Commit Graph

2180 Commits (3b40227bc677fb50a7931d5cce00a370a5d405b6)

Author SHA1 Message Date
Vignesh Natarajan b37626ce6b docs: finish renaming memory state dir references 2026-02-03 00:24:13 -08:00
Vignesh Natarajan 1ee57cf727 fix: changelog entry for QMD memory (#3160) (thanks @vignesh07) 2026-02-02 23:45:05 -08:00
Vignesh Natarajan 4322ca6f4a chore: oxfmt 2026-02-02 23:45:05 -08:00
Vignesh Natarajan 3a57106c1e Add more tests; make fall back more resilient and visible 2026-02-02 23:45:05 -08:00
Shakker 58d5b39c9a Onboarding: keep TUI flow exclusive 2026-02-03 06:11:11 +00:00
Tak Hoffman 578bde1e0d Security: healthcheck skill (#7641) (thanks @Takhoffman) 2026-02-02 20:36:58 -06:00
Gustavo Madeira Santana 2a68bcbeb3 feat(ui): add Agents dashboard 2026-02-02 21:31:17 -05:00
Peter Steinberger fe81b1d712 fix(gateway): require shared auth before device bypass 2026-02-02 16:56:38 -08:00
Peter Steinberger fff59da962 fix(slack): fail closed on slash command channel type lookup 2026-02-02 16:53:07 -08:00
Shakker cfd6b21d0e fix: repair malformed tool calls and session transcripts (#7473) (thanks @justinhuangcode) 2026-02-02 23:56:27 +00:00
Justin 31face5740 Changelog: note tool call repair 2026-02-02 23:56:27 +00:00
Tak Hoffman 0eae9f456c Docs: fix compatibility shim note 2026-02-02 17:22:22 -06:00
Shakker 561a10c491 fix(telegram): recover from grammY long-poll timeouts (#7466) (thanks @macmimi23) 2026-02-02 22:38:57 +00:00
Ji f49297e2c1
fix: skip audio files from text extraction to prevent binary processing (#7475)
* fix: skip audio files from text extraction early

Audio files should not be processed through extractFileBlocks for text
extraction - they are handled by the dedicated audio transcription
capability (STT).

Previously, audio files were only skipped if they didn't "look like text"
(looksLikeUtf8Text check). This caused issues where some audio binary
data (e.g., long Telegram voice messages) could accidentally pass the
heuristic check and get processed as text content.

This fix:
1. Adds audio to the early skip alongside image/video (more efficient)
2. Removes the redundant secondary check that had the flawed condition

Fixes audio binary being incorrectly processed as text in Telegram and
other platforms.

* Media: skip binary media in file extraction (#7475) (thanks @AlexZhangji)

---------

Co-authored-by: Shakker <shakkerdroid@gmail.com>
2026-02-02 22:20:04 +00:00
Shakker 5fb8f779ca fix: validate AbortSignal instances before calling AbortSignal.any() (#7277) (thanks @Elarwei001) 2026-02-02 20:42:40 +00:00
Tyler Yust 64849e81f5
feat(config): default thinking for sessions_spawn subagents (#7372)
* feat(config): add subagent default thinking

* fix: accept config subagents.thinking + stabilize test mocks (#7372) (thanks @tyler6204)

* fix: use findLast instead of clearAllMocks in test (#7372)

* fix: correct test assertions for tool result structure (#7372)

