7c593cd333
docs: finish onboarding/config heading consistency ( #22537 )
...
* docs: fix thinking link and add reasoning anchor reference
* docs(channels): rename LINE setup heading to onboarding
* docs(channels): normalize Nextcloud Talk onboarding headings
* docs(channels): use onboarding heading for Matrix setup
* docs(channels): standardize Discord onboarding heading
* docs(channels): standardize Telegram onboarding heading
* docs(channels): standardize WhatsApp onboarding heading
* docs(channels): rename iMessage onboarding and configuration sections
* docs(channels): rename Slack onboarding and configuration sections
* docs(channels): rename Signal onboarding heading
* docs(channels): standardize Nostr onboarding and configuration headings
* docs(channels): standardize Zalo onboarding and configuration headings
* docs(channels): standardize Twitch onboarding heading
* docs(channels): standardize Google Chat onboarding heading
* docs(channels): standardize Mattermost onboarding heading
* docs(channels): standardize Zalo Personal onboarding heading
* docs(channels): normalize Discord configuration heading
* docs(channels): standardize Microsoft Teams onboarding heading
* docs(channels): rename Signal configuration reference heading
* docs(channels): rename Matrix configuration reference heading
* docs(channels): normalize WhatsApp configuration heading
2026-02-21 03:32:37 -05:00
79183852f9
docs: more channel onboarding naming cleanup ( #22536 )
...
* docs: fix thinking link and add reasoning anchor reference
* docs(channels): rename LINE setup heading to onboarding
* docs(channels): normalize Nextcloud Talk onboarding headings
* docs(channels): use onboarding heading for Matrix setup
* docs(channels): standardize Discord onboarding heading
* docs(channels): standardize Telegram onboarding heading
* docs(channels): standardize WhatsApp onboarding heading
* docs(channels): rename iMessage onboarding and configuration sections
* docs(channels): rename Slack onboarding and configuration sections
* docs(channels): rename Signal onboarding heading
* docs(channels): standardize Nostr onboarding and configuration headings
* docs(channels): standardize Zalo onboarding and configuration headings
* docs(channels): standardize Twitch onboarding heading
* docs(channels): standardize Google Chat onboarding heading
* docs(channels): standardize Mattermost onboarding heading
* docs(channels): standardize Zalo Personal onboarding heading
2026-02-21 03:31:55 -05:00
4c4147fb0a
docs: continue onboarding terminology cleanup ( #22535 )
...
* docs: fix thinking link and add reasoning anchor reference
* docs(channels): rename LINE setup heading to onboarding
* docs(channels): normalize Nextcloud Talk onboarding headings
* docs(channels): use onboarding heading for Matrix setup
* docs(channels): standardize Discord onboarding heading
* docs(channels): standardize Telegram onboarding heading
* docs(channels): standardize WhatsApp onboarding heading
* docs(channels): rename iMessage onboarding and configuration sections
* docs(channels): rename Slack onboarding and configuration sections
* docs(channels): rename Signal onboarding heading
* docs(channels): standardize Nostr onboarding and configuration headings
* docs(channels): standardize Zalo onboarding and configuration headings
* docs(channels): standardize Twitch onboarding heading
2026-02-21 03:31:22 -05:00
5eca08dab7
Chore: trim stale TODOs and issue-template language ( #22534 )
...
* docs: refresh issue template contact copy
* chore: remove OneDrive resumable upload TODO note
2026-02-21 03:31:17 -05:00
12d75ff7f5
docs: continue channel onboarding/config naming cleanup ( #22533 )
...
* docs: fix thinking link and add reasoning anchor reference
* docs(channels): rename LINE setup heading to onboarding
* docs(channels): normalize Nextcloud Talk onboarding headings
* docs(channels): use onboarding heading for Matrix setup
* docs(channels): standardize Discord onboarding heading
* docs(channels): standardize Telegram onboarding heading
* docs(channels): standardize WhatsApp onboarding heading
* docs(channels): rename iMessage onboarding and configuration sections
* docs(channels): rename Slack onboarding and configuration sections
* docs(channels): rename Signal onboarding heading
2026-02-21 03:30:35 -05:00
436f79839b
docs: more channel onboarding heading consistency ( #22532 )
...
