Commit Graph

14699 Commits

Author SHA1 Message Date
Shakker 94942df8c7 build: scope window.open guard to ui checks 2026-02-24 14:48:10 +00:00
Shakker e5836283ab ui: centralize safe external URL opening 2026-02-24 14:48:10 +00:00
Shakker ebb5680893 ui(chat): allowlist image open URLs 2026-02-24 14:48:10 +00:00
Peter Steinberger 370d115549 fix: enforce workspaceOnly for native prompt image autoload 2026-02-24 14:47:59 +00:00
Peter Steinberger c3680c2277 docs(changelog): credit reporter for sandbox bind-path fix 2026-02-24 14:47:56 +00:00
Peter Steinberger 9168f2147f test: add case-insensitive stop abort assertions 2026-02-24 14:47:48 +00:00
Peter Steinberger 6da03eabe2 fix: add changelog and clean regression comment for tool-result guard (#25429) (thanks @mikaeldiakhate-cell) 2026-02-24 14:42:09 +00:00
Leakim 8db7ca8c02 fix: prevent synthetic toolResult for aborted/errored assistant messages
When an assistant message with toolCalls has stopReason 'aborted' or 'error',
the guard should not add those tool call IDs to the pending map. Creating
synthetic tool results for incomplete/aborted tool calls causes API 400 errors:
'unexpected tool_use_id found in tool_result blocks'

This aligns the WRITE path (session-tool-result-guard.ts) with the READ path
(session-transcript-repair.ts) which already skips aborted messages.

Fixes: orphaned tool_result causing session corruption

Tests added:
- does NOT create synthetic toolResult for aborted assistant messages
- does NOT create synthetic toolResult for errored assistant messages
2026-02-24 14:42:09 +00:00
zzzz 31b1b20b3c docs: add WeChat community plugin listing
Add @icesword760/openclaw-wechat to the community plugins page.
This plugin connects OpenClaw to WeChat personal accounts via
WeChatPadPro (iPad protocol) with support for text, image, and
file exchange.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-24 08:41:28 -06:00
Peter Steinberger 760671e31c fix: add changelog for kimi cache usage parsing (#25436) (thanks @Elarwei001) 2026-02-24 14:40:52 +00:00
Elarwei aa2826b5b1 fix(usage): parse Kimi K2 cached_tokens from prompt_tokens_details
Kimi K2 models use automatic prefix caching and return cache stats in
a nested field: usage.prompt_tokens_details.cached_tokens

This fixes issue #7073 where cacheRead was showing 0 for K2.5 users.

Also adds cached_tokens (top-level) for moonshot-v1 explicit caching API.

Closes #7073
2026-02-24 14:40:52 +00:00
Peter Steinberger b511a38fc8 fix: add changelog for doctor sandbox docker warning (#25438) (thanks @mcaxtr) 2026-02-24 14:40:06 +00:00
Marcus Castro 23b9daee6f fix(doctor): improve sandbox warning when Docker unavailable 2026-02-24 14:40:06 +00:00
Peter Steinberger d2c031de84 fix: add changelog for meta timestamp coercion (#25491) (thanks @mcaxtr) 2026-02-24 14:39:12 +00:00
Marcus Castro 2c4ebf77f3 fix(config): coerce numeric meta.lastTouchedAt to ISO string 2026-02-24 14:39:12 +00:00
Peter Steinberger b5787e4abb fix(sandbox): harden bind validation for symlink missing-leaf paths 2026-02-24 14:37:35 +00:00
Peter Steinberger 0365125c21 fix: add changelog for reset hook fallback coverage (#25459) (thanks @chilu18) 2026-02-24 14:27:48 +00:00
chilu18 aec41a588b fix(hooks): backfill reset command hooks for native /new path 2026-02-24 14:27:48 +00:00
Peter Steinberger bbdf895d42 fix: add changelog for slug generator model resolution (#25485) (thanks @SudeepMalipeddi) 2026-02-24 14:27:01 +00:00
SudeepMalipeddi d32298cbd8 fix: slug-generator uses effective model instead of agent-primary
resolveAgentModelPrimary() only checks the agent-level model config and
does not fall back to the system-wide default. When users configure a
non-Anthropic provider (e.g. Gemini, Minimax) as their global default
without setting it at the agent level, the slug-generator falls through
to DEFAULT_PROVIDER (anthropic) and fails with a missing API key error.

