Commit Graph

2096 Commits (4e4ed2ea1793340a9c8d707f3024143ea8f68f4e)

Author SHA1 Message Date
David Iach 4e4ed2ea17
fix(security): cap Slack media downloads and validate Slack file URLs (#6639)
* Security: cap Slack media downloads and validate Slack file URLs

* Security: relax web media fetch cap for compression

* Fixes: sync pi-coding-agent options

* Fixes: align system prompt override type

* Slack: clarify fetchImpl assumptions

* fix: respect raw media fetch cap (#6639) (thanks @davidiach)

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-02-02 00:48:07 -08:00
Peter Steinberger 521b121815 fix: treat '*' tool allowlist as valid 2026-02-02 08:45:51 +00:00
Ayaan Zaidi 01449a2f41 fix: add telegram download timeouts (#6914) (thanks @hclsys) 2026-02-02 13:39:39 +05:30
Ayaan Zaidi e25f8ed56c fix: add changelog for telegram thread spec (#6833) (thanks @obviyus) 2026-02-02 09:26:59 +05:30
Mario Zechner 4347d2468c fix: format issues and lint error in oauth.ts 2026-02-02 01:59:42 +01:00
Peter Steinberger 8c7901c984 fix(twitch): enforce allowFrom allowlist 2026-02-02 00:16:35 +00:00
Peter Steinberger a87a07ec8a fix: harden host exec env validation (#4896) (thanks @HassanFleyah) 2026-02-01 15:37:19 -08:00
VACInc b796f6ec01
Security: harden web tools and file parsing (#4058)
* feat: web content security wrapping + gkeep/simple-backup skills

* fix: harden web fetch + media text detection (#4058) (thanks @VACInc)

---------

Co-authored-by: VAC <vac@vacs-mac-mini.localdomain>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-02-01 15:23:25 -08:00
Peter Steinberger 92112a61db chore: add TLS 1.3 minimum changelog (#5970) (thanks @loganaden) 2026-02-01 15:14:55 -08:00
Peter Steinberger 8eb11bd304
fix: wire before_tool_call hook into tool execution (#6570) (thanks @ryancnelson) (#6660) 2026-02-01 14:52:11 -08:00
Peter Steinberger 99346314f5 chore: trim docs changelog 2026-02-01 14:17:47 -08:00
Peter Steinberger 1968a4b7d2 chore: expand changelog 2026-02-01 14:12:39 -08:00
Peter Steinberger a68e32d95b chore: update changelog 2026-02-01 14:08:09 -08:00
Peter Steinberger 238200f652 chore: update changelog and relay formatting 2026-02-01 14:03:57 -08:00
CLAWDINATOR Bot 92803facf6 docs: preserve moonshot sync markers 2026-02-01 20:34:42 +00:00
Sebastian a863ac9862 Docs: clarify Moonshot endpoints (#4763)
Co-authored-by: hansbbans <hansbbans@users.noreply.github.com>
2026-02-01 15:03:55 -05:00
Peter Steinberger 083ec9325e fix: cover OpenRouter attribution headers 2026-02-01 19:30:33 +00:00
CLAWDINATOR Bot 17287bc8d0 docs: add zh-CN titles (#6487) (thanks @joshp123) 2026-02-01 18:21:15 +00:00
bonald d3e53eaf27
fix(skill): update session-logs paths from .clawdbot to .openclaw (#4502)
Co-authored-by: Jarvis <jarvis@openclaw.ai>
Co-authored-by: CLAWDINATOR Bot <clawdinator[bot]@users.noreply.github.com>
Co-authored-by: Shadow <shadow@openclaw.ai>
2026-02-01 11:42:28 -06:00
CLAWDINATOR Bot 6453f5c395 docs: add Mintlify language navigation (#6416) (thanks @joshp123) 2026-02-01 17:20:44 +00:00
CLAWDINATOR Bot bc5b0c82ac fix(docker): avoid using host port in gateway command (#5110) (thanks @mise42) 2026-02-01 17:17:18 +00:00
shatner 8ff75eaf12
Docs: Direct link to BotFather on Telegram (#4064)
* Docs: Direct link to BotFather on Telegram, sparing users from searching and potentially encountering impostors.

* Update numbering syntax

Update numbering syntax to match PR to latest doc layout.

* Docs: add BotFather verification note

---------

Co-authored-by: Sebastian <sebslight@gmail.com>
2026-02-01 10:15:40 -05:00
Ayaan Zaidi 0992c5a809 fix: cap context window resolution (#6187) (thanks @iamEvanYT) 2026-02-01 19:52:56 +05:30
Ayaan Zaidi 1f3afa38e8 fix: use shared pairing store for telegram (#6127) (thanks @obviyus) 2026-02-01 15:22:37 +05:30
bravostation b4e2e746b3
/new: use agent personality in session greeting (#5706)
* Slash new: use agent personality in session greeting

Previously /new and /reset used a generic greeting prompt. Agents with
personality files (IDENTITY.md, SOUL.md, etc) would respond out of
character until the conversation got going.

Now the prompt instructs the agent to greet users as their character,
using their defined voice, mannerisms, and mood from the start.

* Auto-reply: avoid workspace references in reset prompt

* fix: avoid workspace references in reset greeting (#5706) (thanks @bravostation)

---------

Co-authored-by: MoltBot <bot@moltbot.com>
Co-authored-by: Shadow <shadow@clawd.bot>
2026-01-31 20:43:19 -06:00
Tak Hoffman 3d5c03ec29 fix: resolve Windows npm spawn ENOENT (#5815) (thanks @thejhinvirtuoso) 2026-01-31 20:39:33 -06:00
Lalit Singh 01d76e4799
feat(routing): add thread parent binding inheritance for Discord (#3892)
* feat(routing): add thread parent binding inheritance for Discord

When a Discord thread message doesn't match a direct peer binding,
now checks if the parent channel has a binding and uses that agent.