* docs: fix thinking link and add reasoning anchor reference
* docs(channels): rename LINE setup heading to onboarding
* docs(channels): normalize Nextcloud Talk onboarding headings
* docs(channels): use onboarding heading for Matrix setup
* docs(channels): standardize Discord onboarding heading
* docs(channels): standardize Telegram onboarding heading
* docs(channels): standardize WhatsApp onboarding heading
2026-02-21 03:29:42 -05:00
325992b777
docs: small docs sweep consistency updates ( #22531 )
...
* docs: fix thinking link and add reasoning anchor reference
* docs(channels): rename LINE setup heading to onboarding
* docs(channels): normalize Nextcloud Talk onboarding headings
* docs(channels): use onboarding heading for Matrix setup
2026-02-21 03:29:17 -05:00
c20d519e05
feat(security): migrate sha1 hashes to sha256 for synthetic ids ( #7343 ) ( #22528 )
...
* feat(prompt): add explicit owner hash secret to obfuscation path
* feat(security): migrate synthetic IDs to sha256 for #7343
2026-02-21 03:20:14 -05:00
9abab6a2c9
Add explicit ownerDisplaySecret for owner ID hash obfuscation ( #22520 )
...
* feat(config): add owner display secret setting
* feat(prompt): add explicit owner hash secret to obfuscation path
* test(prompt): assert owner hash secret mode behavior
* Update src/agents/system-prompt.ts
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
---------
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
2026-02-21 03:13:56 -05:00
fe609c0c77
security(hooks): block prototype-chain traversal in webhook template getByPath ( #22213 )
...
* security(hooks): block prototype-chain traversal in webhook template getByPath
The getByPath() function in hooks-mapping.ts traverses attacker-controlled
webhook payload data using arbitrary property path expressions, but does not
filter dangerous property names (__proto__, constructor, prototype).
The config-paths module (config-paths.ts) already blocks these exact keys
for config path traversal via a BLOCKED_KEYS set, but the hooks template
system was not protected with the same guard.
Add a BLOCKED_PATH_KEYS set mirroring config-paths.ts and reject traversal
into __proto__, prototype, or constructor in getByPath(). Add three test
cases covering all three blocked keys.
Signed-off-by: Alan Ross <alan@sleuthco.ai>
* test(gateway): narrow hook action type in prototype-pollution tests
* changelog: credit hooks prototype-path guard in PR 22213
* changelog: move hooks prototype-path fix into security section
---------
Signed-off-by: Alan Ross <alan@sleuthco.ai>
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
2026-02-21 03:01:03 -05:00
0bee3f337a
MSTeams: dedupe sent-message cache storage ( #22514 )
...
Merged via /review-pr -> /prepare-pr -> /merge-pr.
Prepared head SHA: 88e14dcbe1
2026-02-21 13:27:50 +05:30
f4a59eb5d8
Chore: harden A2UI bundle dependency resolution ( #22507 )
...
Merged via /review-pr -> /prepare-pr -> /merge-pr.
Prepared head SHA: d84c5bde51
2026-02-21 13:16:31 +05:30
187f4ea41f
deadcode: remove unused extension dev dependencies ( #22495 )
...
* Chore: remove unused extension dev dependencies
* Chore: fix changelog PR reference
* Chore: restore dropped deadcode changelog entries
* Chore: retag unused-dependency changelog entries
2026-02-21 02:15:43 -05:00
92ac6c95cc
CI: format github workflow ( #22497 )
2026-02-21 02:12:36 -05:00
55eab106ac
chore: remove root long and rolldown deps ( #22481 )
...
