Josh Lehman cf66ec9866 fix(auth): treat unconfigured-owner sessions as owner for ownerOnly tools (#26319) ...

When no commands.ownerAllowFrom is configured (single-user default),
senderIsOwner was always false because matchedSender requires a
non-empty ownerList. This caused ownerOnly tools (cron, gateway) to
be silently filtered from the agent's tool list even for the sole
authorized user.

Now senderIsOwner defaults to true when no owner allowlist is
configured, matching the expected single-user behavior.

# Conflicts:
#	src/auto-reply/command-auth.ts

2026-03-06 15:35:55 -08:00

..

acp

fix: strip skill-injected env vars from ACP harness spawn env (#36280) (#36316)

2026-03-06 18:18:13 -05:00

agents

fix: strip skill-injected env vars from ACP harness spawn env (#36280) (#36316)

2026-03-06 18:18:13 -05:00

auto-reply

fix(auth): treat unconfigured-owner sessions as owner for ownerOnly tools (#26319)

2026-03-06 15:35:55 -08:00

browser

fix(browser): close tracked tabs on session cleanup (#36666)

2026-03-05 16:40:52 -08:00

canvas-host

refactor(tests): dedupe canvas host server setup

2026-03-03 02:53:13 +00:00

channels

feat(gateway): add channel-backed readiness probes (#38285)

2026-03-06 15:15:23 -05:00

cli

chore: code/dead tests cleanup (#38286)

2026-03-06 14:27:02 -05:00

commands

fix(agents): handle overloaded failover separately (#38301)

2026-03-07 01:42:11 +03:00

compat

…

config

feat(compaction): make post-compaction context sections configurable (#34556)

2026-03-06 14:57:15 -08:00

context-engine

feature(context): extend plugin system to support custom context management (#22201)

2026-03-06 05:31:59 -08:00

cron

fix(agents): handle overloaded failover separately (#38301)

2026-03-07 01:42:11 +03:00

daemon

Fix Linux daemon install checks when systemd user bus env is missing (#34884)

2026-03-04 11:54:03 -08:00

discord

fix(agents): handle overloaded failover separately (#38301)

2026-03-07 01:42:11 +03:00

docs

…

gateway

feat(gateway): add channel-backed readiness probes (#38285)

2026-03-06 15:15:23 -05:00

hooks

Infra: require explicit opt-in for prerelease npm installs (#38117)

2026-03-06 11:13:30 -05:00

i18n

ACP: add persistent Discord channel and Telegram topic bindings (#34873)

2026-03-05 09:38:12 +01:00

imessage

refactor: unify inbound debounce policy and split gateway/models helpers

2026-03-03 00:54:33 +00:00

infra

Dead code: remove unused helper modules (#38318)

2026-03-06 17:53:02 -05:00

line

fix(outbound): unify resolved cfg threading across send paths (#33987)

2026-03-04 00:20:44 -06:00

link-understanding

…

logging

build: fix ineffective dynamic imports with lazy boundaries (#33690)

2026-03-03 20:14:41 -05:00

markdown

refactor: dedupe gateway config and infra flows

2026-03-03 00:15:14 +00:00

media

Media: reject spoofed input_image MIME payloads (#38289)

2026-03-06 14:34:28 -05:00

media-understanding

build: prevent mixed static/dynamic pi-model-discovery imports

2026-03-03 21:27:14 -05:00

memory

fix(memory): retry mcporter after Windows EINVAL spawn

2026-03-05 22:27:37 -08:00

node-host

fix(node-host): sync rawCommand with hardened argv after executable path pinning (#33137)

2026-03-04 11:30:33 -05:00

pairing

Gateway: add SecretRef support for gateway.auth.token with auth-mode guardrails (#35094)

2026-03-05 12:53:56 -06:00

plugin-sdk

feature(context): extend plugin system to support custom context management (#22201)

2026-03-06 05:31:59 -08:00

plugins

Infra: require explicit opt-in for prerelease npm installs (#38117)