* fix: remove unnecessary type assertion after rebase
2026-02-02 12:14:17 -08:00
Josh Palmer ea9eed14f8 Docs: add zh-CN landing note (#7303) (thanks @joshp123) 2026-02-02 18:35:01 +01:00
Shakker 3711143549 chore: fix formatting and CI 2026-02-02 16:41:49 +00:00
Shakker 777756e1c2 fix(webchat): respect user scroll position during streaming and refresh (thanks @marcomarandiz)
Merges #7226
2026-02-02 16:22:28 +00:00
Shakker 1b34446bf5 docs: update changelog for PR #7226 2026-02-02 16:19:40 +00:00
Josh Palmer 7cee8c2345 Docs: expand zh-Hans nav (#7242) (thanks @joshp123) 2026-02-02 17:07:34 +01:00
Josh Palmer 991ed3ab58 Tests: stub SSRF DNS pinning (#6619) (thanks @joshp123) 2026-02-02 16:38:25 +01:00
CLAWDINATOR Bot 4023b76ed3 docs: add changelog for zh-CN translations (#6619) (thanks @joshp123) 2026-02-02 16:38:25 +01:00
Peter Steinberger f9fae2c439 fix: stabilize docker e2e flows 2026-02-02 13:11:55 +00:00
Peter Steinberger 9bd64c8a1f fix: expand SSRF guard coverage 2026-02-02 04:58:32 -08:00
Peter Steinberger 57d008a33d fix(update): harden global updates 2026-02-02 04:45:14 -08:00
Ayaan Zaidi 66307695eb fix: start gateway in docker CMD (#6635) (thanks @kaizen403) 2026-02-02 17:38:37 +05:30
Peter Steinberger 81c68f582d fix: guard remote media fetches with SSRF checks 2026-02-02 04:07:29 -08:00
Peter Steinberger ed4529e246 docs: update 2026.2.1 changelog 2026-02-02 03:25:32 -08:00
Peter Steinberger 8b64705e05 docs: fold 2026.2.2 into 2026.2.1 2026-02-02 02:43:54 -08:00
Peter Steinberger f6d98a908a docs: add changelog entry for plugin install hardening 2026-02-02 02:07:47 -08:00
Peter Steinberger d5f6caba3f docs: merge 2026.2.2 changelog into 2026.2.1 2026-02-02 01:31:24 -08:00
Tyler Yust 9ef24fd400
fix: flush block streaming on paragraph boundaries for chunkMode=newline (#7014)
* feat: Implement paragraph boundary flushing in block streaming

- Added `flushOnParagraph` option to `BlockReplyChunking` for immediate flushing on paragraph breaks.
- Updated `EmbeddedBlockChunker` to handle paragraph boundaries during chunking.
- Enhanced `createBlockReplyCoalescer` to support flushing on enqueue.
- Added tests to verify behavior of flushing with and without `flushOnEnqueue` set.
- Updated relevant types and interfaces to include `flushOnParagraph` and `flushOnEnqueue` options.

* fix: Improve streaming behavior and enhance block chunking logic

- Resolved issue with stuck typing indicator after streamed BlueBubbles replies.
- Refactored `EmbeddedBlockChunker` to streamline fence-split handling and ensure maxChars fallback for newline chunking.
- Added tests to validate new chunking behavior, including handling of paragraph breaks and fence scenarios.
- Updated changelog to reflect these changes.

* test: Add test for clamping long paragraphs in EmbeddedBlockChunker

- Introduced a new test case to verify that long paragraphs are correctly clamped to maxChars when flushOnParagraph is enabled.
- Updated logic in EmbeddedBlockChunker to handle cases where the next paragraph break exceeds maxChars, ensuring proper chunking behavior.

* refactor: streamline logging and improve error handling in message processing

- Removed verbose logging statements from the `processMessage` function to reduce clutter.
- Enhanced error handling by using `runtime.error` for typing restart failures.
- Updated the `applySystemPromptOverrideToSession` function to accept a string directly instead of a function, simplifying the prompt application process.
- Adjusted the `runEmbeddedAttempt` function to directly use the system prompt override without invoking it as a function.
2026-02-02 01:22:41 -08:00
Peter Steinberger 85cd55e22b chore: bump to 2026.2.1 2026-02-02 08:51:54 +00:00
David Iach 4e4ed2ea17
fix(security): cap Slack media downloads and validate Slack file URLs (#6639)
* Security: cap Slack media downloads and validate Slack file URLs

* Security: relax web media fetch cap for compression

* Fixes: sync pi-coding-agent options

* Fixes: align system prompt override type

* Slack: clarify fetchImpl assumptions

* fix: respect raw media fetch cap (#6639) (thanks @davidiach)

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-02-02 00:48:07 -08:00
Peter Steinberger 521b121815 fix: treat '*' tool allowlist as valid 2026-02-02 08:45:51 +00:00
Ayaan Zaidi 01449a2f41 fix: add telegram download timeouts (#6914) (thanks @hclsys) 2026-02-02 13:39:39 +05:30
Ayaan Zaidi e25f8ed56c fix: add changelog for telegram thread spec (#6833) (thanks @obviyus) 2026-02-02 09:26:59 +05:30
Mario Zechner 4347d2468c fix: format issues and lint error in oauth.ts 2026-02-02 01:59:42 +01:00
Peter Steinberger 8c7901c984 fix(twitch): enforce allowFrom allowlist 2026-02-02 00:16:35 +00:00
Peter Steinberger a87a07ec8a fix: harden host exec env validation (#4896) (thanks @HassanFleyah) 2026-02-01 15:37:19 -08:00
VACInc b796f6ec01
Security: harden web tools and file parsing (#4058)
* feat: web content security wrapping + gkeep/simple-backup skills

