Commit Graph

2060 Commits

Author SHA1 Message Date
Peter Steinberger
28a3540f32 feat: add native inline widget support (#109212)
* feat: add native inline widget support

* refactor: simplify plugin surface refresh

* fix: preserve plugin surface refresh API

* fix: reload widgets after WebKit termination

* fix: harden native widget refresh

* fix: bound native widget recovery

* docs: defer native widget release note

* chore: refresh native i18n inventory

* fix: harden native widget delivery

* refactor: simplify native widget API surface

* fix: serialize native widget capability refresh

* fix: harden native widget recovery

* fix: recover native widget capabilities

* style: format widget refresh role selection

* fix: correct widget refresh formatting

* fix: harden cross-platform widget recovery

* fix: bind widget trust and recovery to routes

* chore: refresh native i18n inventory

* chore: regenerate Android gateway protocol

* test: remove unused release workflow read
2026-07-16 19:24:41 -07:00
Peter Steinberger
167a8ef20a fix(onboarding): harden fresh local startup and activation (#108764)
* fix(macos): preserve gateway during fresh setup

* fix(macos): validate reusable gateway service

* chore(macos): sync native i18n inventory

* fix(macos): preserve latest gateway service request

* test(macos): isolate gateway port concurrency coverage

* fix(macos): recover gateways after failed readiness

* fix(macos): repair wedged gateway listeners

* fix(macos): bound gateway startup probes

* chore(macos): sync native i18n inventory

* fix(onboarding): activate verified inference immediately

* fix(macos): isolate readiness failure generations

* chore(macos): refresh native i18n inventory

* fix(macos): serialize gateway service lifecycle

* fix(macos): sequence gateway startup persistence

* fix(macos): close gateway readiness races

* fix(macos): publish recovered gateway state

* fix(macos): make gateway readiness generation-safe

* chore(macos): refresh native i18n inventory

* fix(macos): preserve gateway endpoint identity

* fix(macos): refresh gateway ownership after attach

* fix(macos): distinguish transient gateway readiness

* refactor(macos): split gateway readiness lifecycle

* chore(macos): refresh native i18n inventory

* chore(release): keep changelog release-owned
2026-07-16 17:24:53 -07:00
Peter Steinberger
fbb5af6515 improve(mac): group pairing session providers (#109320)
* feat(mac): group pairing session access

* chore(i18n): sync native source inventory

* chore(mac): defer release note generation
2026-07-16 13:19:15 -07:00
Peter Steinberger
8f74762f4d fix(macos): merge the WebChat window title band into the toolbar row (#109318)
The standalone chat window stacked a visible title bar (traffic lights +
"OpenClaw" title) above the SwiftUI toolbar row, wasting a full band of
vertical space. Apply the Dashboard window's merged chrome: hidden title,
transparent titlebar, no separator, movable-by-background — the unified
toolbar (sidebar toggle, search, pickers, session actions) now shares its row
with the traffic lights. A window subclass pins titleVisibility to hidden
because SwiftUI's toolbar bridge can restore visible title chrome, and scene
bridging is reset to toolbars-only after controller attachment (attaching an
NSHostingController resets it to .all).
2026-07-16 13:12:24 -07:00
Peter Steinberger
e71ef76e8e feat(onboarding): offer detected Claude Code/Codex/Hermes memory imports across CLI, macOS, and Linux onboarding (#108977)
* feat(migrate): add Hermes memory-only import and a shared memory-import core

* feat(onboarding): offer detected memory imports during CLI setup and guided onboarding

* feat(ui): show a first-run memory-import offer in Control UI onboarding mode

* feat(linux-app): open the first-run dashboard in onboarding mode

* feat(macos): add the onboarding memory-import page

* docs: document the onboarding memory-import page across surfaces

* chore(i18n): translate onboarding memory-import strings for control-ui and native locales

* refactor: keep memory-import internals unexported for deadcode gates

* fix(ci): resolve lint findings in onboarding memory import

* chore(i18n): refresh native inventory after lint refactor

* fix(ci): skip updater artifacts in the unsigned Linux companion PR lane

* chore(i18n): reconcile locale artifacts after rebase
2026-07-16 10:10:01 -07:00
Peter Steinberger
79b1fdfa39 feat(mac): mascot accessory pack — nightcap, grad cap, hat-tip exit (#108882)
* feat(mac): mascot accessory pack — nightcap, grad cap, hat-tip exit

New accessory channel for the shared mascot: sleepy (and auto-dozing)
Clawd wears a floppy blue nightcap; the final onboarding page tops the
celebration with a graduation cap whose tassel swings with the body;
and leaving the working mood plays a hat-tip — claw to the brim, small
bow, hard hat lifts away. Headwear drawing moves to its own canvas
extension file.

