e80483ff00
poll and profile fixes
2026-03-12 16:47:09 +00:00
50568f29d5
Matrix: tighten verification trust and expose profile updates
2026-03-12 16:47:09 +00:00
887e2aca79
matrix-js: require explicit thread-bound spawn config
2026-03-12 16:47:07 +00:00
46f0bfc55b
Gateway: harden custom session-store discovery ( #44176 )
...
Merged via squash.
Prepared head SHA: 52ebbf5188
2026-03-12 16:44:46 +00:00
9342739d71
fix(providers): respect user-configured baseUrl for kimi-coding ( #36647 )
...
* fix(providers): respect user-configured baseUrl for kimi-coding
The kimi-coding provider was built exclusively from
`buildKimiCodingProvider()` defaults, ignoring any user-specified
`baseUrl` or other overrides in `openclaw.json` providers config.
This caused 404 errors when users configured a custom endpoint.
Now merge `explicitProviders["kimi-coding"]` on top of defaults,
matching the pattern used by ollama/vllm. User's `baseUrl`, `api`,
and `models` take precedence; env/profile API key still wins.
Fixes #36353
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Tests: use Kimi implicit provider harness
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
2026-03-12 12:14:07 -04:00
0a8fa0e001
Moonshot: respect explicit baseUrl for CN endpoint so platform.moonshot.cn keys authenticate ( #33637 ) ( #33696 )
...
* Moonshot: respect explicit baseUrl for CN endpoint so platform.moonshot.cn keys authenticate (#33637 )
* Moonshot: address review - remove dead constant, import canonical URLs (#33696 )
2026-03-12 12:10:38 -04:00
3fa91cd69d
feat: add sessions_yield tool for cooperative turn-ending ( #36537 )
...
Merged via squash.
Prepared head SHA: 75d9204c86
2026-03-12 08:46:47 -07:00
688e3f0863
Compaction Runner: emit transcript updates post-compact ( #25558 )
...
Merged via squash.
Prepared head SHA: 8a858436ed
2026-03-12 08:22:12 -07:00
8ad0ca309e
Subagents: stop retrying external completion timeouts ( #41235 ) ( #43847 )
...
* Changelog: add subagent announce timeout note
* Tests: cover subagent completion timeout no-retry
* Subagents: stop retrying external completion timeouts
* Config: update subagent announce timeout default docs
* Tests: use fake timers for subagent timeout retry guard
2026-03-12 11:03:06 -04:00
2f037f0930
Agents: adapt pi-ai oauth and payload hooks
2026-03-12 10:19:14 -04:00
f3be1c828c
fix(status): resolve context window by provider-qualified key, prefer max on bare-id collision, solve #35976 ( #36389 )
...
Merged via squash.
Prepared head SHA: f8cf752c59
2026-03-12 07:00:36 -07:00
ff47876e61
fix: carry observed overflow token counts into compaction ( #40357 )
...
Merged via squash.
Prepared head SHA: b99eed4329
2026-03-12 06:58:42 -07:00
f2e28fc30f
fix(telegram): allow fallback models in /model validation ( #40105 )
...
Merged via squash.
Prepared head SHA: de07585e03
2026-03-12 13:55:51 +01:00
8ea79b64d0
fix: preserve sandbox write payload stdin ( #43876 )
...
Merged via squash.
Prepared head SHA: a10fd4b21c
2026-03-12 12:42:57 +03:00
f640326e31
fix(failover): add missing network errno patterns to text-based timeout classifier ( #42830 )
...
Merged via squash.
Prepared head SHA: 91761487e8
2026-03-12 12:34:44 +03:00
46a332385d
Gateway: keep spawned workspace overrides internal ( #43801 )
...
* Gateway: keep spawned workspace overrides internal
* Changelog: note GHSA-2rqg agent boundary fix
* Gateway: persist spawned workspace inheritance in sessions
* Agents: clean failed lineage spawn state
* Tests: cover lineage attachment cleanup
* Tests: cover lineage thread cleanup
2026-03-12 04:20:00 -04:00
9aeaa19e9e
Agents: clear invalidated Kimi tool arg repair ( #43824 )
2026-03-12 03:53:06 -04:00
d8ee97c466
Agents: recover malformed Anthropic-compatible tool call args ( #42835 )
...
