Commit Graph

2636 Commits

Author SHA1 Message Date
Peter Steinberger
ef70a55b7a refactor(reply): clarify explicit reply tags in off mode (#16189)
* refactor(reply): clarify explicit reply tags in off mode

* fix(plugin-sdk): alias account-id subpath for extensions
2026-02-14 14:15:37 +01:00
Peter Steinberger
6f7d31c426 fix(security): harden plugin/hook npm installs 2026-02-14 14:07:14 +01:00
Peter Steinberger
d69b32a073 docs(changelog): clarify hooks transform dir restriction 2026-02-14 14:02:16 +01:00
Peter Steinberger
18e8bd68c5 fix(security): block hook manifest path escapes 2026-02-14 14:00:37 +01:00
Peter Steinberger
3bbd29bef9 perf(gateway): cache session list transcript fields 2026-02-14 12:52:51 +00:00
Peter Steinberger
a0361b8ba9 fix(security): restrict hook transform module loading 2026-02-14 13:46:09 +01:00
Peter Steinberger
bf080c2338 Merge remote-tracking branch 'origin/main' 2026-02-14 13:36:18 +01:00
Tak Hoffman
274da72c38 Revert "fix: don't auto-create HEARTBEAT.md on workspace init (openclaw#12027) thanks @shadril238" (#16183)
This reverts commit 386bb0c618.
2026-02-14 06:33:14 -06:00
Peter Steinberger
83248f7603 Merge remote-tracking branch 'origin/main' 2026-02-14 13:30:22 +01:00
Aldo
7b39543e8d fix(reply): honour explicit [[reply_to_*]] tags when replyToMode is off (#16174)
Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: 778fc2559ade85a37209866c2edbe33bfc5bbb86
Co-authored-by: aldoeliacim <17973757+aldoeliacim@users.noreply.github.com>
Co-authored-by: steipete <58493+steipete@users.noreply.github.com>
Reviewed-by: @steipete
2026-02-14 13:29:42 +01:00
Peter Steinberger
318379cdba fix(gateway): bind system.run approvals to exec approvals 2026-02-14 13:27:45 +01:00
Peter Steinberger
0cfea46293 fix: wire minimax-api-key-cn onboarding (#15191) (thanks @liuy) 2026-02-14 13:25:54 +01:00
Peter Steinberger
c90b3e4d5e perf(cli): speed up startup 2026-02-14 12:21:44 +00:00
Peter Steinberger
6dd6bce997 fix(security): enforce sandbox bridge auth 2026-02-14 13:17:41 +01:00
Nicholas
f8ba8f7699 fix(docs): update outdated hooks documentation URLs (#16165)
Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: 8ed13fb02fae2cb6dd3cacdb3cd1ef37a5cdd4d8
Co-authored-by: nicholascyh <188132635+nicholascyh@users.noreply.github.com>
Co-authored-by: steipete <58493+steipete@users.noreply.github.com>
Reviewed-by: @steipete
2026-02-14 13:05:37 +01:00
Peter Steinberger
79e78cff3b docs(changelog): thank reporter for ACP hardening 2026-02-14 12:54:47 +01:00
Peter Steinberger
4711a943e3 fix(browser): authenticate sandbox browser bridge server 2026-02-14 12:54:16 +01:00
Peter Steinberger
9e24eee52c docs(changelog): note audit warning for gateway tools override 2026-02-14 12:48:48 +01:00
Peter Steinberger
3b56a6252b chore!: remove moltbot legacy state/config support 2026-02-14 12:40:47 +01:00
Nick Taylor
1fb52b4d7b feat(gateway): add trusted-proxy auth mode (#15940)
Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: 279d4b304f83186fda44dfe63a729406a835dafa
Co-authored-by: nickytonline <833231+nickytonline@users.noreply.github.com>
Co-authored-by: steipete <58493+steipete@users.noreply.github.com>
Reviewed-by: @steipete
2026-02-14 12:32:17 +01:00
Artale
3a330e681b fix(feishu): remove typing indicator on NO_REPLY cleanup (openclaw#15508) thanks @arosstale
Verified:
- pnpm build
- pnpm check
- pnpm test

