Commit graph

78522 commits

Author SHA1 Message Date
Josh Avant
562391b9af
feat(audit): explain denied operator approvals (#119815)
Some checks are pending
Native App Locale Refresh / Refresh native ja-JP (push) Blocked by required conditions
Native App Locale Refresh / Refresh native ko (push) Blocked by required conditions
Native App Locale Refresh / Refresh native nl (push) Blocked by required conditions
Native App Locale Refresh / Refresh native pl (push) Blocked by required conditions
Native App Locale Refresh / Refresh native pt-BR (push) Blocked by required conditions
Native App Locale Refresh / Refresh native ru (push) Blocked by required conditions
Native App Locale Refresh / Refresh native sv (push) Blocked by required conditions
Native App Locale Refresh / Refresh native th (push) Blocked by required conditions
Native App Locale Refresh / Refresh native tr (push) Blocked by required conditions
Native App Locale Refresh / Refresh native uk (push) Blocked by required conditions
Native App Locale Refresh / Refresh native vi (push) Blocked by required conditions
Native App Locale Refresh / Refresh native zh-CN (push) Blocked by required conditions
Native App Locale Refresh / Refresh native zh-TW (push) Blocked by required conditions
Native App Locale Refresh / Commit native locale refresh (push) Blocked by required conditions
Native App Locale Refresh / resolve-base (push) Waiting to run
Native App Locale Refresh / Verify generated PR App permissions (push) Blocked by required conditions
Native App Locale Refresh / Refresh native ar (push) Blocked by required conditions
Native App Locale Refresh / Refresh native de (push) Blocked by required conditions
OpenClaw Stable Main Closeout / Resolve stable release closeout inputs (push) Waiting to run
OpenClaw Stable Main Closeout / Verify stable main closeout (push) Blocked by required conditions
Plugin Init Scaffold Validation / Validate provider scaffold (push) Waiting to run
Plugin NPM Release / preview_plugins_npm (push) Waiting to run
Plugin NPM Release / Validate release publish approval (push) Blocked by required conditions
Plugin NPM Release / preview_plugin_pack (push) Blocked by required conditions
Plugin NPM Release / Preflight plugin npm package () (push) Blocked by required conditions
Plugin NPM Release / publish_plugins_npm (push) Blocked by required conditions
Plugin NPM Release / verify_plugins_npm (push) Blocked by required conditions
Workflow Sanity / no-tabs (push) Waiting to run
Workflow Sanity / actionlint (push) Waiting to run
Workflow Sanity / generated-doc-baselines (push) Waiting to run
* Audit: add durable decision receipts

* Audit: route generic decision facts through writer

* Audit: satisfy strict decision count typing

* Test: align decision writer type coverage

* Refactor: isolate decision receipt projection

* Fix: preserve ambiguous approval correlation

* Fix decision coverage across pages

* Fix approval coverage across corrupt pages

* Fix decision summaries across retention and paging

* Remove superseded decision fact count path

* Keep session-derived approval links conservative

* Test decision paging at owner boundary

* Audit: bind approval receipts to exact execution

* Test: keep decision receipt coverage focused

* docs(agents): preserve decision receipt ownership

* Docs: refresh Plugin SDK split baselines

* Docs: require opt-in for future decision facts

* Fix: bound decision receipt inspection
2026-08-12 05:23:29 -05:00
clawSean
654fc632cd
docs(backup): describe manual restore flow (#86971)
* docs(backup): describe manual restore flow

* docs(backup): make restore copy-back fail closed

* docs(backup): make inspect-and-stage block fail closed

Add set -euo pipefail to the first restore staging snippet so a failed
openclaw backup verify stops before mktemp/tar extraction, matching the
fail-closed copy-back block. Addresses ClawSweeper P1 on docs/cli/backup.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* docs(backup): reconcile restore guidance with exclusions

