Commit Graph

3230 Commits

Author SHA1 Message Date
Alex Zaytsev 1685a0dd12
fix: remove trailing newline from CLAUDE.md symlink target (#21160)
* fix: remove trailing newline from CLAUDE.md symlink target

* Dev tooling: prevent CLAUDE symlink newline regressions

---------

Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
2026-02-22 12:40:06 -05:00
Aleksandrs Tihenko c52b2ad5c3
fix(cache): inject cache_control into system prompt for OpenRouter Anthropic (#15151) (#17473)
* fix(cache): inject cache_control into system prompt for OpenRouter Anthropic

Add onPayload wrapper that injects cache_control: { type: "ephemeral" }
into the system/developer message content for OpenRouter requests routed
to Anthropic models. The system prompt is typically ~18k tokens and was
being re-processed on every request without caching.

Fixes #15151

* Changelog: add OpenRouter note for #17473

---------

Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
2026-02-22 12:27:01 -05:00
Peter Steinberger 66529c7aa5 refactor(gateway): unify auth credential resolution 2026-02-22 18:23:13 +01:00
Joly0 ded9a59f78
OpenRouter: allow any model ID instead of restricting to static catalog (#14312)
* OpenRouter: allow any model ID instead of restricting to static catalog

OpenRouter models were restricted to a hardcoded prefix list in the internal model catalog, preventing use of newly added or less common models. This change makes OpenRouter work as the pass-through proxy it is -- any valid OpenRouter model ID now resolves dynamically.

Fixes https://github.com/openclaw/openclaw/issues/5241

Changes:
- Add OpenRouter as an implicit provider in resolveImplicitProviders so models.json is populated when an API key is detected (models-config.providers.ts)
- Add a pass-through fallback in resolveModel that creates OpenRouter models on-the-fly when they aren't pre-registered in the local catalog (
model.ts
)
- Remove the static prefix filter for OpenRouter/opencode in isModernModelRef (live-model-filter.ts)

* Apply requested change for maxTokens

* Agents: remove dead helper in live model filter

* Changelog: note Joly0/main OpenRouter fix

* Changelog: fix OpenRouter entry text

---------

Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
2026-02-22 12:21:20 -05:00
zwffff c543994e90
Default reasoning to on when model has reasoning: true (fix #22456) (#22513)
* Default reasoning to on when model has reasoning: true (fix #22456)

What: When a model is configured with reasoning: true in openclaw.json (e.g. OpenRouter x-ai/grok-4.1-fast), the session now defaults reasoningLevel to on if the user has not set it via /reasoning or session store.

Why: Users expected setting reasoning: true on the model to enable reasoning; previously only session/directive reasoningLevel was used and it always defaulted to off, so Think stayed off despite the model config.

* Chore: sync formatted files from main for CI

* Changelog: note zwffff/main OpenRouter fix

* Changelog: fix OpenRouter entry text

* Update msteams.md

* Update msteams.md

* Update msteams.md

---------

Co-authored-by: 曾文锋0668000834 <zeng.wenfeng@xydigit.com>
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
2026-02-22 12:19:36 -05:00
Vincent Koc 9ae08ce205
Memory: add Arabic query expansion stop words (#23717) 2026-02-22 12:17:47 -05:00
Peter Steinberger 8c71bbe1e1 docs(changelog): add memory remote-guard hardening notes 2026-02-22 18:15:35 +01:00
Robby 99cfb3dab2
fix(openrouter): pass reasoning.effort based on thinking level (#14664) (#17236)
* fix(openrouter): pass reasoning.effort to OpenRouter API (#14664)

* Agents: pass thinkLevel to extra-params wrapper

* Changelog: note fix/openrouter-reasoning-effort-14664 OpenRouter fix

* Changelog: fix OpenRouter entry text

---------

Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
2026-02-22 12:14:12 -05:00
Vincent Koc ecf2cff9cd
Update CHANGELOG.md 2026-02-22 12:12:28 -05:00
Vincent Koc 3254c72d4b
Update CHANGELOG.md 2026-02-22 12:09:19 -05:00
Omair Afzal 3891ba4bb5
fix(providers): preserve openrouter/ prefix for native models (#12942)
* fix(providers): preserve openrouter/ prefix for native models (#12924)

OpenRouter-native models like 'openrouter/aurora-alpha' need the full
'openrouter/<name>' as the model ID in API requests. The existing
parseModelRef() stripped the prefix, sending just 'aurora-alpha'
which OpenRouter rejects with 400.

Fix: normalizeProviderModelId() now re-adds the 'openrouter/' prefix
for models without a slash (native models), while passing through
external provider models (e.g. 'anthropic/claude-sonnet-4-5') as-is.

