Commit Graph

21749 Commits

Author SHA1 Message Date
Catalin Lupuleti 489797ceaf fix(plugins): address review feedback for Matrix recovery paths (#52899)
1. Narrow loadConfigForInstall() to catch only INVALID_CONFIG errors,
   letting real failures (fs permission, OOM) propagate.
2. Assert allow array is properly cleaned in stale-cleanup test.
3. Add comment clarifying version-resolution is already addressed via
   the shared VERSION constant.
4. Run cleanStaleMatrixPluginConfig() during install so
   persistPluginInstall() → writeConfigFile() does not fail validation
   on stale Matrix load paths.
2026-03-23 22:16:10 -07:00
Catalin Lupuleti 3ae100a8d7 fix(plugins): make Matrix recovery paths tolerate stale plugin config (#52899) 2026-03-23 22:16:10 -07:00
Peter Steinberger 5c9e4cd30a
refactor: clarify doctor repair flow 2026-03-23 22:12:56 -07:00
Tak Hoffman e8ba55adbb
test: add exact-stem subagent seam tests 2026-03-24 00:09:36 -05:00
Tak Hoffman 7464330a08
test: audit subagent seam coverage inventory 2026-03-24 00:09:36 -05:00
Peter Steinberger 2e1c88b728
refactor: tighten embedded prompt and sidecar guards 2026-03-23 22:09:22 -07:00
Sid Uppal cd90130877
msteams: implement Teams AI agent UX best practices (#51808)
Migrates the Teams extension from @microsoft/agents-hosting to the official Teams SDK (@microsoft/teams.apps + @microsoft/teams.api) and implements Microsoft's AI UX best practices for Teams agents.

- AI-generated label on all bot messages (Teams native badge + thumbs up/down)
- Streaming responses in 1:1 chats via Teams streaminfo protocol
- Welcome card with configurable prompt starters on bot install
- Feedback with reflective learning (negative feedback triggers background reflection)
- Typing indicators for personal + group chats (disabled for channels)
- Informative status updates (progress bar while LLM processes)
- JWT validation via Teams SDK createServiceTokenValidator
- User-Agent: teams.ts[apps]/<sdk-version> OpenClaw/<version> on outbound requests
- Fix copy-pasted image downloads (smba.trafficmanager.net auth allowlist)
- Pre-parse auth gate (reject unauthenticated requests before body parsing)
- Reflection dispatcher lifecycle fix (prevent leaked dispatchers)
- Colon-safe session filenames (Windows compatibility)
- Cooldown cache eviction (prevent unbounded memory growth)

Closes #51806
2026-03-23 22:03:39 -07:00
Peter Steinberger ea62655e19 fix: land cron heartbeat prompt suppression (#53152) (thanks @Protocol-zero-0) 2026-03-23 21:55:34 -07:00
Protocol-zero-0 9f863140d5 test(agents): cover additional heartbeat prompt triggers
Document that default-agent heartbeat prompt injection still applies to memory-triggered and triggerless runs while cron remains excluded.

Made-with: Cursor
2026-03-23 21:55:34 -07:00
Protocol-zero-0 9d21be4193 fix(agents): suppress heartbeat prompt for cron-triggered embedded runs
Prevent cron-triggered embedded runs from inheriting the default heartbeat prompt so non-cron session targets stop reading HEARTBEAT.md and polluting scheduled turns.

Made-with: Cursor
2026-03-23 21:55:34 -07:00
Val Alexander da5b7ff0af
style(ui): polish agent file preview and usage popovers (#53382)
* feat: make workspace links clickable in agent context card and files list

Updated the agent context card and files list to render workspace names as clickable links, allowing users to easily access the corresponding workspace files. This enhances usability by providing direct navigation to the workspace location.

* style(ui): polish markdown preview dialog

* style(ui): reduce markdown preview list indentation

* style(ui): update markdown preview dialog width and alignment

* fix(ui): open usage filter popovers toward the right

* style(ui): adjust positioning of usage filter and export popovers

* style(ui): update sidebar footer padding and modify usage header z-index

* style(ui): adjust positioning of usage filter popover to the left and export popover to the right

* style(ui): simplify workspace link rendering in agent context card

* UI: make workspace paths interactive buttons or plain text

Agent Context card workspace (Channels/Cron panels): replace non-interactive
<div> with a real <button> wired to onSelectPanel('files'), matching the
Overview panel pattern.

Core Files footer workspace: drop workspace-link class since the user is
already on the Files panel — keep as plain text.
2026-03-23 23:55:25 -05:00
HCL be20eebc21 fix(ui): resolve model provider from catalog instead of stale session default
When the server returns a bare model name (e.g. "deepseek-chat") with
a session-level modelProvider (e.g. "zai"), the UI blindly prepends
the provider — producing "zai/deepseek-chat" instead of the correct
"deepseek/deepseek-chat". This causes "model not allowed" errors
when switching between models from different providers.

