Commit Graph

869 Commits

Author SHA1 Message Date
Peter Steinberger 0a421d7409 test(line): improve logout scenario coverage 2026-02-22 11:29:31 +00:00
Peter Steinberger 5574eb6b35 fix(feishu): harden onboarding and webhook validation 2026-02-22 11:29:31 +00:00
Peter Steinberger 9e6125ea2f test(discord): stabilize subagent hook coverage 2026-02-22 11:29:31 +00:00
Peter Steinberger 5056f4e142 fix(bluebubbles): tighten chat target handling 2026-02-22 11:29:31 +00:00
Peter Steinberger 26763d1910 fix: resolve extension type errors and harden probe mocks 2026-02-22 12:25:58 +01:00
Peter Steinberger 777817392d fix: fail closed missing provider group policy across message channels (#23367) (thanks @bmendonca3) 2026-02-22 12:21:04 +01:00
Peter Steinberger 296b3f49ef refactor(bluebubbles): centralize private-api status handling 2026-02-22 12:08:41 +01:00
Peter Steinberger 37f12eb7ee fix: align BlueBubbles private-api null fallback + warning (#23459) (thanks @echoVic) 2026-02-22 11:47:57 +01:00
echoVic 888b6bc948 fix(bluebubbles): treat null privateApiStatus as disabled, not enabled
Bug: privateApiStatus cache expires after 10 minutes, returning null.
The check '!== false' treats null as truthy, causing 500 errors when
trying to use Private API features that aren't actually available.

Root cause: In JavaScript, null !== false evaluates to true.

Fix: Changed all checks from '!== false' to '=== true', so null (cache
expired/unknown) is treated as disabled (safe default).

Files changed:
- extensions/bluebubbles/src/send.ts (line 376)
- extensions/bluebubbles/src/monitor-processing.ts (line 423)
- extensions/bluebubbles/src/attachments.ts (lines 210, 220)

Fixes #23393
2026-02-22 11:47:57 +01:00
Peter Steinberger 29e41d4c0a fix: land security audit severity + temp-path guard fixes (#23428) (thanks @bmendonca3) 2026-02-22 11:26:17 +01:00
Peter Steinberger bf56196de3 fix: tighten feishu dedupe boundary (#23377) (thanks @SidQin-cyber) 2026-02-22 11:13:40 +01:00
SidQin-cyber 9e5e555ba3 fix(feishu): address dedup race condition, namespace isolation, and cache staleness
- Prefix memoryCache keys with namespace to prevent cross-account false
  positives when different accounts receive the same message_id
- Add inflight tracking map to prevent TOCTOU race where concurrent
  async calls for the same message both pass the check and both proceed
- Remove expired-entry deletion from has() to avoid silent cache/disk
  divergence; actual cleanup happens probabilistically inside record()
- Add time-based cache invalidation (30s) to DedupStore.load() so
  external writes are eventually picked up
- Refresh cacheLoadedAt after flush() so we don't immediately re-read
  data we just wrote

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-22 11:13:40 +01:00
SidQin-cyber 9a8179fd59 feat(feishu): persistent message deduplication to prevent duplicate replies
Closes #23369

Feishu may redeliver the same message during WebSocket reconnects or process
restarts.  The existing in-memory dedup map is lost on restart, so duplicates
slip through.

This adds a dual-layer dedup strategy:
- Memory cache (fast synchronous path, unchanged capacity)
- Filesystem store (~/.openclaw/feishu/dedup/) that survives restarts

TTL is extended from 30 min to 24 h.  Disk writes use atomic rename and
probabilistic cleanup to keep each per-account file under 10 k entries.
Disk errors are caught and logged — message handling falls back to
memory-only behaviour so it is never blocked.
2026-02-22 11:13:40 +01:00
Peter Steinberger 73804abcec fix(feishu): avoid template tmpdir join in dedup state path (#23398) 2026-02-22 11:12:01 +01:00
Peter Steinberger 59807efa31 refactor(plugin-sdk): unify channel dedupe primitives 2026-02-22 10:46:34 +01:00
Peter Steinberger 6c2e999776 refactor(security): unify secure id paths and guard weak patterns 2026-02-22 10:16:19 +01:00
Peter Steinberger ae8d4a8eec fix(security): harden channel token and id generation 2026-02-22 10:16:02 +01:00
Vignesh Natarajan 96c985400d BlueBubbles: accept webhook payloads with missing handles 2026-02-21 22:10:30 -08:00
Ryan Haines 75a9ea004b
Fix BlueBubbles DM history backfill bug (#20302)
* feat: implement DM history backfill for BlueBubbles

- Add fetchBlueBubblesHistory function to fetch message history from API
- Modify processMessage to fetch history for both groups and DMs
- Use dmHistoryLimit for DMs and historyLimit for groups
- Add InboundHistory field to finalizeInboundContext call

Fixes #20296

* style: format with oxfmt

* address review: in-memory history cache, resolveAccount try/catch, include is_from_me

- Wrap resolveAccount in try/catch instead of unreachable guard (it throws)
- Include is_from_me messages with 'me' sender label for full conversation context
- Add in-memory rolling history map (chatHistories) matching other channel patterns
- API backfill only on first message per chat, not every incoming message
- Remove unused buildInboundHistoryFromEntries import

* chore: remove unused buildInboundHistoryFromEntries helper

Dead code flagged by Greptile — mapping is done inline in
monitor-processing.ts.

* BlueBubbles: harden DM history backfill state handling

* BlueBubbles: add bounded exponential backoff and history payload guards

* BlueBubbles: evict merged history keys

* Update extensions/bluebubbles/src/monitor-processing.ts

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

---------

Co-authored-by: Ryan Mac Mini <ryanmacmini@ryans-mac-mini.tailf78f8b.ts.net>
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
2026-02-21 20:00:09 -05:00
Jean-Marc 03586e3d00
feat(channels): add Synology Chat native channel (#23012)
* feat(channels): add Synology Chat native channel

Webhook-based integration with Synology NAS Chat (DSM 7+).
Supports outgoing webhooks, incoming messages, multi-account,
DM policies, rate limiting, and input sanitization.

- HMAC-based constant-time token validation
- Configurable SSL verification (allowInsecureSsl) for self-signed NAS certs
- 54 unit tests across 5 test suites
- Follows the same ChannelPlugin pattern as LINE/Discord/Telegram

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat(synology-chat): add pairing, warnings, messaging, agent hints

- Enable media capability (file_url already supported by client)
- Add pairing.notifyApproval to message approved users
- Add security.collectWarnings for missing token/URL, insecure SSL, open DM policy
- Add messaging.normalizeTarget and targetResolver for user ID resolution
- Add directory stubs (self, listPeers, listGroups)
- Add agentPrompt.messageToolHints with Synology Chat formatting guide
- 63 tests (up from 54), all passing

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-22 00:09:58 +01:00
Peter Steinberger 0bd9f0d4ac
fix: enforce strict allowlist across pairing stores (#23017) 2026-02-22 00:00:23 +01:00
Peter Steinberger b34097f62d fix(security): enforce msteams redirect allowlist checks 2026-02-21 23:18:48 +01:00
Peter Steinberger 61dc7ac679 refactor(msteams,bluebubbles): dedupe inbound media download helpers 2026-02-21 23:08:07 +01:00
Peter Steinberger 73d93dee64 fix: enforce inbound media max-bytes during remote fetch 2026-02-21 23:02:29 +01:00
Peter Steinberger 549549f6a0 fix(ci): sync plugin versions and harden install smoke 2026-02-21 20:18:37 +01:00
Peter Steinberger 4540790cb6 refactor(bluebubbles): share dm/group access policy checks 2026-02-21 20:08:33 +01:00
Peter Steinberger 2ba6de7eaa refactor(security): make empty allowlist behavior explicit 2026-02-21 19:54:59 +01:00
Peter Steinberger 9632b9bcf0 fix(security): fail closed parsed chat allowlist 2026-02-21 19:51:36 +01:00
Peter Steinberger bdfb97afad chore: prep 2026.2.22 unreleased and publish new npm plugins 2026-02-21 19:05:35 +01:00
Onur 8178ea472d
feat: thread-bound subagents on Discord (#21805)
* docs: thread-bound subagents plan