Co-authored-by: arosstale <117890364+arosstale@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
2026-02-14 05:24:27 -06:00
Vignesh Natarajan
4c79a63eb8 fix: default QMD search mode (#16047) (thanks @togotago) 2026-02-13 23:14:34 -08:00
Tyler Yust
45e12d2388 bluebubbles: gracefully handle disabled private API with action/tool filtering and fallbacks (#16002)
Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: 243cc0cc9a9ac68b5a7069da50f9f496ac4722d2
Co-authored-by: tyler6204 <243?+tyler6204@users.noreply.github.com>
Co-authored-by: tyler6204 <64381258+tyler6204@users.noreply.github.com>
Reviewed-by: @tyler6204
2026-02-13 21:15:56 -08:00
Peter Steinberger
1f432ffb93 docs(changelog): clarify Hugging Face support in 2026.2.13 2026-02-14 05:51:52 +01:00
Gabriel
8f2884b986 fix: i am fixing all the changes that claude made. vibe coding is not there yet. anyways, i fixed the issues that the bot told me to fix 2026-02-14 05:48:40 +01:00
anthropic-code-agent[bot]
c640b5f86c feat: add NVIDIA API provider integration
Add support for NVIDIA's API (https://integrate.api.nvidia.com/v1) with three models:
- nvidia/llama-3.1-nemotron-70b-instruct (default)
- nvidia/llama-3.3-70b-instruct
- nvidia/mistral-nemo-minitron-8b-8k-instruct

Users can configure via NVIDIA_API_KEY environment variable or auth profiles.

Co-authored-by: thesomewhatyou <162917831+thesomewhatyou@users.noreply.github.com>
2026-02-14 05:48:40 +01:00
Peter Steinberger
e91d957d70 chore(release): publish 2026.2.13 appcast 2026-02-14 04:31:32 +01:00
青雲
89fa93ed75 feat: support freshness parameter for Perplexity web_search provider (#15343)
Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: 01aba2bfba053c028f62970dcd153b19d00c5e3b
Co-authored-by: echoVic <16428813+echoVic@users.noreply.github.com>
Co-authored-by: sebslight <19554889+sebslight@users.noreply.github.com>
Reviewed-by: @sebslight
2026-02-13 22:18:16 -05:00
Peter Steinberger
203b5bdf71 docs: reorder 2026.2.13 changelog by user interest 2026-02-14 03:31:45 +01:00
Peter Steinberger
61b5133264 fix(memory): align QAT default docs/tests (#15429) (thanks @azade-c) 2026-02-14 03:11:14 +01:00
Marcus Castro
2b154e0458 fix(mattermost): add WebSocket reconnection with exponential backoff (#14962)
* fix(mattermost): add WebSocket reconnection with exponential backoff

Fixes #13980

The Mattermost WebSocket monitor had no error handling around the
reconnection loop. When connectOnce() threw (e.g. 'fetch failed' from
network issues), the error propagated through the while loop, causing
the gateway to log 'channel exited' and never restart.

Extract runWithReconnect() utility that:
- Catches thrown errors from connectFn and retries
- Uses exponential backoff (2s→4s→8s→...→60s cap)
- Resets backoff after successful connections
- Stops cleanly on abort signal
- Reports errors and reconnect delays via callbacks

* fix(mattermost): make backoff sleep abort-aware and reject on WS connect failure

