Gateway (additive, no protocol version bump): SessionEntry gains
lastReadAt/markedUnreadAt/lastActivityAt; session rows expose a derived
unread flag (explicit mark, or last read before latest activity; never-read
sessions stay read so upgrades do not light up). lastActivityAt is stamped
in the canonical post-run store update - user, channel, and cron runs count
as activity; heartbeat, internal-event, and preserved-state runs do not.
sessions.patch gains unread; sessions.create gains fork (transcript fork
from parentSessionKey under the parent lifecycle lock, refusing active,
concurrently-changed, and oversized parents, cross-agent aware).
Web sidebar: Pinned/custom-group/Ungrouped sections, unread dots, kebab and
right-click context menu (pin, mark unread/read, rename, fork, move to group,
archive, delete guarded for agent main sessions and active runs), mark-read
on view with loop-safe re-acknowledgement and failure retry; sessions page
gets unread + fork actions and shared custom-group helpers.
iOS Command Center: grouped sections, unread/pin indicators, Show Archived
gated on per-entry state, full context menu with rename/new-group alerts and
delete confirmation, current-session preview guarantee, read-episode
re-acknowledgement; new patch/delete/fork transport calls; Swift protocol
models regenerated.
Android SessionsScreen: grouped headers, unread/pin indicators, Archived
filter gated on per-entry state, long-press menu with the full control set,
agent-scoped forks, explicit label/category clears from session events,
main-session fallback when archiving/deleting the open chat, read-episode
re-acknowledgement with failure retry.
Closes#100739
Adds an additive worktree flag to sessions.create so any new chat can run in an
isolated managed worktree of the agent's git workspace, with the branch checked
out and .worktreeinclude provisioning applied. The session's spawnedCwd points at
the matching subdirectory inside the worktree so chat runs, CLI, and the file
browser execute there. agents.list gains workspaceGit (workspace or an ancestor
is a git checkout) to gate the affordance; web sidebar, iOS, and Android expose a
New-Chat-in-worktree action. Uses the method's operator.write scope, but the
.openclaw/worktree-setup.sh step runs only for operator.admin callers since it
executes repo code. Deleting the session, or leaving via a plain New Chat, clears
the cwd and lossless-removes the worktree; idle GC treats recent session activity
as worktree activity so an active session's checkout is never swept.
Live-verified end-to-end on a real gateway; follow-up to #100535 (issue #100534).
* feat(ios): durable offline command outbox for chat sends
Text messages sent while the gateway is unreachable queue in a durable
per-gateway outbox (new outbox_commands table in the per-gateway chat
cache SQLite store, schema v2) instead of failing. Queued bubbles render
with visible Queued/Sending/Not sent states and flush strictly in
createdAt order once transport health recovers; each command's client
UUID rides as the send idempotency key, so at-least-once delivery plus
gateway dedupe keeps the transcript exact.
Contract summary:
- Bounds: 50 queued commands per gateway; refused enqueues keep the
draft. Queued rows older than 48h expire to failed("expired") rather
than silently sending stale commands; tap-to-retry refreshes
createdAt so an expired row can resend as new intent.
- Failure taxonomy: transport-level failures keep rows queued without
burning retry attempts (backoff ladder, then health drops so the
reconnect machinery owns pacing); gateway rejections burn attempts
and fail terminally after 3, with context-menu retry/delete.
- Deletes are tombstoned synchronously and rechecked after the claim
await so an active flush can never send a removed command; Delete is
hidden while a bubble is already in flight; offline enqueue is
guarded against double submit during the health probe.
- Post-reconnect live sends route behind draining outbox rows (FIFO),
and a cold open assumes a backlog until restore adopts durable rows.
- Crash safety: 'sending' rows revert to 'queued' at startup; flushed
turns are spliced into the session's cached transcript before their
outbox row is deleted, and stale history snapshots cannot evict a
just-flushed turn until a snapshot confirms it.
- Per-gateway scoping and purge ride the transcript cache: one SQLite
file per gateway; reset/forget drops the queue with the cache.
Fixture/unpaired transports get no outbox.
Part of #46664
* chore(ios): sync native i18n inventory
* style(chat-ui): satisfy strict SwiftFormat lint (doc comment, scope blank line)
* fix(ios): restore in-flight chat runs from gateway history
Restore active Apple chat ownership across reconnect, foreground, and sequence-gap recovery using the existing chat.history snapshot. Preserve agent/session scoping and Gateway user-turn identity across Codex and Copilot mirrors, including current offline-cache integration.
* fix(ios): restore in-flight chat runs from gateway history
* feat(ios): read-only offline cache for chat sessions and transcripts
Cache-first cold open for the iOS chat tab: the last known transcript and
session list render immediately from a local SQLite cache, then live gateway
history replaces them wholesale through the existing reconciliation path.
When the gateway is unreachable, recent sessions and transcripts stay
browsable read-only; sending remains gated by the existing connection state.
- New OpenClawChatTranscriptCache protocol seam plus SQLite-backed store in
OpenClawChatUI (raw SQLite3, no new dependencies), scoped per gateway
stableID so transcripts never leak across paired gateways.
- Bounds: 50 sessions, 50 transcripts, 200 messages per session; text rows
only (attachment/binary payloads and tool arguments are stripped).
