777756e1c2
fix(webchat): respect user scroll position during streaming and refresh (thanks @marcomarandiz)
...
Merges #7226
2026-02-02 16:22:28 +00:00
1b34446bf5
docs: update changelog for PR #7226
2026-02-02 16:19:40 +00:00
7cee8c2345
Docs: expand zh-Hans nav ( #7242 ) (thanks @joshp123)
2026-02-02 17:07:34 +01:00
991ed3ab58
Tests: stub SSRF DNS pinning ( #6619 ) (thanks @joshp123)
2026-02-02 16:38:25 +01:00
4023b76ed3
docs: add changelog for zh-CN translations ( #6619 ) (thanks @joshp123)
2026-02-02 16:38:25 +01:00
f9fae2c439
fix: stabilize docker e2e flows
2026-02-02 13:11:55 +00:00
9bd64c8a1f
fix: expand SSRF guard coverage
2026-02-02 04:58:32 -08:00
57d008a33d
fix(update): harden global updates
2026-02-02 04:45:14 -08:00
66307695eb
fix: start gateway in docker CMD ( #6635 ) (thanks @kaizen403)
2026-02-02 17:38:37 +05:30
81c68f582d
fix: guard remote media fetches with SSRF checks
2026-02-02 04:07:29 -08:00
ed4529e246
docs: update 2026.2.1 changelog
2026-02-02 03:25:32 -08:00
8b64705e05
docs: fold 2026.2.2 into 2026.2.1
2026-02-02 02:43:54 -08:00
f6d98a908a
docs: add changelog entry for plugin install hardening
2026-02-02 02:07:47 -08:00
d5f6caba3f
docs: merge 2026.2.2 changelog into 2026.2.1
2026-02-02 01:31:24 -08:00
9ef24fd400
fix: flush block streaming on paragraph boundaries for chunkMode=newline ( #7014 )
...
* feat: Implement paragraph boundary flushing in block streaming
- Added `flushOnParagraph` option to `BlockReplyChunking` for immediate flushing on paragraph breaks.
- Updated `EmbeddedBlockChunker` to handle paragraph boundaries during chunking.
- Enhanced `createBlockReplyCoalescer` to support flushing on enqueue.
- Added tests to verify behavior of flushing with and without `flushOnEnqueue` set.
- Updated relevant types and interfaces to include `flushOnParagraph` and `flushOnEnqueue` options.
* fix: Improve streaming behavior and enhance block chunking logic
- Resolved issue with stuck typing indicator after streamed BlueBubbles replies.
- Refactored `EmbeddedBlockChunker` to streamline fence-split handling and ensure maxChars fallback for newline chunking.
- Added tests to validate new chunking behavior, including handling of paragraph breaks and fence scenarios.
- Updated changelog to reflect these changes.
* test: Add test for clamping long paragraphs in EmbeddedBlockChunker
- Introduced a new test case to verify that long paragraphs are correctly clamped to maxChars when flushOnParagraph is enabled.
- Updated logic in EmbeddedBlockChunker to handle cases where the next paragraph break exceeds maxChars, ensuring proper chunking behavior.
* refactor: streamline logging and improve error handling in message processing
- Removed verbose logging statements from the `processMessage` function to reduce clutter.
- Enhanced error handling by using `runtime.error` for typing restart failures.
- Updated the `applySystemPromptOverrideToSession` function to accept a string directly instead of a function, simplifying the prompt application process.
- Adjusted the `runEmbeddedAttempt` function to directly use the system prompt override without invoking it as a function.
2026-02-02 01:22:41 -08:00
85cd55e22b
chore: bump to 2026.2.1
2026-02-02 08:51:54 +00:00
4e4ed2ea17
fix(security): cap Slack media downloads and validate Slack file URLs ( #6639 )
...