2026-03-06 11:13:30 -05:00

process

fix: Windows: openclaw plugins install fails with spawn EINVAL

2026-03-06 22:19:16 +05:30

providers

refactor: dedupe agent and browser cli helpers

2026-03-03 00:15:00 +00:00

routing

fix(routing): avoid full binding rescans in resolveAgentRoute (#36915)

2026-03-05 16:49:29 -08:00

scripts

CI: cover skill and extension tests

2026-03-06 11:21:03 -05:00

secrets

Dead code: remove unused helper modules (#38318)

2026-03-06 17:53:02 -05:00

security

CLI: make read-only SecretRef status flows degrade safely (#37023)

2026-03-05 23:07:13 -06:00

sessions

fix: add runtime.events regression tests (#16044) (thanks @scifantastic)

2026-03-03 01:37:56 +00:00

shared

add prependSystemContext and appendSystemContext to before_prompt_build (fixes #35131) (#35177)

2026-03-05 13:06:59 -05:00

signal

fix(outbound): unify resolved cfg threading across send paths (#33987)

2026-03-04 00:20:44 -06:00

slack

CLI: make read-only SecretRef status flows degrade safely (#37023)

2026-03-05 23:07:13 -06:00

telegram

chore: prep #38056 for landing (thanks @0xlin2023)

2026-03-06 22:19:16 +05:30

terminal

CLI: dedupe config validate errors and expose allowed values

2026-03-02 20:05:12 -05:00

test-helpers

refactor: dedupe media and request-body test scaffolding

2026-02-22 18:37:25 +00:00

test-utils

fix(agents): handle overloaded failover separately (#38301)

2026-03-07 01:42:11 +03:00

tts

TTS: add baseUrl support to OpenAI TTS config (#34321)

2026-03-05 07:25:04 +00:00

tui

fix(tui): accept canonical session-key aliases in chat event routing

2026-03-05 22:01:06 -08:00

types

Memory: handle SecretRef keys in doctor embeddings (#36835)

2026-03-05 20:05:59 -06:00

utils

fix(secrets): harden api key normalization for ByteString headers

2026-03-05 18:31:45 -08:00

web

WhatsApp: honor outbound mediaMaxMb (#38097)

2026-03-06 11:08:15 -05:00

whatsapp

refactor: dedupe channel outbound and monitor tests

2026-03-03 00:15:15 +00:00

wizard

feat(onboarding): add web search to onboarding flow (#34009)

2026-03-06 13:09:00 -06:00

channel-web.ts

…

docker-image-digests.test.ts

container builds: opt-in extension deps via OPENCLAW_EXTENSIONS build arg (#32223)

2026-03-06 12:18:42 -05:00

docker-setup.e2e.test.ts

feat(docker): add opt-in sandbox support for Docker deployments (#29974)

2026-03-01 23:06:10 -08:00

dockerfile.test.ts

fix(docker): correct awk quoting in Docker GPG fingerprint check (#32153)

2026-03-03 02:32:46 +00:00

entry.ts

CLI: add root --help fast path and lazy channel option resolution (#30975)

2026-03-01 14:23:46 -08:00

extensionAPI.ts

…

globals.ts

…

index.ts

…

logger.test.ts

…

logger.ts

refactor: dedupe agent and reply runtimes

2026-03-02 19:57:33 +00:00

logging.ts

…

poll-params.test.ts

Harden Telegram poll gating and schema consistency (#36547)

2026-03-05 19:24:43 -05:00

poll-params.ts

Harden Telegram poll gating and schema consistency (#36547)

2026-03-05 19:24:43 -05:00

polls.test.ts

…

polls.ts

Harden Telegram poll gating and schema consistency (#36547)

2026-03-05 19:24:43 -05:00

runtime.ts

…

utils.test.ts

fix(utils): guard resolveUserPath for missing workspace input

2026-02-22 13:19:25 +01:00

utils.ts

fix(utils): guard resolveUserPath for missing workspace input

2026-02-22 13:19:25 +01:00

version.test.ts

Gateway: fix stale self version in status output (#32655)

2026-03-03 02:41:52 -05:00

version.ts

Gateway: fix stale self version in status output (#32655)

2026-03-03 02:41:52 -05:00