- Disposable cache: schema versioned via user_version; any open/schema/decode
mismatch drops and rebuilds silently. File protection
completeUntilFirstUserAuthentication on iOS.
- View model pre-paints from cache only until a live response applies
(hasAppliedLiveHistory/hasAppliedLiveSessions guards); write-through is
chained and off the render path.
- iOS wiring keys the chat view model identity on transport mode plus cache
gateway ID so switching paired gateways rebuilds the view model.
Part of #100194
* fix(ios): harden offline transcript cache
* fix(ios): expose offline cached sessions
* fix(ios): isolate transcript caches by gateway
* chore(i18n): sync native inventory
* fix(ios): allow cache extension to replace messages
Ports the animated OpenClawMascotView to the macOS app: the About pane
icon and the onboarding hero now render the Canvas+TimelineView mascot
(float/blink/antenna-wiggle/claw-snap, still under Reduce Motion)
instead of the static app icon.
The view moves from apps/ios into the shared OpenClawChatUI target of
OpenClawKit so iOS and macOS consume one copy; the iOS lint filelist
tracks the moved file.
Ports the openclaw.ai hero mascot animation (body float 4s, eye blink 3s,
antenna wiggle 2s, staggered claw snaps 4s) to every product surface that
shows the logo:
- web: ui/public/favicon.svg now carries SMIL animations, so every <img>
usage (login gate, sidebar brand, agent avatar fallback) animates with
no markup changes; CSS animations do not run in <img>-loaded SVGs.
- iOS: new OpenClawMascotView renders the canonical 120x120 vector via
Canvas + TimelineView (30fps, honors Reduce Motion); OpenClawProMark
uses it in onboarding, sidebar, and command center. Static PNG imageset
deleted (watch app keeps its own copy).
- Android: new OpenClawMascot composable (PathParser + infinite
transitions, honors the OS animator scale) replaces the static vector
drawable in onboarding and the chat/shell/voice headers, with tint
support for the monochrome header silhouettes. Drawable deleted.
- Remove location guidance from SettingsProTabSections (out of scope)
- Revert ChatProTab to connectionStatusButton/connectionStatusIcon
to preserve source guard contract (plain style, Circle content shape)
- Change OpenClawType from static let to static var for Dynamic Type
responsiveness (re-computes through UIFontMetrics each access)
- Add exact provenance: upstream revision URLs and SHA-256 checksums
for all 14 bundled font binaries
- Re-sync native i18n inventory
Co-authored-by: Cursor <cursoragent@cursor.com>
Add OpenClaw design system foundations:
- Custom typography tokens (OpenClawType) using Plus Jakarta Sans,
DM Sans, and JetBrains Mono with Dynamic Type scaling
- Spacing and radius token enums (OpenClawSpacing, OpenClawRadius)
- Additive brand color tokens (accentPressed, teal, void, obsidian,
slate, textPrimary, textSecondary)
- Shared components: OpenClawToggleIndicator, OpenClawStatusBadge,
OpenClawPrimaryButtonStyle, OpenClawSecondaryButtonStyle
- Bundled font files with OFL license provenance
Migrate all iOS views to OpenClawType tokens. No behavioral, navigation,
or routing changes — this is purely visual/typographic.
Co-authored-by: Cursor <cursoragent@cursor.com>
* improve: tighten iOS Control row density
* test(ios): drop brittle control row source guards
* chore(i18n): sync iOS Control inventory
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(ios): return chat to originating control detail
Co-authored-by: Colin <colin@solvely.net>
* fix(ios): reset retained state before control chat handoff
Co-authored-by: Colin <colin@solvely.net>
---------
Co-authored-by: Colin <colin@solvely.net>
* fix(ios): show gateway errors once as a swipeable animated toast
Gateway connection errors on the Settings > Gateway page appeared twice:
as the app-wide toast and again as an embedded banner section. Remove the
embedded banner (and its now-dead sheet/action helpers) so problems surface
only via the root toast, animate the toast in smoothly from the top, and
support swipe-up to dismiss with re-arm on new problems.
* fix(ios): re-surface gateway toast on repeated problem reports
A swiped-away toast stayed hidden when a retry failed with an identical
problem, because value equality alone produces no observable change. The
model now counts every problem report; a report while hidden re-shows the
toast, and a report while visible shakes it instead of stacking a new one.
* fix(ios): keep reset-onboarding action on the gateway toast and sync i18n inventory
The root toast is now the only gateway problem surface outside covers, so it
must keep the reset-onboarding primary action the removed settings banner had:
auth-token-mismatch problems now show Reset onboarding and run the full
GatewayOnboardingReset flow. Also refreshes the native i18n inventory for the
changed Swift strings.
* fix(ios): preserve gateway problem recovery state
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(ios): back from settings details returns to the originating screen
Detail views reachable from multiple places (gateway, voice, notifications
settings) previously opened by switching to the canonical Settings tab, so
Back landed on the Settings root instead of the screen the user came from.
Phone tabs now push SettingsRoute details on their own NavigationStack via
PhoneTabSettingsHost, the Control hub pushes the gateway detail onto its own
stack, and the Approvals->Notifications shortcut appends instead of replacing
the path (phone and iPad). Global flows (deep links, onboarding, problem
banner, notification dialog) still jump to the canonical Settings tab.
* chore(i18n): sync native app i18n inventory line references
* test(ios): prove settings back navigation
* test(ios): prove settings back navigation
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