* fix(mac): one hat at a time and no phantom hat tips

The working hard hat (including its hat-tip exit) suppresses any mood-
or consumer-requested accessory until it is fully gone, and the hat-tip
plays only when the hat actually seated — a working state cancelled
mid-don exits through the normal entrance instead of synthesizing a
full hat just to lift it.

* chore(i18n): refresh native inventory lines for mascot view
2026-07-16 09:14:21 -07:00
Peter Steinberger
8fe4eeea9e fix(exec): stop isolated state dirs from moving live approvals (#108742)
* fix(exec): isolate approval state directories

* chore: drop release-owned changelog entry

* chore: refresh native i18n inventory

* fix(ci): pin XcodeGen for Periphery scans
2026-07-16 08:57:32 -07:00
Peter Steinberger
65bdd1bf08 feat(mac): menu-bar critter celebrates gateway recovery and finished work (#108866)
Two one-shot micro-beats for the 18pt menu-bar critter: a happy-eyes
ear-wiggle when the Gateway comes back from a failure (judged against
the last settled status, so failed -> starting -> running still reads
as a comeback while cold starts and deliberate stop/start cycles stay
quiet), and a brief celebration when sustained work (>= 10s) finishes.
Short blips stay silent so the menu bar never gets noisy.
2026-07-16 08:52:43 -07:00
Peter Steinberger
8bcff3bad9 fix(macos): recover after installed app replacement (#108991)
* fix(macos): relaunch trusted app replacements

* refactor(macos): split relocator extension

* fix(macos): revalidate replacement bundle in child

* chore(macos): refresh native i18n inventory

* style(macos): satisfy Swift formatting and dead-code gates
2026-07-16 06:31:02 -07:00
Peter Steinberger
e4f4b93b10 feat(mac): playful hard-hat working mascot during setup and updates (#108735)
* feat(mac): playful hard-hat working mascot during setup and updates

The mascot gets a new .working mood: it dons a safety hard hat, hammers
away with impact sparks while setup work is in flight, and pauses every
few seconds to wipe its brow. Used on the onboarding "Getting things
ready" page and the post-update window instead of the generic thinking
mood. Lives in shared OpenClawKit so iOS can adopt it too.

* chore(i18n): refresh native inventory line for mascot view
2026-07-16 02:45:19 -07:00
Peter Steinberger
da59d6ade9 feat(onboarding): detect local inference providers (#108605)
* feat(onboarding): detect local inference providers

* fix(onboarding): satisfy inference choice lint

* chore(i18n): refresh onboarding locales

* chore: leave changelog to release automation

* chore(plugin-sdk): refresh API baseline

* fix(onboarding): preserve source config during local activation
2026-07-15 22:46:16 -07:00
Peter Steinberger
b1f4aac349 feat(agents): OpenClaw system-agent delegation
New openclaw delegation tool relays to openclaw.chat in-process; persistent
writes surface through the existing durable operator-approval registry as a
third system-agent kind (no parallel store), armed only by a human operator
in the Control UI — a delegated agent can never self-approve. Setup wizards
(channel/model/open-setup/open-tui) are refused in delegated mode so a
machine agent cannot complete setup or persist credentials unattended.
Vendor-neutral inference fallback ladder (requester route first, then other
authed providers by provider id). update.run removed from the gateway tool.
Caveman system-prompt fragment steers config/channels/plugins/agents/updates
to the openclaw tool. Doctor-owned state migration widens the approval-kind
constraint; runtime stays canonical-only.