* docs: add exact thread-bound subagent implementation touchpoints

* Docs: prioritize auto thread-bound subagent flow

* Docs: add ACP harness thread-binding extensions

* Discord: add thread-bound session routing and auto-bind spawn flow

* Subagents: add focus commands and ACP/session binding lifecycle hooks

* Tests: cover thread bindings, focus commands, and ACP unbind hooks

* Docs: add plugin-hook appendix for thread-bound subagents

* Plugins: add subagent lifecycle hook events

* Core: emit subagent lifecycle hooks and decouple Discord bindings

* Discord: handle subagent bind lifecycle via plugin hooks

* Subagents: unify completion finalizer and split registry modules

* Add subagent lifecycle events module

* Hooks: fix subagent ended context key

* Discord: share thread bindings across ESM and Jiti

* Subagents: add persistent sessions_spawn mode for thread-bound sessions

* Subagents: clarify thread intro and persistent completion copy

* test(subagents): stabilize sessions_spawn lifecycle cleanup assertions

* Discord: add thread-bound session TTL with auto-unfocus

* Subagents: fail session spawns when thread bind fails

* Subagents: cover thread session failure cleanup paths

* Session: add thread binding TTL config and /session ttl controls

* Tests: align discord reaction expectations

* Agent: persist sessionFile for keyed subagent sessions

* Discord: normalize imports after conflict resolution

* Sessions: centralize sessionFile resolve/persist helper

* Discord: harden thread-bound subagent session routing

* Rebase: resolve upstream/main conflicts

* Subagents: move thread binding into hooks and split bindings modules

* Docs: add channel-agnostic subagent routing hook plan

* Agents: decouple subagent routing from Discord

* Discord: refactor thread-bound subagent flows

* Subagents: prevent duplicate end hooks and orphaned failed sessions

* Refactor: split subagent command and provider phases

* Subagents: honor hook delivery target overrides

* Discord: add thread binding kill switches and refresh plan doc

* Discord: fix thread bind channel resolution

* Routing: centralize account id normalization

* Discord: clean up thread bindings on startup failures

* Discord: add startup cleanup regression tests

* Docs: add long-term thread-bound subagent architecture

* Docs: split session binding plan and dedupe thread-bound doc

* Subagents: add channel-agnostic session binding routing

* Subagents: stabilize announce completion routing tests

* Subagents: cover multi-bound completion routing

* Subagents: suppress lifecycle hooks on failed thread bind

* tests: fix discord provider mock typing regressions

* docs/protocol: sync slash command aliases and delete param models

* fix: add changelog entry for Discord thread-bound subagents (#21805) (thanks @onutc)

---------

Co-authored-by: Shadow <hi@shadowing.dev>
2026-02-21 16:14:55 +01:00
Peter Steinberger 1bd3f01c17 fix(telegram): guard duplicate bot token accounts 2026-02-21 15:41:03 +01:00
Peter Steinberger 95c14d9b5f docs: prune low-signal changelog entries 2026-02-21 15:02:10 +01:00
Peter Steinberger 892620ddab chore: update workspace dependencies 2026-02-21 14:35:13 +01:00
Peter Steinberger 14b3743228 fix(ci): stabilize Windows path handling in sandbox tests 2026-02-21 14:32:15 +01:00
Peter Steinberger 283029bdea refactor(security): unify webhook auth matching paths 2026-02-21 11:52:34 +01:00
Peter Steinberger 6b2f2811dc fix(security): require BlueBubbles webhook auth 2026-02-21 11:41:50 +01:00
Peter Steinberger 9231d7d30f chore: bump version to 2026.2.21 2026-02-21 11:02:30 +01:00
Vincent Koc 5eca08dab7
Chore: trim stale TODOs and issue-template language (#22534)
* docs: refresh issue template contact copy

* chore: remove OneDrive resumable upload TODO note
2026-02-21 03:31:17 -05:00
Takayuki Maeda 0bee3f337a
MSTeams: dedupe sent-message cache storage (#22514)
Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: 88e14dcbe1
Co-authored-by: TaKO8Ki <41065217+TaKO8Ki@users.noreply.github.com>
Co-authored-by: obviyus <22031114+obviyus@users.noreply.github.com>
Reviewed-by: @obviyus
2026-02-21 13:27:50 +05:30
Vincent Koc f4a59eb5d8
Chore: harden A2UI bundle dependency resolution (#22507)
Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: d84c5bde51
Co-authored-by: vincentkoc <25068+vincentkoc@users.noreply.github.com>
Co-authored-by: obviyus <22031114+obviyus@users.noreply.github.com>
Reviewed-by: @obviyus
2026-02-21 13:16:31 +05:30
Vincent Koc 187f4ea41f
deadcode: remove unused extension dev dependencies (#22495)
* Chore: remove unused extension dev dependencies

* Chore: fix changelog PR reference

* Chore: restore dropped deadcode changelog entries

* Chore: retag unused-dependency changelog entries
2026-02-21 02:15:43 -05:00
Vincent Koc 569191fff1
extensions: fix MSTeams OneDrive fallback mention handling (#22472) 2026-02-21 01:30:33 -05:00
Vincent Koc d94d21f9b0
test: isolate local media regression fixtures to allowed roots (#22369)
* fix(tui): strip inbound metadata blocks from user text

* chore: clean up metadata-strip format and changelog credit

* chore: format tui metadata-strip tests

* test(web): isolate local media fixture paths to allow-listed roots
2026-02-20 21:50:50 -05:00
Shadow f555835b09
Channels: add thread-aware model overrides 2026-02-20 19:26:25 -06:00
Tyler Yust 2dba150c16
Fix path-root flaky tests and restore status emoji defaults (#22274) 2026-02-20 15:45:33 -08:00
Kirill Shchetynin ee519086f6
Feature/default messenger delivery target (openclaw#16985) thanks @KirillShchetinin
Verified:
- pnpm build
- pnpm check
- pnpm test:macmini

Co-authored-by: KirillShchetinin <13061871+KirillShchetinin@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
2026-02-19 22:37:19 -06:00
Peter Steinberger f66b23de75 chore(release): bump versions to 2026.2.20 2026-02-20 00:02:53 +01:00
Peter Steinberger b0e55283d5 chore: bump release metadata to 2026.2.19 2026-02-19 16:17:34 +01:00
Peter Steinberger 10379e7dcd fix: harden voice-call tts deep merge 2026-02-19 15:37:01 +01:00
Peter Steinberger 3d7ad1cfca fix(security): centralize owner-only tool gating and scope maps 2026-02-19 15:29:23 +01:00
Peter Steinberger f4b288b8f7 refactor(feishu): dedupe mention regex escaping 2026-02-19 15:04:40 +01:00
Peter Steinberger 29118995ad refactor(lobster): remove lobsterPath overrides 2026-02-19 14:58:13 +01:00
Peter Steinberger 7426848913 test(feishu): add mention regex injection regressions 2026-02-19 14:51:41 +01:00
Jamie 7e67ab75cc fix(feishu): escape regex metacharacters in stripBotMention
stripBotMention() passed mention.name and mention.key directly into
new RegExp() without escaping, allowing regex injection and ReDoS via
crafted Feishu mention metadata. extractMessageBody() in mention.ts
already escapes correctly — this applies the same pattern.

Ref: GHSA-c6hr-w26q-c636
2026-02-19 14:51:41 +01:00
Peter Steinberger 0e85380e56 style: format files and fix safe-bins e2e typing 2026-02-19 14:26:12 +01:00
Peter Steinberger ec232a9e2d refactor(security): harden temp-path handling for inbound media 2026-02-19 14:06:37 +01:00
Peter Steinberger aa267812d3 test(security): add webhook hardening regressions 2026-02-19 13:31:28 +01:00
Peter Steinberger a23e0d5140 fix(security): harden feishu and zalo webhook ingress 2026-02-19 13:31:27 +01:00
zerone0x 3feb7fc3a3
fix(matrix): detect mentions in formatted_body matrix.to links (#16941)
* fix(matrix): detect mentions in formatted_body matrix.to links

Many Matrix clients (including Element) send mentions using HTML links
in formatted_body instead of or in addition to the m.mentions field:

```json
{
  "formatted_body": "<a href=\"https://matrix.to/#/@bot:matrix.org\">Bot</a>: hello",
  "m.mentions": null
}
```

This change adds detection for matrix.to links in formatted_body,
supporting both plain and URL-encoded user IDs.

Changes:
- Add checkFormattedBodyMention() helper function
- Check formatted_body in resolveMentions()
- Add comprehensive test coverage

Fixes #6982

* Update extensions/matrix/src/matrix/monitor/mentions.ts

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

---------

Co-authored-by: zerone0x <zerone0x@users.noreply.github.com>
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
2026-02-19 03:40:21 -08:00
Vincent Koc de656e3194
fix(otel): complete diagnostics-otel OpenTelemetry v2 API migration (#12897)
* fix(otel): complete diagnostics-otel OpenTelemetry v2 API migration

* chore(format): align otel files with updated oxfmt config

* chore(format): apply updated oxfmt spacing to otel diagnostics
2026-02-19 02:36:47 -08:00
Vincent Koc 1faa7a87a0
lobster: parse windows cmd shim paths with rooted tokens (#20833) 2026-02-19 02:34:08 -08:00
Peter Steinberger e8e343aeee test(ci): fix launchd and diagnostics-otel test harnesses 2026-02-19 10:17:48 +00:00
Mariano 45db2aa0cd
Security: disable plugin runtime command execution primitive (#20828)
Co-authored-by: mbelinky <mbelinky@users.noreply.github.com>
2026-02-19 10:17:29 +00:00
Peter Steinberger 771af40913 chore(ci): fix main check blockers and stabilize tests 2026-02-19 10:15:25 +00:00
Peter Steinberger 53aecf7a8e test(bluebubbles): merge typing start stop method checks 2026-02-19 10:09:34 +00:00
Peter Steinberger cdb00fe242 fix(feishu): isolate temp download writes in mkdtemp dirs 2026-02-19 11:05:04 +01:00
Vincent Koc 88f698974a
fix(otel): sanitize OTLP endpoint URL resolution (#13791)
* fix(otel): sanitize OTLP endpoint signal URL resolution