* fix: harden web fetch + media text detection (#4058) (thanks @VACInc)

---------

Co-authored-by: VAC <vac@vacs-mac-mini.localdomain>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-02-01 15:23:25 -08:00
Peter Steinberger 92112a61db chore: add TLS 1.3 minimum changelog (#5970) (thanks @loganaden) 2026-02-01 15:14:55 -08:00
Peter Steinberger 8eb11bd304
fix: wire before_tool_call hook into tool execution (#6570) (thanks @ryancnelson) (#6660) 2026-02-01 14:52:11 -08:00
Peter Steinberger 99346314f5 chore: trim docs changelog 2026-02-01 14:17:47 -08:00
Peter Steinberger 1968a4b7d2 chore: expand changelog 2026-02-01 14:12:39 -08:00
Peter Steinberger a68e32d95b chore: update changelog 2026-02-01 14:08:09 -08:00
Peter Steinberger 238200f652 chore: update changelog and relay formatting 2026-02-01 14:03:57 -08:00
CLAWDINATOR Bot 92803facf6 docs: preserve moonshot sync markers 2026-02-01 20:34:42 +00:00
Sebastian a863ac9862 Docs: clarify Moonshot endpoints (#4763)
Co-authored-by: hansbbans <hansbbans@users.noreply.github.com>
2026-02-01 15:03:55 -05:00
Peter Steinberger 083ec9325e fix: cover OpenRouter attribution headers 2026-02-01 19:30:33 +00:00
CLAWDINATOR Bot 17287bc8d0 docs: add zh-CN titles (#6487) (thanks @joshp123) 2026-02-01 18:21:15 +00:00
bonald d3e53eaf27
fix(skill): update session-logs paths from .clawdbot to .openclaw (#4502)
Co-authored-by: Jarvis <jarvis@openclaw.ai>
Co-authored-by: CLAWDINATOR Bot <clawdinator[bot]@users.noreply.github.com>
Co-authored-by: Shadow <shadow@openclaw.ai>
2026-02-01 11:42:28 -06:00
CLAWDINATOR Bot 6453f5c395 docs: add Mintlify language navigation (#6416) (thanks @joshp123) 2026-02-01 17:20:44 +00:00
CLAWDINATOR Bot bc5b0c82ac fix(docker): avoid using host port in gateway command (#5110) (thanks @mise42) 2026-02-01 17:17:18 +00:00
shatner 8ff75eaf12
Docs: Direct link to BotFather on Telegram (#4064)
* Docs: Direct link to BotFather on Telegram, sparing users from searching and potentially encountering impostors.

* Update numbering syntax

Update numbering syntax to match PR to latest doc layout.

* Docs: add BotFather verification note

---------

Co-authored-by: Sebastian <sebslight@gmail.com>
2026-02-01 10:15:40 -05:00
Ayaan Zaidi 0992c5a809 fix: cap context window resolution (#6187) (thanks @iamEvanYT) 2026-02-01 19:52:56 +05:30
Ayaan Zaidi 1f3afa38e8 fix: use shared pairing store for telegram (#6127) (thanks @obviyus) 2026-02-01 15:22:37 +05:30
bravostation b4e2e746b3
/new: use agent personality in session greeting (#5706)
* Slash new: use agent personality in session greeting

Previously /new and /reset used a generic greeting prompt. Agents with
personality files (IDENTITY.md, SOUL.md, etc) would respond out of
character until the conversation got going.

Now the prompt instructs the agent to greet users as their character,
using their defined voice, mannerisms, and mood from the start.

* Auto-reply: avoid workspace references in reset prompt

* fix: avoid workspace references in reset greeting (#5706) (thanks @bravostation)

---------

Co-authored-by: MoltBot <bot@moltbot.com>
Co-authored-by: Shadow <shadow@clawd.bot>
2026-01-31 20:43:19 -06:00
Tak Hoffman 3d5c03ec29 fix: resolve Windows npm spawn ENOENT (#5815) (thanks @thejhinvirtuoso) 2026-01-31 20:39:33 -06:00
Lalit Singh 01d76e4799
feat(routing): add thread parent binding inheritance for Discord (#3892)
* feat(routing): add thread parent binding inheritance for Discord

When a Discord thread message doesn't match a direct peer binding,
now checks if the parent channel has a binding and uses that agent.