* Security: cap Slack media downloads and validate Slack file URLs
* Security: relax web media fetch cap for compression
* Fixes: sync pi-coding-agent options
* Fixes: align system prompt override type
* Slack: clarify fetchImpl assumptions
* fix: respect raw media fetch cap (#6639 ) (thanks @davidiach)
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-02-02 00:48:07 -08:00
521b121815
fix: treat '*' tool allowlist as valid
2026-02-02 08:45:51 +00:00
01449a2f41
fix: add telegram download timeouts ( #6914 ) (thanks @hclsys)
2026-02-02 13:39:39 +05:30
e25f8ed56c
fix: add changelog for telegram thread spec ( #6833 ) (thanks @obviyus)
2026-02-02 09:26:59 +05:30
4347d2468c
fix: format issues and lint error in oauth.ts
2026-02-02 01:59:42 +01:00
8c7901c984
fix(twitch): enforce allowFrom allowlist
2026-02-02 00:16:35 +00:00
a87a07ec8a
fix: harden host exec env validation ( #4896 ) (thanks @HassanFleyah)
2026-02-01 15:37:19 -08:00
b796f6ec01
Security: harden web tools and file parsing ( #4058 )
...
* feat: web content security wrapping + gkeep/simple-backup skills
* fix: harden web fetch + media text detection (#4058 ) (thanks @VACInc)
---------
Co-authored-by: VAC <vac@vacs-mac-mini.localdomain>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-02-01 15:23:25 -08:00
92112a61db
chore: add TLS 1.3 minimum changelog ( #5970 ) (thanks @loganaden)
2026-02-01 15:14:55 -08:00
8eb11bd304
fix: wire before_tool_call hook into tool execution ( #6570 ) (thanks @ryancnelson) ( #6660 )
2026-02-01 14:52:11 -08:00
99346314f5
chore: trim docs changelog
2026-02-01 14:17:47 -08:00
1968a4b7d2
chore: expand changelog
2026-02-01 14:12:39 -08:00
a68e32d95b
chore: update changelog
2026-02-01 14:08:09 -08:00
238200f652
chore: update changelog and relay formatting
2026-02-01 14:03:57 -08:00
92803facf6
docs: preserve moonshot sync markers
2026-02-01 20:34:42 +00:00
a863ac9862
Docs: clarify Moonshot endpoints ( #4763 )
...
Co-authored-by: hansbbans <hansbbans@users.noreply.github.com>
2026-02-01 15:03:55 -05:00
083ec9325e
fix: cover OpenRouter attribution headers
2026-02-01 19:30:33 +00:00
17287bc8d0
docs: add zh-CN titles ( #6487 ) (thanks @joshp123)
2026-02-01 18:21:15 +00:00
d3e53eaf27
fix(skill): update session-logs paths from .clawdbot to .openclaw ( #4502 )
...
Co-authored-by: Jarvis <jarvis@openclaw.ai>
Co-authored-by: CLAWDINATOR Bot <clawdinator[bot]@users.noreply.github.com>
Co-authored-by: Shadow <shadow@openclaw.ai>
2026-02-01 11:42:28 -06:00
6453f5c395
docs: add Mintlify language navigation ( #6416 ) (thanks @joshp123)
2026-02-01 17:20:44 +00:00
bc5b0c82ac
fix(docker): avoid using host port in gateway command ( #5110 ) (thanks @mise42)
2026-02-01 17:17:18 +00:00
8ff75eaf12
Docs: Direct link to BotFather on Telegram ( #4064 )
...
* Docs: Direct link to BotFather on Telegram, sparing users from searching and potentially encountering impostors.
* Update numbering syntax
Update numbering syntax to match PR to latest doc layout.
* Docs: add BotFather verification note
---------
Co-authored-by: Sebastian <sebslight@gmail.com>
2026-02-01 10:15:40 -05:00
0992c5a809
fix: cap context window resolution ( #6187 ) (thanks @iamEvanYT)
2026-02-01 19:52:56 +05:30
1f3afa38e8
fix: use shared pairing store for telegram ( #6127 ) (thanks @obviyus)
2026-02-01 15:22:37 +05:30
b4e2e746b3
/new: use agent personality in session greeting ( #5706 )
...
* Slash new: use agent personality in session greeting
Previously /new and /reset used a generic greeting prompt. Agents with
personality files (IDENTITY.md, SOUL.md, etc) would respond out of
character until the conversation got going.
