Commit Graph

2107 Commits

Author SHA1 Message Date
Peter Steinberger
f9fae2c439 fix: stabilize docker e2e flows 2026-02-02 13:11:55 +00:00
Peter Steinberger
9bd64c8a1f fix: expand SSRF guard coverage 2026-02-02 04:58:32 -08:00
Peter Steinberger
57d008a33d fix(update): harden global updates 2026-02-02 04:45:14 -08:00
Ayaan Zaidi
66307695eb fix: start gateway in docker CMD (#6635) (thanks @kaizen403) 2026-02-02 17:38:37 +05:30
Peter Steinberger
81c68f582d fix: guard remote media fetches with SSRF checks 2026-02-02 04:07:29 -08:00
Peter Steinberger
ed4529e246 docs: update 2026.2.1 changelog 2026-02-02 03:25:32 -08:00
Peter Steinberger
8b64705e05 docs: fold 2026.2.2 into 2026.2.1 2026-02-02 02:43:54 -08:00
Peter Steinberger
f6d98a908a docs: add changelog entry for plugin install hardening 2026-02-02 02:07:47 -08:00
Peter Steinberger
d5f6caba3f docs: merge 2026.2.2 changelog into 2026.2.1 2026-02-02 01:31:24 -08:00
Tyler Yust
9ef24fd400 fix: flush block streaming on paragraph boundaries for chunkMode=newline (#7014)
* feat: Implement paragraph boundary flushing in block streaming

- Added `flushOnParagraph` option to `BlockReplyChunking` for immediate flushing on paragraph breaks.
- Updated `EmbeddedBlockChunker` to handle paragraph boundaries during chunking.
- Enhanced `createBlockReplyCoalescer` to support flushing on enqueue.
- Added tests to verify behavior of flushing with and without `flushOnEnqueue` set.
- Updated relevant types and interfaces to include `flushOnParagraph` and `flushOnEnqueue` options.

* fix: Improve streaming behavior and enhance block chunking logic

- Resolved issue with stuck typing indicator after streamed BlueBubbles replies.
- Refactored `EmbeddedBlockChunker` to streamline fence-split handling and ensure maxChars fallback for newline chunking.
- Added tests to validate new chunking behavior, including handling of paragraph breaks and fence scenarios.
- Updated changelog to reflect these changes.

* test: Add test for clamping long paragraphs in EmbeddedBlockChunker

- Introduced a new test case to verify that long paragraphs are correctly clamped to maxChars when flushOnParagraph is enabled.
- Updated logic in EmbeddedBlockChunker to handle cases where the next paragraph break exceeds maxChars, ensuring proper chunking behavior.

* refactor: streamline logging and improve error handling in message processing

- Removed verbose logging statements from the `processMessage` function to reduce clutter.
- Enhanced error handling by using `runtime.error` for typing restart failures.
- Updated the `applySystemPromptOverrideToSession` function to accept a string directly instead of a function, simplifying the prompt application process.
- Adjusted the `runEmbeddedAttempt` function to directly use the system prompt override without invoking it as a function.
2026-02-02 01:22:41 -08:00
Peter Steinberger
85cd55e22b chore: bump to 2026.2.1 2026-02-02 08:51:54 +00:00
David Iach
4e4ed2ea17 fix(security): cap Slack media downloads and validate Slack file URLs (#6639)
* Security: cap Slack media downloads and validate Slack file URLs

* Security: relax web media fetch cap for compression

* Fixes: sync pi-coding-agent options

* Fixes: align system prompt override type

* Slack: clarify fetchImpl assumptions

* fix: respect raw media fetch cap (#6639) (thanks @davidiach)