* fix(otel): preserve signal URLs with query params

* fix(otel): accept case-insensitive signal paths
2026-02-19 02:02:57 -08:00
Mariano a7c0aa94d9
refactor(security): share safe temp media path builder (#20810)
Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: 7a088e6801
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com>
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com>
Reviewed-by: @mbelinky
2026-02-19 09:59:21 +00:00
Peter Steinberger c06ad38a71 test(voice-call): merge provider credential source cases 2026-02-19 09:55:43 +00:00
Peter Steinberger 32ba62dc69 test(bluebubbles): merge setGroupIcon credential checks 2026-02-19 09:51:35 +00:00
Peter Steinberger 0c1d3b866c test(bluebubbles): collapse duplicate credential and chatGuid cases 2026-02-19 09:48:47 +00:00
Peter Steinberger 02123e591c refactor(lobster): extract windows spawn resolver 2026-02-19 10:44:22 +01:00
Peter Steinberger 6b14498d2f test(lobster): use lobster.exe in windows plugin path case 2026-02-19 09:35:38 +00:00
Peter Steinberger 8b34719b3a style: apply oxfmt import ordering for ci 2026-02-19 09:26:29 +00:00
Peter Steinberger c241bf0049 test: dedupe voice-call provider config validation cases 2026-02-19 09:24:09 +00:00
Peter Steinberger ba7be018da fix(security): remove lobster windows shell fallback 2026-02-19 10:22:59 +01:00
Mariano Belinky c821099157 Feishu: harden temp media download paths 2026-02-19 10:13:48 +01:00
Peter Steinberger d51929ecb5 fix: block ISATAP SSRF bypass via shared host/ip guard 2026-02-19 09:59:47 +01:00
Peter Steinberger 983a68c23e test(matrix): cover directory context and group exact-match resolution 2026-02-18 16:22:20 +00:00
Peter Steinberger eb4f1e765c refactor(matrix): dedupe directory/target match helpers 2026-02-18 16:22:20 +00:00
Peter Steinberger 98fac87a9e test(matrix): add coverage for deduped action helpers 2026-02-18 16:18:01 +00:00
Peter Steinberger f5c3702191 refactor(matrix): dedupe action limit and pin/reaction helpers 2026-02-18 16:18:01 +00:00
Peter Steinberger 29d3bb278f refactor(device-pair): reduce duplicated gateway parsing 2026-02-18 16:08:38 +00:00
Peter Steinberger 95d52b06d5 refactor(mattermost): dedupe reaction flow and test fixtures 2026-02-18 16:08:38 +00:00
Peter Steinberger fa4772b4ce perf(test): dedupe telegram allowlist and speed twitch probe 2026-02-18 04:16:36 +00:00
Peter Steinberger 4bf3338834 chore: bump version to 2026.2.18 unreleased 2026-02-18 04:40:06 +01:00
Peter Steinberger b8b43175c5 style: align formatting with oxfmt 0.33 2026-02-18 01:34:35 +00:00
Peter Steinberger 31f9be126c style: run oxfmt and fix gate failures 2026-02-18 01:29:02 +00:00
Peter Steinberger 6dcc052bb4 fix: stabilize model catalog and pi discovery auth storage compatibility 2026-02-18 02:09:40 +01:00
Tyler Yust 087dca8fa9
fix(subagent): harden read-tool overflow guards and sticky reply threading (#19508)
* fix(gateway): avoid premature agent.wait completion on transient errors

* fix(agent): preemptively guard tool results against context overflow

* fix: harden tool-result context guard and add message_id metadata

* fix: use importOriginal in session-key mock to include DEFAULT_ACCOUNT_ID

The run.skill-filter test was mocking ../../routing/session-key.js with only
buildAgentMainSessionKey and normalizeAgentId, but the module also exports
DEFAULT_ACCOUNT_ID which is required transitively by src/web/auth-store.ts.

Switch to importOriginal pattern so all real exports are preserved alongside
the mocked functions.

* pi-runner: guard accumulated tool-result overflow in transformContext

* PI runner: compact overflowing tool-result context

* Subagent: harden tool-result context recovery

* Enhance tool-result context handling by adding support for legacy tool outputs and improving character estimation for message truncation. This includes a new function to create legacy tool results and updates to existing functions to better manage context overflow scenarios.

* Enhance iMessage handling by adding reply tag support in send functions and tests. This includes modifications to prepend or rewrite reply tags based on provided replyToId, ensuring proper message formatting for replies.

* Enhance message delivery across multiple channels by implementing sticky reply context for chunked messages. This includes preserving reply references in Discord, Telegram, and iMessage, ensuring that follow-up messages maintain their intended reply targets. Additionally, improve handling of reply tags in system prompts and tests to support consistent reply behavior.

* Enhance read tool functionality by implementing auto-paging across chunks when no explicit limit is provided, scaling output budget based on model context window. Additionally, add tests for adaptive reading behavior and capped continuation guidance for large outputs. Update related functions to support these features.

* Refine tool-result context management by stripping oversized read-tool details payloads during compaction, ensuring repeated read calls do not bypass context limits. Introduce new utility functions for handling truncation content and enhance character estimation for tool results. Add tests to validate the removal of excessive details in context overflow scenarios.

* Refine message delivery logic in Matrix and Telegram by introducing a flag to track if a text chunk was sent. This ensures that replies are only marked as delivered when a text chunk has been successfully sent, improving the accuracy of reply handling in both channels.

