kumarabhirup
6594de6186
Merge Ironclaw changes onto upstream Openclaw 2026.2.22
...
Replays all Ironclaw-specific changes (176 commits) onto the latest
upstream Openclaw release (2026.2.22). Conflicts auto-resolved in
favor of Ironclaw to guarantee zero change loss.
Merge base: cbc3de6c9 (2026-02-16)
Upstream: a37e12eab (upstream/main, 2026.2.22)
Ironclaw: 3009566c9 (origin/main, 2026.2.15-1.9)
Backup: ironclaw-backup-pre-sync
Conflict resolutions:
- 6 GitHub workflow files: deleted (Ironclaw intentionally stripped)
- src/sessions/session-key-utils.test.ts: kept (Ironclaw modified)
- Duplicate imports from merge: deduplicated
- Unused imports from upstream code Ironclaw overrode: removed
- Broken test indentation from merge: fixed
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-21 18:06:01 -08:00
kumarabhirup
7aadd02313
test: add comprehensive workspace test suite and deploy pre-flight checks
...
- Profile management: discoverProfiles, getEffectiveProfile precedence,
setUIActiveProfile, resolveWebChatDir, workspace registry (32 tests)
- Workspace init API: creation, bootstrap seeding, custom paths,
validation, idempotency (13 tests)
- Profile switch API: GET/POST profiles, validation, default reset (10 tests)
- Chat isolation: profile-scoped chat dirs, session isolation (7 tests)
- LLM context awareness: bootstrap loading, subagent filtering,
resolveBootstrapContextForRun content isolation (15 unit + 5 live)
- Subagent streaming: registerSubagent, event replay, persistence,
ensureRegisteredFromDisk, fan-out (24 unit + 5 live)
- deploy.sh: add --skip-tests flag, pnpm test + web:build pre-flight,
auto git commit/push of version bump after publish
- package.json: add test:workspace and test:workspace:live scripts
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-21 15:38:31 -08:00
kumarabhirup
6665bf4a71
refactor: simplify web session management by removing unused functions and adding DELETE and PATCH endpoints
...
- Removed unused functions related to session index management.
- Added DELETE endpoint to remove a web chat session and its associated file.
- Added PATCH endpoint to update session metadata, including renaming sessions.
- Streamlined file writing for new session creation.
2026-02-21 15:17:10 -08:00
Peter Steinberger
bfe016fa29
fix: clear stale remote discovery endpoints ( #21618 ) (thanks @bmendonca3)
2026-02-22 00:04:36 +01:00
kumarabhirup
d88ed44521
Merge remote-tracking branch 'origin/main' into kumareth/workspaces
...
Co-authored-by: Cursor <cursoragent@cursor.com>
# Conflicts:
# apps/web/app/components/chat-message.tsx
2026-02-21 15:00:45 -08:00
Brian Mendonca
617e38cec0
Security/macos: enforce wss for non-loopback direct gateway
2026-02-21 23:57:34 +01:00
Brian Mendonca
8942ac04a8
fix(security): fail closed on unauthenticated discovery routing
2026-02-21 23:57:34 +01:00
kumarabhirup
c8ae7acbf4
fix: restore remaining merge regressions (SKILL.md, MIME types, showHidden, symlink, activeProfileHint)
2026-02-21 14:39:55 -08:00
Peter Steinberger
1bc5c2a7e9
refactor: unify exec shell parser parity and gateway websocket test helpers
2026-02-21 23:17:12 +01:00
Peter Steinberger
2028ca4428
fix(macos): unify exec allowlist validation pipeline
2026-02-21 23:09:07 +01:00
Peter Steinberger
dd41fadcaf
fix(macos): enforce path-only exec allowlist patterns
2026-02-21 22:58:40 +01:00
Peter Steinberger
90a378ca3a
fix(macos): block quoted shell substitution in allowlist checks
2026-02-21 22:57:53 +01:00
kumarabhirup
92fadd6700
fix: filter non-parent events in main NDJSON handler and fix workspace creation path
...
Bug 1: Subagent events from gateway broadcasts were processed as parent
events because the sessionKey filter was accidentally removed during the
subagent decoupling refactor. Re-add the filter in wireChildProcess.
Bug 2: Creating workspaces at custom paths failed because:
- mkdir API rejected absolute paths outside workspace root
- Directory picker started at workspace root, not home
- Error responses from mkdir were silently swallowed
Add absolute path support to mkdir, handle errors in picker UI,
start picker at home dir, and normalize init route paths.