Now the prompt instructs the agent to greet users as their character,
using their defined voice, mannerisms, and mood from the start.
* Auto-reply: avoid workspace references in reset prompt
* fix: avoid workspace references in reset greeting (#5706 ) (thanks @bravostation)
---------
Co-authored-by: MoltBot <bot@moltbot.com>
Co-authored-by: Shadow <shadow@clawd.bot>
2026-01-31 20:43:19 -06:00
3d5c03ec29
fix: resolve Windows npm spawn ENOENT ( #5815 ) (thanks @thejhinvirtuoso)
2026-01-31 20:39:33 -06:00
01d76e4799
feat(routing): add thread parent binding inheritance for Discord ( #3892 )
...
* feat(routing): add thread parent binding inheritance for Discord
When a Discord thread message doesn't match a direct peer binding,
now checks if the parent channel has a binding and uses that agent.
This enables multi-agent setups where threads inherit their parent
channel's agent binding automatically.
Changes:
- Add parentPeer parameter to ResolveAgentRouteInput
- Add binding.peer.parent match type
- Resolve thread parent early in Discord preflight
- Pass parentPeer to resolveAgentRoute for threads
Fixes thread routing in Discord multi-agent configurations where
threads were incorrectly routed to the default agent instead of
inheriting from their parent channel's binding.
* ci: trigger fresh macOS runners
* Discord: inherit thread bindings in reactions
* fix: add changelog for thread parent binding (#3892 ) (thanks @aerolalit)
---------
Co-authored-by: Lalit Singh <lalit@clawd.bot>
Co-authored-by: OSS Agent <oss-agent@clawdbot.ai>
Co-authored-by: Shadow <shadow@clawd.bot>
2026-01-31 20:30:45 -06:00
73c405f74a
Docs: note MiniMax OAuth updates ( #5402 ) (thanks @Maosghoul)
2026-01-31 21:08:56 -05:00
8e2b17e0c5
Discord: add PluralKit sender identity resolver ( #5838 )
...
* Discord: add PluralKit sender identity resolver
* fix: resolve PluralKit sender identities (#5838 ) (thanks @thewilloftheshadow)
2026-01-31 19:50:06 -06:00
1295b67057
fix(lobster): block arbitrary exec via lobsterPath/cwd (GHSA-4mhr-g7xj-cg8j) ( #5335 )
...
* fix(lobster): prevent arbitrary exec via lobsterPath/cwd
* fix(lobster): harden lobsterPath errors + normalize cwd sandboxing
* fix(lobster): ignore tool-provided lobsterPath; validate + use plugin config
* fix(lobster): use plugin config lobsterPath + add tests (#5335 ) (thanks @vignesh07)
* fix(lobster): make Windows spawn fallback handle ENOENT (#5335 ) (thanks @vignesh07)
---------
Co-authored-by: Tyler Yust <TYTYYUST@YAHOO.COM>
2026-01-31 12:46:20 -08:00
f1de88c198
fix: restore telegram draft streaming partials ( #5543 ) (thanks @obviyus)
2026-01-31 22:46:19 +05:30
9c29853014
Gateway: inject timestamps into agent/chat.send ( #3705 ) (thanks @conroywhitney, @CashWilliams)
2026-01-31 09:47:27 -06:00
83e64c1ac9
docs: start 2026.1.31 changelog
2026-01-31 16:28:19 +01:00
7d89855c55
fix: align npm publish metadata
2026-01-31 14:21:21 +01:00
8cab78abbc
chore: Run `pnpm format:fix`.
2026-01-31 21:13:13 +09:00
1287328b6f
feat: add MiniMax OAuth plugin ( #4521 ) (thanks @Maosghoul)
2026-01-31 12:42:45 +01:00
b9b94715fa
fix: avoid stderr backpressure in macOS discovery ( #3304 ) (thanks @abhijeet117)
2026-01-31 12:03:30 +01:00
247fab47ca
chore: bump version to 2026.1.30
2026-01-31 11:37:36 +01:00
310eed825e
fix: preserve delivery thread fallback ( #4911 ) (thanks @yevhen)
2026-01-31 09:31:40 +05:30
e849df64dc
fix: normalize telegram account token lookup ( #5055 ) (thanks @jasonsschin)
2026-01-31 08:58:04 +05:30
0b7aa8cf1d
feat(ui): refresh session list after chat commands in Web UI
2026-01-30 14:29:04 -08:00
34bdbdb405
fix: resolve Control UI assets for global installs ( #4909 ) (thanks @YuriNachos)
...