* chore(deadcode): add deadcode scanning and remove unused lockfile deps
* chore(changelog): mention deadcode CI scan pass
* ci: disable deadcode job temporarily
* docs(changelog): add PR ref and thanks for deadcode scan entry
* ci: comment out deadcode job condition while keeping it disabled
* Deps: remove dead root dependency from package manifest
* Changelog: reference PR for deadcode dependency cleanup
* Deps: remove unused root signal-utils
* Chore: remove unused lit context deps
* Chore: remove unused root lit dependency
* Chore: remove root long and rolldown deps
* Chore: add changelog for root long/rolldown removal
* Chore: fix a2ui bundling after root lit dependency removal
* Chore: simplify a2ui bundle script dependencies
2026-02-21 02:05:41 -05:00
40f1a6c0d2
chore: Dedupe sent-message cache storage ( #22127 )
...
Merged via /review-pr -> /prepare-pr -> /merge-pr.
Prepared head SHA: 8401257b27
2026-02-21 12:34:59 +05:30
35fd322114
chore: format CI workflow ( #22482 )
...
* chore: format files for oxfmt
* chore: format CI workflow
2026-02-21 01:46:55 -05:00
7428f5a741
chore: format files for oxfmt ( #22479 )
2026-02-21 01:43:18 -05:00
c2f5628915
Fix formatting ( #22474 )
2026-02-21 01:37:02 -05:00
3002be76e4
docs: add custom spellcheck dictionary and fix docs typos ( #22457 )
...
* docs: fix typos and add docs spellcheck workflow
* docs: add changelog entry for docs spellcheck updates
* docs: fix FAQ TOC fragment links for markdownlint
* docs: fix TOC nesting and spellcheck dictionary flags
2026-02-21 01:35:35 -05:00
3b8d7b2e42
deps: remove dead root dependency ( #22471 )
...
* chore(deadcode): add deadcode scanning and remove unused lockfile deps
* chore(changelog): mention deadcode CI scan pass
* ci: disable deadcode job temporarily
* docs(changelog): add PR ref and thanks for deadcode scan entry
* ci: comment out deadcode job condition while keeping it disabled
* Deps: remove dead root dependency from package manifest
* Changelog: reference PR for deadcode dependency cleanup
* Deps: remove unused root signal-utils
2026-02-21 01:33:45 -05:00
569191fff1
extensions: fix MSTeams OneDrive fallback mention handling ( #22472 )
2026-02-21 01:30:33 -05:00
d3bb924709
chore(deadcode): add deadcode scanning and remove unused lockfile deps ( #22468 )
...
* chore(deadcode): add deadcode scanning and remove unused lockfile deps
* chore(changelog): mention deadcode CI scan pass
* ci: disable deadcode job temporarily
* docs(changelog): add PR ref and thanks for deadcode scan entry
* ci: comment out deadcode job condition while keeping it disabled
2026-02-21 01:29:20 -05:00
e7eba01efc
Security: disable sandbox container --no-sandbox by default ( #22451 )
2026-02-21 01:23:49 -05:00
8877bfd11e
gateway: trust-proxy-aware X-Forwarded-For resolution ( #22466 )
2026-02-21 01:23:21 -05:00
0fe8f07e0e
Docs: add changelog entry for PR #19009 ( #22464 )
2026-02-21 01:17:22 -05:00
58f7b7638a
Security: add per-wrapper IDs to untrusted-content markers ( #19009 )
...
Fixes #10927
Adds unique per-wrapper IDs to external-content boundary markers to
prevent spoofing attacks where malicious content could inject fake
marker boundaries.
- Generate random 16-char hex ID per wrap operation
- Start/end markers share the same ID for pairing
- Sanitizer strips markers with or without IDs (handles legacy + spoofed)
- Added test for attacker-injected markers with fake IDs
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
2026-02-21 01:16:02 -05:00
45fff13b1d
TUI: strip only leading inbound metadata ( #22461 )
2026-02-21 01:13:02 -05:00
59167f86ca
test: correct trusted proxy X-Forwarded-For expectation
2026-02-21 00:48:22 -05:00
c01e486fc0
chore: credit co-author for #21458
...