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-02-02 00:48:07 -08:00
Peter Steinberger
521b121815 fix: treat '*' tool allowlist as valid 2026-02-02 08:45:51 +00:00
Ayaan Zaidi
01449a2f41 fix: add telegram download timeouts (#6914) (thanks @hclsys) 2026-02-02 13:39:39 +05:30
Ayaan Zaidi
e25f8ed56c fix: add changelog for telegram thread spec (#6833) (thanks @obviyus) 2026-02-02 09:26:59 +05:30
Mario Zechner
4347d2468c fix: format issues and lint error in oauth.ts 2026-02-02 01:59:42 +01:00
Peter Steinberger
8c7901c984 fix(twitch): enforce allowFrom allowlist 2026-02-02 00:16:35 +00:00
Peter Steinberger
a87a07ec8a fix: harden host exec env validation (#4896) (thanks @HassanFleyah) 2026-02-01 15:37:19 -08:00
VACInc
b796f6ec01 Security: harden web tools and file parsing (#4058)
* feat: web content security wrapping + gkeep/simple-backup skills

* fix: harden web fetch + media text detection (#4058) (thanks @VACInc)

---------

Co-authored-by: VAC <vac@vacs-mac-mini.localdomain>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-02-01 15:23:25 -08:00
Peter Steinberger
92112a61db chore: add TLS 1.3 minimum changelog (#5970) (thanks @loganaden) 2026-02-01 15:14:55 -08:00
Peter Steinberger
8eb11bd304 fix: wire before_tool_call hook into tool execution (#6570) (thanks @ryancnelson) (#6660) 2026-02-01 14:52:11 -08:00
Peter Steinberger
99346314f5 chore: trim docs changelog 2026-02-01 14:17:47 -08:00
Peter Steinberger
1968a4b7d2 chore: expand changelog 2026-02-01 14:12:39 -08:00
Peter Steinberger
a68e32d95b chore: update changelog 2026-02-01 14:08:09 -08:00
Peter Steinberger
238200f652 chore: update changelog and relay formatting 2026-02-01 14:03:57 -08:00
CLAWDINATOR Bot
92803facf6 docs: preserve moonshot sync markers 2026-02-01 20:34:42 +00:00
Sebastian
a863ac9862 Docs: clarify Moonshot endpoints (#4763)
Co-authored-by: hansbbans <hansbbans@users.noreply.github.com>
2026-02-01 15:03:55 -05:00
Peter Steinberger
083ec9325e fix: cover OpenRouter attribution headers 2026-02-01 19:30:33 +00:00
CLAWDINATOR Bot
17287bc8d0 docs: add zh-CN titles (#6487) (thanks @joshp123) 2026-02-01 18:21:15 +00:00
bonald
d3e53eaf27 fix(skill): update session-logs paths from .clawdbot to .openclaw (#4502)
Co-authored-by: Jarvis <jarvis@openclaw.ai>
Co-authored-by: CLAWDINATOR Bot <clawdinator[bot]@users.noreply.github.com>
Co-authored-by: Shadow <shadow@openclaw.ai>
2026-02-01 11:42:28 -06:00
CLAWDINATOR Bot
6453f5c395 docs: add Mintlify language navigation (#6416) (thanks @joshp123) 2026-02-01 17:20:44 +00:00
CLAWDINATOR Bot
bc5b0c82ac fix(docker): avoid using host port in gateway command (#5110) (thanks @mise42) 2026-02-01 17:17:18 +00:00
shatner
8ff75eaf12 Docs: Direct link to BotFather on Telegram (#4064)
* Docs: Direct link to BotFather on Telegram, sparing users from searching and potentially encountering impostors.

* Update numbering syntax

Update numbering syntax to match PR to latest doc layout.

* Docs: add BotFather verification note

---------

Co-authored-by: Sebastian <sebslight@gmail.com>
2026-02-01 10:15:40 -05:00
Ayaan Zaidi
0992c5a809 fix: cap context window resolution (#6187) (thanks @iamEvanYT) 2026-02-01 19:52:56 +05:30
Ayaan Zaidi
1f3afa38e8 fix: use shared pairing store for telegram (#6127) (thanks @obviyus) 2026-02-01 15:22:37 +05:30
bravostation
b4e2e746b3 /new: use agent personality in session greeting (#5706)
* Slash new: use agent personality in session greeting

Previously /new and /reset used a generic greeting prompt. Agents with
personality files (IDENTITY.md, SOUL.md, etc) would respond out of
character until the conversation got going.

Now the prompt instructs the agent to greet users as their character,
using their defined voice, mannerisms, and mood from the start.