* Agents: recover malformed anthropic tool call args
* Agents: add malformed tool call regression test
* Changelog: note Kimi tool call arg recovery
* Agents: repair toolcall end message snapshots
* Agents: narrow Kimi tool call arg repair
2026-03-12 03:28:22 -04:00
0bcb95e8fa
Models: enforce source-managed SecretRef markers in models.json ( #43759 )
...
Merged via squash.
Prepared head SHA: 4a065ef5d8
2026-03-12 02:22:52 -05:00
99ec687d7a
fix(agents): enforce sandboxed session_status visibility ( #43754 )
...
* agents: guard sandboxed session_status access
* test(agents): cover sandboxed session_status scope
* docs(changelog): credit session_status hardening
* agents: preflight sandboxed session_status checks
* test(agents): cover session_status existence oracle
* agents: preserve legacy session_status tree keys
* test(agents): cover legacy session_status tree keys
* Update CHANGELOG.md
2026-03-12 02:54:25 -04:00
ade748176f
OpenRouter: surface free Hunter and Healer stealth models for the next week ( #43642 )
...
* Models: add temporary Hunter and Healer alpha to OpenRouter catalog
* Add temporary OpenRouter stealth catalog entries
---------
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
2026-03-11 22:58:48 -05:00
f01c41b27a
fix(context-engine): guard compact() throw + fire hooks for ownsCompaction engines ( #41361 )
...
Merged via squash.
Prepared head SHA: 0957b32dc6
2026-03-11 20:19:20 -07:00
e95f2dcd6e
fix(sandbox): anchor fs-bridge writeFile commit to canonical parent path
...
Refs: GHSA-xvx8-77m6-gwg6
2026-03-12 03:52:24 +01:00
17fd46ab66
test: fix websocket tool shape coverage
2026-03-12 02:16:56 +00:00
980619b9be
fix: harden openai websocket replay
2026-03-12 02:13:06 +00:00
cced1e0f76
preserve openai phase param
2026-03-11 23:15:52 +00:00
453c8d7c1b
fix(hooks): add missing trigger and channelId to agent_end, llm_input, and llm_output hook contexts ( #42362 )
...
Merged via squash.
Prepared head SHA: e6d7b7e31a
2026-03-11 23:40:13 +01:00
d79ca52960
Memory: add multimodal image and audio indexing ( #43460 )
...
Merged via squash.
Prepared head SHA: a994c07190
2026-03-11 22:28:34 +00:00
c8dd06cba2
fix(ws): preserve payload overrides
2026-03-11 20:11:51 +00:00
bdd9ed238a
test: align pi-ai oauth mocks
2026-03-11 20:11:51 +00:00
620bae4ec7
fix(ollama): share model context discovery
2026-03-11 20:11:51 +00:00
9329a0ab24
test(agents): cover openai responses phase replay
2026-03-11 20:10:55 +00:00
4133edb395
fix: restore web tools to coding profile ( #43436 )
...
* fix: restore web tools to coding profile
* fix: tighten tool catalog regression assertion
2026-03-11 15:07:17 -05:00
128e5bc317
fix: recognize Venice 402 billing errors for model fallback ( #43205 )
...
Merged via squash.
Prepared head SHA: 1f6b10b9d9
2026-03-11 22:15:32 +03:00
2a18cbb110
fix(agents): prevent false billing error replacing valid response text ( #40616 )
...
Merged via squash.
Prepared head SHA: 05179362b4
2026-03-11 22:00:11 +03:00
4473242b4f
fix: use unknown instead of rate_limit as default cooldown reason ( #42911 )
...
Merged via squash.
Prepared head SHA: bebf6704d7
2026-03-11 21:34:14 +03:00
60aed95346
feat(memory): add gemini-embedding-2-preview support ( #42501 )
...
Merged via squash.
Prepared head SHA: c57b1f8ba2
2026-03-11 14:28:53 -04:00
58634c9c65
fix(agents): check billing errors before context overflow heuristics ( #40409 )
...