Punchcard-Session: brisk-harbor-harbor-6w

* docs(backup): centralize archive restore guidance

Punchcard-Session: calm-cedar-workshop-by

---------

Co-authored-by: clawSean <260045960+clawSean@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
2026-08-12 18:09:26 +08:00
Peter Steinberger
fa4a197177
perf: accelerate sqlite reliability proof (#122576)
Co-authored-by: Amp <amp@ampcode.com>
2026-08-12 03:07:19 -07:00
Vincent Koc
fb788e7a3e
refactor(diagnostics-otel): unify event attribute projection (#122559) 2026-08-12 18:06:08 +08:00
Vincent Koc
9324843d42
fix(release): trust frozen beta Telegram candidates (#122575) 2026-08-12 18:03:15 +08:00
SunnyShu
6fa383695f
fix(gateway): preserve inbound media references in chat history (#122031)
* fix(gateway): retain managed inbound media reference in chat history
* fix(gateway): simplify inbound media projection (#122031) (thanks @SunnyShu0925)

---------

Co-authored-by: Ayaan Zaidi <hi@obviy.us>
Co-authored-by: SunnyShu0925 <shu.zongyu@xydigit.com>
2026-08-12 15:31:39 +05:30
Vincent Koc
2c26f13606
fix(qa): accept staged compaction summaries (#122528) 2026-08-12 17:52:14 +08:00
Pavan Kumar Gondhi
5eb18c1387
fix(ios): keep authenticated Control UI pages bound to the trusted Gateway [AI] (#119906)
* fix(ios): enforce gateway TLS pins in control pages

* test(ios): run control UI trust regressions in CI

* test(ios): avoid nested Testing macros

* fix(ios): preserve control page navigation

* fix(ios): keep authenticated control pages on origin

* fix(ios): canonicalize control page IPv6 hosts

* chore(ios): refresh native i18n inventory

* fix(ios): normalize default TLS challenge ports

* fix(apps): share gateway TLS authority matching

* test(apps): fix authority CI validation

* chore(ci): drop control UI test routing
2026-08-12 15:18:19 +05:30
Peter Steinberger
cb58073a90
fix(ui): paginate all active tasks (#122565)
Preserve task-list cursors and drain every active page so supported running work remains visible and cancellable.
2026-08-12 02:46:55 -07:00
Peter Steinberger
30131a572b
perf: speed changed-test import scans (#122572)
Co-authored-by: Amp <amp@ampcode.com>
2026-08-12 02:30:32 -07:00
Peter Steinberger
7e42dae611
refactor(memory-core): split index manager along the inheritance chain (#122540)
* refactor(memory-core): split index manager along the inheritance chain

* fix(memory): restore the manager lazy boundary

* refactor(memory-core): delete dead manager plumbing

* chore(lint): ratchet max-lines baseline after memory manager split

* fix(memory): keep the manager out of the runtime facade

* test(memory): cover transitive manager facade imports
2026-08-12 02:28:20 -07:00
Peter Steinberger
e5dd254561
fix(memory-wiki): publish lint report atomically (#122568) 2026-08-12 02:23:48 -07:00
zhifu gao
42ad83142e
fix(whatsapp): label voice transcripts as untrusted (#113111)
* fix(whatsapp): label voice transcripts as untrusted

* fix(whatsapp): preserve audio provenance in group history

Frame deferred voice transcripts while retaining their structured audio facts for later model-visible replay.

Refs #87269

---------

Signed-off-by: zhifu gao <lauragpt@users.noreply.github.com>
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
Co-authored-by: zhifu gao <lauragpt@users.noreply.github.com>
2026-08-12 17:14:55 +08:00
Peter Steinberger
5350b92dc8
fix(browser): wake extension relay through gateway (#122537)
* fix(browser): wake extension relay through gateway

* fix(browser): preserve manual extension relay pairing
2026-08-12 02:13:03 -07:00
Vincent Koc
08b7fcc05e
test(cli): cover node daemon adapters (#122562)
Punchcard-Session: golden-valley-cedar-5x

Co-authored-by: xin zhuang <65798732+1052326311@users.noreply.github.com>
2026-08-12 17:09:07 +08:00
Peter Steinberger
66009308bb
test: parallelize doctor process coverage (#122563)
Co-authored-by: Amp <amp@ampcode.com>
2026-08-12 02:08:55 -07:00
Vincent Koc
7e2ec43e54
fix(ci): keep hosted gate verifier standalone (#122561)
Punchcard-Session: silver-valley-orchard-nq
2026-08-12 17:08:09 +08:00
Peter Steinberger
d44f70eb4b
feat(pairing): one-paste device pairing via oc-pair setup links (#120768)
* feat(pairing): one-paste device pairing via oc-pair setup links

Implements milestone 3 from docs/plan/runners.md.