Co-authored-by: YuriNachos <YuriNachos@users.noreply.github.com>
2026-01-30 17:08:40 -05:00
39eb0b7bc0
fix: prevent undefined gateway token defaults ( #4873 ) (thanks @Hisleren)
...
Co-authored-by: Hisleren <Hisleren@users.noreply.github.com>
2026-01-30 16:16:35 -05:00
daf27dd37e
fix: add per-agent models status ( #4780 ) (thanks @jlowin)
2026-01-30 15:47:05 -05:00
fd00d5688a
chore: update openclaw naming
2026-01-30 21:03:11 +01:00
da71eaebd2
fix: correct telegram html nesting ( #4578 ) (thanks @ThanhNguyxn)
2026-01-30 16:53:39 +05:30
fa9ec6e854
fix: add docker ui install changelog entry ( #4584 ) (thanks @obviyus)
2026-01-30 16:25:24 +05:30
bc432d8435
fix: accept numeric Telegram react ids ( #4533 ) (thanks @Ayush10)
2026-01-30 15:01:18 +05:30
3a85cb1833
fix: honor Telegram proxy dispatcher ( #4456 ) (thanks @spiceoogway)
2026-01-30 14:38:39 +05:30
9025da2296
fix: scope telegram skill commands per bot ( #4360 ) (thanks @robhparker)
2026-01-30 12:00:29 +05:30
5e635c9656
feat: add Kimi K2.5 model to synthetic catalog ( #4407 )
...
* feat: add Kimi K2.5 model to synthetic catalog
Add hf:moonshotai/Kimi-K2.5 to the synthetic model catalog.
This model is available via dev.synthetic.new API.
- 256k context window
- 8192 max tokens
- Supports reasoning
* chore: fix formatting in onboard-helpers.ts
* fix: update config candidate ordering test (#4407 ) (thanks @manikv12)
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-01-30 07:17:42 +01:00
23c424899c
docs: reorder 2026.1.29 changelog
2026-01-30 06:25:21 +01:00
9a7160786a
refactor: rename to openclaw
2026-01-30 03:16:21 +01:00
4583f88626
fix: preserve reasoning tags inside code blocks ( #4118 ) (thanks @vinaygit18)
2026-01-29 18:53:05 +00:00
78b9876641
feat: add Xiaomi MiMo provider onboarding ( #3454 )
...
Thanks @WqyJh.
Co-authored-by: Qiying Wang <15232241+WqyJh@users.noreply.github.com>
2026-01-29 17:29:58 +00:00
5152060121
docs(changelog): rewrite 2026.1.29 notes
2026-01-29 16:48:05 +00:00
06289b36da
fix(security): harden SSH target handling ( #4001 )
...
Thanks @YLChen-007.
Co-authored-by: Edward-x <YLChen-007@users.noreply.github.com>
2026-01-29 16:33:36 +00:00
718bc3f9c8
fix: avoid silent telegram empty replies ( #3796 ) ( #3796 )
2026-01-29 11:34:47 +05:30
16a5549ec0
docs: update changelog for mention patterns ( #3303 ) (thanks @HirokiKobayashi-R)
2026-01-29 10:31:47 +05:30
fcc53bcf1b
fix: include AccountId in telegram native command context ( #2942 ) (thanks @Chloe-VP)
2026-01-29 10:17:25 +05:30
4ac7aa4a48
fix: handle telegram video notes ( #2905 ) (thanks @mylukin)
2026-01-29 10:07:21 +05:30
a44da67069
fix: local updates for PR #3600
...
Co-authored-by: kira-ariaki <kira-ariaki@users.noreply.github.com>
2026-01-28 22:00:11 -05:00
b717724275
fix: add security hardening for media text attachments ( #3700 )
...