Merged via squash.
Prepared head SHA: c88f89c462
2026-03-11 21:08:55 +03:00
87876a3e36
Fix env proxy bootstrap for model traffic ( #43248 )
...
* Fix env proxy bootstrap for model traffic
* Address proxy dispatcher review followups
* Fix proxy env precedence for empty lowercase vars
2026-03-11 10:21:35 -05:00
d6108a6f72
Onboard: add Ollama auth flow and improve model defaults
...
Add Ollama as a auth provider in onboarding with Cloud + Local mode
selection, browser-based sign-in via /api/me, smart model suggestions
per mode, and graceful fallback when the default model is unavailable.
- Extract shared ollama-models.ts
- Auto-pull missing models during onboarding
- Non-interactive mode support for CI/automation
Closes #8239
Closes #3494
Co-Authored-By: Jeffrey Morgan <jmorganca@gmail.com>
2026-03-11 14:52:55 +00:00
62d5df28dc
fix(agents): add nodes to owner-only tool policy fallbacks
...
The nodes tool was missing from OWNER_ONLY_TOOL_NAME_FALLBACKS in
tool-policy.ts. applyOwnerOnlyToolPolicy() correctly removed gateway
and cron for non-owners but kept nodes, which internally issues
privileged gateway calls: node.pair.approve (operator.pairing) and
node.invoke (operator.write).
A non-owner sender could approve pending node pairings and invoke
arbitrary node commands, extending to system.run on paired nodes.
Add nodes to the fallback owner-only set. Non-owners no longer receive
the nodes tool after policy application; owners retain it.
Fixes GHSA-r26r-9hxr-r792
2026-03-11 14:17:03 +01:00
10e6e27451
fix(models): guard optional model input capabilities ( #42096 )
...
Merged via squash.
Prepared head SHA: d398fa0222
2026-03-11 13:43:59 +01:00
d68d4362ee
fix(context-pruning): cover image-only tool-result pruning
2026-03-11 18:07:37 +08:00
a78674f115
fix(context-pruning): prune image-containing tool results instead of skipping them ( #41789 )
2026-03-11 18:07:37 +08:00
dc4441322f
fix(agents): include azure-openai in Responses API store override ( #42934 )
...
Merged via squash.
Prepared head SHA: d3285fef41
2026-03-11 16:16:10 +08:00
7761e7626f
Providers: add Opencode Go support ( #42313 )
...
* feat(providers): add opencode-go provider support and onboarding
* Onboard: unify OpenCode auth handling openclaw#42313 thanks @ImLukeF
* Docs: merge OpenCode Zen and Go docs openclaw#42313 thanks @ImLukeF
* Update CHANGELOG.md
---------
Co-authored-by: Ubuntu <ubuntu@vps-90352893.vps.ovh.ca>
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
2026-03-11 01:31:06 -04:00
bd33a340fb
fix(sandbox): sanitize Docker env before marking OPENCLAW_CLI ( #42256 )
...
* Sandbox: sanitize Docker env before exec marker injection
* Sandbox: add regression test for Docker exec marker env
* Sandbox: disable Windows shell fallback for Docker
* Sandbox: cover Windows Docker wrapper rejection
* Sandbox: test strict env sanitization through Docker args
2026-03-11 00:59:36 -04:00
a52104c235
test: restore fs bridge helper export
2026-03-11 02:38:00 +00:00
a0d5462571
fix(security): pin staged writes and fs mutations
2026-03-11 02:38:00 +00:00
72b0e00eab
refactor: unify sandbox fs bridge mutations
2026-03-11 02:10:23 +00:00
Gustavo Madeira Santana
2233admin
chengzhichao-xydt
Jacob Riff
Rodrigo Uroz
Vincent Koc
0x4C33
rabsef-bicrym
avirweb
glitch
jnMetaCode
Josh Avant
Toven
David Rudduck
Robin Waslander
Peter Steinberger
Brian Yu
zhoulf1006
Tak Hoffman
Squabble9
ingyukoh
VibhorGautam
Bill Chirico
ademczuk
Bruce MacDonald
Andyliu
Frank Yang
MoerAI
Luke