Ayuriel/openclaw
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
20,737 Commits 756 Branches 79 Tags
Commit Graph

5092 Commits

Author SHA1 Message Date
Josh Avant
c7134e629c
LINE: harden Express webhook parsing to verified raw body (#51202) 
* LINE: enforce signed-raw webhook parsing

* LINE: narrow scope and add buffer regression

* changelog

Signed-off-by: joshavant <830519+joshavant@users.noreply.github.com>

---------

Signed-off-by: joshavant <830519+joshavant@users.noreply.github.com>
 2026-03-20 15:32:55 -05:00
Gustavo Madeira Santana
3da66718f4
Web: derive search provider metadata from plugin contracts (#50935) 
Merged via squash.

Prepared head SHA: e1c7d72833afff6ef33e8d32cdd395190742dc08
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com>
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com>
Reviewed-by: @gumadeiras
 2026-03-20 12:41:04 -07:00
Jaaneek
916f496b51
Add Grok 4.20 reasoning and non-reasoning to xAI model catalog (#50772) 
Merged via squash.

Prepared head SHA: 095e645ea58b2259b25c923aeaf11bbcb2990c8f
Co-authored-by: Jaaneek <25470423+Jaaneek@users.noreply.github.com>
Co-authored-by: huntharo <5617868+huntharo@users.noreply.github.com>
Reviewed-by: @huntharo
 2026-03-20 15:28:30 -04:00
Gustavo Madeira Santana
a05da76718
Matrix: dedupe replayed inbound events on restart (#50922) 
Merged via squash.

Prepared head SHA: 10d9770aa61d864686e4ba20fbcffb8a8dd68903
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com>
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com>
Reviewed-by: @gumadeiras
 2026-03-20 12:13:24 -07:00
Ayaan Zaidi
35ac1f6e07 fix: add changelog for telegram account routing fix (#50853) (thanks @hclsys) 2026-03-20 23:24:40 +05:30
Vincent Koc
93fbe26adb
fix(config): tighten json and json5 parsing paths (#51153) 2026-03-20 10:10:57 -07:00
John Scianna
5607da90d5
feat: pass modelId to context engine assemble() (#47437) 
Merged via squash.

Prepared head SHA: d708ddb222abda2c8d5396bbf4ce9ee5c4549fe3
Co-authored-by: jscianna <9017016+jscianna@users.noreply.github.com>
Co-authored-by: jalehman <550978+jalehman@users.noreply.github.com>
Reviewed-by: @jalehman
 2026-03-20 08:05:02 -07:00
Thirumalesh
c6968c39d6
feat(compaction): truncate session JSONL after compaction to prevent unbounded growth (#41021) 
Merged via squash.

Prepared head SHA: fa50b635800f20b0732d4f34c6da404db4dbc95f
Co-authored-by: thirumaleshp <85149081+thirumaleshp@users.noreply.github.com>
Co-authored-by: jalehman <550978+jalehman@users.noreply.github.com>
Reviewed-by: @jalehman
 2026-03-20 07:15:09 -07:00
caesargattuso
57f1cf66ad
fix(gateway): skip seq-gap broadcast for stale post-lifecycle events (#43751) 
* fix: stop stale gateway seq-gap errors (#43751) (thanks @caesargattuso)

* fix: keep agent.request run ids session-scoped

---------

Co-authored-by: Ayaan Zaidi <hi@obviy.us>
 2026-03-20 14:56:54 +05:30
Bijin
192f859325
Add Community plugins - openclaw-dingtalk (#29913) 
Merged via squash.

Prepared head SHA: e8e99997cb83b8f88cc89abb7fc0b96570ef313f
Co-authored-by: sliverp <38134380+sliverp@users.noreply.github.com>
Co-authored-by: frankekn <4488090+frankekn@users.noreply.github.com>
Reviewed-by: @frankekn
 2026-03-20 16:58:51 +08:00
Bijin
6cb2fc501a
Community plugins - Add QQbot (#29898) 
Merged via squash.

Prepared head SHA: c776a12d15d029e4a4858ba12653ba9bafcf6949
Co-authored-by: sliverp <38134380+sliverp@users.noreply.github.com>
Co-authored-by: frankekn <4488090+frankekn@users.noreply.github.com>
Reviewed-by: @frankekn
 2026-03-20 16:51:32 +08:00
Ayaan Zaidi
61965e500f fix: route Android Talk synthesis through the gateway (#50849) 2026-03-20 11:01:24 +05:30
Lakshya Agarwal
b36e456b09
feat: add Tavily as a bundled web search plugin with search and extract tools (#49200) 
Merged via squash.