* fix: tighten reply threading coverage and prep fixes (#19508) (thanks @tyler6204)
2026-02-17 15:32:52 -08:00
Peter Steinberger 9a2c39419e chore(release): bump version to 2026.2.17 2026-02-17 23:08:55 +01:00
Tyler Yust e1015a5197 fix(bluebubbles): recover outbound message IDs and include sender metadata 2026-02-17 11:39:58 -08:00
Sebastian dd0b789669 fix(mattermost): surface reactions support 2026-02-17 09:30:50 -05:00
Sebastian 7884d65687 test(feishu): cover post mentions for other users 2026-02-17 08:53:25 -05:00
Sebastian 210bc37971 chore(subagents): add regression coverage and changelog 2026-02-17 08:40:36 -05:00
Muhammed Mukhthar CM 85b5ac8520 Revert: fully roll back #17974 zh-cn UI README 2026-02-17 13:31:38 +00:00
Mariano 0c87dbdcfc
voice-call: harden closed-loop turn loop and transcript routing (#19140)
Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: 14a3edb005
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com>
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com>
Reviewed-by: @mbelinky
2026-02-17 13:02:38 +00:00
Muhammed Mukhthar CM bc4038149c Revert: undo #17974 README change 2026-02-17 12:23:26 +00:00
Nimrod Gutman 5db95cd8d5 fix(extensions): revert openai codex auth plugin (PR #18009) 2026-02-17 10:40:13 +02:00
cpojer 5649e403df
chore: Fix hanging test. 2026-02-17 15:56:51 +09:00
cpojer d0cb8c19b2
chore: wtf. 2026-02-17 13:36:48 +09:00
Sebastian ed11e93cf2 chore(format) 2026-02-16 23:20:16 -05:00
Sebastian ca19745fa2 Revert "channels: migrate extension account listing to factory"
This reverts commit d24340d75b.
2026-02-16 23:17:13 -05:00
Sebastian 65fa529e03 Revert "fix(whatsapp): allow per-message link preview override\n\nWhatsApp messages default to enabling link previews for URLs. This adds\nsupport for overriding this behavior per-message via the \nparameter (e.g. from tool options), consistent with Telegram.\n\nFix: Updated internal WhatsApp Web API layers to pass option\ndown to Baileys ."
This reverts commit 1bef2fc68b.
2026-02-16 22:59:37 -05:00
Sebastian 759c7fc18e revert(voice-call): remove cached inbound greeting 2026-02-16 22:35:28 -05:00
Sebastian 950f36feff revert(voice-call): undo oxfmt formatting pass 2026-02-16 22:35:28 -05:00
Sebastian ffe1ba68b9 revert(voice-call): undo cached greeting note 2026-02-16 22:35:28 -05:00
Sebastian df8f7ff1ab docs(voice-call): document stale call reaper config 2026-02-16 22:26:31 -05:00
cpojer cf6cdc74d0
chore: Fix types in tests 23/N. 2026-02-17 12:24:03 +09:00
Sebastian bfaa03981b test(voice-call): cover stream disconnect auto-end 2026-02-16 22:13:08 -05:00
Sebastian 4aed4eedb7 test(extensions): cast fetch mocks to satisfy tsgo 2026-02-16 21:25:35 -05:00
cpojer 4b8f53979e
chore: Fix type errors from reverts. 2026-02-17 11:22:49 +09:00
Sebastian 0158e41298 Revert "fix: resolve #12770 - update Antigravity default model and trim leading whitespace in BlueBubbles replies"
This reverts commit e179d453c7.
2026-02-16 21:11:53 -05:00
cpojer b3d9ecf4e4
chore: Fix types that were broken due to reverts. 2026-02-17 10:57:31 +09:00
Peter Steinberger afa5533253 fix(mattermost): harden react remove flag parsing 2026-02-17 02:55:46 +01:00
Peter Steinberger 2992639f88 Revert "feat: add Linq channel — real iMessage via API, no Mac required"
This reverts commit d4a142fd8f.
2026-02-17 02:30:55 +01:00
Peter Steinberger a36782e342 Revert "feat(linq): add interactive onboarding adapter"
This reverts commit b91e43714b.
2026-02-17 02:30:55 +01:00
cpojer d3a36cc3b0
chore: Fix remaining extension test types, enable type checking for extension tests. 2026-02-17 10:14:01 +09:00
cpojer a741985574
chore: Fix more extension test types, 2/N. 2026-02-17 10:14:01 +09:00
cpojer 72f00df95a
chore: Fix more extension test type 1/N. 2026-02-17 10:14:01 +09:00
cpojer 0f8d1f175a
chore: Fix type errors in `extensions/twitch` tests. 2026-02-17 10:14:00 +09:00
cpojer 889f221ed1
chore: Fix type errors in `extensions/bluebubbles` tests. 2026-02-17 10:14:00 +09:00
cpojer 90ef2d6bdf
chore: Update formatting. 2026-02-17 09:18:40 +09:00
cpojer 1e13a3933c
chore: Update deps. 2026-02-17 09:14:42 +09:00
Peter Steinberger 94e4631171 refactor(onboarding): simplify zalo allowFrom merge paths 2026-02-16 23:47:57 +00:00
Peter Steinberger d89d951c3e refactor(onboarding): reuse allowFrom merge helper in matrix 2026-02-16 23:47:57 +00:00
Peter Steinberger 7632e60d70 refactor(onboarding): reuse allowFrom merge helper in extensions 2026-02-16 23:47:57 +00:00
Peter Steinberger 12a947223b fix(ci): restore main checks after bulk merges 2026-02-16 23:47:27 +00:00
Peter Steinberger eaa2f7a7bf fix(ci): restore main lint/typecheck after direct merges 2026-02-16 23:26:11 +00:00
gaowanqi08141999 86517b8e30 feat(feishu): add bitable create app and create field tools 2026-02-17 00:02:00 +01:00
度人自度 531f735c8a Update extensions/openclaw-zh-cn-ui/README.md
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
2026-02-17 00:01:46 +01:00
度人自度 aeadeffa15 Update README.md 2026-02-17 00:01:46 +01:00
度人自度 967efc8e1b Update README.md 2026-02-17 00:01:46 +01:00
度人自度 c88a90c7c3 Create README.md 2026-02-17 00:01:46 +01:00
Ralph 990cf2d226 fix(extensions): address greptile review comments for openai-codex-auth
- Change provider ID from 'openai-codex' to 'openai-codex-import' to avoid
  conflict with core's built-in openai-codex provider
- Update model prefix from 'openai/' to 'openai-codex/' to match core's
  namespace convention and avoid collision with standard OpenAI API provider
- Use correct Codex models (gpt-5.3-codex, gpt-5.2-codex) instead of generic
  OpenAI models (gpt-4.1, o1, o3)
- Respect CODEX_HOME env var when resolving auth file path, matching core
  behavior in src/agents/cli-credentials.ts
- Validate refresh token presence and throw clear error instead of using
  empty string which causes silent failures
2026-02-17 00:01:00 +01:00
Ralph 24569d093a style: fix import ordering in openai-codex-auth 2026-02-17 00:01:00 +01:00
Ralph 3ac422fe2e feat(extensions): add OpenAI Codex CLI auth provider
Adds a new authentication provider that reads OAuth tokens from the
OpenAI Codex CLI (~/.codex/auth.json) to authenticate with OpenAI's API.

This allows ChatGPT Plus/Pro subscribers to use OpenAI models in OpenClaw
without needing a separate API key - just authenticate with 'codex login'
first, then enable this plugin.

Features:
- Reads existing Codex CLI credentials from ~/.codex/auth.json
- Supports all Codex-available models (gpt-4.1, gpt-4o, o1, o3, etc.)
- Automatic token expiry detection from JWT
- Clear setup instructions and troubleshooting docs

Usage:
  openclaw plugins enable openai-codex-auth
  openclaw models auth login --provider openai-codex --set-default
2026-02-17 00:01:00 +01:00
Peter Steinberger 2fa9ddebdb fix(mattermost): add actions config typing 2026-02-16 23:00:32 +00:00
popomore eed806ce58 f 2026-02-16 23:59:41 +01:00
popomore a42ccb9c1d f 2026-02-16 23:59:41 +01:00
popomore c315246971 fix(feishu): fix mention detection for post messages with embedded docs
Parse "at" elements from post content when message.mentions is empty to
detect bot mentions in rich text messages containing documents.
2026-02-16 23:59:41 +01:00
Rain 1bef2fc68b fix(whatsapp): allow per-message link preview override\n\nWhatsApp messages default to enabling link previews for URLs. This adds\nsupport for overriding this behavior per-message via the \nparameter (e.g. from tool options), consistent with Telegram.\n\nFix: Updated internal WhatsApp Web API layers to pass option\ndown to Baileys . 2026-02-16 23:57:09 +01:00
Echo 82861968c2 fix(mattermost): address review feedback on reactions PR 2026-02-16 23:55:40 +01:00
Echo 2a2372cd6c feat(mattermost): add emoji reactions support 2026-02-16 23:55:40 +01:00
yinghaosang d24340d75b channels: migrate extension account listing to factory 2026-02-16 23:53:19 +01:00
George McCain b91e43714b feat(linq): add interactive onboarding adapter
Walk users through Linq setup via `openclaw channels add` wizard
instead of requiring manual JSON config editing. Prompts for API
token, phone number, and webhook config with sensible defaults.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-16 23:52:56 +01:00
George McCain d4a142fd8f feat: add Linq channel — real iMessage via API, no Mac required
Adds a complete Linq iMessage channel adapter that replaces the existing
iMessage channel's Mac Mini + dedicated Apple ID + SSH wrapper + Full Disk
Access setup with a single API key and phone number.

Core implementation (src/linq/):
- types.ts: Linq webhook event and message types
- accounts.ts: Multi-account resolution from config (env/file/inline token)
- send.ts: REST outbound via Linq Blue V3 API (messages, typing, reactions)
- probe.ts: Health check via GET /v3/phonenumbers
- monitor.ts: Webhook HTTP server with HMAC-SHA256 signature verification,
  replay protection, inbound debouncing, and full dispatch pipeline integration

Extension plugin (extensions/linq/):
- ChannelPlugin implementation with config, security, setup, outbound,
  gateway, and status adapters
- Supports direct and group chats, reactions, and media

Wiring:
- Channel registry, dock, config schema, plugin-sdk exports, and plugin
  runtime all updated to include the new linq channel

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-16 23:52:56 +01:00
JayMishra-github 95024d1671 fix: log error on auto-end failure instead of swallowing
Address review feedback: log a warning when endCall fails on stream
disconnect instead of silently discarding the error.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-16 23:52:51 +01:00
JayMishra-github 4c0a741308 fix: apply oxfmt 0.32.0 formatting (match CI version)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-16 23:52:51 +01:00
JayMishra-github d56c04a3b5 fix: apply oxfmt formatting
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-16 23:52:51 +01:00
JayMishra-github 3eec5e54b1 fix(voice-call): auto-end call when media stream disconnects
When a Twilio media stream disconnects (e.g., caller hangs up or
network drops), the call object was left in an active state indefinitely.
This caused "stuck calls" that consumed resources and blocked new calls.

Now calls are automatically ended when their media stream closes,
matching the expected lifecycle behavior.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-16 23:52:51 +01:00
JayMishra-github a5c94b8e7b fix: log error on reaper endCall failure instead of swallowing
Address review feedback: log a warning when the stale call reaper
fails to end a call instead of silently discarding the error.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-16 23:52:48 +01:00
JayMishra-github 390c503b56 feat(voice-call): add configurable stale call reaper
Adds a periodic reaper that automatically ends calls older than a
configurable threshold. This catches calls stuck in unexpected states,
such as notify-mode calls that never receive a terminal webhook from
the provider.

New config option:
  staleCallReaperSeconds: number (default: 0 = disabled)

When enabled, checks every 30 seconds and ends calls exceeding the
max age. Recommended value: 120-300 for production deployments.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-16 23:52:48 +01:00
JayMishra-github 0764999e2c fix: document intentional non-persistence of initialMessage deletion
Address review feedback: the in-memory deletion of initialMessage is
not persisted to disk, which is acceptable because a gateway restart
would also sever the media stream, making replay impossible.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-16 23:52:36 +01:00
JayMishra-github 0291ce30a8 fix: apply oxfmt 0.32.0 formatting (match CI version)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-16 23:52:36 +01:00
JayMishra-github dd319d05d8 fix: apply oxfmt formatting
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-16 23:52:36 +01:00
JayMishra-github 2c6db57554 feat(voice-call): pre-cache inbound greeting for instant playback
Pre-generates TTS audio for the configured inboundGreeting at startup
and serves it instantly when an inbound call connects, eliminating the
500ms+ TTS synthesis delay on the first ring.