Refs #107237
2026-07-15 01:56:31 -07:00
Peter Steinberger
db7c5d6a2c fix(macos): prevent Settings from opening with dashboard (#108074)
* fix(macos): keep settings explicit-only

* chore: defer release changelog

* chore(macos): refresh native i18n inventory

* refactor(macos): remove dead status router cleanup
2026-07-15 01:53:11 -07:00
Peter Steinberger
bfb015dbc5 fix(macos): silence Xcode 27 source warnings (#108081)
* fix(macos): silence Xcode 27 warnings

* fix(macos): silence remaining Swift 6.4 warnings
2026-07-15 01:49:23 -07:00
Peter Steinberger
bef86c8b88 fix(macos): skip post-update window for app-only updates (#108146)
* fix(macos): skip app-only update dialog

* fix(macos): preserve incomplete gateway recovery

* chore: leave release changelog ownership intact
2026-07-15 01:38:49 -07:00
Peter Steinberger
0d7da61e9b fix(macos): hide update guide after app-only updates (#108034)
* fix(macos): hide update guide for app-only updates

* chore: defer release note to release changelog

* docs(macos): clarify app-only update completion

* chore(i18n): sync native update strings
2026-07-15 00:09:26 -07:00
Peter Steinberger
c31d19950f refactor(macos): tighten status item lifecycle 2026-07-14 23:57:05 -07:00
Peter Steinberger
d61250ee7c fix(macos): keep left and right menu bar clicks reliable (#107786)
* fix(macos): stabilize menu bar click routing

* chore(macos): refresh native i18n inventory

* test(macos): avoid global menu event dispatch

* fix(macos): initialize status mouse router

* test(macos): avoid bare status button fixture

* test(macos): isolate status click routing
2026-07-14 21:12:58 -07:00
Peter Steinberger
b1b5e212c0 fix(mac): keep dashboard navigation beside link browser (#107798)
* fix(mac): keep dashboard navigation beside link browser

* chore(i18n): refresh macOS browser source location

* test(ui): mirror responsive nav fixture state

* test(mac): respect constrained runner window size

* test(mac): measure laid-out browser split width

* test(mac): use constrained window layout width

* fix(mac): refresh split frames before restoring width

* chore(i18n): refresh macOS browser source location

* test(mac): use constrained window frame width

* test(mac): snapshot constrained split geometry

* test(mac): exercise feasible divider shrink

* test(mac): verify divider persistence callback

* test(mac): use current split dimension constant
2026-07-14 19:01:45 -07:00
Peter Steinberger
6f8903bc4d fix(macos): distinguish app and Gateway updates (#107793)
* fix(macos): clarify app-owned gateway updates

* fix(macos): sync update ownership translations

* fix(i18n): refresh control UI fallbacks

* fix(i18n): translate new control UI copy

* fix(ui): keep update routing live
2026-07-14 17:06:45 -07:00
Peter Steinberger
890f20be06 feat(macos): coordinate app and Gateway updates (#107634)
* feat(macos): coordinate app and Gateway updates

* fix(macos): harden coordinated update recovery

* fix(gateway): reject mixed wake presence events

* chore: keep release notes in PR body

* chore(i18n): sync macOS update strings

* chore(generated): sync native artifacts

* style(macos): satisfy Swift checks

* chore(i18n): refresh update source locations

* fix(macos): localize post-update status

* fix(macos): satisfy post-update Swift lint

* chore(i18n): refresh post-update source locations

* test(gateway): isolate system-event routing state

* test(gateway): document system-event authorization
2026-07-14 14:59:32 -07:00
Peter Steinberger
f6653d1127 fix(macos): keep Connect Your AI choices in CLI order (#107642)
* fix(macos): align AI connection choices

* refactor(crestodian): extract setup auth options
2026-07-14 13:19:32 -07:00
Peter Steinberger
d66033315f style(macos): doc comment on storedPendingPayload
Refs #107237
2026-07-14 11:03:02 -07:00
Peter Steinberger
6fdbe9a02a fix(system-agent): adopt retired pending key and re-enter shell on bare /openclaw
Review findings on the rename: macOS resume store now migrates activation
leases persisted under the retired crestodian UserDefaults key so an app
upgrade cannot orphan a live activation; open-tui results carry
returnToShell so bare /openclaw re-enters the OpenClaw shell instead of
exiting the CLI.