Prepared head SHA: ece9226e886004f1e0536dd5de3ddc2946fc118c
Co-authored-by: lakshyaag-tavily <266572148+lakshyaag-tavily@users.noreply.github.com>
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com>
Reviewed-by: @gumadeiras
 2026-03-20 01:06:26 -04:00
Gustavo Madeira Santana
914fc265c5
Docs(matrix): add changelog entry for allowBots/allowPrivateNetwork 2026-03-20 00:22:52 -04:00
ernestodeoliveira
80110c550f
fix(telegram): warn when setup leaves dmPolicy as pairing without allowFrom (#50710) 
* fix(telegram): warn when setup leaves dmPolicy as pairing without allowFrom

* fix(telegram): scope setup warning to account config

* fix(telegram): quote setup allowFrom example

* fix: warn on insecure Telegram setup defaults (#50710) (thanks @ernestodeoliveira)

---------

Co-authored-by: Claude Code <claude-code@openclaw.ai>
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
 2026-03-20 09:29:33 +05:30
Josh Avant
de9f2dc227
Gateway: harden OpenResponses file-context escaping (#50782) 2026-03-19 22:02:13 -05:00
Jinhao Dong
4f00b3b534
feat(xiaomi): add MiMo V2 Pro and MiMo V2 Omni models, switch to OpenAI completions API (#49214) 
Merged via squash.

Prepared head SHA: 6b672f36cf0bd4296d3bb2d1b2e6e50d1bb601f1
Co-authored-by: DJjjjhao <50042705+DJjjjhao@users.noreply.github.com>
Co-authored-by: grp06 <1573959+grp06@users.noreply.github.com>
Reviewed-by: @grp06
 2026-03-19 19:26:47 -07:00
Harold Hunt
f1ce679929
Discord: reconcile native commands without restart churn (#46597) 
Merged via squash.

Prepared head SHA: 37090daad4b99171a55962101d9998fd452e2739
Co-authored-by: huntharo <5617868+huntharo@users.noreply.github.com>
Reviewed-by: @huntharo
 2026-03-19 22:23:21 -04:00
Harold Hunt
65594f972c
Gateway: unify plugin interactive callback state (#50722) 
Merged via squash.

Prepared head SHA: 7a2740b18a336bc3a58c23cff08953a5c06a6078
Co-authored-by: huntharo <5617868+huntharo@users.noreply.github.com>
Co-authored-by: huntharo <5617868+huntharo@users.noreply.github.com>
Reviewed-by: @huntharo
 2026-03-19 22:09:38 -04:00
Harold Hunt
41628770f5
Tests: trim command secret gateway imports (#50663) 
Merged via squash.

Prepared head SHA: 7f64fd3ee17c3a7e5b7f26e618816497e94c5243
Co-authored-by: huntharo <5617868+huntharo@users.noreply.github.com>
Co-authored-by: huntharo <5617868+huntharo@users.noreply.github.com>
Reviewed-by: @huntharo
 2026-03-19 19:53:02 -04:00
Josh Avant
8e132aed6e
Hardening: refresh stale device pairing requests and pending metadata (#50695) 
* Docs: clarify device pairing supersede behavior

* Device pairing: supersede pending requests on auth changes
 2026-03-19 18:26:06 -05:00
fuller-stack-dev
36f394c299
fix(gateway): increase WS handshake timeout from 3s to 10s (#49262) 
* fix(gateway): increase WS handshake timeout from 3s to 10s

The 3-second default is too aggressive when the event loop is under load
(concurrent sessions, compaction, agent turns), causing spurious
'gateway closed (1000)' errors on CLI commands like `openclaw cron list`.