Changes:
- twilio.ts: Add cachedGreetingAudio storage with getter/setter
- runtime.ts: Pre-synthesize greeting TTS after provider initialization
- webhook.ts: Play cached audio directly via media stream on inbound
  connect, falling back to the original TTS path for outbound calls
  or when no cached audio is available

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-16 23:52:36 +01:00
Jean Carlos Nunez e179d453c7 fix: resolve #12770 - update Antigravity default model and trim leading whitespace in BlueBubbles replies 2026-02-16 23:50:14 +01:00
Latitude Bot 3238bd78d9 fix(discord): normalize bare numeric IDs in outbound target resolution
Bare numeric Discord IDs (e.g. '1470130713209602050') in cron
delivery.to caused 'Ambiguous Discord recipient' errors and silent
delivery failures.

Adds normalizeDiscordOutboundTarget() to the existing Discord
normalize module (channels/plugins/normalize/discord.ts) alongside
normalizeDiscordMessagingTarget. Defaults bare numeric IDs to
'channel:<id>', matching existing behavior.

Both the Discord extension plugin and standalone outbound adapter
use the shared helper via a one-liner resolveTarget.

Fixes #14753. Related: #13927
2026-02-16 13:25:58 -06:00
Mariano 130e59a9c0
iOS: port onboarding + QR pairing flow stability (#18162)
Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: a87eadea19
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com>
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com>
Reviewed-by: @mbelinky
2026-02-16 16:22:51 +00:00
Peter Steinberger 1d37389490 test: annotate harness mocks to avoid TS2742 in CI 2026-02-16 15:19:11 +00:00
Peter Steinberger 544ffbcf7b refactor(extensions): dedupe connector helper usage 2026-02-16 14:59:30 +00:00
Peter Steinberger 39fa81dc96 chore: bump version to 2026.2.16 2026-02-16 06:08:47 +01:00
Peter Steinberger 702b94fe8f style(line): format files to unblock ci check 2026-02-16 03:39:41 +00:00
Vignesh Natarajan c7bc7249c3 test (security/line): cover missing webhook auth startup paths 2026-02-15 19:25:33 -08:00
Vignesh Natarajan beb77229c0 fix (security/line): fail closed when webhook auth is missing 2026-02-15 19:25:33 -08:00
Shadow a61c2dc4bd
Discord: add component v2 UI tool support (#17419) 2026-02-15 21:19:25 -06:00
Peter Steinberger 59c0b2bb37 refactor(auth): reuse oauth auth result helper 2026-02-15 19:37:40 +00:00
Peter Steinberger 342e9cac03 refactor(status): reuse plugin-sdk status helpers 2026-02-15 19:37:40 +00:00
Peter Steinberger bdfa2b490b refactor(media): reuse buildAgentMediaPayload 2026-02-15 19:37:40 +00:00
Peter Steinberger 00e63da336 refactor(webhooks): reuse plugin-sdk webhook path helpers 2026-02-15 19:37:40 +00:00
Peter Steinberger 88548784ce fix(bluebubbles): use Buffer for multipart body 2026-02-15 19:25:11 +00:00
Peter Steinberger 719280d737 refactor(bluebubbles): share multipart helpers 2026-02-15 19:24:03 +00:00
Peter Steinberger de103773c7 refactor(tlon): share urbit poke/scry ops 2026-02-15 19:21:42 +00:00
Peter Steinberger 0653e8d2ec refactor(matrix): dedupe group config resolution 2026-02-15 19:21:37 +00:00
Peter Steinberger 699136f89a refactor(msteams): share credential prompt 2026-02-15 19:21:31 +00:00
Shadow c6b3736fe7 fix: dedupe probe/token base types (#16986) (thanks @iyoda) 2026-02-15 11:36:54 -06:00
Peter Steinberger 379b445582 chore: bump version to 2026.2.15 2026-02-15 04:50:31 +01:00
Peter Steinberger fef86e475b refactor: dedupe shared helpers across ui/gateway/extensions 2026-02-15 03:34:14 +00:00
Vignesh Natarajan ed7d83bcfc fix (memory/lancedb): require explicit opt-in for auto-capture 2026-02-14 18:20:48 -08:00
Vignesh Natarajan 61725fb37e fix (memory/lancedb): harden memory recall and auto-capture 2026-02-14 18:19:56 -08:00
Peter Steinberger 1ff15e60d3 chore(release): bump versions to 2026.2.14 2026-02-15 02:53:35 +01:00
Peter Steinberger 451deb066f refactor(plugin-sdk): reuse dedupe cache 2026-02-15 01:46:52 +00:00
Peter Steinberger 65aac6494a refactor(feishu): share download buffer reader 2026-02-15 01:46:52 +00:00
Peter Steinberger b78bfd5213 fix(test): mock whatsapp outbound target resolver 2026-02-15 01:26:25 +00:00
Peter Steinberger 811e0c5797 refactor(bluebubbles): share send helpers 2026-02-15 01:15:43 +00:00
Peter Steinberger 5e205030ed refactor(telegram): share outbound param parsing 2026-02-15 01:15:43 +00:00
Peter Steinberger 461ead8ceb refactor(imessage): share target parsing helpers 2026-02-15 01:15:43 +00:00
Peter Steinberger f835eb32f3 refactor(slack): share message action helpers 2026-02-15 01:15:43 +00:00
Peter Steinberger eccd4d8c39 refactor(whatsapp): share target resolver 2026-02-15 01:15:43 +00:00
Peter Steinberger 56bc9b5058 refactor(zalo): share outbound chunker 2026-02-15 01:15:43 +00:00
Peter Steinberger 0d0ebd0e20 refactor(onboarding): share promptAccountId helper 2026-02-15 01:15:43 +00:00
Peter Steinberger be57344b99 refactor(test): dedupe googlechat webhook routing setup 2026-02-15 00:26:46 +00:00
Peter Steinberger 54060104a7 refactor(test): dedupe gemini oauth fixture setup 2026-02-15 00:26:46 +00:00
Peter Steinberger c872a43146 refactor(msteams): share Graph helpers 2026-02-15 00:26:46 +00:00
Peter Steinberger a8e4ab3ebe refactor(bluebubbles): dedupe webhook normalization 2026-02-15 00:26:46 +00:00
Peter Steinberger 52bfe5060c refactor: share file lock via plugin-sdk 2026-02-15 00:26:46 +00:00
Vignesh Natarajan 8cb0373bc1 Memory-lancedb: configurable capture limit (#16624) (thanks @ciberponk) 2026-02-14 16:03:40 -08:00
fan 3e00460cdc feat(memory-lancedb): make auto-capture max length configurable 2026-02-14 16:03:40 -08:00
Peter Steinberger 7418400c47 perf(test): speed up nostr profile fuzz 2026-02-14 20:12:26 +00:00
Peter Steinberger 5e496a1519 perf(test): mock lobster subprocess 2026-02-14 20:12:26 +00:00
Peter Steinberger 185792b6cd chore(deps): update dependencies 2026-02-14 21:10:20 +01:00
Peter Steinberger 743f4b2849 fix(security): harden BlueBubbles webhook auth behind proxies 2026-02-14 19:47:51 +01:00
Peter Steinberger d0f64c955e refactor(tlon): centralize Urbit request helpers 2026-02-14 19:22:29 +01:00
Christian Klotz df7464ddf6
fix(bluebubbles): include sender identity in group chat envelopes (#16326)
* fix(bluebubbles): include sender identity in group chat envelopes

Use formatInboundEnvelope (matching iMessage/Signal pattern) so group
messages show the group label in the envelope header and include the
sender name in the message body. ConversationLabel now resolves to the
group name for groups instead of being undefined.

Fixes #16210

Co-authored-by: zerone0x <hi@trine.dev>

* fix(bluebubbles): use finalizeInboundContext and set BodyForAgent to raw text

Wrap ctxPayload with finalizeInboundContext (matching iMessage/Signal/
every other channel) so field normalization, ChatType, ConversationLabel
fallback, and MediaType alignment are applied consistently.

Change BodyForAgent from the envelope-formatted body to rawBody so the
agent prompt receives clean message text instead of the [BlueBubbles ...]
envelope wrapper.

Co-authored-by: zerone0x <hi@trine.dev>

* docs: add changelog entry for BlueBubbles group sender fix (#16326)

* fix(bluebubbles): include id in fromLabel matching formatInboundFromLabel

Align fromLabel output with the shared formatInboundFromLabel pattern:
groups get 'GroupName id:peerId', DMs get 'Name id:senderId' when the
name differs from the id. Addresses PR review feedback.

