Commit Graph

53987 Commits

Author SHA1 Message Date
Peter Steinberger
b78ebacb18 refactor: centralize plugin model discovery 2026-05-29 09:24:08 +01:00
Jayesh Betala
189a7962b2 fix(cli): reject empty config path segments
Reject malformed dot-notation config paths before `openclaw config get/set/unset` reads or mutates config. Empty, leading, trailing, whitespace-only, and dot-before-bracket segments now fail closed instead of normalizing to a different key, while valid bracket paths and escaped dots continue to work.

Thanks @jbetala7 for the fix.

Verification:
- `git diff --check`
- `node scripts/run-vitest.mjs run src/cli/config-cli.test.ts` (111 passed)
- GitHub exact-head checks on `116254ba414bff6a0c3881e34fad30baca95ef0a`: 76 success, 23 skipped, 1 neutral, 0 failures

Fixes #87564

Co-authored-by: Jayesh Betala <jayesh.betala7@gmail.com>
2026-05-29 09:23:32 +01:00
UB
d18ee1881c fix(discord): remove optional runtime error shims
Remove unreachable optional chaining from four Discord message-handler-family runtime error calls.

This aligns the code with the required RuntimeEnv.error contract while leaving production behavior unchanged for valid runtimes. Maintainer-updated PR proof clarifies that shared queue reporter hooks still treat malformed runtime reporter failures as best-effort.
2026-05-29 09:22:44 +01:00
Peter Steinberger
5ff0c75da7 fix(config): preserve large numeric schema keys 2026-05-29 04:20:42 -04:00
Peter Steinberger
f6d293a1ee fix(telegram): reject unsafe callback pages 2026-05-29 04:15:13 -04:00
Ninty
ee6eab8143 fix(agents): clean up exec abort listener after completion (#83022)
Clean up completed exec tool-call abort listeners so normal foreground completion and background-yield no longer retain the exec run/session context through AbortSignal listener state.

The listener cleanup now lives beside the exec listener registration and runs when the foreground process settles, rejects, or the tool returns a background running result. Existing abort/timeout/background behavior remains owned by the process supervisor and process registry.

Verification:
- gh pr checks 83022
- gh api repos/openclaw/openclaw/commits/fe86528ecb2043b6febef5c2eec53f9124be5543/check-runs
- git merge-tree --write-tree origin/main refs/remotes/pr/83022
- git diff --check origin/main...refs/remotes/pr/83022
- node AbortSignal add/remove listener probe

Thanks @c19354837.

Co-authored-by: Ninty <c19354837@hotmail.com>
2026-05-29 09:15:07 +01:00
Syu
843577f69a test(tasks): cover legacy flow run migration edge cases
Add regression coverage for legacy and hybrid flow_runs SQLite migrations, including post-rebuild managed writes and canonical owner_key schema assertions.\n\nVerification:\n- node scripts/run-vitest.mjs src/tasks/task-flow-registry.store.test.ts\n- .agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main
2026-05-29 09:15:01 +01:00
Vincent Koc
a4bb9b1438 refactor: share browser debug route responses 2026-05-29 10:14:18 +02:00
Peter Steinberger
895d1a90f3 fix(google-meet): reject invalid auth timeouts 2026-05-29 04:11:02 -04:00
Vincent Koc
456cade93c fix(together): bound generated video downloads 2026-05-29 10:10:39 +02:00
Jayesh Betala
2990c00cb5 fix(skills): tolerate BOM-prefixed frontmatter
Fixes #66479.

Workspace skills whose SKILL.md starts with a UTF-8 BOM now keep their shared markdown frontmatter metadata, so they remain discoverable through skills list. The fix strips one leading BOM at the parser boundary and adds parser plus workspace discovery regression coverage.

Thanks @jbetala7 for the fix.

Co-authored-by: Jayesh Betala <jayesh.betala7@gmail.com>
2026-05-29 09:10:21 +01:00
Peter Steinberger
35cdd40182 fix(cli): reject unsafe duration values 2026-05-29 04:06:56 -04:00
Pavan Kumar Gondhi
9497629c1e fix(msteams): pin attachment fetch DNS
Route Microsoft Teams attachment downloads through the shared SSRF guarded fetch path so DNS validation is pinned into the dispatcher used for the actual request.

Keep Teams auth fallback and allowlisted HTTPS Authorization redirect behavior while failing closed for custom fetch hooks that cannot accept dispatcher injection.

Verification:
- CI=1 OPENCLAW_VITEST_MAX_WORKERS=1 timeout 300 node scripts/run-vitest.mjs run extensions/msteams/src/attachments/shared.test.ts extensions/msteams/src/attachments/bot-framework.test.ts src/infra/net/fetch-guard.ssrf.test.ts
- gh pr checks 87567 --repo openclaw/openclaw --watch=false

