Commit Graph

21733 Commits

Author SHA1 Message Date
sudie-codes 6e970010f7
msteams: add message edit and delete support (#49925)
- Add edit/delete action handlers with toolContext.currentChannelId
  fallback for in-thread edits/deletes without explicit target
- Add editMessageMSTeams/deleteMessageMSTeams to channel runtime
- Add updateActivity/deleteActivity to SendContext and MSTeamsTurnContext
- Extend content param with text/content/message fallback chain
- Update test mocks for new SendContext shape

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 23:42:04 -05:00
sudie-codes 9f5d286caf
msteams: extract structured quote/reply context (#51647)
* msteams: extract structured quote/reply context from Teams HTML attachments

* msteams: address PR #51647 review feedback
2026-03-23 23:41:51 -05:00
Tak Hoffman 8c89d0e7cd
tests: add boundary coverage for media delivery (#53361)
* tests: add boundary coverage for media delivery

* tests: isolate telegram outbound adapter transport

* tests: harden telegram webhook certificate assertion

* tests: fix guardrail false positives on rebased branch
2026-03-23 23:37:34 -05:00
Peter Steinberger e864421d83 fix: unify live model auth gating 2026-03-24 04:28:53 +00:00
Peter Steinberger e28e520379
refactor: simplify provider inference and zoned parsing helpers 2026-03-23 21:22:30 -07:00
Peter Steinberger 1bfef17825 ci: balance shards and reuse pr artifacts 2026-03-24 04:19:43 +00:00
Peter Steinberger 26365f7daf
fix: hash inline scripts with data-src attributes 2026-03-23 21:14:55 -07:00
Peter Steinberger 0857447a5d
fix: reject nonexistent zoned cron at-times 2026-03-23 21:14:55 -07:00
Peter Steinberger 69a317995d
fix: fail closed when provider inference drops errored allowlists 2026-03-23 21:14:55 -07:00
Peter Steinberger 3a36fffc15
docs: update mac release automation guidance 2026-03-23 21:12:46 -07:00
Peter Steinberger dc4d2ca263
build: prepare 2026.3.24 2026-03-23 21:05:59 -07:00
Peter Steinberger ce49d8bca9
fix: verify global npm correction installs 2026-03-23 21:04:08 -07:00
Tak Hoffman 50d996a6ec
tests: cron coverage and NO_REPLY delivery fixes (#53366)
* tools: extend seam audit inventory

* tools: audit cron seam coverage gaps

* test: add cron seam coverage tests

* fix: avoid marking NO_REPLY cron deliveries as delivered

* fix: clean up delete-after-run NO_REPLY cron sessions
2026-03-23 22:52:13 -05:00
Vincent Koc 6142fc1d94 fix(runtime): anchor bundled plugin npm staging to active node 2026-03-23 20:32:48 -07:00
Peter Steinberger 483dc90f05 test: harden linux runtime smoke guards 2026-03-24 03:23:52 +00:00
Peter Steinberger dd2361a4c4 docs: refresh plugin-sdk api baseline 2026-03-24 03:20:51 +00:00
Ayaan Zaidi 17c1ee7716
fix: preserve command auth resolution errors on empty inferred allowlists 2026-03-24 08:38:27 +05:30
Peter Steinberger 630f1479c4
build: prepare 2026.3.23-2 2026-03-23 20:04:42 -07:00
Peter Steinberger 38137b0cf8
refactor: split tracked ClawHub update flows 2026-03-23 20:01:51 -07:00
Peter Steinberger b4e392cf9d fix: unblock runtime-api smoke checks 2026-03-24 03:00:51 +00:00
Taras Lukavyi 7ffe7e4822 fix: populate currentThreadTs in threading tool context fallback for Telegram DM topics (#52217)
When a channel plugin lacks a custom buildToolContext (e.g. Telegram),
the fallback path in buildThreadingToolContext did not set currentThreadTs
from the inbound MessageThreadId. This caused resolveTelegramAutoThreadId
to return undefined, so message tool sends without explicit threadId
would route to the main chat instead of the originating DM topic.

