vultr/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-28 05:16:17 +00:00
Code Issues Packages Projects Releases Wiki Activity
52,012 Commits 1,843 Branches 149 Tags
c7d4e9e1c20403d005335e09c0e019a8520f5565
Commit Graph

3319 Commits

Author SHA1 Message Date
Vincent Koc
6d9b3887ea fix(test): suppress rolldown timing noise 2026-05-24 14:26:19 +02:00
Vincent Koc
0f82c810fc fix(test): sync sparse AWS Crabbox runs from full checkout 2026-05-24 14:00:37 +02:00
Vincent Koc
71547678c7 fix(release): harden Windows cross-os command shims 2026-05-24 13:52:18 +02:00
Vincent Koc
98e09e8817 fix(test): harden Docker resource ceilings 2026-05-24 13:38:50 +02:00
Josh Lehman
62b51a6295 fix(telegram): serialize topic dispatch replies (#85709) 
* fix(telegram): serialize topic dispatch replies (clawdbot-b19)

* fix(telegram): normalize dispatch topic context

* fix(telegram): satisfy dispatch race CI checks

* fix(telegram): normalize raw code language tags

* refactor(reply): centralize turn admission

* fix(telegram): persist recovered topic routes

* fix(reply): preserve queue policy admission

* fix(reply): retain active abort owner

* fix(reply): split active abort ownership

* fix(reply): defer busy followup drains

* fix(reply): wire hook abort ownership

* fix(reply): preserve deferred queue summaries

* fix(reply): type queued summary retry

* fix(reply): abort embedded and core runs

* test(reply): keep final abort operation active

* test(reply): stabilize abort normalization test

* fix(reply): keep non-visible admission skips silent

* test(reply): avoid dispatch shard mock bleed

* fix(reply): merge deferred queue summaries

* fix(reply): abort active-lane resolver runs

* fix(reply): compose borrowed lane abort signals

* fix(reply): keep interrupt turns caller-owned

* fix(telegram): keep recovered topic history scoped

* fix(reply): retry deferred summary queues

* fix(reply): document deferred summary restore

* fix(telegram): rebuild recovered topic prompt body

* fix(reply): run admitted session ids

* fix(telegram): recover topic chat actions

* fix(reply): honor pre-dispatch aborts for handled replies

* fix(reply): guard local handled final aborts

* fix(reply): refresh admitted session files

* fix(telegram): trust final current-message marker

* fix(telegram): migrate recovered room history

* fix(telegram): scope recovered topics to current chat

* fix(reply): wait for visible reply lane ownership

* fix(telegram): pass recovered topic body to agent

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
 2026-05-24 11:49:48 +01:00
Vincent Koc
3838e450dd fix(test): build startup artifacts for smoke scripts 2026-05-24 12:34:13 +02:00
Vincent Koc
9ff4d36c98 fix(test): fail missing explicit test targets 2026-05-24 11:46:51 +02:00
Vincent Koc
75ac11aca2 fix(release): harden Windows release-check npm probes 2026-05-24 11:14:41 +02:00
Peter Steinberger
cf46f2e3a0 fix(docker): parse peer-suffixed lockfile packages 2026-05-24 09:51:39 +01:00
Peter Steinberger
f799da0947 fix(docker): seed lockfile packages before prune 2026-05-24 09:33:34 +01:00
Peter Steinberger
2cd93f1c0d fix(docker): seed lockfile snapshot tarballs before prune 2026-05-24 09:18:04 +01:00
Vincent Koc
abdd8a40cc fix(plugins): harden Windows npm package staging 2026-05-24 09:32:17 +02:00
Vincent Koc
a56f452972 fix(release): harden Windows npm shim verification 2026-05-24 09:02:44 +02:00
Vincent Koc
d21abb88e4 fix(scripts): harden Windows install checks 2026-05-24 07:03:49 +02:00
Peter Steinberger
3839b48615 test(parallels): harden release VM smoke isolation 2026-05-24 05:50:03 +01:00
NianJiu
d4e42d61c9 fix(minimax): normalize OAuth token expiry to absolute millisecond timestamp (#83480) 
* fix(minimax): normalize OAuth token expiry to absolute millisecond timestamp

MiniMax returns expired_in from the token endpoint as a relative duration
in seconds (standard OAuth expires_in semantics), but the auth profile
store's hasUsableOAuthCredential() expects an absolute millisecond
timestamp.  Without conversion the token appears perpetually expired,
triggering a slow OAuth refresh network call to api.minimaxi.com on
every request — the root cause of the 30-50s auth-stage delay.