2026-02-21 13:45:11 -08:00
kumarabhirup
109b88b93c
web: restore functional features dropped by design merge
...
Restore backend/logic features that were incorrectly auto-merged from the
design branch:
- Spreadsheet viewer (xlsx, csv, ods, etc.) and xlsx dependency
- HTML iframe viewer with source toggle
- Directory picker modal for workspace creation
- Workspace registry for custom-path workspaces
- Session auto-discovery for orphaned sessions
- Workspace init seeding (CRM objects, DuckDB, templates, bootstrap files)
- Symlink resolution and showHidden in tree/browse routes
- Upload to workspace assets/ instead of hidden ~/.ironclaw/uploads/
- Webpack dev watcher config (next.config.ts)
- router.push for back-button navigation history
2026-02-21 13:10:32 -08:00
kumarabhirup
db4c90b37d
Merge remote-tracking branch 'origin/markrachapoom/design' into kumareth/workspaces
...
Co-authored-by: Cursor <cursoragent@cursor.com>
# Conflicts:
# apps/web/app/api/chat/subagent-stream/route.ts
# apps/web/app/api/workspace/watch/route.ts
# apps/web/app/components/chat-panel.tsx
# apps/web/app/components/subagent-panel.tsx
# apps/web/lib/subagent-runs.ts
# apps/web/tsconfig.tsbuildinfo
2026-02-21 12:40:07 -08:00
kumarabhirup
536ae59667
web: add interactive messaging UI to subagent panel
...
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-21 12:32:59 -08:00
kumarabhirup
7cdcf61639
web: support subagent sessions in chat and stop API routes
2026-02-21 12:32:37 -08:00
kumarabhirup
54d048bfb9
web: merge subagent-stream into unified stream route
2026-02-21 12:32:32 -08:00
kumarabhirup
e267fe7df4
web: export stream parser and add user-message event type
2026-02-21 12:32:27 -08:00
kumarabhirup
7d762b2b75
web: refactor subagent-runs to use direct gateway subscription with interactive messaging
2026-02-21 12:32:21 -08:00
kumarabhirup
3ee2528b75
web: filter silent-reply tokens and remove subagent event routing from parent stream
2026-02-21 12:32:16 -08:00
kumarabhirup
f3ae8127da
web: filter leaked NO_REPLY tokens in chat message display
2026-02-21 12:32:10 -08:00
kumarabhirup
a2845a321e
fix: type JSON.parse results to avoid Object.values unknown entries
2026-02-21 11:11:47 -08:00
kumarabhirup
32baa3f149
chore: update tsconfig.tsbuildinfo
2026-02-21 11:05:09 -08:00
kumarabhirup
9c3c339f48
fix: prefix unused watcherReady with underscore
2026-02-21 11:04:43 -08:00
kumarabhirup
119dcdc775
web: show 'Waiting for subagents...' status in chat panel
2026-02-21 11:04:37 -08:00
kumarabhirup
149dfb7d50
web: add SSE keepalive and waiting-for-subagents header in stream route
2026-02-21 11:04:32 -08:00
kumarabhirup
9d8c384517
web: add waiting-for-subagents state and subscribe continuation in active-runs
2026-02-21 11:04:26 -08:00
kumarabhirup
6650287da2
fix: prefix unused key variable in activateGatewayFallback
2026-02-21 11:04:20 -08:00
kumarabhirup
f83731d3b5
web: replace gateway WS with subscribe-child streams in subagent-runs
2026-02-21 11:04:07 -08:00
kumarabhirup
a6dab967a2
web: add globalSeq to AgentEvent and spawnAgentSubscribeProcess helper
2026-02-21 11:04:01 -08:00
kumarabhirup
0f28afd59b
web: remove gateway-events.ts WebSocket module in favor of subscribe-child streams
2026-02-21 11:03:57 -08:00
Peter Steinberger
25e89cc863
fix(security): harden shell env fallback
2026-02-21 20:01:08 +01:00
Nimrod Gutman
d6353cc54b
fix(ios): suppress expected speech cancellation errors
2026-02-21 20:52:05 +02:00
Nimrod Gutman
8a661e30c9
fix(ios): prefetch talk tts segments
2026-02-21 20:52:05 +02:00
Peter Steinberger
e371da38aa
fix(macos): consolidate exec approval evaluation
2026-02-21 19:30:35 +01:00
Peter Steinberger
fa89ae8e9e
fix: stabilize swift protocol generation and flaky tests
2026-02-21 16:53:46 +01:00
Peter Steinberger
5da03e6221
fix(macos): harden exec allowlist shell-chain checks
2026-02-21 16:27:18 +01:00
Onur
8178ea472d
feat: thread-bound subagents on Discord ( #21805 )
...