Co-authored-by: zerone0x <hi@trine.dev>

---------

Co-authored-by: zerone0x <hi@trine.dev>
2026-02-14 18:17:26 +00:00
Peter Steinberger f47584fec8 refactor(voice-call): centralize Telnyx webhook verification 2026-02-14 19:02:10 +01:00
Mariano 71f357d949
bluebubbles: harden local media path handling against LFI (#16322)
* bluebubbles: harden local media path handling

* bluebubbles: remove racy post-open symlink lstat

* fix: bluebubbles mediaLocalRoots docs + typing fix (#16322) (thanks @mbelinky)
2026-02-14 17:43:44 +00:00
Peter Steinberger bfa7d21e99 fix(security): harden tlon Urbit requests against SSRF 2026-02-14 18:42:10 +01:00
Robby 8e5689a84d
feat(telegram): add sendPoll support (#16193) (#16209)
Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: b58492cfed
Co-authored-by: robbyczgw-cla <239660374+robbyczgw-cla@users.noreply.github.com>
Co-authored-by: steipete <58493+steipete@users.noreply.github.com>
Reviewed-by: @steipete
2026-02-14 18:34:30 +01:00
Peter Steinberger 29b587e73c fix(voice-call): fail closed when Telnyx webhook public key missing 2026-02-14 18:17:20 +01:00
Peter Steinberger ff11d8793b fix(voice-call): require Twilio signature in ngrok loopback mode 2026-02-14 18:14:59 +01:00
Peter Steinberger 188c4cd076 fix(security): reject ambiguous webhook target matches 2026-02-14 17:28:28 +01:00
Peter Steinberger 61d59a8028 fix(googlechat): reject ambiguous webhook routing 2026-02-14 17:11:55 +01:00
Peter Steinberger 3e0e78f82a fix(nostr): guard profile mutations 2026-02-14 16:51:04 +01:00
Peter Steinberger 5b4121d601
fix: harden Feishu media URL fetching (#16285) (thanks @mbelinky)
Security fix for Feishu extension media fetching.
2026-02-14 16:42:35 +01:00
Peter Steinberger c8424bf29a
fix(googlechat): deprecate users/<email> allowlists (#16243) 2026-02-14 15:31:26 +01:00
Tanwa Arpornthip c76288bdf1
fix(slack): download all files in multi-image messages (#15447)
* fix(slack): download all files in multi-image messages

resolveSlackMedia() previously returned after downloading the first
file, causing multi-image Slack messages to lose all but the first
attachment. This changes the function to collect all successfully
downloaded files into an array, matching the pattern already used by
Telegram, Line, Discord, and iMessage adapters.

The prepare handler now populates MediaPaths, MediaUrls, and
MediaTypes arrays so downstream media processing (vision, sandbox
staging, media notes) works correctly with multiple attachments.

Fixes #11892, #7536

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(slack): preserve MediaTypes index alignment with MediaPaths/MediaUrls

The filter(Boolean) on MediaTypes removed entries with undefined contentType,
shrinking the array and breaking index correlation with MediaPaths and MediaUrls.
Downstream code (media-note.ts, attachments.ts) requires these arrays to have
equal lengths for correct per-attachment MIME type lookup. Replace filter(Boolean)
with a nullish coalescing fallback to "application/octet-stream".

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(slack): align MediaType fallback and tests (#15447) (thanks @CommanderCrowCode)

* fix: unblock plugin-sdk account-id typing (#15447)

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-02-14 14:16:02 +01:00
Peter Steinberger ef70a55b7a
refactor(reply): clarify explicit reply tags in off mode (#16189)
* refactor(reply): clarify explicit reply tags in off mode

* fix(plugin-sdk): alias account-id subpath for extensions
2026-02-14 14:15:37 +01:00
Peter Steinberger 6543ce717c perf(test): avoid plugin-sdk barrel imports 2026-02-14 12:42:19 +00:00
Artale 3a330e681b
fix(feishu): remove typing indicator on NO_REPLY cleanup (openclaw#15508) thanks @arosstale
Verified:
- pnpm build
- pnpm check
- pnpm test

Co-authored-by: arosstale <117890364+arosstale@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
2026-02-14 05:24:27 -06:00
Pejman Pour-Moezzi c17a109daa fix: align extension plugin and docs with new replyToMode default
Update the Telegram extension channel plugin fallback and documentation
to reflect the new "off" default, as flagged by Greptile review.
2026-02-13 23:31:17 -08:00
Peter Steinberger db72184de6 perf(test): speed up Matrix send tests 2026-02-14 05:25:40 +00:00
Tyler Yust 45e12d2388
bluebubbles: gracefully handle disabled private API with action/tool filtering and fallbacks (#16002)
Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: 243cc0cc9a
Co-authored-by: tyler6204 <243?+tyler6204@users.noreply.github.com>
Co-authored-by: tyler6204 <64381258+tyler6204@users.noreply.github.com>
Reviewed-by: @tyler6204
2026-02-13 21:15:56 -08:00
Peter Steinberger e6d5b5fb11 perf(test): remove slow port inspection and reconnect sleeps 2026-02-14 04:57:28 +00:00
Peter Steinberger 89574f30cb refactor(voice-call): split manager into facade and context slices 2026-02-14 03:39:33 +01:00
Peter Steinberger edbd86074f refactor(mattermost): extract websocket monitor and reconnect policies 2026-02-14 03:39:19 +01:00
Peter Steinberger 6ebf503fa8 refactor(media): centralize voice compatibility policy 2026-02-14 03:17:40 +01:00
Marcus Castro 2b154e0458
fix(mattermost): add WebSocket reconnection with exponential backoff (#14962)
* fix(mattermost): add WebSocket reconnection with exponential backoff

Fixes #13980

The Mattermost WebSocket monitor had no error handling around the
reconnection loop. When connectOnce() threw (e.g. 'fetch failed' from
network issues), the error propagated through the while loop, causing
the gateway to log 'channel exited' and never restart.

Extract runWithReconnect() utility that:
- Catches thrown errors from connectFn and retries
- Uses exponential backoff (2s→4s→8s→...→60s cap)
- Resets backoff after successful connections
- Stops cleanly on abort signal
- Reports errors and reconnect delays via callbacks

* fix(mattermost): make backoff sleep abort-aware and reject on WS connect failure

* fix(mattermost): clean up abort listener on normal timeout to prevent leak

* fix(mattermost): skip error reporting when abort causes connection rejection

* fix(mattermost): use try/finally for abort listener cleanup in connectOnce

* fix: force-close WebSocket on error to prevent reconnect hang

* fix: use ws.terminate() on abort for reliable teardown during CONNECTING state

* fix(mattermost): use initial retry delay for reconnect backoff

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-02-14 03:10:22 +01:00
David Cantú Martínez 9443c638f4
voice-call: hang up rejected inbounds, idempotency and logging (#15892)
Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: 36f826ea23
Co-authored-by: dcantu96 <32658690+dcantu96@users.noreply.github.com>
Co-authored-by: steipete <58493+steipete@users.noreply.github.com>
Reviewed-by: @steipete
2026-02-14 03:09:31 +01:00
Azade 🐐 1b95220a99
fix(media): recognize MP3 and M4A as voice-compatible audio (#15438)
* fix(media): recognize MP3 and M4A as voice-compatible audio

Telegram sendVoice supports OGG/Opus, MP3, and M4A, but
isVoiceCompatibleAudio only recognized OGG/Opus formats.

- Add MP3 and M4A extensions and MIME types
- Use explicit MIME set instead of substring matching
- Handle MIME parameters (e.g. 'audio/ogg; codecs=opus')
- Add test coverage for all supported and unsupported formats

* fix: narrow MIME allowlist per review feedback

Remove audio/mp4 and audio/aac from voice MIME types — too broad.
Keep only M4A-specific types (audio/x-m4a, audio/m4a).
Add audio/mp4 and audio/aac as negative test cases.

* fix: align voice compatibility and channel coverage (#15438) (thanks @azade-c)

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-02-14 03:03:02 +01:00
Peter Steinberger 51296e770c feat(slack): land thread-ownership from @DarlingtonDeveloper (#15775)
Land PR #15775 by @DarlingtonDeveloper:
- add thread-ownership plugin and Slack message_sending hook wiring
- include regression tests and changelog update

Co-authored-by: Mike <108890394+DarlingtonDeveloper@users.noreply.github.com>
2026-02-13 23:37:05 +00:00
Peter Steinberger 93dd51bce0 perf(matrix): lazy-load music-metadata parsing 2026-02-13 21:23:50 +00:00
Peter Steinberger 2b685b08c2 fix: harden matrix multi-account routing (#7286) (thanks @emonty) 2026-02-13 20:39:58 +01:00
Monty Taylor a76ac1344e fix: resolveAllowFrom uses cfg+accountId params, not account 2026-02-13 20:39:58 +01:00
Monty Taylor 1a17466a60 fix: use account-aware config paths in resolveDmPolicy and resolveAllowFrom 2026-02-13 20:39:58 +01:00
Monty Taylor 3985ef7b37 fix: merge top-level config into per-account config so inherited settings apply 2026-02-13 20:39:58 +01:00
Monty Taylor ed5a8dff8a chore: fix CHANGELOG.md formatting 2026-02-13 20:39:58 +01:00
Monty Taylor da00f6cf8e fix: deep-merge nested config, prefer default account in send fallback, simplify credential filenames 2026-02-13 20:39:58 +01:00
Monty Taylor 1a72902991 refactor: read accounts from cfg.channels.matrix.accounts directly for clarity 2026-02-13 20:39:58 +01:00
Monty Taylor bf4e348440 fix: de-duplicate normalized account IDs and add case-insensitive config lookup to send/client 2026-02-13 20:39:58 +01:00
Monty Taylor a6dd50fede fix: normalize account config keys for case-insensitive matching 2026-02-13 20:39:58 +01:00
Monty Taylor c89b8d99fc fix: normalize accountId in active-client and send/client for consistent keying 2026-02-13 20:39:58 +01:00
Monty Taylor caf5d2dd7c feat(matrix): Add multi-account support to Matrix channel
The Matrix channel previously hardcoded `listMatrixAccountIds` to always
return only `DEFAULT_ACCOUNT_ID`, ignoring any accounts configured in
`channels.matrix.accounts`. This prevented running multiple Matrix bot
accounts simultaneously.