* fix(pairing): sign bootstrap handshake, keep URL candidates, wire pairing countdown

* test(gateway): update client callsite guard

* fix(pairing): preserve setup URL context paths

* fix(ui): keep pairing help aligned with setup mode

* fix(pairing): isolate bootstrap credentials

* perf(ui): keep one-paste pairing within bundle budget

* refactor(pairing): isolate native pair URL prefix parsing

* fix(pairing): preserve candidate lifecycle state

* fix(pairing): retire shared credentials after bootstrap

* fix(pairing): apply rotated manifest through client owner

* test(pairing): prove bootstrap retirement across reconnect

* fix(pairing): preserve native gateway context paths

* fix(pairing): carry native context paths through reconnect

* fix(ios): preserve encoded gateway context path

* chore(plugin-sdk): refresh pairing API baselines
2026-08-12 02:01:33 -07:00
Josh Avant
3b01ea7905
fix(audit): show authenticated users for Gateway runs (#122484)
* fix(audit): show authenticated users for Gateway runs

* fix(audit): keep profile labels out of sessions

* test(qa): verify session label retention at storage

* fix(sessions): preserve canonical profile ownership

* test(qa): require full identity inspection proof

* docs(agents): preserve execution identity ownership boundary
2026-08-12 08:50:37 +00:00
Peter Steinberger
6d973d114f
test: trim duplicate target registry coverage (#122555)
Co-authored-by: Amp <amp@ampcode.com>
2026-08-12 01:46:38 -07:00
Peter Steinberger
92ed766673
fix(camera): publish URL downloads atomically (#122550) 2026-08-12 01:38:18 -07:00
Peter Steinberger
432ccac74b
fix(channels): honor terminal reaction holds (#122544)
Serialize done and error holds before restoring initial reactions, and restore Slack error reactions through the shared lifecycle.
2026-08-12 01:36:54 -07:00
Vincent Koc
1672d78d17
refactor(plugins): share bounded run id tracking (#122362) 2026-08-12 16:23:33 +08:00
Peter Steinberger
e4da1c8d8b
improve: speed up secrets runtime coverage tests (#122538)
* test: speed up secrets runtime coverage

* test: respect extension contract boundary

---------

Co-authored-by: Amp <amp@ampcode.com>
2026-08-12 01:22:36 -07:00
Peter Steinberger
31aa7c7c75
refactor(agents): split cli-runner into concept modules (#122442)
* refactor(agents): split CLI runner concepts

* chore(lint): ratchet cli-runner max-lines baseline

* refactor(agents): remove stale runner import

* refactor(agents): preserve cleanup error typing

* refactor(agents): disambiguate CLI backend predicate

* test(agents): align code-mode pending boundary

Fixes red main: both host calls are unsettled when the guest snapshot is first parked; later waits still prove that settled calls are filtered.

* test(agents): tolerate code-mode settlement race

Fixes red main: the fast host call may settle as the guest snapshot is parked, while the deliberately slow call must remain pending.
2026-08-12 01:20:27 -07:00
Peter Steinberger
08142099da
refactor(plugins): remove test-only facades and adapter (#122532)
* refactor(plugins): trim test-only facades

* refactor(whatsapp): remove legacy outbound adapter
2026-08-12 01:20:09 -07:00
Vincent Koc
dfbdbf2a67
fix(provider-runtime): retry transient socket failures (#122535)
* test: cover UND_ERR_SOCKET retry recovery