Refs #107237
2026-07-14 11:03:02 -07:00
Peter Steinberger
a6a0716486 feat(setup): rename Crestodian to OpenClaw system agent
User-facing name is now OpenClaw (the system speaks); internal code name is
system-agent. Gateway methods crestodian.* -> openclaw.chat/openclaw.setup.*,
agent tool -> openclaw, reserved agent ids openclaw + retired crestodian.
openclaw setup routes: onboarding flags -> onboard, -m/--yes -> system agent,
bare configured interactive -> OpenClaw chat, unconfigured -> onboarding.
Hidden crestodian CLI and /crestodian TUI aliases kept; docs moved to
docs/cli/openclaw.md with redirect stub. macOS/Android strings in lockstep.

Refs #107237
2026-07-14 11:03:02 -07:00
Peter Steinberger
96eaf2be80 fix: restore recent native, browser, and audio behavior (#107631)
* fix: repair recent landed regressions

* chore: keep release changelog owned

* test(macos): align CLI fixtures with Node floor

* fix(macos): document Node runtime floor contract

* style(auto-reply): restore runtime mode formatting
2026-07-14 10:47:33 -07:00
Peter Steinberger
2bbf5e6ca0 fix(macos): prevent clipped and stalled onboarding (#107598)
* fix(macos): harden onboarding on short screens

* chore: keep release notes in PR body

* chore(i18n): refresh macOS onboarding inventory
2026-07-14 10:07:41 -07:00
Peter Steinberger
a9316bc65f fix(macos): honor attach-only launch agent marker (#107402) 2026-07-14 06:15:34 -07:00
Peter Steinberger
bc4ed5cf61 feat(macos): native-feel dashboard hosting — instant reopen, preload, frame autosave, ⌘N/⌘K, route memory (#106997)
* feat(macos): native-feel dashboard hosting: instant reopen, preload, frame autosave, ⌘N/⌘K, route memory

The hosted Control UI dashboard now skips SPA reloads when reopening an
unchanged endpoint (auth-equality gated), preloads after launch when a
credentialed local/direct config exists, autosaves its window frame, maps
⌘N/⌘K menu items onto the shipped native web events, filters browser-tell
context-menu items, restores the last committed route via web-side
localStorage memory, and themes the pre-paint background.

* refactor(ui): satisfy TS LOC ratchet: move optional lazy-element helpers out of app-host

app-host.ts is over the 500-line ratchet ceiling and may not grow; move the
self-contained optional custom-element block into lazy-custom-element.ts (its
natural owner) and fold the route-restore decision into native-route-memory's
considerRouteRestore so the shell only replaces-or-persists.

* fix(macos): recover stuck dashboard command queue via deliverability gate

Replace the failure-page-only fast-path check with canDeliverNativeCommands
(live document or in-flight load); a terminally cancelled reload now falls
through to the reload path instead of queueing ⌘N/⌘K forever.

* fix(ui): let in-flight navigation win over native route restore

The one-shot startup restore now checks the rendered/pending match against
the committed bootstrap route; an explicit navigation already in flight
(replayed native new-session, fast click) is no longer clobbered.

* docs(ui): note idempotent collapse of pending native new-session replays

* fix(macos): drop queued dashboard commands on terminal load failure

Queued ⌘N/⌘K are moment-bound; surviving a failure page meant a later
recovery reload replayed stale commands (double palette toggle nets closed,
surprise navigation). Both failure entry points now clear the queue.

* fix(ui): persist native route memory only for settled router states

Mid-navigation emissions still carry the stale committed bootstrap route; an
interrupted restore could overwrite the remembered destination with it.

* fix(macos): coalesce dashboard opens for queued native commands

One in-flight open drains a manager-level queue in press order; a Task per
key press could race window creation (duplicate windows) and reorder ⌘N/⌘K
delivery on the non-immediate remote path.

* fix(macos): correct dashboard placement after frame-autosave restore

setFrameAutosaveName re-applies the stored frame; run ensureOnScreen after
both autosave-name assignments so a frame saved on a disconnected monitor
cannot restore the window off-screen.

* fix(macos): clear dashboard failure state when history restores a real document

Swipe-back/⌘[ off the failure page commits an http(s) document without
passing through load(); the flag previously stayed set and forced a reload
on the next native command.

* fix(macos): keep in-flight dashboard loads instead of restarting them

An open/update during the launch preload previously cancelled and restarted
the same-URL load; in-flight non-failure documents now count as usable in
the reload decision.

* fix(macos,ui): ⌘K legacy fallback + transient search param filtering

Command palette dispatch now sends a cancelable toggle event and falls back
to the shipped open-search event when no handler acknowledges it, so ⌘K
keeps working against older gateway-served bundles. Route memory strips
one-shot action params (?draft=) before persisting; navigation state like
?session= still restores.