Changes:
- Increase DEFAULT_HANDSHAKE_TIMEOUT_MS from 3_000 to 10_000
- Add OPENCLAW_HANDSHAKE_TIMEOUT_MS env var for user override (no VITEST gate)
- Keep OPENCLAW_TEST_HANDSHAKE_TIMEOUT_MS as fallback for existing tests

Fixes #46892

* fix: restore VITEST guard on test env var, use || for empty-string fallback, fix formatting

* fix: cover gateway handshake timeout env override (#49262) (thanks @fuller-stack-dev)

---------

Co-authored-by: Wilfred <wilfred@Wilfreds-Mac-mini.local>
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
 2026-03-19 22:46:40 +05:30
Harold Hunt
401ffb59f5
CLI: support versioned plugin updates (#49998) 
Merged via squash.

Prepared head SHA: 545ea60fa26bb742376237ca83c65665133bcf7c
Co-authored-by: huntharo <5617868+huntharo@users.noreply.github.com>
Reviewed-by: @huntharo
 2026-03-19 12:51:10 -04:00
Ayaan Zaidi
f1e4f8e8d2 fix: add changelog attribution for Azure Foundry custom providers (#50535) 2026-03-19 22:07:19 +05:30
Ayaan Zaidi
91104ac740 fix(onboard): respect services.ai custom provider compatibility 2026-03-19 22:07:19 +05:30
Ayaan Zaidi
7a57082466 fix(provider): onboard azure custom endpoints via responses 2026-03-19 21:53:27 +05:30
Liu Ricardo
8c01347989
test(contracts): cover matrix session binding adapters (#50369) 
Merged via squash.

Prepared head SHA: 25412dbc2ca91876882de1854da1f0e9c0640543
Co-authored-by: ChroniCat <220139611+ChroniCat@users.noreply.github.com>
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com>
Reviewed-by: @gumadeiras
 2026-03-19 10:26:37 -04:00
Harold Hunt
5508374669
fix(plugins): share split-load singleton state (openclaw#50418) thanks @huntharo 
Co-authored-by: huntharo <5617868+huntharo@users.noreply.github.com>
 2026-03-19 09:10:24 -04:00
Shaun Tsai
bcc725ffe2
fix(agents): strip prompt cache for non-OpenAI responses endpoints (#49877) thanks @ShaunTsai 
Fixes #48155

Co-authored-by: Shaun Tsai <13811075+ShaunTsai@users.noreply.github.com>
Co-authored-by: frankekn <4488090+frankekn@users.noreply.github.com>
 2026-03-19 15:12:29 +08:00
Josh Avant
b965ef3802
Channels: stabilize lane harness and monitor tests (#50167) 
* Channels: stabilize lane harness regressions

* Signal tests: stabilize tool-result harness dispatch

* Telegram tests: harden polling restart assertions

* Discord tests: stabilize channel lane harness coverage

* Slack tests: align slash harness runtime mocks

* Telegram tests: harden dispatch and pairing scenarios

* Telegram tests: fix SessionEntry typing in bot callback override case

* Slack tests: avoid slash runtime mock deadlock

* Tests: address bot review follow-ups

* Discord: restore accounts runtime-api seam

* Tests: stabilize Discord and Telegram channel harness assertions

* Tests: clarify Discord mock seam and remove unused Telegram import

* changelog

Signed-off-by: joshavant <830519+joshavant@users.noreply.github.com>

---------

Signed-off-by: joshavant <830519+joshavant@users.noreply.github.com>
 2026-03-19 01:47:48 -05:00
Gustavo Madeira Santana
ddd921ff0b
Docs: add new Matrix plugin changelog entry 2026-03-19 02:21:34 -04:00
Ayaan Zaidi
d978ace90b
fix: isolate CLI startup imports (#50212) 
* fix: isolate CLI startup imports

* fix: clarify CLI preflight behavior

* fix: tighten main-module detection

* fix: isolate CLI startup imports (#50212)
 2026-03-19 10:34:29 +05:30
Josh Avant
68bc6effc0
Telegram: stabilize pairing/session/forum routing and reply formatting tests (#50155) 
* Telegram: stabilize Area 2 DM and model callbacks

* Telegram: fix dispatch test deps wiring

* Telegram: stabilize area2 test harness and gate flaky sticker e2e

* Telegram: address review feedback on config reload and tests

* Telegram tests: use plugin-sdk reply dispatcher import

* Telegram tests: add routing reload regression and track sticker skips

* Telegram: add polling-session backoff regression test

* Telegram tests: mock loadWebMedia through plugin-sdk path

* Telegram: refresh native and callback routing config

* Telegram tests: fix compact callback config typing
 2026-03-19 00:01:14 -05:00
Josh Avant
a2a9a553e1
Stabilize plugin loader and Docker extension smoke (#50058) 
* Plugins: stabilize Area 6 loader and Docker smoke

