72af92ba4e
qqbot: require explicit allowlist for /bot-logs to prevent info disclosure ( #58895 )
...
* qqbot: harden /bot-logs authorization fallback
* fix(qqbot): harden bot logs allowlist guard
* fix(qqbot): normalize bot logs allowlist entries
2026-04-01 18:40:46 +09:00
2d53ffdec1
fix(exec): resolve remote approval regressions ( #58792 )
...
* fix(exec): restore remote approval policy defaults
* fix(exec): handle headless cron approval conflicts
* fix(exec): make allow-always durable
* fix(exec): persist exact-command shell trust
* fix(doctor): match host exec fallback
* fix(exec): preserve blocked and inline approval state
* Doctor: surface allow-always ask bypass
* Doctor: match effective exec policy
* Exec: match node durable command text
* Exec: tighten durable approval security
* Exec: restore owner approver fallback
* Config: refresh Slack approval metadata
---------
Co-authored-by: scoootscooob <zhentongfan@gmail.com>
2026-04-01 02:07:20 -07:00
59c23dee09
refactor(anthropic): move stream wrappers into plugin
2026-04-01 09:21:48 +01:00
9ab3352b1a
fix: avoid duplicate discord resolve logs
2026-04-01 08:14:54 +01:00
e643ba2f5e
fix: preserve telegram topic routing in announce and delivery context
2026-04-01 16:13:24 +09:00
1b94e8ca14
feat: feishu comment event ( #58497 )
...
Merged via squash.
Prepared head SHA: a9dfeb0d62
2026-04-01 00:12:38 -07:00
cad3da52c9
fix(memory): prefer --mask over --glob for qmd collection pattern flag ( #58736 )
...
* fix(memory): prefer --mask over --glob for qmd collection pattern flag
qmd 2.0.1 silently ignores the --glob flag when creating collections,
causing all patterns (e.g. MEMORY.md, memory.md) to fall back to the
default **/*.md glob. This leads to collection conflicts when multiple
collections target the same workspace directory with different patterns.
The existing flag negotiation logic in addCollection() tries --glob
first (when collectionPatternFlag is null), and since qmd accepts the
flag without error, OpenClaw never falls back to --mask. The result is
that memory-root-{agent} gets created with **/*.md instead of MEMORY.md,
and memory-alt-{agent} fails with a duplicate path+pattern conflict.
Fix: default collectionPatternFlag to '--mask' so the working flag is
tried first. The fallback to --glob is preserved for older qmd versions
that may not support --mask.
* docs(changelog): note qmd collection flag fix
---------
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
2026-04-01 16:11:56 +09:00
d9a2690535
test: trim mattermost setup cases
2026-04-01 08:03:26 +01:00
035028208f
test: trim line webhook/slack setup prompts
2026-04-01 08:02:26 +01:00
709668ccd1
test: trim line/twitch setup validations
2026-04-01 07:46:25 +01:00
add54e1d26
test: trim low-signal matrix monitor tests
2026-04-01 07:46:25 +01:00
25eaebb9b6
test: drop duplicate telegram/discord command tests
2026-04-01 07:46:25 +01:00
5f3737f229
fix: auto-enable minimax plugin for API key auth route ( #57127 )
...
Merged via squash.
Prepared head SHA: 5782b26738
2026-03-31 22:52:19 -07:00
e1d963ed2e
fix: bound discord inbound media downloads ( #58593 ) (thanks @aquaright1)
...
* fix(discord): bound attachment downloads by timeout
* fix(ci): unblock check and clarify discord timeouts
* fix: bound discord inbound media downloads (#58593 ) (thanks @aquaright1)
---------
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
2026-04-01 10:59:58 +05:30
5836ddea3f
test: fix amazon-bedrock extension test boundary ( #58753 )
...
* Tests: stop amazon-bedrock from importing private core plugin types
* Config: refresh generated doc baseline
2026-03-31 22:24:38 -07:00
ac6db066d3
feat(whatsapp): add reaction guidance levels ( #58622 )
...
* WhatsApp: add reaction guidance policy
* WhatsApp: expose reaction guidance to agents
2026-04-01 01:42:10 -03:00
21403a3898
fix(whatsapp): pass Timestamp to finalizeInboundContext ( #58590 )
...
Merged via squash.
Prepared head SHA: 74aa9a1408
2026-04-01 01:02:23 -03:00
69685f99fe
fix: preserve Telegram local Bot API MIME types ( #54603 ) (thanks @jzakirov)
...