Fixes #52217
2026-03-24 08:27:03 +05:30
Peter Steinberger 3ae5d33799
refactor: extract cron schedule and test runner helpers 2026-03-23 19:53:43 -07:00
Taras Lukavyi d4e3babdcc
fix: command auth SecretRef resolution (#52791) (thanks @Lukavyi)
* fix(command-auth): handle unresolved SecretRef in resolveAllowFrom

* fix(command-auth): fall back to config allowlists

* fix(command-auth): avoid duplicate resolution fallback

* fix(command-auth): fail closed on invalid allowlists

* fix(command-auth): isolate fallback resolution errors

* fix: record command auth SecretRef landing notes (#52791) (thanks @Lukavyi)

---------

Co-authored-by: Ayaan Zaidi <hi@obviy.us>
2026-03-24 08:21:30 +05:30
Tak Hoffman 5cd8d43af9
tests: improve boundary audit coverage and safety (#53080)
* tools: extend seam audit inventory

* tools: tighten seam audit heuristics

* tools: refine seam test matching

* tools: refine seam audit review heuristics

* style: format seam audit script

* tools: widen seam audit matcher coverage

* tools: harden seam audit coverage

* tools: tighten boundary audit matchers

* tools: ignore mocked import matches in boundary audit

* test: include native command reply seams in audit
2026-03-23 21:46:53 -05:00
Peter Steinberger a3f2fbf5a2
refactor: harden extension runtime-api seams 2026-03-23 19:39:20 -07:00
Peter Steinberger d8e77c423a test: isolate line jiti runtime smoke 2026-03-24 02:38:49 +00:00
Peter Steinberger 9e8abb468d fix: clean changelog merge duplication (#53224) (thanks @RolfHegr) 2026-03-23 19:38:04 -07:00
Peter Steinberger 0cbf6d5fed fix: land cron tz one-shot handling and prerelease config warnings (#53224) (thanks @RolfHegr) 2026-03-23 19:38:04 -07:00
Rolfy 9aac5582d6 fix(cron): make --tz work with --at for one-shot jobs
Previously, `--at` with an offset-less ISO datetime (e.g. `2026-03-23T23:00:00`)
was always interpreted as UTC, even when `--tz` was provided. This caused one-shot
jobs to fire at the wrong time.

Changes:
- `parseAt()` now accepts an optional `tz` parameter
- When `--tz` is provided with `--at`, offset-less datetimes are interpreted in
  that IANA timezone using Intl.DateTimeFormat
- Datetimes with explicit offsets (e.g. `+01:00`, `Z`) are unaffected
- Removed the guard in cron-edit that blocked `--tz` with `--at`
- Updated `--at` help text to mention `--tz` support
- Added 2 tests verifying timezone resolution and offset preservation
2026-03-23 19:38:04 -07:00
Peter Steinberger 8f9799307b
test: print failed test lane output tails 2026-03-23 19:36:44 -07:00
Peter Steinberger 7f373823b0
refactor: separate exec policy and execution targets 2026-03-23 19:36:44 -07:00
Val Alexander a96eded4a0
feat(csp): support inline script hashes in Control UI CSP (#53307) thanks @BunsDev
Co-authored-by: BunsDev <68980965+BunsDev@users.noreply.github.com>
Co-authored-by: Nova <nova@openknot.ai>
2026-03-23 21:35:33 -05:00
Peter Steinberger e530865274 fix: preserve legacy clawhub skill updates (#53206) (thanks @drobison00) 2026-03-23 19:34:05 -07:00
Devin Robison 003752b9b3 Remove lower casing -- preserving prior behavior 2026-03-23 19:34:05 -07:00
Devin Robison a339d706c1 Formatting fixes and remove trailing dash acceptance 2026-03-23 19:34:05 -07:00
Devin Robison 40071ea23e fix: tighten skill slug validation to ASCII-only 2026-03-23 19:34:05 -07:00
Peter Steinberger 2be3c996fb test: alias all plugin-sdk subpaths in line smoke 2026-03-24 02:31:59 +00:00
Peter Steinberger d5917d37c5 test: allow line runtime api source fallback 2026-03-24 02:26:17 +00:00
Peter Steinberger 462a7a9ae6 test: allow realpath in shell planner assertions 2026-03-24 02:15:14 +00:00
Drickon 715b13547f
fix(line): pre-export clashing symbols to prevent jiti TypeError on startup (#53221)
* fix(line): pre-export clashing symbols to prevent jiti TypeError on startup