Root cause: resolveModelOverrideValue() and resolveDefaultModelValue()
in app-render.helpers.ts, plus the /model slash command handler in
slash-command-executor.ts, all call resolveServerChatModelValue()
which trusts the session's default provider. The session provider
reflects the PREVIOUS model, not the newly selected one.

Fix: for bare model names, create a raw ChatModelOverride and resolve
through normalizeChatModelOverrideValue() which looks up the correct
provider from the model catalog. Falls back to server-provided provider
only if the catalog lookup fails. All 3 call sites are fixed.

Closes #53031

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: HCL <chenglunhu@gmail.com>
2026-03-23 21:54:02 -07:00
Peter Steinberger 5ab3782215 fix: add config clobber forensics 2026-03-24 04:50:30 +00:00
giulio-leone 67c7f98c32 fix(doctor): skip service config repairs during updates
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-03-23 21:48:18 -07:00
giulio-leone d8aada9d45 Preserve no-restart during update doctor fixes
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-03-23 21:48:18 -07:00
giulio-leone 3359dcfdcf fix(doctor): honor --fix in non-interactive mode
Ensure repair-mode doctor prompts auto-accept recommended fixes even when running non-interactively, while still requiring --force for aggressive rewrites.

This restores the expected behavior for upgrade/doctor flows that rely on 'openclaw doctor --fix --non-interactive' to repair stale gateway service configuration such as entrypoint drift after global updates.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-03-23 21:48:18 -07:00
sudie-codes 6e970010f7
msteams: add message edit and delete support (#49925)
- Add edit/delete action handlers with toolContext.currentChannelId
  fallback for in-thread edits/deletes without explicit target
- Add editMessageMSTeams/deleteMessageMSTeams to channel runtime
- Add updateActivity/deleteActivity to SendContext and MSTeamsTurnContext
- Extend content param with text/content/message fallback chain
- Update test mocks for new SendContext shape

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 23:42:04 -05:00
sudie-codes 9f5d286caf
msteams: extract structured quote/reply context (#51647)
* msteams: extract structured quote/reply context from Teams HTML attachments

* msteams: address PR #51647 review feedback
2026-03-23 23:41:51 -05:00
Tak Hoffman 8c89d0e7cd
tests: add boundary coverage for media delivery (#53361)
* tests: add boundary coverage for media delivery

* tests: isolate telegram outbound adapter transport

* tests: harden telegram webhook certificate assertion

* tests: fix guardrail false positives on rebased branch
2026-03-23 23:37:34 -05:00
Peter Steinberger e864421d83 fix: unify live model auth gating 2026-03-24 04:28:53 +00:00
Peter Steinberger e28e520379
refactor: simplify provider inference and zoned parsing helpers 2026-03-23 21:22:30 -07:00
Peter Steinberger 1bfef17825 ci: balance shards and reuse pr artifacts 2026-03-24 04:19:43 +00:00
Peter Steinberger 26365f7daf
fix: hash inline scripts with data-src attributes 2026-03-23 21:14:55 -07:00
Peter Steinberger 0857447a5d
fix: reject nonexistent zoned cron at-times 2026-03-23 21:14:55 -07:00
Peter Steinberger 69a317995d
fix: fail closed when provider inference drops errored allowlists 2026-03-23 21:14:55 -07:00
Peter Steinberger 3a36fffc15
docs: update mac release automation guidance 2026-03-23 21:12:46 -07:00
Peter Steinberger dc4d2ca263
build: prepare 2026.3.24 2026-03-23 21:05:59 -07:00
Peter Steinberger ce49d8bca9
fix: verify global npm correction installs 2026-03-23 21:04:08 -07:00
Tak Hoffman 50d996a6ec
tests: cron coverage and NO_REPLY delivery fixes (#53366)
* tools: extend seam audit inventory