* Docker: fail fast on extension npm install errors

* Tests: stabilize loader non-native Jiti boundary CI timeout

* Tests: stabilize plugin loader Jiti source-runtime coverage

* Docker: keep extension deps on lockfile graph

* Tests: cover tsx-cache renamed package cwd fallback

* Tests: stabilize plugin-sdk export subpath assertions

* Plugins: align tsx-cache alias fallback with subpath fallback

* Tests: normalize guardrail path checks for Windows

* Plugins: restrict plugin-sdk cwd fallback to trusted roots

* Tests: exempt outbound-session from extension import guard

* Tests: tighten guardrails and cli-entry trust coverage

* Tests: guard optional loader fixture exports

* Tests: make loader fixture package exports null-safe

* Tests: make loader fixture package exports null-safe

* Tests: make loader fixture package exports null-safe

* changelog

Signed-off-by: joshavant <830519+joshavant@users.noreply.github.com>

---------

Signed-off-by: joshavant <830519+joshavant@users.noreply.github.com>
 2026-03-18 23:35:32 -05:00
lixuankai
c86de678f3
feat(android): support android node sms.search (#48299) 
* feat(android): support android node sms.search

* feat(android): support android node sms.search

* fix(android): split sms search permissions

* fix: document android sms.search landing (#48299) (thanks @lixuankai)

---------

Co-authored-by: lixuankai <lixuankai@oppo.com>
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
 2026-03-19 08:52:15 +05:30
Tyler Yust
a290f5e50f
fix: persist outbound sends and skip stale cron deliveries (#50092) 
* fix(bluebubbles): auto-create chats for new numbers, persist outbound messages to session transcripts

Two fixes for BlueBubbles message tool behavior:

1. **Attachment sends to new phone numbers**: sendBlueBubblesAttachment now
   auto-creates a new DM chat (via /api/v1/chat/new) when no existing chat
   is found for a handle target, matching the behavior already present in
   sendMessageBlueBubbles for text sends. The existing createNewChatWithMessage
   is refactored into a reusable createChatForHandle that returns the chatGuid.

2. **Outbound message session persistence**: Ensures outbound messages sent
   via the message tool are reliably tracked in session transcripts:
   - ensureOutboundSessionEntry now falls back to directly creating a session
     store entry when recordSessionMetaFromInbound returns null, guaranteeing
     a sessionId exists for the subsequent mirror append.
   - appendAssistantMessageToSessionTranscript now normalizes the session key
     (lowercased) when looking up the store, preventing case mismatches
     between the store keys and the mirror sessionKey.

Tests added for all changes.

* test(slack): verify outbound session tracking and new target sends for Slack

The shared infrastructure changes from the BlueBubbles fix (session key
normalization in transcript.ts and fallback session entry creation in
outbound-session.ts) already cover Slack. Slack's sendMessageSlack uses
conversations.open to auto-create DM channels for new user targets.

Add tests confirming:
- Slack user DM and channel session route resolution (outbound.test.ts)
- Slack session key normalization for transcript append (sessions.test.ts)
- Slack outbound sendText/sendMedia to new user and channel targets (channel.test.ts)

* fix(cron): skip stale delayed deliveries

* fix: prep PR #50092
 2026-03-19 11:40:34 +09:00
clawdia
6ae68faf5f
fix(whatsapp): use globalThis singleton for active-listener Map (#47433) 
Merged via squash.

Prepared head SHA: 1c43dbff399853fd0bd4132886c3394d6659e85b
Co-authored-by: clawdia67 <261743618+clawdia67@users.noreply.github.com>
Co-authored-by: mcaxtr <7562095+mcaxtr@users.noreply.github.com>
Reviewed-by: @mcaxtr
 2026-03-18 22:16:31 -03:00
Josh Avant
0f0cecd2e8
Discord: enforce strict DM component allowlist auth (#49997) 
* Discord: enforce strict DM component allowlist auth