* fix(mattermost): clean up abort listener on normal timeout to prevent leak

* fix(mattermost): skip error reporting when abort causes connection rejection

* fix(mattermost): use try/finally for abort listener cleanup in connectOnce

* fix: force-close WebSocket on error to prevent reconnect hang

* fix: use ws.terminate() on abort for reliable teardown during CONNECTING state

* fix(mattermost): use initial retry delay for reconnect backoff

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-02-14 03:10:22 +01:00
David Cantú Martínez
9443c638f4 voice-call: hang up rejected inbounds, idempotency and logging (#15892)
Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: 36f826ea23a6a457b9c6b0f6def1fe1b46af6431
Co-authored-by: dcantu96 <32658690+dcantu96@users.noreply.github.com>
Co-authored-by: steipete <58493+steipete@users.noreply.github.com>
Reviewed-by: @steipete
2026-02-14 03:09:31 +01:00
大猫子
13aface863 fix(config): accept $schema key in root config (#15280)
* fix(config): accept $schema key in root config (#14998)

* fix: strip $schema via preprocess to avoid spurious UI section

* fix(config): allow root  without zod preprocess wrapper

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-02-14 03:07:12 +01:00
大猫子
dbe026214f fix(routing): exclude peer-specific bindings from guild-wide matching (#15274)
* fix(routing): exclude peer-specific bindings from guild-wide matching (#14752)

* fix(routing): enforce binding scope AND semantics + regressions

* fix(routing): document strict binding-scope behavior (#15274) (thanks @lailoo)

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-02-14 03:05:09 +01:00
Azade 🐐
1b95220a99 fix(media): recognize MP3 and M4A as voice-compatible audio (#15438)
* fix(media): recognize MP3 and M4A as voice-compatible audio

Telegram sendVoice supports OGG/Opus, MP3, and M4A, but
isVoiceCompatibleAudio only recognized OGG/Opus formats.

- Add MP3 and M4A extensions and MIME types
- Use explicit MIME set instead of substring matching
- Handle MIME parameters (e.g. 'audio/ogg; codecs=opus')
- Add test coverage for all supported and unsupported formats

* fix: narrow MIME allowlist per review feedback

Remove audio/mp4 and audio/aac from voice MIME types — too broad.
Keep only M4A-specific types (audio/x-m4a, audio/m4a).
Add audio/mp4 and audio/aac as negative test cases.

* fix: align voice compatibility and channel coverage (#15438) (thanks @azade-c)

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-02-14 03:03:02 +01:00
Peter Steinberger
8c3cc793b7 fix: dedupe before_tool_call in embedded runtime (#15635) (thanks @lailoo) 2026-02-14 02:50:35 +01:00
damaozi
534e4213a1 fix(hooks): deduplicate before_tool_call hook in toToolDefinitions (#15502) 2026-02-14 02:50:35 +01:00
Nikolay Petrov
3b5a9c14dd Fix: Preserve Per-Agent Exec Override After Session Compaction (#15833)
Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: 9dfe5bdf230422721f548cffc1a93a654c369cd7
Co-authored-by: napetrov <18015221+napetrov@users.noreply.github.com>
Co-authored-by: steipete <58493+steipete@users.noreply.github.com>
Reviewed-by: @steipete
2026-02-14 02:34:04 +01:00
大猫子
c4d2061a7c Web UI: allow img tags in DOMPurify so markdown images render in webchat (#15480)
Thanks @lailoo.
2026-02-14 02:29:13 +01:00
damaozi
1d01bb1c8d fix(telegram): scope default account skill commands to resolved agent (#15599) 2026-02-14 02:28:39 +01:00
Artale
643288fda8 fix(cli): route logs to stderr during shell completion output (openclaw#15496) thanks @arosstale
Verified:
- pnpm install --frozen-lockfile
- pnpm build
- pnpm check
- pnpm test