PR: #87567
2026-05-29 09:03:50 +01:00
Peter Steinberger
e5063f51cb fix(phone-control): reject invalid arm durations 2026-05-29 04:03:45 -04:00
Vincent Koc
3e050d05e8 refactor: share session tab registry helpers 2026-05-29 10:02:18 +02:00
Peter Steinberger
8363d6596c ci: retry transient checkout fetch timeouts 2026-05-29 09:00:45 +01:00
Peter Steinberger
6fab00acaa fix(docs): preserve plugin reference manual sections 2026-05-29 09:00:28 +01:00
Peter Steinberger
24614ac100 refactor(browser): centralize route numeric readers 2026-05-29 03:59:19 -04:00
Vincent Koc
6c309b9883 refactor: share browser route navigation policy 2026-05-29 09:52:12 +02:00
Peter Steinberger
2ea8d88d63 fix(browser): validate cookie expiry values 2026-05-29 03:50:19 -04:00
Vincent Koc
0fbd975fe8 test(infra): avoid host-specific exec path fixtures 2026-05-29 09:49:49 +02:00
Peter Steinberger
ac52499aca fix(browser): validate screenshot timeout 2026-05-29 03:46:53 -04:00
Vincent Koc
4ad875308f fix(memory): bound remote JSON responses 2026-05-29 09:45:39 +02:00
Peter Steinberger
c48a4a3188 fix(browser): validate geolocation options 2026-05-29 03:43:06 -04:00
Abdel Gomez-Perez
9de6abd8d7 fix(agents): bridge CLI tool progress events 2026-05-29 13:04:31 +05:30
Peter Steinberger
c7f50738c0 fix(browser): validate permission grant timeout 2026-05-29 03:34:06 -04:00
Peter Steinberger
dca86d47e0 fix(browser): validate hook download timeouts 2026-05-29 03:30:46 -04:00
Peter Steinberger
854cb9292d fix(browser): validate response body numeric options 2026-05-29 03:27:34 -04:00
Vincent Koc
fce7470495 refactor: share file transfer node host path handling 2026-05-29 09:26:24 +02:00
Peter Steinberger
0b24f47465 fix(browser): tighten act numeric parsing 2026-05-29 03:23:42 -04:00
Peter Steinberger
4fae13e29e fix(browser): centralize snapshot numeric parsing 2026-05-29 03:15:56 -04:00
Peter Steinberger
0bc591a7d7 fix(browser): reject invalid tab indexes 2026-05-29 03:07:15 -04:00
Vincent Koc
0a14f593c3 refactor: share file transfer node invoke handling 2026-05-29 09:05:36 +02:00
Vincent Koc
c9a939ad2d fix(release): bound ClawHub owner metadata 2026-05-29 09:03:22 +02:00
Peter Steinberger
286883cc54 fix(browser): cap route timer delays 2026-05-29 03:03:07 -04:00
Peter Steinberger
b0730944eb fix(browser): cap cli request timeouts 2026-05-29 02:50:51 -04:00
Vincent Koc
d78b0814d5 fix(gateway): avoid cold-loading providers for MCP inventory 2026-05-29 08:48:35 +02:00
Vincent Koc
2879f76301 refactor: share xai code execution tool config 2026-05-29 08:48:27 +02:00
Peter Steinberger
13ac8a0758 fix(google-meet): validate api page size 2026-05-29 02:46:50 -04:00
Peter Steinberger
31f3914082 fix(voice-call): bound cli numeric options 2026-05-29 02:42:44 -04:00
Peter Steinberger
8e56c024df fix(gateway): cap handshake timer delays 2026-05-29 02:38:45 -04:00
Vincent Koc
70230f4235 refactor: share brave web search metadata 2026-05-29 08:34:37 +02:00
Vincent Koc
44adda3195 fix(release): bound ClawHub verifier responses 2026-05-29 08:33:50 +02:00
Peter Steinberger
4829d30cf0 fix(mattermost): bound slash callback env port 2026-05-29 02:31:53 -04:00
ZC
7a381b807e fix(cron): preflight model fallbacks before skip (#82887)
Fix cron local-model preflight fallback handling so scheduled runs try configured fallback candidates before skipping when the local primary is unavailable.

Verification:
- GitHub CI on PR head fe884dab90: passing required CI checks.
- Local focused cron/model fallback tests passed earlier for the touched surface.
- Local merge-wrapper build and check passed on the prepared candidate.
- Local full pnpm test reported unrelated failures outside this PR's touched files; touched files are limited to cron docs, src/agents/model-fallback.ts, and src/cron/isolated-agent/*.

Co-authored-by: chen-zhang-cs-code <chenzhangcode@163.com>
Co-authored-by: Onur Solmaz <2453968+osolmaz@users.noreply.github.com>
2026-05-29 14:29:26 +08:00
Ayaan Zaidi
c559776c51 fix(channels): preserve room event progress suppression 2026-05-29 11:56:58 +05:30
Ayaan Zaidi
f9b1132bbb test(channels): cover suppressed group progress callbacks 2026-05-29 11:56:58 +05:30
Peter Lindsey
85b6f91bd7 fix(dispatch): forward channel-owned progress callbacks in all chat types when verbose is off
Remove the chatType === 'direct' guard from
shouldAllowQuietChannelOwnedProgressCallbacks so that channel-owned native
progress callbacks (onToolStart, onItemEvent, onPlanUpdate,
onApprovalEvent, onCommandOutput, onPatchSummary, onCompactionStart/End)
are forwarded in group and group-channel sessions when verbose is off.

Previously the guard required chatType === 'direct', which meant that
/verbose off would suppress all progress callbacks in group sessions
while direct sessions continued to relay them. Message-level tool
summary suppression is handled separately; native channel relay hooks
should not be gated on chat type.

Closes #87612
2026-05-29 11:56:58 +05:30
Peter Steinberger
0f0c744517 fix(config): bound gateway env ports 2026-05-29 02:26:01 -04:00
Vincent Koc
91a78477d0 refactor: share xai web search metadata 2026-05-29 08:23:32 +02:00