vultr/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-04-13 02:01:16 +00:00
Code Issues Packages Projects Releases Wiki Activity
29,876 Commits 1,246 Branches 105 Tags
c9067b652090f4aa6ae4e2730060ef3c8ed5a67d
Commit Graph

1612 Commits

Author SHA1 Message Date
Peter Steinberger
c9067b6520 fix: preserve scoped plugin symlink installs 2026-04-10 21:22:16 +01:00
Peter Steinberger
3198c10fba fix: stabilize Codex harness landing checks 2026-04-10 21:22:16 +01:00
Peter Steinberger
44ec4d05de feat: add pluggable agent harness registry 2026-04-10 21:22:16 +01:00
Peter Steinberger
0ebeee8b0d chore: enable consistent-return 2026-04-10 20:56:43 +01:00
Peter Steinberger
cdb944ef0a chore: enable no-misused-spread 2026-04-10 20:14:49 +01:00
Peter Steinberger
a6edccad3d test: align plugin install denylist expectations 2026-04-10 19:42:38 +01:00
Peter Steinberger
e7db987ce6 test: trim heavy imports and harden ci checks 2026-04-10 19:23:10 +01:00
Peter Steinberger
f6ed276f51 style: apply updated formatter output 2026-04-10 19:17:39 +01:00
Peter Steinberger
56468cdb06 fix: align plugin install denylist scan tests 2026-04-10 18:57:52 +01:00
Michael Appel
9f97ad857a fix(security): pin axios to 1.15.0 and add dependency denylist for plugin installs [AI-assisted] (#63891) 
* fix: address issue

* fix: address review feedback

* fix: address PR review feedback

* fix: address PR review feedback

* fix: address PR review feedback

* fix: address PR review feedback

* fix: address PR review feedback

* Plugins: fix install security CI regressions

* Plugins: make manifest traversal linear

* Plugins: bound manifest security traversal

* Plugins: block denied node_modules package dirs

* Plugins: match node_modules case-insensitively

* Plugins: block denied package symlink paths

* Tests: normalize blocked symlink assertion

* Plugins: fail closed on unreadable denied paths

* Plugins: block denied node_modules file aliases

* Plugins: inspect node_modules symlink targets

* Plugins: preserve symlink target package paths

* fix: address PR review feedback

* chore(changelog): add axios pin and dependency denylist entry

---------

Co-authored-by: Devin Robison <drobison@nvidia.com>
 2026-04-10 11:20:05 -06:00
Peter Steinberger
777c6f7580 refactor: split manifest command alias helpers 2026-04-10 17:37:31 +01:00
Peter Steinberger
8a5b7cf573 test: inject provider auth command fixtures 2026-04-10 16:41:10 +01:00
Peter Steinberger
9fd08f9d0f refactor: remove type-only import cycles 2026-04-10 15:14:27 +01:00
Peter Steinberger
09a8e0f289 fix: keep bundled CLI backend fallback stable (#64242) 2026-04-10 14:56:12 +01:00
Peter Steinberger
beaff3c553 fix: clarify plugin command alias diagnostics (#64242) (thanks @feiskyer) 2026-04-10 14:56:12 +01:00
ly85206559
13821fd54b fix(plugins): make service registration idempotent 
Treat duplicate registerService calls from the same plugin id as idempotent so plugin snapshot and activation loads stop emitting spurious service already registered diagnostics.\n\nThanks @ly85206559.
 2026-04-10 14:06:18 +01:00
Mariano
03e19c5436 fix(gateway): restore dreaming startup reconciliation (#64258) 
* gateway: restore dreaming startup reconciliation

* gateway: harden dreaming startup reconciliation

---------

Co-authored-by: mbelinky <mbelinky@users.noreply.github.com>
 2026-04-10 15:02:19 +02:00
Peter Steinberger
d350280fc2 test: fix latest type and lazy cli gates 2026-04-10 12:37:01 +01:00
Peter Steinberger
2ad451e91f test: fix parallel full-suite exposed gates 2026-04-10 12:34:53 +01:00
Peter Steinberger
644105bea6 fix: restore latest main typecheck 2026-04-10 12:20:04 +01:00
Pavan Kumar Gondhi
6517c700de fix(nostr): require operator.admin scope for profile mutation routes [AI] (#63553) 
* fix: address issue

* fix: address review feedback

* fix: address review feedback

* fix: finalize issue changes

* fix: address PR review feedback

* fix: address review-pr skill feedback

* fix: address PR review feedback

* fix: address review-pr skill feedback

* fix: address PR review feedback

* fix: address PR review feedback

* fix: address PR review feedback

* fix: address PR review feedback

* docs: add changelog entry for PR merge
 2026-04-10 16:38:41 +05:30
Mariano
46f8c4dfd5 fix(memory-core): harden request-scoped dreaming fallback (#64156) 
* memory-core: harden request-scoped dreaming fallback

* memory-core: tighten request-scoped fallback classification
 2026-04-10 12:11:57 +02:00
Peter Steinberger
9714495797 test: keep plugin runtime symlink assertion on symlink path 2026-04-10 10:28:53 +01:00
Peter Steinberger
ec5ef68b0c test: fix latest fast-lane boundaries 2026-04-10 09:53:17 +01:00
Peter Steinberger
67ede66b3e test: refresh latest main expectations 2026-04-10 09:47:57 +01:00
samzong
723dec0432 [Feat] Gateway: add commands.list RPC method (#62656) 
Merged via squash.