Co-authored-by: arosstale <117890364+arosstale@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
2026-02-13 19:14:53 -06:00
Owen
87b31acbb5 feat: add GLM-5 model support (#14352) (#15867)
Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: 0e3289a5944843241396b5b95461a5892f92acd9
Co-authored-by: battman21 <2656916+battman21@users.noreply.github.com>
Co-authored-by: steipete <58493+steipete@users.noreply.github.com>
Reviewed-by: @steipete
2026-02-14 02:13:42 +01:00
Artale
0942ecb54f fix(cron): use job config for cleanup instead of hardcoded "keep" (openclaw#15427) thanks @arosstale
Verified:
- pnpm install --frozen-lockfile
- pnpm build
- pnpm check
- pnpm test

Co-authored-by: arosstale <117890364+arosstale@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
2026-02-13 19:10:17 -06:00
Artale
7f0d6b1fcb fix(heartbeat): exempt wake and hook reasons from empty-heartbeat skip (openclaw#14532) thanks @arosstale
Verified:
- pnpm build
- pnpm check
- pnpm test

Co-authored-by: arosstale <117890364+arosstale@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
2026-02-13 19:05:02 -06:00
Artale
31d8546afd fix(gateway): hide phantom main agent when agents.list is configured (openclaw#12364) thanks @arosstale
Verified:
- pnpm build
- pnpm check
- pnpm test

Co-authored-by: arosstale <117890364+arosstale@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
2026-02-13 18:56:10 -06:00
AkosCz
a4f4b0636f fix: preserve ${VAR} env var references when writing config back to disk (#11560)
* fix: preserve ${VAR} env var references when writing config back to disk

Fixes #11466

When config is loaded, ${VAR} references are resolved to their plaintext
values. Previously, writeConfigFile would serialize the resolved values,
silently replacing "${ANTHROPIC_API_KEY}" with "sk-ant-api03-..." in the
config file.

Now writeConfigFile reads the current file pre-substitution, and for each
value that matches what a ${VAR} reference would resolve to, restores the
original reference. Values the caller intentionally changed are kept as-is.

This fixes all 50+ writeConfigFile call sites (doctor, configure wizard,
gateway config.set/apply/patch, plugins, hooks, etc.) without requiring
any caller changes.

New files:
- src/config/env-preserve.ts — restoreEnvVarRefs() utility
- src/config/env-preserve.test.ts — 11 unit tests

* fix: remove global config env snapshot race

* docs(changelog): note config env snapshot race fix

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-02-14 01:53:17 +01:00
Owen
11ab1c6937 fix: enforce Telegram 100-command limit with warning (#5787) (#15844)
* fix: enforce Telegram 100-command limit with warning (#5787)

Telegram's setMyCommands API rejects requests with more than 100 commands.
When skills + custom + plugin commands exceed the limit, truncate to 100
and warn the user instead of silently failing on every startup.

* fix: enforce Telegram menu cap + keep hidden commands callable (#15844) (thanks @battman21)

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-02-14 01:51:00 +01:00
Cezar “ikari” Pokorski
d134c854a5 feat(config): expose full pi-ai model compat fields in config schema (openclaw#11063) thanks @ikari-pl
Verified:
- pnpm build
- pnpm check
- pnpm test (full run; transient lobster timeout rerun passed)

Co-authored-by: ikari-pl <811702+ikari-pl@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
2026-02-13 18:47:18 -06:00
AI-Reviewer-QS
28431b84cc fix(gateway): prune expired entries instead of clearing all hook auth failure state (#15848)
Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: 188a40e8a35112b9ea2df23dd0a940b9be1eac1d
Co-authored-by: AI-Reviewer-QS <255312808+AI-Reviewer-QS@users.noreply.github.com>
Co-authored-by: steipete <58493+steipete@users.noreply.github.com>
Reviewed-by: @steipete
2026-02-14 01:46:12 +01:00
Artale
67b5c093b5 fix(auto-reply): allow image-only messages to reach the agent (openclaw#12352) thanks @arosstale
Verified:
- pnpm build
- pnpm check
- pnpm test

Co-authored-by: arosstale <117890364+arosstale@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
2026-02-13 18:42:22 -06:00