Commit Graph

59343 Commits

Author SHA1 Message Date
Vincent Koc
76658cd159 fix(ci): keep ci workflow edits off fast-only routing 2026-06-16 20:28:23 +02:00
dwc1997
3ad3cc61b8 fix(minimax): check base_resp envelope errors in TTS provider (#93688)
MiniMax TTS API returns HTTP 200 even on quota/billing errors, with the
error encoded in base_resp.status_code. Without this check, placeholder
audio returned alongside the error is silently accepted, preventing the
TTS dispatcher from falling back to a configured secondary provider.

This follows the same pattern used by all other MiniMax providers:
- image-generation-provider.ts
- video-generation-provider.ts
- music-generation-provider.ts
- minimax-web-search-provider.runtime.ts

Fixes #76904

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-17 02:25:46 +08:00
Vincent Koc
3b7729779a fix(ios): reject malformed node e2e wait seconds 2026-06-16 20:20:46 +02:00
liuhao1024
17bdd3375f fix(whatsapp): extract GIF metadata and distinguish gifPlayback in media placeholders (fixes #49099) (#93679)
* fix(whatsapp): extract GIF metadata and distinguish gifPlayback in media placeholders (fixes #49099)

- Add escapeAttr() helper to sanitize quotes and angle brackets in XML attribute values
- Add extractExternalAdReplyMetadata() to extract title, sourceUrl, body from contextInfo.externalAdReply
- Distinguish GIFs from videos using videoMessage.gifPlayback flag (media:gif vs media:video)
- Enrich image and video placeholders with externalAdReply metadata when available
- Add 5 test cases covering GIF detection, metadata extraction, attribute escaping, and empty fields

* fix(whatsapp): keep GIF metadata in untrusted context

---------

Co-authored-by: Vincent Koc <25068+vincentkoc@users.noreply.github.com>
2026-06-17 02:12:10 +08:00
ZengWen-DT
cfdcd5cdfd fix(qqbot): deliver cron auto-TTS voice by trusting OpenClaw temp root (#92947)
QQBot is the only channel that root-sandboxes outbound local files. Its three
gate sites (resolveOutboundMediaPath, the voice send re-check, and
structured-payload validation) only trusted the QQ Bot media storage roots, so
framework-generated scratch media written under OpenClaw's hardened temp root
(e.g. cron auto-TTS voice files from speech-core) was rejected. The send then
returned a no-identity error, the message was silently lost, yet cron still
recorded it as delivered.

Add one shared resolver (resolveTrustedOutboundMediaPath) that also trusts the
preferred OpenClaw temp root — already a sanctioned media root in core
(buildMediaLocalRoots) — and route all three gates through it so the trust set
agrees everywhere. Fixes #92816.

Co-authored-by: zengwen <zeng_wen@foxmail.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-17 02:11:52 +08:00
Vincent Koc
875669e38e fix(ci): keep approval type contracts off runtime imports 2026-06-16 20:08:49 +02:00
Vincent Koc
8d159e1ff8 fix(qa): reject loose Parallels host ports 2026-06-16 20:08:49 +02:00
Goutam Adwant
2c286c3465 fix(google-meet): declare realtime provider secret inputs (#93677)
* fix(google-meet): declare realtime provider secret inputs

* test(secrets): cover Google Meet installed manifest

---------

Co-authored-by: Vincent Koc <25068+vincentkoc@users.noreply.github.com>
2026-06-17 01:58:37 +08:00
Vincent Koc
7bf821a2ee fix(qa): match Windows RPC sampling ports exactly 2026-06-16 19:48:32 +02:00
Peter Steinberger
070685f765 chore(release): update appcast for 2026.6.8 (#93722)
Merged via squash.