Switch to resolveAgentEffectiveModelPrimary() which correctly respects
the full model resolution chain including global defaults.

Fixes #25365
2026-02-24 14:27:01 +00:00
Peter Steinberger 5e6fe9c160 fix: add changelog for slack dm channel-type guard (#25479) (thanks @mcaxtr) 2026-02-24 14:26:01 +00:00
Marcus Castro 3ff6e078ec test(slack): add missing allowNameMatching field to DM classification tests 2026-02-24 14:26:01 +00:00
Marcus Castro f33d0a884e fix(slack): override wrong channel_type for D-prefix DM channels 2026-02-24 14:26:01 +00:00
Peter Steinberger 8cc841766c docs(security): enumerate dangerous config parameters 2026-02-24 14:25:43 +00:00
Peter Steinberger 39631639b7 fix: add changelog + typed omission test note (#25314) (thanks @lbo728) 2026-02-24 14:22:02 +00:00
lbo728 b863316e7b fix(models): preserve user reasoning override when merging with built-in catalog
When a built-in provider model has reasoning:true (e.g. MiniMax-M2.5) and
the user explicitly sets reasoning:false in their config, mergeProviderModels
unconditionally overwrote the user's value with the built-in catalog value.

The merge code refreshes capability metadata (input, contextWindow, maxTokens,
reasoning) from the implicit catalog. This is correct for fields like
contextWindow and maxTokens — the catalog has authoritative values that
shouldn't be stale. But reasoning is a user preference, not just a
capability descriptor: users may need to disable it to avoid 'Message
ordering conflict' errors with certain models or backends.

Fix: check whether 'reasoning' is present in the explicit (user-supplied)
model entry. If the user has set it (even to false), honour that value.
If the user hasn't set it, fall back to the built-in catalog default.

This allows users to configure tools.models.providers.minimax.models with
reasoning:false for MiniMax-M2.5 without being silently overridden.

Fixes #25244
2026-02-24 14:22:02 +00:00
Peter Steinberger 07f653ffc8 fix: polish bare wildcard allowlist handling (#25250) (thanks @widingmarcus-cyber) 2026-02-24 14:20:11 +00:00
Marcus Widing 0f0b2c0255 fix(exec): match bare * wildcard in allowlist entries (#25082)
The matchAllowlist() function skipped patterns without path separators
(/, \, ~), causing a bare "*" wildcard entry to never reach the glob
matcher. Since glob's single * maps to [^/]*, it would also fail against
absolute paths. Handle bare "*" as a special case that matches any
resolved executable path.

Closes #25082
2026-02-24 14:20:11 +00:00
Peter Steinberger e9216cb7dc fix: add changelog for trusted-proxy pairing bypass (#25428) (thanks @SidQin-cyber) 2026-02-24 14:17:54 +00:00
SidQin-cyber 20523b918a fix(gateway): allow trusted-proxy control-ui auth to skip device pairing
Control UI connections authenticated via gateway.auth.mode=trusted-proxy were
still forced through device pairing because pairing bypass only considered
shared token/password auth (sharedAuthOk). In trusted-proxy deployments,
this produced persistent "pairing required" failures despite valid trusted
proxy headers.

Treat authenticated trusted-proxy control-ui connections as pairing-bypass
eligible and allow missing device identity in that mode.

Fixes #25293

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-24 14:17:54 +00:00
Peter Steinberger d84659f22f fix: add changelog for block-reply flush await (#25427) (thanks @SidQin-cyber) 2026-02-24 14:11:40 +00:00
SidQin-cyber 99d854db82 fix(agents): await block-reply flush before tool execution starts
handleToolExecutionStart() flushed pending block replies and then called
onBlockReplyFlush() as fire-and-forget (`void`). This created a race where
fast tool results (especially media on Telegram) could be delivered before
the text block that preceded the tool call.

Await onBlockReplyFlush() so the block pipeline finishes before tool
execution continues, preserving delivery order.