Punchcard-Session: golden-cedar-brook-4q

* fix(provider-runtime): retry UND_ERR_SOCKET failures

Punchcard-Session: golden-cedar-brook-4q
2026-08-12 16:16:22 +08:00
Vincent Koc
83649466fa
fix(qa): isolate gateway child skip controls (#122534) 2026-08-12 16:08:43 +08:00
Peter Steinberger
85a176b98a
feat(ui): commit-scoped session diff viewer with file, sync, and view menus (#122470)
* feat(ui): commit-scoped session diff viewer with file, sync, and view menus

The Control UI session diff panel becomes a dense Amp-style viewer: per-file
menus (copy path, open file, reveal in file tree, open in editor), a Sync
Locally popover with a copyable git fetch command, view options (collapse all,
wrapping, split/unified layout), and a sticky footer that reports how far the
branch is ahead of its merge base and switches between all changes,
uncommitted work, and individual commits.

sessions.diff gains an additive scope param (all | uncommitted | commit) plus
commits, aheadCount, and mergeBase metadata. Commit-scope diffs read only the
object database, skip untracked collection, and bypass session-start baseline
filtering; unknown commits surface a typed unavailableReason. Offscreen file
bodies use content-visibility so large diffs stay responsive.

* fix(ui): satisfy session diff CI gates

* fix(gateway): fence commit-scoped session diffs to the advertised branch history

ClawSweeper found that commit-scoped sessions.diff accepted any commit resolvable in the checkout. Fence operator.read commit reads to the advertised merge-base..HEAD history and cover sibling-branch and base-history commits.
2026-08-12 01:08:33 -07:00
Vincent Koc
716f996be8
fix(ci): prepare sandbox before repo E2E (#122525) 2026-08-12 16:08:19 +08:00
Vincent Koc
b8a0fa2e7a
fix(plugins): derive media aliases from exports (#122523) 2026-08-12 16:03:34 +08:00
Peter Steinberger
5a643e3543
fix(plugins): keep packed entries consistent through package lifecycle (#121174)
* fix(plugins): own packed entry lifecycles by package

Persist package ownership per runtime child, route lifecycle actions through one closed resolver, reconcile removed child policy during updates, and retain rollback generations until durable config/index commit.

* fix(plugins): break uninstall policy import cycle

* test(plugins): model package ownership in lifecycle fixtures
2026-08-12 00:49:29 -07:00
Peter Steinberger
016c5aa772
ci: balance Control UI E2E shards by source size (#122527)
Co-authored-by: Amp <amp@ampcode.com>
2026-08-12 00:48:14 -07:00
Peter Steinberger
bfe1f33ea0
improve(ui): make Control UI feel native on mobile (#122492)
* improve(ui): make Control UI feel native on mobile

* fix(ui): keep coarse-pointer input floor text-scale aware

* fix(ui): let self-sized controls opt out of the touch input floor

* fix(ui): fold per-control coarse-pointer font floors into the shared touch floor
2026-08-12 00:46:35 -07:00
Peter Steinberger
94c28e093d
fix(test): route agent directory runs to owning shard (#122514)
* fix(test): route agent directories to owner projects

* fix(test): preserve invalid signal diagnostics
2026-08-12 00:44:49 -07:00
Peter Steinberger
af3550df73
fix(ui): confirm automation removal (#122505)
Bind irreversible Cron removal to the current Gateway, admin scope, state object, and job revision across the confirmation modal.
2026-08-12 00:41:17 -07:00
Peter Steinberger
b46181bfc0
fix(agent): post-tool timeout does not replay completed tools (#122516)
* fix(agent): prevent replay after post-tool timeout

* fix(agent): narrow settled tool assistant evidence
2026-08-12 00:31:55 -07:00
Peter Steinberger
1da8fffbcb
improve: speed up secrets audit test shard (#122504)
* test: speed up secrets audit coverage

* test: complete daemon plugin fixtures

---------

Co-authored-by: Amp <amp@ampcode.com>
2026-08-12 00:23:34 -07:00
Peter Steinberger
0de17482ae
feat(gateway,ui): quiet Where picker, placement chip, and projects read model (#120804)
* feat(gateway): projects.list groups known checkouts by repo identity

Implements docs/plan/runners.md milestone 4 derived projects read model.