Prepared head SHA: 8647435153
Co-authored-by: vincentkoc <25068+vincentkoc@users.noreply.github.com>
Reviewed-by: @vincentkoc
2026-06-17 01:37:43 +08:00
Vincent Koc
33862206b4 fix(qa): reject invalid qa lab ports 2026-06-16 19:35:48 +02:00
Alix-007
e77fa3aeba fix(openai-completions): guard string assistant content in transform + tool-history (#93681)
When an assistant message's `content` is a raw string at runtime (JSONL
transcript replay passes it through even though the type declares an array),
the OpenAI-compatible completions path crashes:

- `transformMessages` called `assistantMsg.content.flatMap(...)` ->
  `TypeError: ... .flatMap is not a function` (first crash, always hit).
- Two `hasToolHistory` helpers (`openai-transport-stream.ts` and
  `openai-completions.ts`) called `content.some(...)` -> `TypeError: ...
  .some is not a function` (siblings, surface once the flatMap crash is fixed).

Normalize a string assistant content to an equivalent single text block
before transforming (matching the string->text handling already used in
anthropic-payload-policy.ts), and `Array.isArray`-guard both `hasToolHistory`
helpers so a string assistant simply does not count toward tool history.

Verified end-to-end through the real `buildOpenAICompletionsParams` and
`streamOpenAICompletions` entry points: before the fix a string-content
assistant followed by a toolResult throws TypeError; after the fix params are
produced correctly (string preserved as text, tool history detected). Normal
array content is unaffected.
2026-06-17 01:32:46 +08:00
Vincent Koc
c1df7aa08b fix(context-engine): avoid turn-maintenance lane livelock (#93727)
* fix(context-engine): resolve deferred turn-maintenance livelock

Co-authored-by: Vishnu <268122714+baghvn@users.noreply.github.com>

* fix(clownfish): address review for gitcrawl-451-autonomous-terminal-gap (1)

Co-authored-by: Vishnu <268122714+baghvn@users.noreply.github.com>

* fix(clownfish): address review for gitcrawl-451-autonomous-terminal-gap (1)

Co-authored-by: Vishnu <268122714+baghvn@users.noreply.github.com>

* fix(clownfish): address review for gitcrawl-451-autonomous-terminal-gap (1)

Co-authored-by: Vishnu <268122714+baghvn@users.noreply.github.com>

---------

Co-authored-by: openclaw-clownfish[bot] <280122609+openclaw-clownfish[bot]@users.noreply.github.com>
Co-authored-by: Vishnu <268122714+baghvn@users.noreply.github.com>
2026-06-17 01:30:09 +08:00
litang9
d1e20d2f29 fix(gateway): surface codex app-server returned failures (#93665)
* fix(gateway): surface codex app-server returned failures

* fix(auto-reply): retain codex app-server failures

* fix(agents): mark codex completion timeouts terminal

---------

Co-authored-by: Alex Tang <tangli1987118@hotmail.com>
Co-authored-by: Vincent Koc <25068+vincentkoc@users.noreply.github.com>
2026-06-17 01:20:34 +08:00
mushuiyu_xydt
1469441ff4 fix(gateway): send approval route notices with write scope (#93656)
* fix(gateway): send approval route notices with write scope

* fix(gateway): avoid approval runtime import cycle

* fix(approvals): preserve scoped runtime requests

---------

Co-authored-by: Vincent Koc <25068+vincentkoc@users.noreply.github.com>
2026-06-17 01:19:19 +08:00
Ayaan Zaidi
42dcf7075f Fix Telegram rich progress detail updates (#93698)
Merged via squash.

Prepared head SHA: 77da499825
Co-authored-by: obviyus <22031114+obviyus@users.noreply.github.com>
Co-authored-by: obviyus <22031114+obviyus@users.noreply.github.com>
Reviewed-by: @obviyus
2026-06-16 22:48:12 +05:30
liuhao1024
0278b59d0e fix(respawn): rewrite pnpm versioned entry paths to stable wrapper (fixes #52313) (#93671)
* fix(respawn): rewrite pnpm versioned entry paths to stable wrapper

During self-update the pnpm versioned directory (node_modules/.pnpm/openclaw@<ver>/)
may be removed. If process.argv contains the versioned path, the respawned child
fails to start because the entrypoint no longer exists.

Detect pnpm versioned realpaths in spawnDetachedGatewayProcess and rewrite them
to the stable node_modules/<pkg>/openclaw.mjs wrapper before spawning.