Closes #12924

* Changelog: add OpenRouter note for #12942

---------

Co-authored-by: Luna AI <luna@coredirection.ai>
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
2026-02-22 12:08:46 -05:00
Dan Dodson 4cad674387
fix: preserve stored provider in resolveSessionModelRef for vendor-prefixed models (#22753)
* fix: preserve stored provider in resolveSessionModelRef for vendor-prefixed models

When an OpenRouter model with a vendor prefix (e.g. "anthropic/claude-haiku-4.5")
was successfully used and persisted to the session entry, the next call to
resolveSessionModelRef would re-parse the model string through parseModelRef,
which splits on the first slash and incorrectly extracts "anthropic" as the
provider — discarding the stored "openrouter" provider entirely. This caused
subsequent requests to attempt direct Anthropic API calls with an OpenRouter
API key, producing "credit balance too low" billing errors.

The fix trusts the explicitly stored modelProvider on the session entry and
skips parseModelRef re-parsing when a provider is already recorded. parseModelRef
is still used as a fallback when no provider is stored on the entry.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Changelog: add OpenRouter note for #22753

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
2026-02-22 12:07:33 -05:00
Peter Steinberger 8cc744ef1f fix(logging): cap file logs with configurable maxFileBytes
Co-authored-by: Xinhua Gu <562450+xinhuagu@users.noreply.github.com>
2026-02-22 17:58:51 +01:00
Peter Steinberger 795db98f6a fix(telegram): notify users on media download failures
Co-authored-by: Artale <117890364+arosstale@users.noreply.github.com>
2026-02-22 17:54:16 +01:00
Peter Steinberger d0e6763263 fix(telegram): wire webhookPort through config and startup
Co-authored-by: xrf9268-hue <244283935+xrf9268-hue@users.noreply.github.com>
2026-02-22 17:54:16 +01:00
Peter Steinberger 5069250faf fix(telegram): clear webhook state before polling startup
Co-authored-by: Peter Machona <7957943+chilu18@users.noreply.github.com>
2026-02-22 17:54:16 +01:00
Peter Steinberger 81384daeb4 fix(telegram): harden polling retry setup and teardown order
Co-authored-by: Cklee <99405438+liebertar@users.noreply.github.com>
Co-authored-by: Ho Lim <166576253+HOYALIM@users.noreply.github.com>
2026-02-22 17:54:16 +01:00
Peter Steinberger 1a9b5840d2 fix(telegram): keep webhook monitor alive until abort
Co-authored-by: Evgeny Zislis <7056+kesor@users.noreply.github.com>
2026-02-22 17:54:16 +01:00
Peter Steinberger e58054b85c docs(telegram): align Node22 network defaults and setup guidance 2026-02-22 17:54:16 +01:00
Peter Steinberger e9ed688c2c fix(net): enable family fallback for pinned SSRF dispatcher 2026-02-22 17:54:15 +01:00
Peter Steinberger 4d0ca7c315 fix(telegram): restart stalled polling after unhandled network errors 2026-02-22 17:54:15 +01:00
Peter Steinberger 824d1e095b fix(infra): treat undici fetch failed as transient unhandled rejection 2026-02-22 17:54:15 +01:00
Vincent Koc 35b162af76
Memory: add Spanish and Portuguese query expansion stop words (#23710) 2026-02-22 11:26:12 -05:00
Vincent Koc 21cbf59509
feat(memory): add Japanese query expansion support for FTS (#23156)
* Memory: add Japanese query expansion support