* feat(ui): regroup the Where picker by gateway, devices, and cloud

* feat(ui): placement chip shows where a session runs with reclaim

Implements docs/plan/runners.md milestone 4 placement display and reclaim.
2026-08-12 00:21:23 -07:00
Peter Steinberger
fc0147b529
test(plugins): remove duplicate setup cases (#122515) 2026-08-12 00:19:22 -07:00
Ayaan Zaidi
83bca68440
fix: remove new-chat startup stalls (#122471)
* fix(gateway): defer dashboard title generation

* perf(agents): reuse prepared plugin metadata for model catalogs

* perf(agents): keep live model inventory off turn startup

* perf: keep isolated completions on static catalogs

* fix: preserve fast readable worktree names

* refactor: remove unnecessary title startup plumbing
2026-08-12 12:44:46 +05:30
Peter Steinberger
6f39f953ec
fix(ui): show each chat panel button once, in the pane header (#122507)
* test(ui): advertise terminal and browser panels in the mock harness

The mocked Control UI never advertised browser.request or terminal.open and
left terminalEnabled false, so the chat header's panel toggles were invisible
in the harness and could not be visually verified.

* fix(ui): give the chat pane header the only panel toggle row

The session workspace rail header rendered Terminal, Browser, Ask OpenClaw and
Changes alongside its own dock/refresh/collapse controls. Terminal and Changes
already lived in the chat pane header, so both rendered twice at once, while
Browser was reachable only from inside a files rail and Ask OpenClaw sat in a
per-session rail despite being a global surface that already owns a sidebar
entry (settings route 'custodian').

The rail header now owns workspace-file actions only. Browser moves up to the
pane header beside Terminal and into the narrow-header overflow menu; the
duplicated Terminal and Changes buttons and the Ask OpenClaw toggle are gone.

Production LOC: +21 -84.

* test(ui): stop the vite stub from shadowing the mock bootstrap config

ui/vite.config.ts registers a placeholder /control-ui-config.json middleware
and config-file plugins load before inline ones, so the mock gateway plugin's
bootstrap body never reached the app and every scenario bootstrap field was
silently dropped. Marking the mock plugin 'pre' lets it answer first.
2026-08-12 00:13:13 -07:00
Peter Steinberger
d3696f8d76
test(core): remove orphan test exports (#122500) 2026-08-12 00:04:39 -07:00
Peter Steinberger
07d9f9c92c
refactor(gateway): extract source-agnostic desktop relay core (#122455)
* refactor(gateway): extract source-agnostic desktop relay core

Split the cloud-worker desktop observer into a reusable core under
src/gateway/desktop/ so upcoming desktop sources (gateway host, nodes)
plug into one relay pipeline:

- attachment.ts: RfbAttachment union (unix socket | loopback TCP)
- session-registry.ts: generic observer lifecycle (8-observer cap,
  controller eviction, 60s linger, owner-epoch fencing) with typed
  stale-owner/stopped errors
- observe-bridge.ts: single-use observe tokens + WS relay, path moves
  to /desktop/observe (clients consume wsPath verbatim)
- rfb-view-only-filter.ts: pure move

desktop-tunnel.ts keeps only worker SSH acquisition and app launch,
plugged into the shared registry; external API unchanged. Behavior
is identical; worker desktop tests pass unmodified apart from import
and path renames. Drops the never-used now() option.

* fix(gateway): fence only superseded desktop sessions

The desktop core extraction replaced the owner fence's "stop strictly
older owners" check with an unconditional session stop. A launcher that
claims an owner epoch first, then reaches its async fencing pass after a
same-epoch observe has already created the session, tore that session
down and failed the observer with "stopped before connecting".

Restore the original invariant in the registry that owns it:
stopSuperseded() retires an entry only when its epoch is strictly lower
than the claimant's, so peers sharing a generation keep the session.