Fixes #25267

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-24 14:11:40 +00:00
Peter Steinberger 4d124e4a9b feat(security): warn on likely multi-user trust-model mismatch 2026-02-24 14:03:19 +00:00
DoncicX 32d7756d8c iOS: extract device/platform info into DeviceInfoHelper, keep Settings platform string as iOS X.Y.Z 2026-02-24 13:56:43 +00:00
Peter Steinberger e3ac491da3 docs(changelog): trim 2026.2.24 unreleased entries 2026-02-24 13:51:45 +00:00
Peter Steinberger 7c99a733a9 fix: harden macOS usage cost submenu recursion guard (#25341) (thanks @yingchunbai) 2026-02-24 13:48:59 +00:00
yingchunbai 96b21f4823 fix(macos): remove self-delegate on cost usage submenu to prevent recursive dropdown
The cost usage submenu set `menu.delegate = self` (the MenuSessionsInjector),
which caused `menuWillOpen(_:)` to call `inject(into:)` on the submenu when
it opened. This re-inserted the "Usage cost (30 days)" item into the submenu,
creating an infinite recursive dropdown.

Fix: remove the delegate assignment from the submenu — it does not need
the injector's delegate behavior since it only contains a static chart view.

Closes #25167

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-24 13:48:59 +00:00
Peter Steinberger 2bad30b4d3 chore(release): bump version to 2026.2.24 2026-02-24 13:42:43 +00:00
Shakker aceb17a30e
changelog: add entry for PR 18685 fix 2026-02-24 13:04:10 +00:00
Mariana Sinisterra 649d141527
fix(ui): prevent tabnabbing in chat images (#18685)
* UI: prevent tabnabbing in chat images

* ui: remove comment from image open helper

---------

Co-authored-by: Shakker <shakkerdroid@gmail.com>
2026-02-24 12:56:08 +00:00
LawrenceLuo 66e61ca6ce
docs: fix broken links in README (#25368)
- /start/faq → /help/faq
- /concepts/groups → /channels/groups
- /concepts/group-messages → /channels/group-messages
- /concepts/channel-routing → /channels/channel-routing

Co-authored-by: LawrenceLuo <5390633+PinoHouse@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-02-24 06:27:23 -06:00
Peter Machona 097a6a83a0
fix(cli): replace stale doctor/restart command hints (#24485)
* fix(cli): replace stale doctor and restart hints

* fix: add changelog for CLI hint updates (#24485) (thanks @chilu18)

---------

Co-authored-by: Muhammed Mukhthar CM <mukhtharcm@gmail.com>
2026-02-24 14:49:59 +05:30
Val Alexander 1c228dc249
docs: add Val Alexander to maintainers list (#25197)
* docs: add Val Alexander to maintainers list

- Focus: UI/UX, Docs, and Agent DevX
- GitHub: @BunsDev
- X/Twitter: @BunsDev

* Update CONTRIBUTING.md

* fix: format
2026-02-24 01:50:30 -06:00
Vincent Koc 4b316c33db
Auto-reply: normalize stop matching and add multilingual triggers (#25103)
* Auto-reply tests: cover multilingual abort triggers

* Auto-reply: normalize multilingual abort triggers

* Gateway: route chat stop matching through abort parser

* Gateway tests: cover chat stop parsing variants

* Auto-reply tests: cover Russian and German stop words

* Auto-reply: add Russian and German abort triggers

* Gateway tests: include Russian and German stop forms

* Telegram tests: route Russian and German stop forms to control lane

* Changelog: note multilingual abort stop coverage

* Changelog: add shared credit for abort shortcut update
2026-02-24 01:07:25 -05:00
Peter Steinberger b817600533 chore(release): cut 2026.2.23 2026-02-24 05:39:22 +00:00
Peter Steinberger 8ea936cdda docs: clarify prompt caching intro 2026-02-24 05:22:00 +00:00
Peter Steinberger cafa8226d7 docs(changelog): move stop-signal expansion to changes 2026-02-24 05:14:02 +00:00
Peter Steinberger 936f2449bd chore(release): prep 2026.2.23-beta.1 changelog 2026-02-24 05:02:40 +00:00
Peter Steinberger fd10286819 docs(changelog): mark allowFrom id-only default as breaking 2026-02-24 04:47:36 +00:00
Peter Steinberger 91ea6ad8ec docs(changelog): reorder unreleased fixes by user impact 2026-02-24 04:46:19 +00:00