This enables multi-agent setups where threads inherit their parent
channel's agent binding automatically.

Changes:
- Add parentPeer parameter to ResolveAgentRouteInput
- Add binding.peer.parent match type
- Resolve thread parent early in Discord preflight
- Pass parentPeer to resolveAgentRoute for threads

Fixes thread routing in Discord multi-agent configurations where
threads were incorrectly routed to the default agent instead of
inheriting from their parent channel's binding.

* ci: trigger fresh macOS runners

* Discord: inherit thread bindings in reactions

* fix: add changelog for thread parent binding (#3892) (thanks @aerolalit)

---------

Co-authored-by: Lalit Singh <lalit@clawd.bot>
Co-authored-by: OSS Agent <oss-agent@clawdbot.ai>
Co-authored-by: Shadow <shadow@clawd.bot>
2026-01-31 20:30:45 -06:00
Gustavo Madeira Santana 73c405f74a Docs: note MiniMax OAuth updates (#5402) (thanks @Maosghoul) 2026-01-31 21:08:56 -05:00
Shadow 8e2b17e0c5
Discord: add PluralKit sender identity resolver (#5838)
* Discord: add PluralKit sender identity resolver

* fix: resolve PluralKit sender identities (#5838) (thanks @thewilloftheshadow)
2026-01-31 19:50:06 -06:00
Vignesh 1295b67057
fix(lobster): block arbitrary exec via lobsterPath/cwd (GHSA-4mhr-g7xj-cg8j) (#5335)
* fix(lobster): prevent arbitrary exec via lobsterPath/cwd

* fix(lobster): harden lobsterPath errors + normalize cwd sandboxing

* fix(lobster): ignore tool-provided lobsterPath; validate + use plugin config

* fix(lobster): use plugin config lobsterPath + add tests (#5335) (thanks @vignesh07)

* fix(lobster): make Windows spawn fallback handle ENOENT (#5335) (thanks @vignesh07)

---------

Co-authored-by: Tyler Yust <TYTYYUST@YAHOO.COM>
2026-01-31 12:46:20 -08:00
Ayaan Zaidi f1de88c198 fix: restore telegram draft streaming partials (#5543) (thanks @obviyus) 2026-01-31 22:46:19 +05:30
Tak Hoffman 9c29853014 Gateway: inject timestamps into agent/chat.send (#3705) (thanks @conroywhitney, @CashWilliams) 2026-01-31 09:47:27 -06:00
Peter Steinberger 83e64c1ac9 docs: start 2026.1.31 changelog 2026-01-31 16:28:19 +01:00
Peter Steinberger 7d89855c55 fix: align npm publish metadata 2026-01-31 14:21:21 +01:00
cpojer 8cab78abbc
chore: Run `pnpm format:fix`. 2026-01-31 21:13:13 +09:00
Peter Steinberger 1287328b6f feat: add MiniMax OAuth plugin (#4521) (thanks @Maosghoul) 2026-01-31 12:42:45 +01:00
Peter Steinberger b9b94715fa fix: avoid stderr backpressure in macOS discovery (#3304) (thanks @abhijeet117) 2026-01-31 12:03:30 +01:00
Peter Steinberger 247fab47ca chore: bump version to 2026.1.30 2026-01-31 11:37:36 +01:00
Ayaan Zaidi 310eed825e fix: preserve delivery thread fallback (#4911) (thanks @yevhen) 2026-01-31 09:31:40 +05:30
Ayaan Zaidi e849df64dc fix: normalize telegram account token lookup (#5055) (thanks @jasonsschin) 2026-01-31 08:58:04 +05:30
Tyler Yust 0b7aa8cf1d feat(ui): refresh session list after chat commands in Web UI 2026-01-30 14:29:04 -08:00
Gustavo Madeira Santana 34bdbdb405 fix: resolve Control UI assets for global installs (#4909) (thanks @YuriNachos)
Co-authored-by: YuriNachos <YuriNachos@users.noreply.github.com>
2026-01-30 17:08:40 -05:00
Gustavo Madeira Santana 39eb0b7bc0 fix: prevent undefined gateway token defaults (#4873) (thanks @Hisleren)
Co-authored-by: Hisleren <Hisleren@users.noreply.github.com>
2026-01-30 16:16:35 -05:00
Gustavo Madeira Santana daf27dd37e fix: add per-agent models status (#4780) (thanks @jlowin) 2026-01-30 15:47:05 -05:00
Peter Steinberger fd00d5688a chore: update openclaw naming 2026-01-30 21:03:11 +01:00
Ayaan Zaidi da71eaebd2 fix: correct telegram html nesting (#4578) (thanks @ThanhNguyxn) 2026-01-30 16:53:39 +05:30
Ayaan Zaidi fa9ec6e854 fix: add docker ui install changelog entry (#4584) (thanks @obviyus) 2026-01-30 16:25:24 +05:30
Ayaan Zaidi bc432d8435 fix: accept numeric Telegram react ids (#4533) (thanks @Ayush10) 2026-01-30 15:01:18 +05:30
Ayaan Zaidi 3a85cb1833 fix: honor Telegram proxy dispatcher (#4456) (thanks @spiceoogway) 2026-01-30 14:38:39 +05:30
Ayaan Zaidi 9025da2296 fix: scope telegram skill commands per bot (#4360) (thanks @robhparker) 2026-01-30 12:00:29 +05:30
Manik Vahsith 5e635c9656
feat: add Kimi K2.5 model to synthetic catalog (#4407)
* feat: add Kimi K2.5 model to synthetic catalog