* Discord: align model picker fallback routing

* changelog

Signed-off-by: joshavant <830519+joshavant@users.noreply.github.com>

---------

Signed-off-by: joshavant <830519+joshavant@users.noreply.github.com>
 2026-03-18 20:11:47 -05:00
Peter Steinberger
42b9212eb2 fix: preserve interactive Ollama model selection (#49249) (thanks @BruceMacD) 2026-03-18 18:02:44 -07:00
Josh Avant
2661de384f
Matrix: make onboarding status runtime-safe (#49995) 
* Matrix: make onboarding status runtime-safe

* Matrix tests: mock reply dispatch in BodyForAgent coverage

* changelog

Signed-off-by: joshavant <830519+joshavant@users.noreply.github.com>

---------

Signed-off-by: joshavant <830519+joshavant@users.noreply.github.com>
 2026-03-18 17:33:42 -05:00
Josh Avant
859889aae9
WhatsApp: stabilize inbound monitor and setup tests (#50007) 2026-03-18 17:08:57 -05:00
Vincent Koc
63e09f8267 chore(changelog): remove fragment workflow drift 2026-03-18 12:26:56 -07:00
liyuan97
b64f4e313d
MiniMax: add M2.7 models and update default to M2.7 (#49691) 
* MiniMax: add M2.7 models and update default to M2.7

- Add MiniMax-M2.7 and MiniMax-M2.7-highspeed to provider catalog and model definitions
- Update default model from MiniMax-M2.5 to MiniMax-M2.7 across onboard, portal, and provider configs
- Update isModernMiniMaxModel to recognize M2.7 prefix
- Update all test fixtures to reflect M2.7 as default

Made-with: Cursor

* MiniMax: add extension test for model definitions

* update 2.7

* feat: add MiniMax M2.7 models and update default (#49691) (thanks @liyuan97)

---------

Co-authored-by: George Zhang <georgezhangtj97@gmail.com>
 2026-03-18 09:24:37 -07:00
Andrew Demczuk
089a43f5e8
fix(security): block build-tool and glibc env injection vectors in host exec sandbox (#49702) 
Add GLIBC_TUNABLES, MAVEN_OPTS, SBT_OPTS, GRADLE_OPTS, ANT_OPTS,
DOTNET_ADDITIONAL_DEPS to blockedKeys and GRADLE_USER_HOME to
blockedOverrideKeys in the host exec security policy.

Closes #22681
 2026-03-18 13:11:01 +01:00
Vignesh Natarajan
1890089f49 fix: serialize duplicate channel starts (#49583) (thanks @sudie-codes) 2026-03-18 01:57:12 -07:00
Vincent Koc
466510b6d8 refactor: replace "seam" terminology across codebase 
Replace "seam" with clearer terms throughout:
- "surface" for public API/extension boundaries
- "boundary" for plugin/module interfaces
- "interface" for runtime connection points
- "hook" for test injection points
- "palette" for the lobster palette reference

Also delete experiments/acp-pluginification-architecture-plan.md

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 00:20:15 -07:00
Vincent Koc
21c2ba480a
Image generation: native provider migration and explicit capabilities (#49551) 
* Docs: retire nano-banana skill wrapper

* Doctor: migrate nano-banana to native image generation

* Image generation: align fal aspect ratio behavior

* Image generation: make provider capabilities explicit
 2026-03-18 00:04:03 -07:00
scoootscooob
08a0219b1a
Google Chat: thin runtime api seam (#49504) 
Merged via squash.

Prepared head SHA: 3369cf2c35cbf03bc4008d123e69f43f1cc083e9
Co-authored-by: scoootscooob <167050519+scoootscooob@users.noreply.github.com>
Co-authored-by: scoootscooob <167050519+scoootscooob@users.noreply.github.com>
Reviewed-by: @scoootscooob
 2026-03-17 23:02:30 -07:00
Josh Lehman
7f0f8dd268
feat: expose context-engine compaction delegate helper (#49061) 
* ContextEngine: add runtime compaction delegate helper

* plugin-sdk: expose compaction delegate through compat

* docs: clarify delegated plugin compaction

* docs: use scoped compaction delegate import
 2026-03-17 22:54:18 -07:00
Alix-007
2c579b6ac1
fix(models): preserve @YYYYMMDD version suffixes (#48896) thanks @Alix-007 
Co-authored-by: Alix-007 <267018309+Alix-007@users.noreply.github.com>
Co-authored-by: frankekn <frank.ekn@gmail.com>
 2026-03-18 13:20:06 +08:00