* fix: Prevent XML attribute injection by escaping special characters in file name and MIME type attributes.
* fix: text attachment MIME misclassification with security hardening (#3628 )
- Fix CSV/TSV inference from content heuristics
- Add UTF-16 detection and BOM handling
- Add XML attribute escaping for file output (security)
- Add MIME override logging for auditability
- Add comprehensive test coverage for edge cases
Thanks @frankekn
2026-01-29 02:39:01 +00:00
67f1402703
fix: tts base url runtime read ( #3341 ) (thanks @hclsys)
2026-01-28 23:30:29 +00:00
6044bf3637
Discord: fix resolveDiscordTarget parse options
2026-01-28 00:37:21 -06:00
b6a3a91edf
fix: wire per-account dm scope guidance ( #3095 ) (thanks @jarvis-sam)
2026-01-28 11:42:33 +05:30
93c2d65398
fix: restore discord username lookup and align minimax test ( #3131 ) (thanks @bonald)
2026-01-28 11:04:07 +05:30
61ab348dd3
Discord: fix target type imports
2026-01-27 22:56:12 -06:00
b01612c262
Discord: gate username lookups
2026-01-27 22:48:18 -06:00
14e4b88bf0
fix: keep telegram dm thread sessions ( #2731 ) (thanks @dylanneve1)
2026-01-28 09:32:20 +05:30
d0ef4d3b85
fix: update Moonshot Kimi model references ( #2762 ) (thanks @MarvinCui)
2026-01-27 21:10:59 -06:00
7bfe6ab2d6
fix: resolve Discord usernames for outbound sends ( #2649 ) (thanks @nonggialiang)
2026-01-27 21:05:37 -06:00
57d9c09f6e
fix: expand Telegram polling network recovery ( #3013 ) (thanks @ryancontent)
2026-01-27 19:56:24 -06:00
eb50314d7d
fix: update MiniMax provider config ( #3064 ) (thanks @hlbbbbbbb)
2026-01-27 19:48:38 -06:00
34653e4baf
fix: guard channel tool listActions ( #2859 ) (thanks @mbelinky)
2026-01-27 19:25:50 -06:00
4647309c4c
fix: update exe.dev install docs (# https://github.com/moltbot/moltbot/pull/3047 ) (thanks @zackerthescar)
2026-01-27 18:54:46 -06:00
7eb57b691c
chore: prep 2026.1.27-beta.1 release
2026-01-28 01:35:58 +01:00
e2c437e81e
fix: migrate legacy state/config paths
2026-01-28 00:16:00 +00:00
3b879fe524
fix(infra): prevent gateway crashes on transient network errors
2026-01-27 18:11:04 -06:00
0b1c8db0ca
fix: handle image size errors safely ( #2871 ) (thanks @Suksham-sharma)
2026-01-27 16:02:19 -06:00
d35ffcd538
docs: update changelog for compile cache ( #2808 ) (thanks @pi0)
2026-01-27 13:53:52 -08:00
9b16a6be3d
fix: inherit provider baseUrl/api for inline models ( #2740 ) (thanks @lploc94)
2026-01-27 16:47:32 -05:00
2930ebfd43
fix(ui): constrain chat textarea auto-resize ( #2950 ) (thanks @shivamraut101)
2026-01-27 13:08:15 -08:00
284b54af42
feat: Add support for Telegram quote (partial message replies) ( #2900 )
...
* feat: Add support for Telegram quote (partial message replies)
- Enhanced describeReplyTarget() to detect and extract quoted text from msg.quote
- Updated reply formatting to distinguish between full message replies and quotes
- Added isQuote flag to replyTarget object for proper identification
- Quote replies show as [Quoting user] "quoted text" [/Quoting]
- Regular replies unchanged: [Replying to user] full message [/Replying]
Resolves need for partial message reply support in Telegram Bot API.
Backward compatible with existing reply functionality.