Fixes #83449.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(minimax): cover oauth expiry normalization

* fix: polish minimax oauth expiry normalization (#83480) (thanks @NianJiuZst)

* fix: update minimax raw fetch allowlist (#83480)

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
 2026-05-24 05:21:22 +01:00
Gio Della-Libera
82af6119fa fix: honor OPENCLAW_HOME defaults (#85802) 
* fix: honor OPENCLAW_HOME defaults

* fix(install): preserve openclaw home upgrade defaults

* fix(install): satisfy shellcheck tilde patterns
 2026-05-23 20:39:59 -07:00
Peter Steinberger
bae0e3fae5 fix(release): speed plugin bundled dependency installs 2026-05-24 04:27:42 +01:00
Peter Steinberger
4daf1aab55 fix(release): keep plugin bundled install lock-compatible 2026-05-24 04:27:42 +01:00
Peter Steinberger
bc6d430d00 fix: recover discord realtime playback state 2026-05-24 03:44:31 +01:00
Masato Hoshino
069c7b87eb fix(browser): thread snapshot timeoutMs through agent tool and helpers (#75702) 
Summary:
- Threads browser snapshot `timeoutMs` through the agent action, client/proxy request, snapshot route plan, Ch ...  Playwright/CDP helpers, regression tests, changelog, and one JSDoc-only shrinkwrap script type annotation.
- Reproducibility: yes. source reproduction is high-confidence: current main accepts top-level browser `timeou ...  helpers drop it. I did not rerun the original macOS or Browserbase live scenario in this read-only review.

Automerge notes:
- PR branch already contained follow-up commit before automerge: fix(browser): apply default snapshot timeout to proxy path and add Pl…
- PR branch already contained follow-up commit before automerge: docs(changelog): add browser snapshot timeout propagation fix entry
- PR branch already contained follow-up commit before automerge: fix(browser): thread snapshot timeoutMs through agent tool and helpers
- PR branch already contained follow-up commit before automerge: fix(clawsweeper): address review for automerge-openclaw-openclaw-7570…

Validation:
- ClawSweeper review passed for head 0eec196962.
- Required merge gates passed before the squash merge.

Prepared head SHA: 0eec196962
Review: https://github.com/openclaw/openclaw/pull/75702#issuecomment-4359923127

Co-authored-by: masatohoshino <g515hoshino@gmail.com>
Co-authored-by: clawsweeper <274271284+clawsweeper[bot]@users.noreply.github.com>
Co-authored-by: clawsweeper[bot] <274271284+clawsweeper[bot]@users.noreply.github.com>
Approved-by: takhoffman
Co-authored-by: takhoffman <781889+takhoffman@users.noreply.github.com>
 2026-05-24 02:15:58 +00:00
Vincent Koc
32f91503be fix(scripts): harden Windows QA runners 2026-05-24 02:55:08 +02:00
Peter Steinberger
e5534dd2f3 perf: reduce gateway benchmark filesystem churn 2026-05-24 00:31:01 +01:00
Peter Steinberger
4cc2b293db ci: mount local installer scripts in smoke containers 2026-05-23 23:43:36 +01:00
Peter Steinberger
c4f0da00a9 refactor: use channel target resolution APIs (#85814) 
* refactor: use channel target resolution apis

* refactor: satisfy delivery lint

* refactor: remove unused target parsing shim

* fix: preserve routed cron topic targets
 2026-05-23 21:26:55 +01:00
Kaspre
fd2a9adbe6 fix(ollama): bypass managed proxy for loopback embeddings (#85707) 
* fix(ollama): bypass proxy for local embeddings

* fix(ollama): keep managed proxy bypass loopback-only

* fix(ollama): keep proxy bypass internal

* fix(ollama): keep proxy bypass private

* fix(ollama): harden internal proxy bypass

* chore(plugin-sdk): refresh api baseline

* fix(ollama): keep internal bypass out of qa aliases

* test(ollama): keep ssrf runtime mock complete

* fix(ollama): keep dist sdk aliases public-only

* fix(ollama): keep fetch bypass out of infra runtime

* fix(ollama): preserve packaged private sdk alias

* test(ollama): harden private ssrf alias coverage

* test(ollama): cover private ssrf resolver edges

* fix(ollama): scope private sdk native aliases

* test(ollama): audit blocked loopback bypasses

* fix(plugins): keep staged sdk aliases public-only

* test(ollama): harden proxy bypass proof

* test(ollama): cover origin mismatch proxy path

* test(ollama): cover ipv6 and batch bypass paths

* fix lint findings in Ollama proxy tests

* refactor: tighten Ollama proxy bypass

* fix: widen private sdk owner registry type

* test: stabilize Ollama proxy PR checks

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
 2026-05-23 21:17:55 +01:00
Vincent Koc
353d13248e fix(scripts): route check stages through managed runner 2026-05-23 21:20:52 +02:00
Peter Steinberger
fcb9c46af0 ci: retry GHCR docker login 2026-05-23 19:28:03 +01:00
Vincent Koc
208a0679e2 fix(scripts): avoid Windows shell argv warnings 2026-05-23 20:00:24 +02:00
Vincent Koc
8a94e825cd fix(scripts): run Windows check commands through shims 2026-05-23 18:30:14 +02:00
Jason O'Neal
7fffbf60b0 fix: harden package URL downloads (#85578) 
* fix: harden package URL downloads

Guard package acceptance URL downloads with HTTPS-only validation, no embedded credentials, private/special-use DNS and IP rejection, manual redirect checks, bounded timeout/size limits, pinned lookup, and atomic temp-file writes. Add tooling tests for unsafe URLs, redirect validation, size limits, and successful writes.