This enables multi-agent setups where threads inherit their parent
channel's agent binding automatically.

Changes:
- Add parentPeer parameter to ResolveAgentRouteInput
- Add binding.peer.parent match type
- Resolve thread parent early in Discord preflight
- Pass parentPeer to resolveAgentRoute for threads

Fixes thread routing in Discord multi-agent configurations where
threads were incorrectly routed to the default agent instead of
inheriting from their parent channel's binding.

* ci: trigger fresh macOS runners

* Discord: inherit thread bindings in reactions

* fix: add changelog for thread parent binding (#3892) (thanks @aerolalit)

---------

Co-authored-by: Lalit Singh <lalit@clawd.bot>
Co-authored-by: OSS Agent <oss-agent@clawdbot.ai>
Co-authored-by: Shadow <shadow@clawd.bot>
2026-01-31 20:30:45 -06:00
Gustavo Madeira Santana 73c405f74a Docs: note MiniMax OAuth updates (#5402) (thanks @Maosghoul) 2026-01-31 21:08:56 -05:00
Shadow 8e2b17e0c5
Discord: add PluralKit sender identity resolver (#5838)
* Discord: add PluralKit sender identity resolver

* fix: resolve PluralKit sender identities (#5838) (thanks @thewilloftheshadow)
2026-01-31 19:50:06 -06:00
Vignesh 1295b67057
fix(lobster): block arbitrary exec via lobsterPath/cwd (GHSA-4mhr-g7xj-cg8j) (#5335)
* fix(lobster): prevent arbitrary exec via lobsterPath/cwd

* fix(lobster): harden lobsterPath errors + normalize cwd sandboxing

* fix(lobster): ignore tool-provided lobsterPath; validate + use plugin config

* fix(lobster): use plugin config lobsterPath + add tests (#5335) (thanks @vignesh07)

* fix(lobster): make Windows spawn fallback handle ENOENT (#5335) (thanks @vignesh07)

---------

Co-authored-by: Tyler Yust <TYTYYUST@YAHOO.COM>
2026-01-31 12:46:20 -08:00
Ayaan Zaidi f1de88c198 fix: restore telegram draft streaming partials (#5543) (thanks @obviyus) 2026-01-31 22:46:19 +05:30
Tak Hoffman 9c29853014 Gateway: inject timestamps into agent/chat.send (#3705) (thanks @conroywhitney, @CashWilliams) 2026-01-31 09:47:27 -06:00
Peter Steinberger 83e64c1ac9 docs: start 2026.1.31 changelog 2026-01-31 16:28:19 +01:00
Peter Steinberger 7d89855c55 fix: align npm publish metadata 2026-01-31 14:21:21 +01:00
cpojer 8cab78abbc
chore: Run `pnpm format:fix`. 2026-01-31 21:13:13 +09:00
Peter Steinberger 1287328b6f feat: add MiniMax OAuth plugin (#4521) (thanks @Maosghoul) 2026-01-31 12:42:45 +01:00
Peter Steinberger b9b94715fa fix: avoid stderr backpressure in macOS discovery (#3304) (thanks @abhijeet117) 2026-01-31 12:03:30 +01:00
Peter Steinberger 247fab47ca chore: bump version to 2026.1.30 2026-01-31 11:37:36 +01:00
Ayaan Zaidi 310eed825e fix: preserve delivery thread fallback (#4911) (thanks @yevhen) 2026-01-31 09:31:40 +05:30
Ayaan Zaidi e849df64dc fix: normalize telegram account token lookup (#5055) (thanks @jasonsschin) 2026-01-31 08:58:04 +05:30
Tyler Yust 0b7aa8cf1d feat(ui): refresh session list after chat commands in Web UI 2026-01-30 14:29:04 -08:00
Gustavo Madeira Santana 34bdbdb405 fix: resolve Control UI assets for global installs (#4909) (thanks @YuriNachos)
Co-authored-by: YuriNachos <YuriNachos@users.noreply.github.com>
2026-01-30 17:08:40 -05:00
Gustavo Madeira Santana 39eb0b7bc0 fix: prevent undefined gateway token defaults (#4873) (thanks @Hisleren)
Co-authored-by: Hisleren <Hisleren@users.noreply.github.com>
2026-01-30 16:16:35 -05:00
Gustavo Madeira Santana daf27dd37e fix: add per-agent models status (#4780) (thanks @jlowin) 2026-01-30 15:47:05 -05:00
Peter Steinberger fd00d5688a chore: update openclaw naming 2026-01-30 21:03:11 +01:00
Ayaan Zaidi da71eaebd2 fix: correct telegram html nesting (#4578) (thanks @ThanhNguyxn) 2026-01-30 16:53:39 +05:30
Ayaan Zaidi fa9ec6e854 fix: add docker ui install changelog entry (#4584) (thanks @obviyus) 2026-01-30 16:25:24 +05:30
Ayaan Zaidi bc432d8435 fix: accept numeric Telegram react ids (#4533) (thanks @Ayush10) 2026-01-30 15:01:18 +05:30
Ayaan Zaidi 3a85cb1833 fix: honor Telegram proxy dispatcher (#4456) (thanks @spiceoogway) 2026-01-30 14:38:39 +05:30
Ayaan Zaidi 9025da2296 fix: scope telegram skill commands per bot (#4360) (thanks @robhparker) 2026-01-30 12:00:29 +05:30