Fixes #52313

* fix(respawn): scope pnpm entry rewrite to openclaw

---------

Co-authored-by: Vincent Koc <25068+vincentkoc@users.noreply.github.com>
2026-06-17 01:15:24 +08:00
joshavant
62503c4b48 android: check version sync for mixed release changes 2026-06-16 19:13:44 +02:00
joshavant
f78235d346 android: include changelog in metadata upload 2026-06-16 19:13:44 +02:00
joshavant
d42e557a66 android: combine play release upload 2026-06-16 19:13:44 +02:00
joshavant
2971775ead android: upload changelog with play build 2026-06-16 19:13:44 +02:00
joshavant
c9a854c217 android: fix release screenshot review blockers 2026-06-16 19:13:44 +02:00
joshavant
f3ab59db58 android: generate release screenshots 2026-06-16 19:13:44 +02:00
joshavant
91fb5d3823 android: add play release upload lane 2026-06-16 19:13:44 +02:00
joshavant
91220cbd31 android: archive release artifacts from pinned version 2026-06-16 19:13:44 +02:00
joshavant
40eec48caf android: add pinned release versioning 2026-06-16 19:13:44 +02:00
ml12580
b836946879 fix(wizard): preserve existing default model during setup auth choice [AI-assisted] (#93658)
* fix(wizard): preserve existing default model during setup auth choice

Without preserveExistingDefaultModel: true, the setup wizard
overwrite the user's configured default model when a new provider
auth is selected. This causes existing heartbeat turns to silently
consume paid API quota (e.g. Google Gemini) instead of the user's
original model.

The configure.gateway-auth.ts path already passes this flag; the
setup wizard path was missing it.

Fixes #64129

* fix(wizard): add type assertion for preserveExistingDefaultModel test
2026-06-17 01:13:33 +08:00
ZengWen-DT
6470bb7625 fix(heartbeat): bootstrap plugin session targets (#93630)
* fix(heartbeat): bootstrap plugin session targets

* fix(heartbeat): reuse bootstrapped route plugin

* fix(heartbeat): preserve active external route plugins

* fix(heartbeat): carry prepared plugin through routing

* fix(heartbeat): canonicalize with prepared route plugin

* fix(heartbeat): preserve explicit route account context

* fix(heartbeat): enforce prepared plugin route policy

* fix(outbound): partition prepared plugin target cache

* test(cron): expect prepared delivery plugin

* test(outbound): use complete plugin fixtures

* fix(outbound): bootstrap direct metadata shells

* fix(outbound): scope external runtime activation

* test(outbound): model activated direct plugins

* fix(heartbeat): keep route policy activation-aware

* fix(heartbeat): preserve prepared plugin policy

---------

Co-authored-by: Vincent Koc <25068+vincentkoc@users.noreply.github.com>
2026-06-17 01:02:49 +08:00
Vincent Koc
617f97d4b9 fix(plugin-sdk): refresh API baseline hash 2026-06-16 18:34:45 +02:00
Vincent Koc
3d05da9a54 fix(telegram): preserve streamed text during media normalization 2026-06-16 18:19:04 +02:00
clawsweeper[bot]
5ce413a2c7 fix(i18n): retain Codex error tails in logs (#93687)
Summary:
- This PR changes the docs i18n Codex command-output preview to keep a short head plus retained tail, and adds Go unit coverage for stdout and stderr tails.
- PR surface: Other +20. Total +20 across 2 files.
- Reproducibility: yes. Source inspection of current main and `v2026.6.6` shows long output is truncated to the prefix only, and the PR's focused tests model the stdout/stderr tail cases that lose final API details.

Automerge notes:
- No ClawSweeper repair was needed after automerge opt-in.

Validation:
- ClawSweeper review passed for head b510b598c6.
- Required merge gates passed before the squash merge.