* fix: cancel redirect response bodies before closing dispatcher

ClawSweeper P2: the redirect branch in openPackageDownloadResponse cleared
the timeout and awaited dispatcher.close() without first cancelling
response.body. Undici's close() is graceful — it waits for in-flight
requests to complete — so a malicious redirect with a slow/never-ending
body could hang the hardened downloader.

Fix: call response.body?.cancel() before dispatcher.close() to abort the
redirect body immediately.

Test: add a regression test that uses a ReadableStream with an indefinite
interval to simulate a hanging body, and asserts cancel() was called.

Refs: clawsweeper review on PR #85512

* test: harden redirect body cancellation race in regression test

Guard the ReadableStream controller.enqueue() call with a cancelled
flag and try/catch to prevent ERR_INVALID_STATE when the interval
fires after cancel() closes the controller.

* fix: cancel final response body before closing dispatcher in downloadUrl

ClawSweeper P2: the HTTP-error and declared-oversize early-exit paths
in downloadUrl threw before consuming or canceling response.body. The
finally block then cleared the timeout and awaited graceful
dispatcher.close() with the body still open, allowing a slow/never-ending
response to hang release tooling.

Fix: add response.body?.cancel() in the finally block before
dispatcher.close().

Tests: add two regressions:
- HTTP 500 with slow body: asserts cancel() called before dispatcher close
- Declared content-length oversize with slow body: same assertion

* fix: add trusted package URL source policy

* fix: keep package URL resolver dependency-free

* test: cover encoded IPv6 package URL bypasses

* docs: sync package acceptance source overview

* docs: restore release doc formatting

* docs: sync package acceptance trusted-url source

* test: cover dotted IPv4 embedded IPv6 package URLs

* fix: parse dotted IPv4 embedded in IPv6 package URLs

* test: isolate anthropic pruning defaults

* test: move anthropic dated model coverage

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
 2026-05-23 17:28:29 +01:00
Peter Steinberger
2ad507c031 fix(release): allow large beta smoke run lists 2026-05-23 13:39:43 +01:00
Vincent Koc
1f32a4855a fix(release): run npm shims on Windows 2026-05-23 14:08:48 +02:00
Vincent Koc
5c535df0a2 fix(scripts): resolve Crabbox shims on Windows 2026-05-23 13:23:49 +02:00
Vincent Koc
68bcd4e39d test(ci): harden installer smoke coverage 2026-05-23 13:19:12 +02:00
Vincent Koc
1e21121021 fix(ci): require live docker credentials by resource 2026-05-23 12:39:02 +02:00
Vincent Koc
cc6c3728c7 fix(ci): require factory auth for droid live docker 2026-05-23 12:20:26 +02:00
Vincent Koc
4e34ac483c fix(scripts): repair live docker auth shellcheck 2026-05-23 11:58:16 +02:00
Vincent Koc
5db773fad8 fix(docker): avoid printing gateway token 2026-05-23 11:54:53 +02:00
Vincent Koc
15d9134fc6 fix(e2e): prefer x64 MinGit on Windows 2026-05-23 11:46:25 +02:00
Peter Steinberger
07694c639d feat: add meeting notes plugin 
Adds source-only external meeting notes plugin, SDK source-provider contract, CLI access, date-sharded storage, and Discord voice source.
 2026-05-23 10:38:09 +01:00
Vincent Koc
6657b493e2 fix(e2e): scrub Windows update config on PowerShell 5.1 2026-05-23 11:24:36 +02:00
Peter Steinberger
d485464dbc ci: fix plugin npm bundled dependency install 2026-05-23 09:22:25 +01:00
Vincent Koc
7f05be041e fix(diagnostics): harden observability exports and smokes (#85371) 
* test(diagnostics): widen observability smokes

* fix(diagnostics): sanitize observability exports

* docs(diagnostics): format otel export docs
 2026-05-23 15:27:43 +08:00
Vincent Koc
73c1e375e4 test(e2e): sample kitchen sink RSS on Windows 2026-05-23 09:07:31 +02:00
Vincent Koc
c298dfe013 test(plugins): fail gauntlet on load diagnostics 2026-05-23 08:55:44 +02:00
Vincent Koc
9ff1a4371f fix(build): preserve tsdown heap floor 2026-05-23 08:39:17 +02:00
Vincent Koc
b4f62c9afc fix(e2e): support macOS script wrappers 2026-05-23 08:23:31 +02:00
Vincent Koc
743fd4c9db fix(ci): scope changed shrinkwrap checks 2026-05-23 08:17:56 +02:00
Alex Knight
bb5abefcf5 fix: smooth chat focus mode layout 
Collapse the focused chat chrome, suppress focused-mode header scroll churn, and seed the mock chat UI with enough history to exercise scrolling.
 2026-05-23 13:52:02 +10:00