* chore(i18n): register dashboard menu strings + drop unused route-memory export

native:i18n:sync inventory + per-locale artifacts for New Session / Command
Palette…; StoredNativeRoute is module-internal after the considerRouteRestore
refactor (deadcode exports gate).

* chore(i18n): rebaseline raw-copy for relocated lazy-element labels

The lazy-custom-element extraction moved three internal load-failure labels
out of app-host.ts; refresh the keyless raw-copy baseline to match (main's
new ui:i18n:verify gate).
2026-07-14 03:33:25 -07:00
Peter Steinberger
20f145f9c1 fix(mac): enable terminal actions for paired-node sessions (#107361)
* fix(mac): enable paired-node terminal sessions

* fix(ci): align node worker bridge checks
2026-07-14 03:22:28 -07:00
Peter Steinberger
334e7f3f21 feat(apps): add native mobile Automations parity (#106355)
* fix(apps): address native Skills review feedback

* feat(apps): add native Automations parity

* fix(ios): preserve automation editor selection

* fix(android): page automation discovery

* chore(apps): refresh native source inventory

* fix(ios): refresh invalid automation diagnostics

* chore(apps): sync native localization

* fix(cron): stabilize paginated snapshots

* refactor(cron): split pagination helpers

* fix(apps): address final native review feedback

* chore(apps): refresh native source inventory

* fix(ios): dedupe automation list actions

* chore: keep release note in PR context

* fix(ci): repair current main architecture gates

* fix(ios): default new skill requirement fields

* fix(ios): retain queued automation reservations
2026-07-13 15:35:32 -07:00
Vincent Koc
898ef1f45c refactor(macos): remove write-only voice wake state (#106468) 2026-07-14 05:54:25 +08:00
Peter Steinberger
9b64c861e5 fix(chat): prevent reasoning races after model changes (#106534)
* fix(chat): serialize session setting changes

* fix(chat): bind settings mutations to gateway routes

* fix(chat): align settings lanes with shared requests

* fix(ios): preserve injected session mutations

* fix(chat): preserve authoritative settings refreshes

* fix(chat): reconcile authoritative settings state

* fix(ci): satisfy session settings quality gates

* fix(android): regenerate native string resources

* fix(ci): update session settings export baseline

* fix(ci): reconcile dead export baseline

* fix(android): resume outbox after settings lane

* chore(i18n): refresh native source inventory

* chore(i18n): refresh rebased native inventory

* chore(i18n): sync control UI locales

* chore: keep release notes in pull request

* style(macos): fix settings comment format

* fix(ai): keep Google thinking type internal
2026-07-13 14:27:54 -07:00
Jaksen Charles
cbb7f35084 fix: show confirm dialog for macOS dashboard deletes 2026-07-13 13:15:27 -07:00
Peter Steinberger
ce1c91d1ab fix(macos): defer cookie import banner until inline browser opens (#106255)
* fix(macos): defer browser import offer

* chore(macos): sync native i18n inventory

* chore: keep release note context in PR

* fix(macos): preserve first eligible browser offer

* fix(macos): retry armed browser offer on update

* fix(macos): retry browser offer after unavailable status

* fix(macos): retain browser offer reconnect retry

* fix(macos): retry stale browser import offer

* fix(macos): retry browser offer after onboarding

* chore(macos): sync native i18n inventory

* fix(macos): cancel stale browser offer
2026-07-13 09:28:16 -07:00
Peter Steinberger
0fe2132d5f feat(mac): gate Peekaboo Bridge on Computer Control (#106531)
Both settings grant local UI automation, so run PeekabooBridge only while
Allow Computer Control is on. The toggle now reflects the effective state and
is disabled when Computer Control is off; users drive Peekaboo via its own Mac
app in that case. Removes the confusing standalone bridge switch.
2026-07-13 08:56:27 -07:00
Peter Steinberger
7d23570591 fix(mac): keep node admission tunnel-local (#106481) 2026-07-13 08:19:53 -07:00
Peter Steinberger
50e5ffcd25 feat(mac): native pairing approval dialog with instant decisions (#106091)
* feat(mac): native pairing approval dialog with instant decisions