Add hf:moonshotai/Kimi-K2.5 to the synthetic model catalog.
This model is available via dev.synthetic.new API.

- 256k context window
- 8192 max tokens
- Supports reasoning

* chore: fix formatting in onboard-helpers.ts

* fix: update config candidate ordering test (#4407) (thanks @manikv12)

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-01-30 07:17:42 +01:00
Peter Steinberger 23c424899c docs: reorder 2026.1.29 changelog 2026-01-30 06:25:21 +01:00
Peter Steinberger 9a7160786a refactor: rename to openclaw 2026-01-30 03:16:21 +01:00
Shakker 4583f88626 fix: preserve reasoning tags inside code blocks (#4118) (thanks @vinaygit18) 2026-01-29 18:53:05 +00:00
Peter Steinberger 78b9876641 feat: add Xiaomi MiMo provider onboarding (#3454)
Thanks @WqyJh.

Co-authored-by: Qiying Wang <15232241+WqyJh@users.noreply.github.com>
2026-01-29 17:29:58 +00:00
Peter Steinberger 5152060121 docs(changelog): rewrite 2026.1.29 notes 2026-01-29 16:48:05 +00:00
Peter Steinberger 06289b36da fix(security): harden SSH target handling (#4001)
Thanks @YLChen-007.

Co-authored-by: Edward-x <YLChen-007@users.noreply.github.com>
2026-01-29 16:33:36 +00:00
Ayaan Zaidi 718bc3f9c8
fix: avoid silent telegram empty replies (#3796) (#3796) 2026-01-29 11:34:47 +05:30
Ayaan Zaidi 16a5549ec0 docs: update changelog for mention patterns (#3303) (thanks @HirokiKobayashi-R) 2026-01-29 10:31:47 +05:30
Ayaan Zaidi fcc53bcf1b fix: include AccountId in telegram native command context (#2942) (thanks @Chloe-VP) 2026-01-29 10:17:25 +05:30
Ayaan Zaidi 4ac7aa4a48 fix: handle telegram video notes (#2905) (thanks @mylukin) 2026-01-29 10:07:21 +05:30
Gustavo Madeira Santana a44da67069 fix: local updates for PR #3600
Co-authored-by: kira-ariaki <kira-ariaki@users.noreply.github.com>
2026-01-28 22:00:11 -05:00
Shakker b717724275
fix: add security hardening for media text attachments (#3700)
* fix: Prevent XML attribute injection by escaping special characters in file name and MIME type attributes.

* fix: text attachment MIME misclassification with security hardening (#3628)

- Fix CSV/TSV inference from content heuristics
- Add UTF-16 detection and BOM handling
- Add XML attribute escaping for file output (security)
- Add MIME override logging for auditability
- Add comprehensive test coverage for edge cases

Thanks @frankekn
2026-01-29 02:39:01 +00:00
Shakker 67f1402703 fix: tts base url runtime read (#3341) (thanks @hclsys) 2026-01-28 23:30:29 +00:00
Shadow 6044bf3637
Discord: fix resolveDiscordTarget parse options 2026-01-28 00:37:21 -06:00
Ayaan Zaidi b6a3a91edf fix: wire per-account dm scope guidance (#3095) (thanks @jarvis-sam) 2026-01-28 11:42:33 +05:30