Prepared head SHA: b510b598c6
Review: https://github.com/openclaw/openclaw/pull/93687#issuecomment-4720840859

Co-authored-by: clawsweeper <274271284+clawsweeper[bot]@users.noreply.github.com>
Co-authored-by: Mason Huang <8814856+hxy91819@users.noreply.github.com>
Approved-by: hxy91819
2026-06-16 16:14:12 +00:00
Alix-007
3630ce6cbb fix(agents): return string assistant content in getLastAssistantText (#93646)
* fix(agents): handle string assistant content in getLastAssistantText

PR #93456 added an `if (!Array.isArray(message.content)) return false` guard
to hasAssistantToolCallArguments, acknowledging that a persisted/legacy
assistant message can carry a string `content` at runtime even though the
type is declared as an array. buildSessionContext pushes such entries through
unchanged, so the string can reach agent.state.messages.

getLastAssistantText() still assumed an array: iterating a string `content`
yields individual characters, none of which has `type === "text"`, so the
assistant's text was silently dropped and the function returned undefined.

Mirror extractTextContent(): when `content` is a string, treat it as the text
itself; otherwise iterate the content blocks as before. The aborted/empty
check is left untouched because `.length === 0` is already correct for both an
empty array and an empty string.

* fix(agents): safely read persisted assistant text

---------

Co-authored-by: Vincent Koc <25068+vincentkoc@users.noreply.github.com>
2026-06-16 23:57:28 +08:00
Vincent Koc
64785823d0 fix(gateway): ignore stale sudo scope for root user services (#93693)
Co-authored-by: openclaw-clownfish[bot] <280122609+openclaw-clownfish[bot]@users.noreply.github.com>
2026-06-16 23:56:12 +08:00
Vincent Koc
6e3ebaccf0 fix(telegram): dispatch MEDIA directives as attachments (#93690)
* fix(telegram): deliver MEDIA directive replies as attachments

* fix(clownfish): address review for gitcrawl-167-autonomous-terminal-gap (1)

---------

Co-authored-by: openclaw-clownfish[bot] <280122609+openclaw-clownfish[bot]@users.noreply.github.com>
2026-06-16 23:52:59 +08:00
liuhao1024
a67ae8137d fix(reply): preserve unsent text-only finals after block pipeline streamed partial content (fixes #81078) (#93629)
When the block reply pipeline streamed partial content, buildReplyPayloads()
unconditionally dropped all text-only final payloads. This suppressed the
complete final reply when the pipeline only streamed a partial block and
never sent the exact final text.

The fix checks hasSentPayload() for text-only payloads too, preserving
unsent finals instead of dropping them unconditionally.
2026-06-16 23:49:12 +08:00
pick-cat
a6b348a307 fix(control-ui): copy code blocks over plain HTTP via clipboard fallback (#93666)
The async Clipboard API is only available in secure contexts (HTTPS or
localhost). On plain-HTTP deployments navigator.clipboard is undefined, so the
code block copy button threw synchronously and silently failed. Add a shared
copyToClipboard helper that guards the secure-context path and falls back to the
legacy execCommand copy, reuse it for the code block button and the copy-as-
markdown affordance, and cover it with a unit test plus a real-browser e2e that
simulates the non-secure context.

Fixes #93628

Co-authored-by: Pick-cat <266665499+Pick-cat@users.noreply.github.com>
2026-06-16 23:47:03 +08:00
Vincent Koc
f285a0c4c4 fix(ci): fail unusable Windows testbox phone-home 2026-06-16 17:24:18 +02:00
Vincent Koc
05584427a8 fix(deps): update Hono security pin
Update the global Hono override and published shrinkwraps to 4.12.25 so release packages avoid the current high-severity CORS advisory.
2026-06-16 23:12:39 +08:00
Mason Huang
f046d7aa23 fix(status): ignore stale context after model switch (#93306)
Summary:
- The PR changes `/status` context-window selection to ignore stale runtime snapshots after manual model switches while preserving fallback/runtime-alias context windows.
- PR surface: Source +6, Tests +128. Total +134 across 2 files.
- Reproducibility: yes. source-reproducible: current main trusts explicit runtime context before checking fall ... fer. I did not run a local failing repro, but the PR fixture models the stale prior-runtime state directly.