* docs: thread-bound subagents plan
* docs: add exact thread-bound subagent implementation touchpoints
* Docs: prioritize auto thread-bound subagent flow
* Docs: add ACP harness thread-binding extensions
* Discord: add thread-bound session routing and auto-bind spawn flow
* Subagents: add focus commands and ACP/session binding lifecycle hooks
* Tests: cover thread bindings, focus commands, and ACP unbind hooks
* Docs: add plugin-hook appendix for thread-bound subagents
* Plugins: add subagent lifecycle hook events
* Core: emit subagent lifecycle hooks and decouple Discord bindings
* Discord: handle subagent bind lifecycle via plugin hooks
* Subagents: unify completion finalizer and split registry modules
* Add subagent lifecycle events module
* Hooks: fix subagent ended context key
* Discord: share thread bindings across ESM and Jiti
* Subagents: add persistent sessions_spawn mode for thread-bound sessions
* Subagents: clarify thread intro and persistent completion copy
* test(subagents): stabilize sessions_spawn lifecycle cleanup assertions
* Discord: add thread-bound session TTL with auto-unfocus
* Subagents: fail session spawns when thread bind fails
* Subagents: cover thread session failure cleanup paths
* Session: add thread binding TTL config and /session ttl controls
* Tests: align discord reaction expectations
* Agent: persist sessionFile for keyed subagent sessions
* Discord: normalize imports after conflict resolution
* Sessions: centralize sessionFile resolve/persist helper
* Discord: harden thread-bound subagent session routing
* Rebase: resolve upstream/main conflicts
* Subagents: move thread binding into hooks and split bindings modules
* Docs: add channel-agnostic subagent routing hook plan
* Agents: decouple subagent routing from Discord
* Discord: refactor thread-bound subagent flows
* Subagents: prevent duplicate end hooks and orphaned failed sessions
* Refactor: split subagent command and provider phases
* Subagents: honor hook delivery target overrides
* Discord: add thread binding kill switches and refresh plan doc
* Discord: fix thread bind channel resolution
* Routing: centralize account id normalization
* Discord: clean up thread bindings on startup failures
* Discord: add startup cleanup regression tests
* Docs: add long-term thread-bound subagent architecture
* Docs: split session binding plan and dedupe thread-bound doc
* Subagents: add channel-agnostic session binding routing
* Subagents: stabilize announce completion routing tests
* Subagents: cover multi-bound completion routing
* Subagents: suppress lifecycle hooks on failed thread bind
* tests: fix discord provider mock typing regressions
* docs/protocol: sync slash command aliases and delete param models
* fix: add changelog entry for Discord thread-bound subagents (#21805 ) (thanks @onutc)
---------
Co-authored-by: Shadow <hi@shadowing.dev>
2026-02-21 16:14:55 +01:00
Peter Steinberger
f202e73077
refactor(security): centralize host env policy and harden env ingestion
2026-02-21 13:04:39 +01:00
Peter Steinberger
2cdbadee1f
fix(security): block startup-file env injection across host execution paths
2026-02-21 11:44:20 +01:00
Peter Steinberger
9231d7d30f
chore: bump version to 2026.2.21
2026-02-21 11:02:30 +01:00
Nimrod Gutman
78caf9ec3d
feat(ios): surface gateway talk defaults and refresh icon assets ( #22530 )
...
Merged via /review-pr -> /prepare-pr -> /merge-pr.
Prepared head SHA: 54f3a40e223f64a48f22485e919951d7ccd7ac85
Co-authored-by: ngutman <1540134+ngutman@users.noreply.github.com>
Co-authored-by: ngutman <1540134+ngutman@users.noreply.github.com>
Reviewed-by: @ngutman
2026-02-21 10:34:20 +02:00
Vincent Koc
f4a59eb5d8
Chore: harden A2UI bundle dependency resolution ( #22507 )
...
Merged via /review-pr -> /prepare-pr -> /merge-pr.
