for bash turns (zero for excludeFromContext records,
which convertToLlm drops), and the summary prefix/suffix plus summary
text for the two summary roles.
2026-06-29 10:47:45 -07:00
Masato Hoshino
888f399499 fix(status): surface should-run plugin drift (#97878)
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-29 10:46:36 -07:00
Dallin Romney
beab0ecb02 test: link ClawHub packaged plugin QA evidence (#97712)
* test: link ClawHub packaged plugin QA evidence

* test: narrow ClawHub QA primary links
2026-06-29 10:46:33 -07:00
ly-wang19
5f60724b6d fix(nodes): guard node scalar fields against malformed entries 2026-06-29 10:36:29 -07:00
LiLan0125
685b95b607 fix(cron): warn when allowed web_search has no provider 2026-06-29 10:36:22 -07:00
cxbAsDev
597a0ba43c fix(discord): bound PluralKit and voice-message JSON reads 2026-06-29 10:36:16 -07:00