* Auto-reply: avoid workspace references in reset prompt

* fix: avoid workspace references in reset greeting (#5706) (thanks @bravostation)

---------

Co-authored-by: MoltBot <bot@moltbot.com>
Co-authored-by: Shadow <shadow@clawd.bot>
2026-01-31 20:43:19 -06:00
Tak Hoffman
3d5c03ec29 fix: resolve Windows npm spawn ENOENT (#5815) (thanks @thejhinvirtuoso) 2026-01-31 20:39:33 -06:00
Lalit Singh
01d76e4799 feat(routing): add thread parent binding inheritance for Discord (#3892)
* feat(routing): add thread parent binding inheritance for Discord

When a Discord thread message doesn't match a direct peer binding,
now checks if the parent channel has a binding and uses that agent.

This enables multi-agent setups where threads inherit their parent
channel's agent binding automatically.

Changes:
- Add parentPeer parameter to ResolveAgentRouteInput
- Add binding.peer.parent match type
- Resolve thread parent early in Discord preflight
- Pass parentPeer to resolveAgentRoute for threads

Fixes thread routing in Discord multi-agent configurations where
threads were incorrectly routed to the default agent instead of
inheriting from their parent channel's binding.

* ci: trigger fresh macOS runners

* Discord: inherit thread bindings in reactions

* fix: add changelog for thread parent binding (#3892) (thanks @aerolalit)

---------

Co-authored-by: Lalit Singh <lalit@clawd.bot>
Co-authored-by: OSS Agent <oss-agent@clawdbot.ai>
Co-authored-by: Shadow <shadow@clawd.bot>
2026-01-31 20:30:45 -06:00
Gustavo Madeira Santana
73c405f74a Docs: note MiniMax OAuth updates (#5402) (thanks @Maosghoul) 2026-01-31 21:08:56 -05:00
Shadow
8e2b17e0c5 Discord: add PluralKit sender identity resolver (#5838)
* Discord: add PluralKit sender identity resolver

* fix: resolve PluralKit sender identities (#5838) (thanks @thewilloftheshadow)
2026-01-31 19:50:06 -06:00
Vignesh
1295b67057 fix(lobster): block arbitrary exec via lobsterPath/cwd (GHSA-4mhr-g7xj-cg8j) (#5335)
* fix(lobster): prevent arbitrary exec via lobsterPath/cwd

* fix(lobster): harden lobsterPath errors + normalize cwd sandboxing

* fix(lobster): ignore tool-provided lobsterPath; validate + use plugin config

* fix(lobster): use plugin config lobsterPath + add tests (#5335) (thanks @vignesh07)

* fix(lobster): make Windows spawn fallback handle ENOENT (#5335) (thanks @vignesh07)

---------

Co-authored-by: Tyler Yust <TYTYYUST@YAHOO.COM>
2026-01-31 12:46:20 -08:00
Ayaan Zaidi
f1de88c198 fix: restore telegram draft streaming partials (#5543) (thanks @obviyus) 2026-01-31 22:46:19 +05:30
Tak Hoffman
9c29853014 Gateway: inject timestamps into agent/chat.send (#3705) (thanks @conroywhitney, @CashWilliams) 2026-01-31 09:47:27 -06:00
Peter Steinberger
83e64c1ac9 docs: start 2026.1.31 changelog 2026-01-31 16:28:19 +01:00
Peter Steinberger
7d89855c55 fix: align npm publish metadata 2026-01-31 14:21:21 +01:00
cpojer
8cab78abbc chore: Run pnpm format:fix. 2026-01-31 21:13:13 +09:00
Peter Steinberger
1287328b6f feat: add MiniMax OAuth plugin (#4521) (thanks @Maosghoul) 2026-01-31 12:42:45 +01:00
Peter Steinberger
b9b94715fa fix: avoid stderr backpressure in macOS discovery (#3304) (thanks @abhijeet117) 2026-01-31 12:03:30 +01:00
Peter Steinberger
247fab47ca chore: bump version to 2026.1.30 2026-01-31 11:37:36 +01:00
Ayaan Zaidi
310eed825e fix: preserve delivery thread fallback (#4911) (thanks @yevhen) 2026-01-31 09:31:40 +05:30