* feat(gateway): add sessions.files.reveal to open a session workspace on the gateway host
Resolves the session's workspace root server-side (same resolution as
sessions.files.list), refuses exec-node and cloud-worker placements, and
opens the directory with the platform opener. The opener helpers move out
of config.ts into a shared open-path module that config.openFile now uses.
* feat(ui): always-on chat title bar with inline rename and workspace menu
Every chat pane now renders its header: click the session title to rename
it inline (Enter commits via sessions.patch, Escape cancels), a workspace
chip names the session's checkout with reveal/copy-path/copy-branch
actions, and cloud-worker sessions show a globe. The single-pane floating
toggle cluster and the transcript's reserved titlebar drag band fold into
the header, which keeps native macOS window dragging.
* fix(ui): resolve title-bar session aliases and clear the collapsed-nav overlay
Live verification found two gaps: route aliases like ?session=main showed
the generic key-derived title instead of the session's label (resolve via
hello defaults + key equivalence, matching the pane), and the floating
sidebar-expand pill overlapped the header title on plain web while the nav
was collapsed (52px inset, mirroring the native-shell clearances).
* fix(ui): keep the protocol schema layer out of the Control UI startup bundle
The title-bar change made session-row-badges runtime-import the
gateway-protocol barrel for one classifier, dragging typebox and every
schema into startup JS (395 KiB gzip vs the 370 KiB budget). The placement
vocabulary now lives in a dependency-free session-placement-state module:
the schema union derives from it, the barrel re-exports it, and the UI
deep-imports it (startup back to 361.8 KiB).
* fix(gateway-protocol): keep SessionPlacementStateSchema statically typed
Type.Union over a mapped array loses tuple inference and collapses Static
to never; the literal list stays explicit with a compile-time guard tying
it to the shared SESSION_PLACEMENT_STATES vocabulary.
* chore(protocol): regenerate Swift/Kotlin bindings for sessions.files.reveal
* chore: narrow new exports flagged by the deadcode gate
* chore(i18n): leave generated locale artifacts to the locale-refresh workflow
The generated-artifact isolation gate (067635cb51) landed mid-flight;
source PRs now carry en.ts only.
The run-scoped plan snapshot already fed the sticky composer bar; it now
also renders as an always-expanded card inside the active run's work
group, so plan progress is visible in scroll context. The bar and card
share one extracted renderer (variant: bar | card) instead of duplicating
the template, and the card clears with the run through existing plan
lifecycle.
* feat(ui): add verify-connection affordance and device-code wizard e2e to Model Setup
* fix(ui): drop unnecessary Boolean conversion in canVerify
* chore(ui): reconcile i18n baselines after rebase
Adds the sidebar approval attention chip and a dedicated approval history
page backed by the new approval.history gateway RPC (30-day retention
window). Extracts buildSidebarAttentionItems into its own module so the Lit
component consumes it as a real cross-module dependency, and wires the strict
i18n catalog for the new strings (fallbacks=0).
* feat(migrate): add Hermes memory-only import and a shared memory-import core
* feat(onboarding): offer detected memory imports during CLI setup and guided onboarding
* feat(ui): show a first-run memory-import offer in Control UI onboarding mode
* feat(linux-app): open the first-run dashboard in onboarding mode
* feat(macos): add the onboarding memory-import page
* docs: document the onboarding memory-import page across surfaces
* chore(i18n): translate onboarding memory-import strings for control-ui and native locales
* refactor: keep memory-import internals unexported for deadcode gates
* fix(ci): resolve lint findings in onboarding memory import
* chore(i18n): refresh native inventory after lint refactor
* fix(ci): skip updater artifacts in the unsigned Linux companion PR lane
* chore(i18n): reconcile locale artifacts after rebase
The gateway already broadcasts stream:"plan" agent events with typed
{step, status} snapshots; all three clients dropped them. Control UI now
renders an expandable checklist bar above the composer (run-scoped,
cleared on run lifecycle); the shared iOS/macOS chat UI mounts a
Liquid Glass pill (iOS 26 glassEffect, material fallback) between the
message list and composer; Android adds an expandable pill above the
composer bridged through ChatController/NodeRuntime/MainViewModel.