The regression test drives launch-then-observe at one epoch and fails on
the pre-fix code inside fenceReplacedOwners.

* refactor(gateway): drop unused WorkerDesktopTunnels type export
2026-08-11 23:58:06 -07:00
Ayaan Zaidi
1fd7eedb33
fix(media): let sandboxed agents read staged documents (#122490)
Use successful per-attachment staging results in unsupported-document guidance so sandboxed agents receive only workspace-readable paths. Failed or partial staging keeps the existing fallback.

Co-authored-by: Ayaan Zaidi <hi@obviy.us>
2026-08-12 12:22:35 +05:30
Peter Steinberger
87ecc4085d
feat(webui): auto-request notification permission on first chat send (#122446)
* feat(webui): auto-request notification permission on first chat send

The Control UI now asks for notification permission automatically on the first chat message you send (once per browser/origin; web push in browsers, native prompt in the macOS app; denied permission is never re-asked automatically — Settings -> Notifications stays the manual path).

* fix(webui): preserve notification prompt gesture boundary

Restrict the one-shot notification prompt to direct non-command composer sends, invoke browser permission synchronously, and keep Settings documented as the management and recovery path.

* fix(webui): exclude deferred notification sends

Require an actively dispatching browser input event before consuming the notification one-shot, so retained catalog handoffs and other deferred sends cannot suppress the first real composer prompt.
2026-08-11 23:52:05 -07:00
Peter Steinberger
3dcd494f66
improve(ci): reuse built dist for Doctor proof (#122491)
Amp-Thread-ID: https://ampcode.com/threads/T-019ff3db-c467-70ad-8ed3-81f2ba94b0c0

Co-authored-by: Amp <amp@ampcode.com>
2026-08-11 23:51:59 -07:00
Peter Steinberger
59ea107d09
refactor(agents): delete dead model-selection surface and consolidate compaction targets (#122474)
* refactor(agents): delete dead model-selection surface, consolidate compaction target assembly

Removes production surface with zero live callers: buildConfiguredAllowlistKeys
(orphaned since fallback allowlist filtering was split out), the
retryTransientProviderRuntimeMiss resolveModelAsync option (its gateway startup
prewarming caller was replaced by prepared runtime snapshots), the ignored
useAsyncModelResolution plumbing (kept only as a deprecated no-op field on the
plugin-SDK-shipped prepareSimpleCompletionModelForAgent), and dead facade
re-exports (inferUniqueProviderFromCatalog, ThinkLevel, ModelRefStatus).

Consolidates resolveEmbeddedCompactionTarget's five hand-built result sites into
one assembleTarget helper owning the auth-profile-drop-on-provider-change rule;
resolution precedence is unchanged and now pinned by new table-driven cases
(unique-provider inference, ambiguous literal, profile-suffix preservation).

Net -93 production LOC, -106 test LOC.

* chore(sdk): regenerate plugin SDK API baseline after facade export removals
2026-08-11 23:37:15 -07:00
Peter Steinberger
8190c326ce
feat(gateway): add /startupz startup probe and fix deployment template admission (#122477)
* feat(gateway): add /startupz startup probe with auth-gated version detail

Startup/traffic-admission probe that excludes downstream channel health:
200 started once startup work completes and the gateway is not draining,
503 starting/draining otherwise. Version and uptime are only included for
local-direct or authenticated callers, reusing the /readyz detail gate.

* fix(deploy): use /startupz for traffic admission in bundled templates

fly.toml gains its missing HTTP check; render.yaml stops using pure
liveness as admission; k8s pins an immutable image tag, seeds config
only when missing, and adds a startupProbe; stale Fly healthcheck-port
doc corrected (healthcheck follows the active gateway lock port since
bc4221a07e).

* docs(k8s): make persistent-file config ownership explicit with reseed path
2026-08-11 23:36:33 -07:00
Peter Steinberger
0b4701677b
test(core): remove residual duplicate cases (#122487) 2026-08-11 23:34:31 -07:00