* updating references
* Mac: finish Moltbot rename
* Mac: finish Moltbot rename (paths)
* fix(macOS): rename Clawdbot directories to Moltbot for naming consistency
Directory renames:
- apps/macos/Sources/Clawdbot → Moltbot
- apps/macos/Sources/ClawdbotDiscovery → MoltbotDiscovery
- apps/macos/Sources/ClawdbotIPC → MoltbotIPC
- apps/macos/Sources/ClawdbotMacCLI → MoltbotMacCLI
- apps/macos/Sources/ClawdbotProtocol → MoltbotProtocol
- apps/macos/Tests/ClawdbotIPCTests → MoltbotIPCTests
- apps/shared/ClawdbotKit → MoltbotKit
- apps/shared/MoltbotKit/Sources/Clawdbot* → Moltbot*
- apps/shared/MoltbotKit/Tests/ClawdbotKitTests → MoltbotKitTests
Resource renames:
- Clawdbot.icns → Moltbot.icns
Code fixes:
- Update Package.swift paths to reference Moltbot* directories
- Fix clawdbot* → moltbot* symbol references in Swift code:
- clawdbotManagedPaths → moltbotManagedPaths
- clawdbotExecutable → moltbotExecutable
- clawdbotCommand → moltbotCommand
- clawdbotNodeCommand → moltbotNodeCommand
- clawdbotOAuthDirEnv → moltbotOAuthDirEnv
- clawdbotSelectSettingsTab → moltbotSelectSettingsTab
* fix: update remaining ClawdbotKit path references to MoltbotKit
- scripts/bundle-a2ui.sh: A2UI_APP_DIR path
- package.json: format:swift and protocol:check paths
- scripts/protocol-gen-swift.ts: output paths
- .github/dependabot.yml: directory path and comment
- .gitignore: build cache paths
- .swiftformat: exclusion paths
- .swiftlint.yml: exclusion path
- apps/android/app/build.gradle.kts: assets.srcDir path
- apps/ios/project.yml: package path
- apps/ios/README.md: documentation reference
- docs/concepts/typebox.md: documentation reference
- apps/shared/MoltbotKit/Package.swift: fix argument order
* chore: update Package.resolved after dependency resolution
* fix: add MACOS_APP_SOURCES_DIR constant and update test to use new path
The cron-protocol-conformance test was using LEGACY_MACOS_APP_SOURCES_DIR
which points to the old Clawdbot path. Added a new MACOS_APP_SOURCES_DIR
constant for the current Moltbot path and updated the test to use it.
* fix: finish Moltbot macOS rename (#2844 ) (thanks @fal3)
* Extensions: use workspace moltbot in memory-core
* fix(security): recognize Venice-style claude-opus-45 as top-tier model
The security audit was incorrectly flagging venice/claude-opus-45 as
'Below Claude 4.5' because the regex expected -4-5 (with dash) but
Venice uses -45 (without dash between 4 and 5).
Updated isClaude45OrHigher() regex to match both formats.
Added test case to prevent regression.
* Branding: update bot.molt bundle IDs + launchd labels
* Branding: remove legacy android packages
* fix: wire telegram quote support (#2900 )
Co-authored-by: aduk059 <aduk059@users.noreply.github.com>
* fix: support Telegram quote replies (#2900 ) (thanks @aduk059)
---------
Co-authored-by: Gustavo Madeira Santana <gumadeiras@users.noreply.github.com>
Co-authored-by: Shadow <shadow@clawd.bot>
Co-authored-by: Alex Fallah <alexfallah7@gmail.com>
Co-authored-by: Josh Palmer <joshp123@users.noreply.github.com>
Co-authored-by: jonisjongithub <jonisjongithub@users.noreply.github.com>
Co-authored-by: Gustavo Madeira Santana <gumadeiras@gmail.com>
Co-authored-by: aduk059 <aduk059@users.noreply.github.com>
2026-01-27 15:59:24 -05:00
Shakker
Josh Palmer
CLAWDINATOR Bot
Peter Steinberger
Ayaan Zaidi
Tyler Yust
David Iach
Mario Zechner
VACInc
Sebastian
bonald
shatner
bravostation
Tak Hoffman
Lalit Singh
Gustavo Madeira Santana
Shadow
Vignesh
cpojer
Tyler Yust
Manik Vahsith
Ayaan Zaidi
Shakker
Shadow
elliotsecops
A. Duk