Co-authored-by: samzong <samzong.lu@gmail.com>
Co-authored-by: Frank Yang <frank.ekn@gmail.com>
Reviewed-by: @frankekn
 2026-04-10 14:28:47 +08:00
Qasim Soomro
71617ef2f0 fix: allow private network provider request opt-in (#63671) 
* feat(models): allow private network via models.providers.*.request
Add optional request.allowPrivateNetwork for operator-controlled self-hosted
OpenAI-compatible bases (LAN/overlay/split DNS). Plumbs the flag into
resolveProviderRequestPolicyConfig for streaming provider HTTP and OpenAI
responses WebSocket so SSRF policy can allow private-resolved model URLs
when explicitly enabled.
Updates zod schema, config help/labels, and unit tests for sanitize/merge.

* agents thread provider request into websocket stream

* fix(config): scope allowPrivateNetwork to model requests

* fix(agents): refresh websocket manager on request changes

* fix(agents): scope runtime private-network overrides to models

* fix: allow private network provider request opt-in (#63671) (thanks @qas)

---------

Co-authored-by: Ayaan Zaidi <hi@obviy.us>
 2026-04-10 11:11:03 +05:30
Josh Avant
33ad806a14 Browser: consolidate duplicate helper surfaces via facade delegation (#63957) 
* Plugin SDK: route browser helper surfaces through browser facade

* Browser doctor flow: add facade path regression and export parity guards

* Contracts: dedupe browser facade parity checks without reducing coverage

* Browser tests: restore host-inspection semantics coverage in extension

* fix: add changelog note for browser facade consolidation (#63957) (thanks @joshavant)
 2026-04-09 19:49:04 -05:00
Vincent Koc
c87994bc9a fix(plugins): split registry type surface 2026-04-09 09:05:11 +01:00
Peter Steinberger
719f06510c chore: bump version to 2026.4.10 2026-04-09 03:56:22 +01:00
Mason Huang
ba636d1206 plugin-sdk: keep command status compatibility path light 2026-04-09 01:35:15 +01:00
Mason Huang
aa15de8fdc plugin-sdk: split command status surface 2026-04-09 01:35:15 +01:00
Peter Steinberger
39cc6b7dc7 fix: stabilize character eval and Qwen model routing 2026-04-09 01:04:09 +01:00
Peter Steinberger
fbbd644d7a plugins: load lightweight provider discovery entries 2026-04-09 00:33:33 +01:00
Altay
554bc0a9fd fix(plugins): keep test helpers out of contract barrels (#63311) 
Merged via squash.

Prepared head SHA: 769e90c6af
Co-authored-by: altaywtf <9790196+altaywtf@users.noreply.github.com>
Co-authored-by: altaywtf <9790196+altaywtf@users.noreply.github.com>
Reviewed-by: @altaywtf
 2026-04-08 22:59:05 +01:00
Agustin Rivera
dafcaf9d69 fix(browser): harden browser control override loading (#62663) 
* fix(browser): harden browser control overrides

* fix(lint): prepare boundary artifacts for extension oxlint

* docs(changelog): add browser override hardening entry

* fix(lint): avoid duplicate boundary prep

---------

Co-authored-by: Devin Robison <drobison@nvidia.com>
Co-authored-by: Devin Robison <drobison00@users.noreply.github.com>
 2026-04-08 13:24:47 -06:00
Peter Steinberger
9e4f478f86 feat(plugins): support provider auth aliases 2026-04-08 19:03:04 +01:00
Pavan Kumar Gondhi
2d97eae53e fix(plugins): prevent untrusted workspace plugins from hijacking bundled provider auth choices [AI] (#62368) 
* fix: address issue

* fix: address review feedback

* docs(changelog): add onboarding auth-choice guard entry

* fix: address PR review feedback

* fix: address PR review feedback

* fix: address PR review feedback

* fix: address PR review feedback

* fix: address PR review feedback

* fix: address PR review feedback

* fix: address PR review feedback

* fix: address PR review feedback

---------

Co-authored-by: Devin Robison <drobison@nvidia.com>
 2026-04-08 23:08:14 +05:30
Peter Steinberger
7f5d129a37 fix: keep runtime task test harness behind task seams 2026-04-08 16:53:46 +01:00
Peter Steinberger
34f73abfd3 refactor: dedupe plugin metadata test helpers 2026-04-08 15:58:46 +01:00
Peter Steinberger
e98dc17866 refactor: dedupe plugin test harnesses 2026-04-08 15:58:45 +01:00
Peter Steinberger
49f3ede504 refactor: dedupe shared helper branches 2026-04-08 15:58:45 +01:00
Peter Steinberger
edf6b490a6 fix: harden bundled plugin dependency release checks 2026-04-08 15:15:44 +01:00
Peter Steinberger
557559cd42 test: keep bundled metadata sidecar scan inventory-only 2026-04-08 15:12:33 +01:00
Peter Steinberger
e915ef7a25 test: keep public artifact coverage on cheap boundaries 2026-04-08 15:05:37 +01:00
Peter Steinberger
841a1566ef test: keep web provider artifact test in boundary 2026-04-08 14:37:19 +01:00
Peter Steinberger
e65d6ebb63 test: fix full suite CI test isolation 2026-04-08 14:29:19 +01:00
Peter Steinberger
307979a4c7 test: restore manifest-only web provider coverage 2026-04-08 14:22:02 +01:00
Peter Steinberger
37473142d8 test: keep web provider artifact test in boundary 2026-04-08 14:11:35 +01:00
Peter Steinberger
5aa8579dd7 test: keep provider policy artifact coverage narrow 2026-04-08 14:00:47 +01:00