mirror of
https://github.com/openclaw/openclaw.git
synced 2026-07-22 13:31:16 +00:00
723f5ba4fc
* refactor(ui): restructure Settings IA around user-facing pages Settings sidebar shrinks to settings-only destinations grouped by attention: General/Appearance/Notifications up top, Connections, Agents & Tools, Privacy & Security, System. Sessions, Worktrees, Activity, and Memory Import leave the takeover: Sessions/Activity return to the workspace sidebar, Worktrees becomes a Sessions hub tab, Memory Import is reached from the Agents memory panel. Model Setup becomes a Models subpage. New config pages: Notifications (web push), Privacy & Security (curated policy rows + security/approvals schema sections), Advanced (uncurated schema sections + raw editor, replacing the General quick/advanced toggle). General slims to model defaults, language, and gateway host; identity moves to Profile, lobster appearance rows to Appearance. * feat(agents): widen system-agent config writes to operator parity Every config surface the Control UI can edit is now agent-writable behind the exact-operation human approval gate, except a small documented denylist ($include, auth, env, models, secrets). tools.* and plugins.entries.* writes are allowed; plugin_uninstall works for plugins that provably do not back the active default inference route (fail closed otherwise); set_default_model takes an optional agentId and live-tests a per-agent model with the same rigor as the default route. Per-agent routing fields on non-default agents are direct-writable; the default agent's route keeps the verified set_default_model/onboard paths. A new config-write-parity contract test forces explicit classification of every top-level config key. * feat(ui): sync operator display prefs through config ui.prefs Theme, theme mode, text scale, locale, and chat display prefs get a canonical server-side home in config ui.prefs. The Control UI mirrors them into localStorage for instant boot, writes local changes through to the gateway (best-effort; viewer-scope or offline clients stay device-local), and applies server-side deltas on connect and on every config snapshot reload — so an agent changing the theme through the approval gate takes effect in the UI, and prefs follow the operator across devices. * chore: prune quick.ts from max-lines baseline after slim-down * style: oxfmt changed files * chore: regenerate plugin-sdk api baseline for ui.prefs config surface * fix: dedupe runPluginUninstall dep type and narrow locale extraction * docs: update Control UI settings structure and ui.prefs sync * fix: address autoreview findings on parity guards and prefs sync - plugins.entries.* config writes get the same active-route ownership check as plugin_uninstall (fail closed when unprovable) - system-agent prompt now describes the guarded write policy instead of the old blanket refusals - per-agent set_default_model logs the agent-scoped label - legacy /config?section=... deep links redirect to the Advanced page - prefs sync: pushes coalesce and drain serially (no CAS races dropping updates), replaced config hashes mark pre-patch snapshots as stale, and the last-seen server value persists per gateway scope so reloads cannot revert unpushable viewer-scope edits - lint: theme membership checks use Sets * fix: harden uninstall route guard and scope prefs queue per gateway - plugin uninstall ownership now covers execution owners (runtime policy, embedded harness override) in addition to the provider, and re-verifies inside the commit boundary so a concurrent route switch cannot slip a destructive uninstall past the pre-approval check - prefs push queue binds to one gateway client; switching gateways drops the old queue (device-local fallback) instead of cross-writing prefs * style: top-level type import in config-page test * fix: close review races in config-write guards and prefs reconciliation - config_set/config_set_ref re-verify the inference-route guard inside the commit boundary so conditional verdicts (per-agent routing, plugin entries) cannot be flipped by a concurrent edit after approval - server prefs apply per changed field, so a server change to one pref no longer reverts unpushable local edits of the others - replaced-hash staleness retires once post-patch state is observed, so a genuine restore of the pre-patch config becomes authoritative again - moved-section deep links (communications notifications, automation approvals) redirect to their new pages * style: satisfy no-useless-assignment and loop-condition lints in prefs sync * fix(ci): resolve unhandled profile-test rejections and knip unused exports The profile page's new identity section reads context.config; the test context mock now provides it, eliminating the unhandled rejections that failed checks-ui and the compact-large shard. Exports flagged by the dependency gate (extract/patch helpers, section-key and prop types) go module-private; extraction coverage moves behind applyServerUiPrefs. * refactor(agents): move config-write policy to its own module The static path classifier and documented denylist move to config-write-policy.ts, shared by the execution guard and the parity contract test — no test-only exports left for the dependency gate to flag. Blocked-root refusals now cite the denylist's documented escalation for that root.