* fix(telegram): preserve content type for local Bot API media files
* fix: preserve Telegram local Bot API MIME types (#54603 ) (thanks @jzakirov)
---------
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
2026-04-01 09:08:31 +05:30
54f2c8e939
test: merge mattermost setup registration checks
2026-04-01 03:17:10 +01:00
6e2738ef00
test: merge kilocode provider registration coverage
2026-04-01 03:13:26 +01:00
a59f2f43b6
test: drop thread-ownership hook registration smoke
2026-04-01 03:12:19 +01:00
3c6e0cfe25
test: drop feishu plugin registration smoke
2026-04-01 03:11:33 +01:00
8076c78b2e
test: drop subagent hook registration smokes
2026-04-01 03:10:47 +01:00
5e371fe875
test: drop discord command registration smoke
2026-04-01 03:09:52 +01:00
6e773cc3b6
test: drop webhook registration smokes
2026-04-01 03:08:33 +01:00
35c9372dc4
test: merge diffs registration smoke into config defaults
2026-04-01 03:05:46 +01:00
5c27f15fe6
test: drop browser plugin registration smoke
2026-04-01 03:03:27 +01:00
4765ce3ad7
test: drop low-signal extension registration smokes
2026-04-01 03:02:40 +01:00
73ead2425b
test: drop redundant web search registration smokes
2026-04-01 02:57:08 +01:00
219116e862
test: drop redundant status-issues skip checks
2026-04-01 02:32:55 +01:00
09c03fcfed
test: drop low-signal memory plugin metadata check
2026-04-01 02:30:53 +01:00
0614d992a4
test: drop redundant openai registration smoke
2026-04-01 02:26:50 +01:00
f9c18186a8
test: move openai live smoke to live suite
2026-04-01 02:24:12 +01:00
1226361c6d
test: move memory lancedb live smoke to live suite
2026-04-01 02:18:20 +01:00
beb2171ab5
test: move openrouter live test to live suite
2026-04-01 02:15:35 +01:00
d2663262d4
Fix broken URL in Twitch extension README ( #58563 )
...
Remove stray `%20` (URL-encoded space) from the StreamWeasels username-to-ID
converter link, which caused a 404 when clicked.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-31 21:10:28 -04:00
a37c66906c
fix(acpx): retry backend health probes after ensure ( #58612 )
...
* fix(acpx): retry backend health probes after ensure
* fix(acpx): keep doctor checks diagnostic-only
2026-03-31 21:10:09 -04:00
8e0f495197
fix(acpx): preserve control command error details ( #58613 )
2026-03-31 21:10:04 -04:00
7941f21bef
fix(voice-call): clear connection timeout on successful STT connect ( #58586 )
...
The 10-second connection timeout in OpenAIRealtimeSTTSession.doConnect()
was never cleared on success or teardown, leaking a timer on every
connection and accumulating stale timers across reconnect cycles.
Store the timeout handle and clear it in both the open handler and
close(), matching the existing clearTimeout pattern in
waitForTranscript().
Co-authored-by: Sharoon Sharif <ssharif@Hosanna.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-31 21:10:02 -04:00
187d3ed053
fix(acpx): fall back to PATH node for shebang wrappers ( #58614 )
2026-03-31 21:09:58 -04:00
eee185af99
feat(amazon-bedrock): add Bedrock Guardrails support ( #58588 )
...
* feat(amazon-bedrock): just the kiro plans, need to remove before PR
* docs(bedrock-guardrails): add environment setup instructions
* docs(bedrock-guardrails): mark environment setup tasks as completed
* feat(amazon-bedrock): add trace configuration to guardrail settings
* feat(amazon-bedrock): implement guardrail wrapper factory and wire into registration
* test(amazon-bedrock): add comprehensive guardrail configuration tests
* docs(bedrock): add guardrails configuration documentation
* docs(bedrock-guardrails): add comprehensive manual testing guide for Docker deployment
* docs(bedrock-guardrails): expand manual testing guide with STS credentials and config options
* docs(bedrock-guardrails): complete manual testing verification with 8 test scenarios
* chore: remove kiro spec files from PR
* fix(docs): correct guardrail config path to plugins.entries.*.config
* style: format docs and test files
2026-03-31 21:09:52 -04:00
68ee3113a9
Fix: CDP profiles prefer cdpPort over stale WebSocket cdpUrl ( Resolves #58494 ) ( #58499 )
...
* fix(browser): prefer cdpPort over stale WebSocket cdpUrl for attach-only profiles
* fix(browser): preserve profile host when dropping stale devtools WS path
2026-03-31 21:09:31 -04:00
5b8f0cf1d5
test: centralize inbound contract suites
2026-04-01 02:04:53 +01:00
051e31fb55
test: centralize outbound payload contracts
2026-04-01 02:01:48 +01:00
ddf39180a4
test: remove extension dm policy wrappers
2026-04-01 01:59:22 +01:00
2db2b078ca
test: remove extension group policy wrappers
2026-04-01 01:57:18 +01:00
1f97f907b2
test: centralize registry-backed channel contracts
2026-04-01 01:53:23 +01:00
ba5b373ad4
test: centralize channel catalog contracts
2026-04-01 01:51:26 +01:00
85679252c4
test: remove extension provider contract wrappers
2026-04-01 01:49:55 +01:00
78be556299
test: consolidate plugin registration contracts
2026-04-01 01:46:56 +01:00
Vincent Koc
Peter Steinberger
yi-bot
wittam-01
chi
Tars
Kenny Xie
Josh Lehman
Marcus Castro
Owen Wang
Jamil Zakirov
Zhang
zssggle-rgb
Sharoon Sharif
Michael Flanagan
Han Yang