Automerge notes:
- PR branch already contained follow-up commit before automerge: test(status): make context fixtures type-correct

Validation:
- ClawSweeper review passed for head f14fda4279.
- Required merge gates passed before the squash merge.

Prepared head SHA: f14fda4279
Review: https://github.com/openclaw/openclaw/pull/93306#issuecomment-4708596208

Co-authored-by: Mason Huang <masonxhuang@tencent.com>
Approved-by: hxy91819
2026-06-16 15:05:51 +00:00
Vincent Koc
de1d329e31 fix(plugins): allow Dreaming sidecar through restrictive memory allowlists (#93678)
Co-authored-by: openclaw-clownfish[bot] <280122609+openclaw-clownfish[bot]@users.noreply.github.com>
Co-authored-by: pradeep7127 <21005375+pradeep7127@users.noreply.github.com>
2026-06-16 23:02:15 +08:00
Vincent Koc
75cdf22152 fix(browser): accept top-level act fields with nested requests (#93674)
* fix(browser): accept top-level act fields with nested requests

Co-authored-by: Capivariano <11271294+angelusbr@users.noreply.github.com>

* fix(clownfish): address review for gitcrawl-416-autonomous-terminal-gap (1)

Co-authored-by: Capivariano <11271294+angelusbr@users.noreply.github.com>

---------

Co-authored-by: openclaw-clownfish[bot] <280122609+openclaw-clownfish[bot]@users.noreply.github.com>
Co-authored-by: Capivariano <11271294+angelusbr@users.noreply.github.com>
2026-06-16 22:50:53 +08:00
Vincent Koc
acc375ff75 fix(commands): preserve multiline slash skill args (#93672)
Co-authored-by: openclaw-clownfish[bot] <280122609+openclaw-clownfish[bot]@users.noreply.github.com>
Co-authored-by: Blind Dev <264741654+web3blind@users.noreply.github.com>
2026-06-16 22:47:15 +08:00
Vincent Koc
e48222175f fix(browser): recover stale managed Chrome CDP listener (#93670)
* fix(browser): recover stale managed Chrome CDP listener

Co-authored-by: Rohit <76606932+rohitjavvadi@users.noreply.github.com>

* fix(clownfish): address review for gitcrawl-387-autonomous-terminal-gap (1)

Co-authored-by: Rohit <76606932+rohitjavvadi@users.noreply.github.com>

---------

Co-authored-by: openclaw-clownfish[bot] <280122609+openclaw-clownfish[bot]@users.noreply.github.com>
Co-authored-by: Rohit <76606932+rohitjavvadi@users.noreply.github.com>
2026-06-16 22:45:21 +08:00
Vincent Koc
1fc04ac6e3 fix(ios): satisfy watch screenshot SwiftFormat 2026-06-16 16:24:32 +02:00
Vincent Koc
5939a2ac9f fix(clawdock): open dashboard on published port without starting deps (#93663)
Co-authored-by: openclaw-clownfish[bot] <280122609+openclaw-clownfish[bot]@users.noreply.github.com>
Co-authored-by: Derek Homan <205598+dhoman@users.noreply.github.com>
2026-06-16 22:24:00 +08:00
Vincent Koc
6656c71c7a fix(discord): protect mention aliases in code fences (#93662)
Co-authored-by: openclaw-clownfish[bot] <280122609+openclaw-clownfish[bot]@users.noreply.github.com>
Co-authored-by: Rohit <76606932+rohitjavvadi@users.noreply.github.com>
2026-06-16 22:22:02 +08:00
github-actions[bot]
8c7690b256 chore(ui): refresh fa control ui locale 2026-06-16 14:18:52 +00:00
github-actions[bot]
7c314e1504 chore(ui): refresh nl control ui locale 2026-06-16 14:18:27 +00:00
github-actions[bot]
6ab41d50d4 chore(ui): refresh th control ui locale 2026-06-16 14:17:41 +00:00
github-actions[bot]
f95ca1de26 chore(ui): refresh vi control ui locale 2026-06-16 14:17:28 +00:00