Changes:
- Update `listMatrixAccountIds` to read from `channels.matrix.accounts`
  config, falling back to `DEFAULT_ACCOUNT_ID` for legacy single-account
  configurations
- Add `resolveMatrixConfigForAccount` to resolve config for a specific
  account ID, merging account-specific values with top-level defaults
- Update `resolveMatrixAccount` to use account-specific config when
  available
- The multi-account config structure (channels.matrix.accounts) was not
  defined in the MatrixConfig type, causing TypeScript to not recognize
  the field. Added the accounts field to properly type the multi-account
  configuration.
- Add stopSharedClientForAccount() to stop only the specific account's
  client instead of all clients when an account shuts down
- Wrap dynamic import in try/finally to prevent startup mutex deadlock
  if the import fails
- Pass accountId to resolveSharedMatrixClient(), resolveMatrixAuth(),
  and createMatrixClient() to ensure the correct account's credentials
  are used for outbound messages
- Add accountId parameter to resolveMediaMaxBytes to check account-specific
  config before falling back to top-level config
- Maintain backward compatibility with existing single-account setups

This follows the same pattern already used by the WhatsApp channel for
multi-account support.

Fixes #3165
Fixes #3085

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-13 20:39:58 +01:00
Peter Steinberger f02247b6c5 fix(ci): fix discord proxy websocket binding and bluebubbles timeout status 2026-02-13 19:35:55 +00:00
Mariano 7f0489e473
Security/Browser: constrain trace and download output paths to OpenClaw temp roots (#15652)
* Browser/Security: constrain trace and download output paths to temp roots

* Changelog: remove advisory ID from pre-public security note

* Browser/Security: constrain trace and download output paths to temp roots

* Changelog: remove advisory ID from pre-public security note

* test(bluebubbles): align timeout status expectation to 408

* test(discord): remove unused race-condition counter in threading test

* test(bluebubbles): align timeout status expectation to 408
2026-02-13 19:24:33 +00:00
Peter Steinberger a1df0939db refactor(bluebubbles): split monitor parsing and processing modules 2026-02-13 19:08:37 +00:00
Peter Steinberger a750a195e5 refactor(extensions): extract feishu dedup and mattermost onchar helpers 2026-02-13 19:08:37 +00:00
Peter Steinberger 3cbcba10cf fix(security): enforce bounded webhook body handling 2026-02-13 19:14:54 +01:00
Peter Steinberger 201ac2b72a perf: replace proper-lockfile with lightweight file locks 2026-02-13 17:57:30 +00:00
Marcus Castro 3d921b6157
fix(slack): apply limit parameter to emoji-list action (#13421)
Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: 67e9b64858
Co-authored-by: mcaxtr <7562095+mcaxtr@users.noreply.github.com>
Co-authored-by: steipete <58493+steipete@users.noreply.github.com>
Reviewed-by: @steipete
2026-02-13 18:20:41 +01:00
David Rudduck 5643a93479
fix(security): default standalone servers to loopback bind (#13184)
* fix(security): default standalone servers to loopback bind (#4)

Change canvas host and telegram webhook default bind from 0.0.0.0
(all interfaces) to 127.0.0.1 (loopback only) to prevent unintended
network exposure when no explicit host is configured.

* fix: restore telegram webhook host override while keeping loopback defaults (openclaw#13184) thanks @davidrudduck

* style: format telegram docs after rebase (openclaw#13184) thanks @davidrudduck

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-02-13 16:39:56 +01:00
Peter Steinberger a5faea614b fix(msteams): detect windows local paths for uploads 2026-02-13 15:07:31 +00:00
Peter Steinberger 9131b22a28 test: migrate suites to e2e coverage layout 2026-02-13 14:28:22 +00:00
Peter Steinberger 106d605519 fix: harden msteams mentions and fallback links (#15436) (thanks @hyojin) 2026-02-13 15:10:57 +01:00
Hyojin Kwak 604dc700a6 MSTeams: fix regex injection in mention name formatting
Escape regex metacharacters in display names before constructing RegExp
to prevent runtime errors or unintended matches when names contain special
characters like (, ), ., +, ?, [, etc.

Add test coverage for names with regex metacharacters.
2026-02-13 15:10:57 +01:00
Hyojin Kwak 7c6d6ce06f MS Teams: add user mention support
- Add mention parsing and validation logic
- Handle mention entities with proper whitespace
- Validate mention IDs to prevent false positives from code snippets
- Use fake placeholders in tests for privacy
2026-02-13 15:10:57 +01:00
Peter Steinberger 67251e97bd
fix(ci): sync extension versions to root release (#15199) 2026-02-13 05:54:03 +01:00
Peter Steinberger daf13dbb06 fix: enforce feishu dm policy + pairing flow (#14876) (thanks @coygeek) 2026-02-13 05:48:22 +01:00
Coy Geek f05553413d fix(aa-01): apply security fix
Generated by staged fix workflow.
2026-02-13 05:48:22 +01:00
Marcus Castro 39ee708df6
fix(outbound): return error instead of silently redirecting to allowList[0] (#13578) 2026-02-13 05:20:03 +01:00
LeftX 65be9ccf63
feat(feishu): add streaming card support via Card Kit API (openclaw#10379) thanks @xzq-xu
Verified:
- pnpm build
- pnpm check
- pnpm test

Co-authored-by: xzq-xu <53989315+xzq-xu@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
2026-02-12 20:19:27 -06:00
cpojer 7b34b46363
chore: Update deps. 2026-02-13 09:43:41 +09:00
Peter Steinberger b50640c600 fix(irc): type socket error param 2026-02-12 22:58:42 +01:00
Peter Steinberger 722c010b95 chore(deps): update dependencies 2026-02-12 22:58:42 +01:00
Skyler Miao cb0350230c
feat(minimax): update models from M2.1 to M2.5 (#14865)
Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: 1d58bc5760
Co-authored-by: adao-max <153898832+adao-max@users.noreply.github.com>
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com>
Reviewed-by: @gumadeiras
2026-02-12 16:48:46 -05:00
0xRain af172742a3
fix(feishu): use msg_type 'media' for video/audio messages (#14648)
Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: e8044cb208
Co-authored-by: 0xRaini <190923101+0xRaini@users.noreply.github.com>
Co-authored-by: steipete <58493+steipete@users.noreply.github.com>
Reviewed-by: @steipete
2026-02-12 19:05:09 +01:00
Peter Steinberger 7695b4842b chore: bump version to 2026.2.12 2026-02-12 18:20:46 +01:00
Sebastian d31caa81ef fix(runtime): guard cleanup and preserve skipped cron jobs 2026-02-12 09:28:47 -05:00
mcwigglesmcgee f8cad44cd6
fix(voice-call): pass Twilio stream auth token via <Parameter> instead of query string (#14029)
Twilio strips query parameters from WebSocket URLs in <Stream> TwiML,
so the auth token set via ?token=xxx never arrives on the WebSocket
connection. This causes stream rejection when token validation is enabled.

Fix: pass the token as a <Parameter> element inside <Stream>, which
Twilio delivers in the start message's customParameters field. The
media stream handler now extracts the token from customParameters,
falling back to query string for backwards compatibility.

Co-authored-by: McWiggles <mcwigglesmcgee@users.noreply.github.com>
2026-02-12 07:55:00 -06:00
Coy Geek f836c385ff
fix: BlueBubbles webhook auth bypass via loopback proxy trust (#13787)
* fix(an-08): apply security fix

Generated by staged fix workflow.

* fix(an-08): apply security fix

Generated by staged fix workflow.

* fix(an-08): stabilize bluebubbles auth fixture for security patch

Restore the default test password in createMockAccount and add a
fallback password query in createMockRequest when auth is omitted.