All parsers accept typed and legacy string steps, enforce the
single-in_progress invariant, and scope snapshots and clears to the
owning run. Locale artifacts, Android resources, and the iOS string
catalog carry generated translations for the pill strings.
* feat(ui): web delights — empty-state mascots, first-reply confetti, composer drag-catch
Three mascot-powered moments in the Control UI: the plugins page and
channels hub show a sleepy Clawd when truly empty and a curious one on
a search miss; the very first successful assistant reply in a browser
earns a single confetti burst in the mascot palette (localStorage
once-flag, reduced-motion aware); and dragging files over the new-
session composer makes the welcome mascot tease with an open mouth,
then snap a catch on drop — upload behavior untouched.
* fix(ui): satisfy strict types and knip for the confetti module
Tuple index under noUncheckedIndexedAccess gets an anchored fallback,
the once-flag helper stays module-internal (knip counts only production
consumers), and its coverage moves to the public fireFirstReplyConfetti
path in jsdom using the shared storage mock.
* feat(ui): animated Clawd mascot on the new-session welcome hero
Ports the native mascot to the Control UI as a canvas-backed
<openclaw-mascot> Lit component: exact 120x120 vector geometry, mood
loops (idle/curious/thinking/working/happy/celebrating/sad/sleepy/
attentive), deterministic seeded animator, DPR-aware rendering,
visibility-paused rAF, theme-reactive palette, and a reduced-motion
static pose. The new-session welcome hero swaps its static lobster
sprite for the living mascot.
* fix(ui): cancel stale mascot gestures on mood change
* fix(ui): keep MascotEffect internal to the pose module
* test(lint): allowlist the canvas fill suppression for the web mascot
* fix(control-ui): restore userAvatar wiring in Quick Settings (#107292)
Between 2026.6.11 and 2026.7.1 the Quick Settings parent renderer stopped
passing userAvatar / onUserAvatarChange down to the avatar editor, while
the editor still calls onUserAvatarChange?.(...). As a result, choosing,
clearing, or entering an emoji/text avatar under Settings \u2192 Simple
silently no-ops and never persists.
Restore the wiring: ConfigPage now reads the browser-local user identity
via loadLocalUserIdentity(), tracks the avatar on a @state field, and
persists changes through applyLocalUserIdentity() (added to
ui/src/app/settings.ts). No behavior change vs 2026.6.11.
* chore: drop changelog edit (release-generation owns CHANGELOG)
* ci: pick up periphery workflow fix
* ci: pick up pinned xcodegen installer
* chore: restore merge-base CHANGELOG (release-owned file)
---------
Co-authored-by: SymbolStar <SymbolStar@users.noreply.github.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* feat(canvas): let widget buttons send prompts into web chat
Inline show_widget documents get a sendPrompt(text) bridge: a private
MessageChannel offered to the Control UI before widget code runs. The chat
adopts only the first offer per frame, requires transient user activation,
a visible focused frame, plain text (no slash commands), and rate limits
10 prompts/minute per widget. Accepted prompts run the normal user send
path of the owning chat pane.
* fix(canvas): appease lint/knip/docs gates for widget prompts
Split widget prompt tests into their own file, drive validation and rate
limits through the real port path instead of exported internals, use
addEventListener on the adopted port, and regenerate docs_map.
* fix(canvas): install widget listeners per window for non-isolated tests
Module-boolean listener flags broke in shared vitest workers where each test
file gets a fresh jsdom window; key installation by window instead and give
port flushing more headroom.