* chore(i18n): sync native inventory and locale artifacts

* chore(i18n): regenerate native inventory, locale artifacts, and projections

* chore(i18n): re-sync native inventory ordering
2026-07-13 07:08:14 -07:00
Peter Steinberger
4643bb4c2c fix(mac): keep remote nodes connected during config metadata writes (#106419)
* fix(mac): ignore config metadata churn

* chore: keep release note in PR
2026-07-13 06:31:11 -07:00
Peter Steinberger
e1a92c99cf fix(ios): persist chat thinking selections (#106287)
* refactor(apple): share chat gateway requests

* fix(ci): sync native app inventory

* docs: keep Apple release note in PR body
2026-07-13 05:44:08 -07:00
Peter Steinberger
265f79e607 fix(mac): allow five-minute node worker cold starts (#106380)
* fix(mac): extend node worker startup timeout

* chore: keep release notes in PR
2026-07-13 05:35:09 -07:00
Peter Steinberger
bfdfd35e5d fix(mac): allow slow node worker startup (#106281)
* fix(mac): allow slow node worker startup

* chore: leave release notes to release flow
2026-07-13 05:00:48 -07:00
Peter Steinberger
b0ebb81e89 refactor(macos): use swift-log contracts (#106270) 2026-07-13 04:18:32 -07:00
Peter Steinberger
73a0bf4b7c refactor(apple): share chat gateway payload mapping (#106154)
* refactor(apple): share chat gateway payload mapping

* test(apple): track shared event mapping
2026-07-13 02:39:01 -07:00
Peter Steinberger
4e46f08fed fix(macos): keep CLI path discovery off main actor (#106089) 2026-07-13 00:41:59 -07:00
Peter Steinberger
b2b87e956e fix(macos): center dashboard traffic lights with the hosted titlebar buttons (#106099)
* fix(macos): center dashboard traffic lights with the hosted titlebar buttons

Give the dashboard window an empty unified toolbar so its titlebar grows
to 52pt, vertically centering the macOS traffic lights against the row of
web-hosted titlebar buttons (sidebar toggle, back/forward) instead of
hugging the top edge. Bump the injected --openclaw-native-titlebar-height
to match, and nudge the hosted controls' left offset from 78px to 92px so
the traffic-light cluster and the first web button read as separate groups.

The toolbar exists only to size the titlebar, so View > Hide Toolbar (and
the corresponding shortcut) are refused; hiding it would collapse the
titlebar while the web inset stays pinned at 52pt, resurrecting the
misalignment. Smoke tests cover toolbar presence/style, hide refusal, and
the exact injected height.

* chore(i18n): resync native inventory line metadata
2026-07-13 00:17:13 -07:00
Peter Steinberger
b57e7b74e6 feat: add native Skills management parity (#105814)
* feat(apps): add native skills management parity

* chore(i18n): refresh native skills inventory

* style(apps): apply canonical Swift formatting

* style(ios): wrap skills status message

* chore(i18n): refresh native skill locales

* refactor(apps): trim native skills review surface

* chore(i18n): regenerate native app resources

* chore: keep release changelog owner-only

* fix(ios): remove dead gateway and watch wrappers
2026-07-13 00:11:11 -07:00
Peter Steinberger
f1076c23d4 fix(ci): isolate macOS node restart notifications 2026-07-13 02:54:10 -04:00
Peter Steinberger
b43e832fcc feat(ui): host the macOS dashboard titlebar buttons in the web UI (#105902)
* feat(ui): host the macOS dashboard titlebar buttons in the web UI

* style(ui): oxfmt macos titlebar controls

* fix(ui): bracket-access native web chrome globals for no-underscore-dangle

* docs(macos): note intentional no-fallback contract for non-web-chrome pages

* chore(ui): drop unused NativeHistoryStateEvent export

* chore(i18n): resync native inventory line metadata

* chore(i18n): translate nav.back/nav.forward across locales
2026-07-12 20:29:58 -07:00
Peter Steinberger
af326b98d7 fix(macos): avoid SwiftUI macro plugin dependency (#105768)
* fix(macos): avoid SwiftUI macro plugin dependency

* fix(macos): scope chat previews to iOS

* chore(i18n): refresh native source locations

* fix(macos): preserve explicit environment keys in formatter

* chore(pr): keep changelog release-owned
2026-07-12 17:40:41 -07:00