Prepared head SHA: d84c5bde518a4b2f3d192b0446672afeecf3fa3d
Co-authored-by: vincentkoc <25068+vincentkoc@users.noreply.github.com>
Co-authored-by: obviyus <22031114+obviyus@users.noreply.github.com>
Reviewed-by: @obviyus
2026-02-21 13:16:31 +05:30
Vincent Koc
55eab106ac
chore: remove root long and rolldown deps ( #22481 )
...
* chore(deadcode): add deadcode scanning and remove unused lockfile deps
* chore(changelog): mention deadcode CI scan pass
* ci: disable deadcode job temporarily
* docs(changelog): add PR ref and thanks for deadcode scan entry
* ci: comment out deadcode job condition while keeping it disabled
* Deps: remove dead root dependency from package manifest
* Changelog: reference PR for deadcode dependency cleanup
* Deps: remove unused root signal-utils
* Chore: remove unused lit context deps
* Chore: remove unused root lit dependency
* Chore: remove root long and rolldown deps
* Chore: add changelog for root long/rolldown removal
* Chore: fix a2ui bundling after root lit dependency removal
* Chore: simplify a2ui bundle script dependencies
2026-02-21 02:05:41 -05:00
Harold Hunt
844d84a7f5
Issue 17774 - Usage - Local - Show data from midnight to midnight of selected dates for browser time zone (AI assisted) (openclaw#19357) thanks @huntharo
...
Verified:
- pnpm install --frozen-lockfile
- pnpm build
- pnpm check
- pnpm test:macmini (override approved by Tak for this run; local baseline failures outside PR scope)
Co-authored-by: huntharo <5617868+huntharo@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
2026-02-20 20:09:03 -06:00
Mars
a4e7e952e1
fix(ui): strip injected inbound metadata from user messages in history ( #22142 )
...
* fix(ui): strip injected inbound metadata from user messages in history
Fixes #21106
Fixes #21109
Fixes #22116
OpenClaw prepends structured metadata blocks ("Conversation info",
"Sender:", reply-context) to user messages before sending them to the
LLM. These blocks are intentionally AI-context-only and must never reach
the chat history that users see.
Root cause:
`buildInboundUserContextPrefix` in `inbound-meta.ts` prepends the
blocks directly to the stored user message content string, so they are
persisted verbatim and later shown in webchat, TUI, and every other
rendering surface.
Fix:
• `src/auto-reply/reply/strip-inbound-meta.ts` — new utility with a
6-sentinel fast-path strip (zero-alloc on miss) + 9-test suite.
• `src/tui/tui-session-actions.ts` — wraps `chatLog.addUser(...)` with
`stripInboundMetadata()` so the TUI never stores the prefix.
• `ui/src/ui/chat/message-normalizer.ts` — strips user-role text content
items during normalisation so webchat renders clean messages.
* fix(ui): strip inbound metadata for user messages in display path
* test: fix discord component send test spread typing
* fix: strip inbound metadata from mac chat history decode
* fix: align Swift metadata stripping parser with TS implementation
* fix: normalize line endings in inbound metadata stripper
* chore: document Swift/TS metadata-sentinel ownership
* chore: update changelog for inbound metadata strip fix
* changelog: credit Mellowambience for 22142
---------
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
2026-02-20 17:35:13 -08:00
Shadow
4ab946eebf
Discord VC: voice channels, transcription, and TTS ( #18774 )
2026-02-20 16:06:07 -06:00
kumarabhirup
76f06e0eaf
web: scope subagent storage to workspace profile
...
Subagent event JSONL files and rehydration metadata were stored in the
shared ~/.openclaw/web-chat/ directory regardless of the active workspace
profile, while parent chat sessions were correctly profile-scoped.
Move subagent event persistence into the profile-scoped web-chat dir
(web-chat-<profile>/subagent-events/) and add a profile-local
subagent-index.json for fast rehydration after page refresh. The shared
gateway registry (~/.openclaw/subagents/runs.json) remains the fallback
source. Existing events in the legacy shared path are still readable as
a migration fallback.
2026-02-20 13:37:46 -08:00
Mark
ca8ac9fda1
Revert "Merge kumar workspaces to design branch"
...
This reverts commit bf4445115b911fa7831e6a35f7d0114154bb58ec, reversing
changes made to face53f2341417e339c02d5d7d4c412b961f87f6.
2026-02-20 12:45:42 -08:00