Co-authored-by: Pejman Pour-Moezzi <481729+pejmanjohn@users.noreply.github.com>
2026-02-20 23:03:07 -06:00
07039dc089
Gateway: harden trusted proxy X-Forwarded-For parsing ( #22429 )
2026-02-20 23:59:20 -05:00
35be87b09b
fix(tui): strip inbound metadata blocks from user messages (clean rewrite) ( #22345 )
...
* fix(tui): strip inbound metadata blocks from user text
* chore: clean up metadata-strip format and changelog credit
* chore: format tui metadata-strip tests
* test: align metadata-strip regression expectations
* refactor: reuse canonical inbound metadata stripper
* test: allow tmp media fixture paths in media-understanding tests
* refactor: reuse canonical inbound metadata stripper
* format: fix changelog blank line after headings
* test: fix unrelated check typing regressions
* test: align memory async mock embedding signatures
* test: avoid tsgo mock typing pitfall
* test: restore async search mock typings in merge tree
* test: trigger ci rerun without behavior change
* chore: dedupe todays changelog entries
* fix: dedupe sqlite mock keys in qmd manager test
* Update qmd-manager.test.ts
* test: align chat metadata sanitization expectation
2026-02-20 23:52:43 -05:00
338ae269d6
test(memory): avoid stmt mock shape flake by reusing typed busy stmt
2026-02-20 20:43:15 -08:00
665221a1f0
test(memory): mock sqlite stmt with all+get for busy case
2026-02-20 20:43:15 -08:00
e90eedb0ae
test(memory): fix sqlite busy mock to match implementation
2026-02-20 20:43:15 -08:00
cd6bbe8cea
Session: enforce startup sequence on bare reset greeting
2026-02-20 20:38:56 -08:00
7417c36268
fix(cron): honor maxConcurrentRuns in timer loop (openclaw#22413) thanks @Takhoffman
...
Verified:
- pnpm install --frozen-lockfile
- pnpm build
- pnpm check
- pnpm test:macmini (failed on unrelated baseline test: src/memory/qmd-manager.test.ts > throws when sqlite index is busy)
Co-authored-by: Takhoffman <781889+Takhoffman@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
2026-02-20 22:31:58 -06:00
93c2f20a23
Memory: surface explicit memory_search unavailable status
2026-02-20 20:30:52 -08:00
1cc2263578
TUI: bound chat-log growth to prevent render overflows
2026-02-20 20:27:58 -08:00
2227840989
Gateway/TUI: filter heartbeat ACK noise in chat events
2026-02-20 20:23:28 -08:00
1ded4c672a
test(memory): fix TS types after vitest/ts updates
2026-02-20 20:21:42 -08:00
d583399c92
Hooks: persist session memory on /reset
2026-02-20 20:19:29 -08:00
544c213d42
Memory/QMD: diversify mixed-source search results
2026-02-20 20:13:24 -08:00
d7a7ebb75a
TUI: dedupe duplicate backspace events in input
2026-02-20 20:10:22 -08:00
18b4b47708
TUI: guide pairing-required recovery in disconnect state
2026-02-20 20:04:19 -08:00
c0d5fc8d1e
CLI: default pairing channel for pairing commands
2026-02-20 19:59:54 -08:00
be756b9a89
Memory: fix async sync close race
2026-02-20 19:55:11 -08:00
2649e9e044
fix: preselect Telegram-supported status reaction variants ( #22380 )
...
Merged via /review-pr -> /prepare-pr -> /merge-pr.
Prepared head SHA: 018fcd6e2e
2026-02-21 09:20:20 +05:30
6a27787209
Docker: restore pre-change ownership steps
2026-02-20 21:46:30 -06:00
22ffde90bb
tests: align macmini suite expectations with current behavior (openclaw#22379) thanks @Takhoffman
...
Verified:
- pnpm build
- pnpm check
- pnpm test:macmini
Co-authored-by: Takhoffman <781889+Takhoffman@users.noreply.github.com>
2026-02-20 21:45:04 -06:00
Vincent Koc
SleuthCo.AI
Takayuki Maeda
C.J. Winslow
Shadow
vignesh07
Tak Hoffman
Ayaan Zaidi