* tools: audit cron seam coverage gaps

* test: add cron seam coverage tests

* fix: avoid marking NO_REPLY cron deliveries as delivered

* fix: clean up delete-after-run NO_REPLY cron sessions
2026-03-23 22:52:13 -05:00
Vincent Koc 6142fc1d94 fix(runtime): anchor bundled plugin npm staging to active node 2026-03-23 20:32:48 -07:00
Peter Steinberger 483dc90f05 test: harden linux runtime smoke guards 2026-03-24 03:23:52 +00:00
Peter Steinberger dd2361a4c4 docs: refresh plugin-sdk api baseline 2026-03-24 03:20:51 +00:00
Ayaan Zaidi 17c1ee7716
fix: preserve command auth resolution errors on empty inferred allowlists 2026-03-24 08:38:27 +05:30
Peter Steinberger 630f1479c4
build: prepare 2026.3.23-2 2026-03-23 20:04:42 -07:00
Peter Steinberger 38137b0cf8
refactor: split tracked ClawHub update flows 2026-03-23 20:01:51 -07:00
Peter Steinberger b4e392cf9d fix: unblock runtime-api smoke checks 2026-03-24 03:00:51 +00:00
Taras Lukavyi 7ffe7e4822 fix: populate currentThreadTs in threading tool context fallback for Telegram DM topics (#52217)
When a channel plugin lacks a custom buildToolContext (e.g. Telegram),
the fallback path in buildThreadingToolContext did not set currentThreadTs
from the inbound MessageThreadId. This caused resolveTelegramAutoThreadId
to return undefined, so message tool sends without explicit threadId
would route to the main chat instead of the originating DM topic.

Fixes #52217
2026-03-24 08:27:03 +05:30
Peter Steinberger 3ae5d33799
refactor: extract cron schedule and test runner helpers 2026-03-23 19:53:43 -07:00
Taras Lukavyi d4e3babdcc
fix: command auth SecretRef resolution (#52791) (thanks @Lukavyi)
* fix(command-auth): handle unresolved SecretRef in resolveAllowFrom

* fix(command-auth): fall back to config allowlists

* fix(command-auth): avoid duplicate resolution fallback

* fix(command-auth): fail closed on invalid allowlists

* fix(command-auth): isolate fallback resolution errors

* fix: record command auth SecretRef landing notes (#52791) (thanks @Lukavyi)

---------

Co-authored-by: Ayaan Zaidi <hi@obviy.us>
2026-03-24 08:21:30 +05:30
Tak Hoffman 5cd8d43af9
tests: improve boundary audit coverage and safety (#53080)
* tools: extend seam audit inventory

* tools: tighten seam audit heuristics

* tools: refine seam test matching

* tools: refine seam audit review heuristics

* style: format seam audit script

* tools: widen seam audit matcher coverage

* tools: harden seam audit coverage

* tools: tighten boundary audit matchers

* tools: ignore mocked import matches in boundary audit

* test: include native command reply seams in audit
2026-03-23 21:46:53 -05:00
Peter Steinberger a3f2fbf5a2
refactor: harden extension runtime-api seams 2026-03-23 19:39:20 -07:00
Peter Steinberger d8e77c423a test: isolate line jiti runtime smoke 2026-03-24 02:38:49 +00:00
Peter Steinberger 9e8abb468d fix: clean changelog merge duplication (#53224) (thanks @RolfHegr) 2026-03-23 19:38:04 -07:00
Peter Steinberger 0cbf6d5fed fix: land cron tz one-shot handling and prerelease config warnings (#53224) (thanks @RolfHegr) 2026-03-23 19:38:04 -07:00
Rolfy 9aac5582d6 fix(cron): make --tz work with --at for one-shot jobs
Previously, `--at` with an offset-less ISO datetime (e.g. `2026-03-23T23:00:00`)
was always interpreted as UTC, even when `--tz` was provided. This caused one-shot
jobs to fire at the wrong time.

Changes:
- `parseAt()` now accepts an optional `tz` parameter
- When `--tz` is provided with `--at`, offset-less datetimes are interpreted in
  that IANA timezone using Intl.DateTimeFormat
- Datetimes with explicit offsets (e.g. `+01:00`, `Z`) are unaffected
- Removed the guard in cron-edit that blocked `--tz` with `--at`
- Updated `--at` help text to mention `--tz` support
- Added 2 tests verifying timezone resolution and offset preservation
2026-03-23 19:38:04 -07:00
Peter Steinberger 8f9799307b
test: print failed test lane output tails 2026-03-23 19:36:44 -07:00
Peter Steinberger 7f373823b0
refactor: separate exec policy and execution targets 2026-03-23 19:36:44 -07:00
Val Alexander a96eded4a0
feat(csp): support inline script hashes in Control UI CSP (#53307) thanks @BunsDev
Co-authored-by: BunsDev <68980965+BunsDev@users.noreply.github.com>
Co-authored-by: Nova <nova@openknot.ai>
2026-03-23 21:35:33 -05:00
Peter Steinberger e530865274 fix: preserve legacy clawhub skill updates (#53206) (thanks @drobison00) 2026-03-23 19:34:05 -07:00
Devin Robison 003752b9b3 Remove lower casing -- preserving prior behavior 2026-03-23 19:34:05 -07:00