* Docs/Changelog: credit Japanese FTS update
2026-02-22 11:19:20 -05:00
Peter Steinberger f442a3539f feat(update): add core auto-updater and dry-run preview 2026-02-22 17:11:36 +01:00
Nikolay Petrov 13690d406a
Telegram: coalesce forwarded text+media bursts into one inbound turn (#19476)
Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: 09e0b4e9bd
Co-authored-by: napetrov <18015221+napetrov@users.noreply.github.com>
Co-authored-by: obviyus <22031114+obviyus@users.noreply.github.com>
Reviewed-by: @obviyus
2026-02-22 21:41:09 +05:30
Marcus Castro 337eef55d7
fix(telegram): link forwarded messages with comments (#9720)
Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: 5f81061b5f
Co-authored-by: mcaxtr <7562095+mcaxtr@users.noreply.github.com>
Co-authored-by: obviyus <22031114+obviyus@users.noreply.github.com>
Reviewed-by: @obviyus
2026-02-22 21:23:56 +05:30
Marcus Castro ace8357149
fix(telegram): skip failed photo downloads in media group instead of dropping entire group (#20598)
Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: 4a9c5f7af7
Co-authored-by: mcaxtr <7562095+mcaxtr@users.noreply.github.com>
Co-authored-by: obviyus <22031114+obviyus@users.noreply.github.com>
Reviewed-by: @obviyus
2026-02-22 20:57:06 +05:30
Peter Steinberger 9363c320d8 fix(security): harden shell env fallback startup env handling 2026-02-22 16:06:27 +01:00
Peter Steinberger ab1840b881 docs(changelog): credit SSRF report in unreleased notes 2026-02-22 16:02:49 +01:00
Glucksberg 53adae9cec
fix(telegram): add dnsResultOrder=ipv4first default on Node 22+ to fix fetch failures (#5405)
Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: 71366e9532
Co-authored-by: Glucksberg <80581902+Glucksberg@users.noreply.github.com>
Co-authored-by: obviyus <22031114+obviyus@users.noreply.github.com>
Reviewed-by: @obviyus
2026-02-22 20:07:51 +05:30
Peter Steinberger 4e65e61612 fix: retry missing config snapshots before skip (#23343) (thanks @lbo728) 2026-02-22 15:34:46 +01:00
Peter Steinberger 3e2849c578 fix: align timeout cooldown behavior docs/tests (#22622) (thanks @vageeshkumar) 2026-02-22 15:34:20 +01:00
Peter Steinberger a5e2bd4eaa docs: document verbose-gated tool error details 2026-02-22 15:26:48 +01:00
Peter Steinberger 184844e50c fix: add signal rpc malformed-json regression test (#22995) (thanks @adhitShet) 2026-02-22 15:23:37 +01:00
Peter Steinberger 7abae052f9 chore(skills): remove bundled food-order skill 2026-02-22 15:06:27 +01:00
Onur Solmaz f39a66de27 docs: make subagents thread guidance channel-first (#23589) (thanks @osolmaz) 2026-02-22 14:39:40 +01:00
Peter Steinberger 1152b25866 fix(gateway): guard trim crashes in subagent flow 2026-02-22 13:21:26 +01:00
Peter Steinberger eec3182cbb fix(utils): guard resolveUserPath for missing workspace input 2026-02-22 13:19:25 +01:00
Artale 51e9c54f09
fix(agents): skip bootstrap files with undefined path (#22698)
* fix(agents): skip bootstrap files with undefined path

buildBootstrapContextFiles() called file.path.replace() without checking
that path was defined. If a hook pushed a bootstrap file using 'filePath'
instead of 'path', the function threw TypeError and crashed every agent
session — not just the misconfigured hook.

Fix: add a null-guard before the path.replace() call. Files with undefined
path are skipped with a warning so one bad hook can't take down all agents.

Also adds a test covering the undefined-path case.

Fixes #22693

* fix: harden bootstrap path validation and report guards (#22698) (thanks @arosstale)

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-02-22 13:17:07 +01:00
Peter Steinberger 7c3c406a35 fix: keep auth-profile cooldown windows immutable in-window (#23536) (thanks @arosstale) 2026-02-22 13:14:02 +01:00
artale dc69610d51 fix(auth-profiles): never shorten cooldown deadline on retry
When the backoff saturates at 60 min and retries fire every 30 min
(e.g. cron jobs), each failed request was resetting cooldownUntil to
now+60m.  Because now+60m < existing deadline, the window kept getting
renewed and the profile never recovered without manually clearing
usageStats in auth-profiles.json.

Fix: only write a new cooldownUntil (or disabledUntil for billing) when
the new deadline is strictly later than the existing one.  This lets the
original window expire naturally while still allowing genuine backoff
extension when error counts climb further.

Fixes #23516

[AI-assisted]
2026-02-22 13:14:02 +01:00
Peter Steinberger 376eb6e99b docs(changelog): note safe-bin profile hardening 2026-02-22 13:03:05 +01:00
Peter Steinberger e80c803fa8 fix(security): block shell env allowlist bypass in system.run 2026-02-22 12:47:05 +01:00
Peter Steinberger d5bb9f026e fix: add changelog entry for remote ws onboarding hardening (#23476) (thanks @bmendonca3) 2026-02-22 12:46:20 +01:00
Peter Steinberger 65dccbdb4b fix: document onboarding dmScope default as breaking change (#23468) (thanks @bmendonca3) 2026-02-22 12:36:49 +01:00
Peter Steinberger 401106b963 fix: harden flaky tests and cover native google thought signatures (#23457) (thanks @echoVic) 2026-02-22 12:24:53 +01:00
Peter Steinberger 777817392d fix: fail closed missing provider group policy across message channels (#23367) (thanks @bmendonca3) 2026-02-22 12:21:04 +01:00
Yuzuru Suzuki 6f7e5f92c3
fix: add operator.read and operator.write to default CLI scopes (#22582)
Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: 8569fc88c9
Co-authored-by: YuzuruS <1485195+YuzuruS@users.noreply.github.com>
Co-authored-by: obviyus <22031114+obviyus@users.noreply.github.com>
Reviewed-by: @obviyus
2026-02-22 16:36:18 +05:30
Peter Steinberger 37f12eb7ee fix: align BlueBubbles private-api null fallback + warning (#23459) (thanks @echoVic) 2026-02-22 11:47:57 +01:00