When jiti CJS-transforms extensions/line/runtime-api.ts, both
export * from "openclaw/plugin-sdk/line-runtime" and the subsequent
export * from individual source files attempt to define the same 13
symbols via Object.defineProperty with configurable:false. The second
call throws TypeError: Cannot redefine property.

The root cause is that src/plugin-sdk/line-runtime.ts re-exports
these symbols directly from the extension source files, creating a
circular path back to the same files that runtime-api.ts star-exports.

Fix: add named pre-exports for all symbols that plugin-sdk/line-runtime
re-exports from this extension. Named exports register in jiti's
_exportNames map at transform time; the star re-export's hasOwnProperty
guard then skips them, preventing the duplicate Object.defineProperty.

export * reordering cannot fix this: _exportNames is only populated
by named exports, not by export *, so the guard never fires regardless
of order.

This is the same class of bug as the Matrix plugin crash described in
issues #50868, #52780, and #52891, and uses the same fix pattern as
PR #50919.

* test: add LINE runtime-api Jiti regression (#53221) (thanks @Drickon)

* test: stabilize LINE Jiti regression (#53221) (thanks @Drickon)

* test: harden LINE Jiti regression (#53221) (thanks @Drickon)

* chore: retrigger PR checks (#53221)

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-03-23 19:13:25 -07:00
Peter Steinberger d8cef14eb1 fix: split exec and policy resolution for wrapper trust (#53134) (thanks @vincentkoc) 2026-03-23 19:04:04 -07:00
Peter Steinberger 21d480ed92 fix(infra): preserve blocked dispatch policy target
# Conflicts:
#	CHANGELOG.md
2026-03-23 19:04:04 -07:00
Vincent Koc 32e89b4687 Infra: preserve wrapper executable for multiplexer trust 2026-03-23 19:04:04 -07:00
Peter Steinberger 2d5f822ca1 fix: warn on same-base prerelease configs 2026-03-24 02:02:31 +00:00
Peter Steinberger 85ed1a8986
refactor: clean up ClawHub compatibility validation 2026-03-23 18:52:37 -07:00
Val Alexander 9dd0530b97
fix(ui): redact sensitive config values in diff panel
Use isSensitiveConfigPath to detect token/password/secret/apiKey paths
and display REDACTED_PLACEHOLDER instead of raw values in the config
diff panel, preventing credential exposure in the UI.
2026-03-23 20:48:08 -05:00
Val Alexander 21ac4b9a8a
style(ui): continue ui clarity pass across theme, config, and usage (#53272) thanks @BunsDev
Co-authored-by: BunsDev <68980965+BunsDev@users.noreply.github.com>
Co-authored-by: Nova <nova@openknot.ai>
2026-03-23 20:45:43 -05:00
Peter Steinberger ecc8fe5dc2 ci: rebalance sharded test lanes 2026-03-24 01:44:26 +00:00
Peter Steinberger 5b4fd6bf31 fix: use runtime version for ClawHub plugin API checks (#53157) (thanks @futhgar) 2026-03-23 18:41:18 -07:00
futhgar 447e074bf4 fix(plugins): use runtime version for plugin API compatibility check
OPENCLAW_PLUGIN_API_VERSION was hardcoded to "1.2.0" while ClawHub-published
plugins require >=2026.3.22, making all plugin installs via ClawHub fail with
"requires plugin API >=2026.3.22, but this OpenClaw runtime exposes 1.2.0".

Use resolveRuntimeServiceVersion() (already imported) to read the actual
version from package.json at runtime.

Fixes #53038
2026-03-23 18:41:18 -07:00