* feat(ui): add guided Model Setup page for inference onboarding
* fix(ui): regenerate i18n locale bundles and narrow model-setup exports for CI gates
* chore(ui): regenerate i18n baselines after rebase
* chore(ui): translate model-setup strings for all locales
* fix(workboard): record resolved runtime metadata instead of hardcoded codex engine
Workboard executions labeled every dispatched run engine=codex, model=default,
and id suffix :codex even for Claude/other harness agents. The gateway agent
admission phase now returns the resolved {harness, provider, model} for plugin
subagent runs; the dispatcher records it verbatim and omits engine/model when
unresolved. Engine becomes an open runtime identifier in the workboard
contract (built-in launch choices stay a closed list), store/UI normalizers
preserve historical labels as written instead of inventing codex, and new
execution ids use an :agent-session suffix. Fixes#108362
* fix(workboard): accept undefined engine in ui engineModel helper
* fix(ui): honor timezone in usage detail timeline
Apply the selected local or UTC calendar boundaries to session detail points and keep the full final day.
Co-Authored-By: OpenAI Codex <noreply@openai.com>
* test(ui): make usage timezone regression deterministic
Model a non-UTC local calendar through Date getters instead of relying on runtime TZ mutation.
Co-Authored-By: OpenAI Codex <noreply@openai.com>
* test(ui): type local date getter mocks
Annotate Date receivers so the deterministic timezone regression passes strict test type checking.
Co-Authored-By: OpenAI Codex <noreply@openai.com>
* fix(ui): complete usage timeline timezone handling
---------
Co-authored-by: OpenAI Codex <noreply@openai.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* refactor(ui): share one panel tab strip between terminal and browser
Extract the terminal tab strip (tab + attached close button as one
surface, from #108611) into a shared panel-tab-strip module and migrate
the in-app browser panel onto it. The browser tabs inherit the attached
close design; terminal tabs gain middle-click close and long-label
ellipsis; both get the empty-group workaround and a strip that shrinks
inside the flex header. Net -24 prod LOC; duplicated tp-/bp- strip CSS
deleted.
* fix(ui): keep shared panel new-tab button stable
The flex height constraint chain was broken at three points in the
board-mode layout, preventing both the proposal queue and detail
body from scrolling:
1. .sw-hub-panel > .skill-workshop used a > child selector but
.skill-workshop is nested inside an inner wa-tab-panel wrapper,
so the rule never matched. Switched to a descendant selector.
2. #skill-workshop-mode-panel (the inner tab panel) had no flex
styles, defaulting to display:block which cannot pass through
flex height constraints. Added explicit flex container styles.
3. The wa-tab-panel shadow-DOM part(base) wrapper also needs flex
overrides to fill the host height. Added part selectors with
display:flex, flex:1, min-height:0, and width:100% to preserve
full-width block behavior for non-flex children like the
history scan banner.
Also added flex-shrink:0 to .sw-history so the banner does not
collapse when .skill-workshop receives a definite height.
Fixes#108196
The web terminal's per-tab close control rendered as a detached floating
square next to the tab. It now joins the tab as one surface: shared hover
background, active accent underline continuing beneath it, full tab
height, with its own rounded inner highlight on hover.
The live codex text provider was a redundant projection of the openai
catalog (exclusive provider ownership; the openai plugin's ChatGPT OAuth
discovery already serves gpt-5.6-* route-aware). Folding it:
- extensions/codex no longer registers a text provider, catalog entry, or
synthetic text auth; provider.ts/provider-catalog.ts/provider-discovery.ts
and the route-blind model-name heuristics are deleted; the narrow
post-harness reasoning fallback moves to an app-server-owned module
- openai thinking policy keys on explicit selected-route provenance
(api === openai-chatgpt-responses) instead of value-shape inference
- models.list gains an optional additive agentRuntime field (configured
intent); session agentHarnessId remains the execution proof
- doctor --fix migrates the shipped codex/* config shape end to end:
every model slot, provider-config merge with blocker-aware conflict
handling, sessions, cron payloads (two-phase: runtime policy persists
before cron refs rewrite), transcripts; migrated refs carry model-scoped
agentRuntime.id=codex preserving the shipped wizard semantics; auto
runtime policies normalize to codex with sibling fields preserved;
blocked provider conflicts retain the whole legacy namespace fail-closed
with an actionable warning
- the stale openai:default profile cleanup (#91352) was deliberately
deferred to a follow-up after review showed it needs per-agent identity
proofs; doctor keeps warning about unusable profiles
Fixes#105561Fixes#84637Fixes#90420