This keeps the AN-08 loopback-auth regression tests strict while
preserving existing monitor behavior tests that assume authenticated
webhook fixtures.
2026-02-12 07:12:17 -06:00
Tak Hoffman 7ca8d936d5 fix: remove workspace dev dependency in feishu plugin (openclaw#14423) thanks @jackcooper2015
Co-authored-by: jack-cooper <10961327+jackcooper2015@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
2026-02-11 22:53:40 -06:00
Tak Hoffman cf6e8e18d2 fix: preserve top-level feishu doc block order (openclaw#13994) thanks @Cynosure159
Co-authored-by: Cynosure159 <29699738+Cynosure159@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
2026-02-11 22:53:40 -06:00
Tak Hoffman a028c0512c fix: use resolved feishu account in status probe (openclaw#11233) thanks @onevcat
Co-authored-by: Wei Wang <1019875+onevcat@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
2026-02-11 22:53:40 -06:00
Tak Hoffman 3d771afe79 fix: tighten feishu mention trigger matching (openclaw#11088) thanks @openperf
Co-authored-by: 王春跃 <80630709+openperf@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
2026-02-11 22:53:40 -06:00
Tak Hoffman 8fdb2e64a7 fix: buffer upload path for feishu SDK (openclaw#10345) thanks @youngerstyle
Co-authored-by: zhiyi <7426274+youngerstyle@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
2026-02-11 22:53:40 -06:00
cpojer 9df89ceda2
chore: Update deps. 2026-02-12 09:15:12 +09:00
Sebastian a1a61f35df chore(irc): sync plugin version to 2026.2.10 2026-02-11 08:38:33 -05:00
Peter Steinberger 1872d0c592 chore: bump version to 2026.2.10 2026-02-11 11:27:23 +01:00
the sun gif man aade133978
🤖 memory-lancedb: avoid plugin-sdk enum helper in local TypeBox schema (#13897) 2026-02-10 21:28:32 -08:00
Vignesh fa906b26ad
feat: IRC — add first-class channel support
Adds IRC as a first-class channel with core config surfaces (schema/hints/dock), plugin auto-enable detection, routing/policy alignment, and docs/tests.

Co-authored-by: Vignesh <vigneshnatarajan92@gmail.com>
2026-02-10 17:33:57 -06:00
williamtwomey 5fab11198d
Fix matrix media attachments (#12967) thanks @williamtwomey
Co-authored-by: Gustavo Madeira Santana @gumadeiras
2026-02-10 13:18:47 -05:00
Peter Steinberger 53273b490b fix(auto-reply): prevent sender spoofing in group prompts 2026-02-10 00:44:38 -06:00
quotentiroler cc87c0ed7c Update contributing, deduplicate more functions 2026-02-09 19:21:33 -08:00
cpojer 49fb8f74e4
chore: Fix types after ChatType changes. 2026-02-10 09:20:39 +09:00
Yifeng Wang 5c2cb6c591
feat(feishu): sync community contributions from clawdbot-feishu (#12662)
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-10 09:19:44 +09:00
peetzweg/ 49c60e9065
feat(matrix): add thread session isolation (#8241)
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-10 09:16:40 +09:00
cpojer fa21050af0
chore: Update deps. 2026-02-10 08:52:07 +09:00
Seb Slight ec55583bb7
fix: align extension tests and fetch typing for gate stability (#12816) 2026-02-09 11:12:07 -08:00
Peter Steinberger 33c75cb6bf chore(extensions): mark bundled packages private 2026-02-09 12:59:06 -06:00
max 40b11db80e
TypeScript: add extensions to tsconfig and fix type errors (#12781)
* TypeScript: add extensions to tsconfig and fix type errors

- Add extensions/**/* to tsconfig.json includes
- Export ProviderAuthResult, AnyAgentTool from plugin-sdk
- Fix optional chaining for messageActions across channels
- Add missing type imports (MSTeamsConfig, GroupPolicy, etc.)
- Add type annotations for provider auth handlers
- Fix undici/fetch type compatibility in zalo proxy
- Correct ChannelAccountSnapshot property usage
- Add type casts for tool registrations
- Extract usage view styles and types to separate files

* TypeScript: fix optional debug calls and handleAction guards
2026-02-09 10:05:38 -08:00
Peter Steinberger fb8c653f53 chore(release): 2026.2.9 2026-02-09 11:19:07 -06:00
max f0924d3c4e
refactor: consolidate PNG encoder and safeParseJson utilities (#12457)
- Create shared PNG encoder module (src/media/png-encode.ts)

- Refactor qr-image.ts and live-image-probe.ts to use shared encoder

- Add safeParseJson to utils.ts and plugin-sdk exports

- Update msteams and pairing-store to use centralized safeParseJson
2026-02-09 00:21:54 -08:00
max ec910a235e
refactor: consolidate duplicate utility functions (#12439)
* refactor: consolidate duplicate utility functions

- Add escapeRegExp to src/utils.ts and remove 10 local duplicates
- Rename bash-tools clampNumber to clampWithDefault (different signature)
- Centralize formatError calls to use formatErrorMessage from infra/errors.ts
- Re-export formatErrorMessage from cli/cli-utils.ts to preserve API

* refactor: consolidate remaining escapeRegExp duplicates

* refactor: consolidate sleep, stripAnsi, and clamp duplicates
2026-02-08 23:59:43 -08:00
cpojer 3573f26d40
chore: Update deps. 2026-02-09 09:58:58 +09:00
max 223eee0a20
refactor: unify peer kind to ChatType, rename dm to direct (#11881)
* fix: use .js extension for ESM imports of RoutePeerKind

The imports incorrectly used .ts extension which doesn't resolve
with moduleResolution: NodeNext. Changed to .js and added 'type'
import modifier.

* fix tsconfig

* refactor: unify peer kind to ChatType, rename dm to direct

- Replace RoutePeerKind with ChatType throughout codebase
- Change 'dm' literal values to 'direct' in routing/session keys
- Keep backward compat: normalizeChatType accepts 'dm' -> 'direct'
- Add ChatType export to plugin-sdk, deprecate RoutePeerKind
- Update session key parsing to accept both 'dm' and 'direct' markers
- Update all channel monitors and extensions to use ChatType

BREAKING CHANGE: Session keys now use 'direct' instead of 'dm'.
Existing 'dm' keys still work via backward compat layer.

* fix tests

* test: update session key expectations for dmdirect migration

- Fix test expectations to expect :direct: in generated output
- Add explicit backward compat test for normalizeChatType('dm')
- Keep input test data with :dm: keys to verify backward compat

* fix: accept legacy 'dm' in session key parsing for backward compat

getDmHistoryLimitFromSessionKey now accepts both :dm: and :direct:
to ensure old session keys continue to work correctly.

* test: add explicit backward compat tests for dmdirect migration

- session-key.test.ts: verify both :dm: and :direct: keys are valid
- getDmHistoryLimitFromSessionKey: verify both formats work

* feat: backward compat for resetByType.dm config key

* test: skip unix-path Nix tests on Windows
2026-02-09 09:20:52 +09:00
Mariano Belinky 730f86dd5c Gateway/Plugins: device pairing + phone control plugins (#11755) 2026-02-08 18:07:13 +01:00
max eb3e9c649b
chore: fix vitest standalone configs and update package description (#11865)
* chore: fix vitest standalone configs and update package description

- vitest.live.config.ts and vitest.e2e.config.ts now extend root config
- Inherits testTimeout (120s), resolve.alias, pool, setupFiles, excludes
- ui/vitest.node.config.ts gets explicit 120s timeout
- package.json description updated for multi-channel AI gateway
- Removed unused src/utils/time-format.ts

* chore: filter inherited excludes in live/e2e vitest configs

* refactor: dedupe GroupPolicy/DmPolicy in extensions

Import from openclaw/plugin-sdk instead of re-declaring identical types.
2026-02-08 05:24:50 -08:00
max 28e1a65ebc
chore: project hygiene — fix workspace:*, sandbox USER, dead config (#11289)
* chore: project hygiene fixes (workspace:*, sandbox USER, dead config)

* chore: also fix workspace:* in zalouser dependencies
2026-02-08 02:36:42 -08:00
Gustavo Madeira Santana e2dea2684f
Tests: harden flake hotspots and consolidate provider-auth suites (#11598)
* Tests: harden flake hotspots and consolidate provider-auth suites

* Tests: restore env vars by deleting missing snapshot values

* Tests: use real newline in memory summary filter case

* Tests(memory): use fake timers for qmd timeout coverage

* Changelog: add tests hardening entry for #11598
2026-02-07 21:32:23 -05:00
Advait Paliwal 980f788731
feat(gateway): add agents.create/update/delete methods (#11045)
* feat(gateway): add agents.create/update/delete methods

* fix(lint): preserve memory-lancedb load error cause

* feat(gateway): trash agent files on agents.delete

* chore(protocol): regenerate Swift gateway models

* fix(gateway): stabilize agents.create dirs and agentDir

* feat(gateway): support avatar in agents.create

* fix: prep agents.create/update/delete handlers (#11045) (thanks @advaitpaliwal)

- Reuse movePathToTrash from browser/trash.ts (has ~/.Trash fallback on non-macOS)
- Fix partial-failure: workspace setup now runs before config write
- Always write Name to IDENTITY.md regardless of emoji/avatar
- Add unit tests for agents.create, agents.update, agents.delete
- Add CHANGELOG entry

---------

Co-authored-by: Tyler Yust <TYTYYUST@YAHOO.COM>
2026-02-07 16:47:58 -08:00