Commit Graph

14699 Commits

Author SHA1 Message Date
Shakker
94942df8c7 build: scope window.open guard to ui checks 2026-02-24 14:48:10 +00:00
Shakker
e5836283ab ui: centralize safe external URL opening 2026-02-24 14:48:10 +00:00
Shakker
ebb5680893 ui(chat): allowlist image open URLs 2026-02-24 14:48:10 +00:00
Peter Steinberger
370d115549 fix: enforce workspaceOnly for native prompt image autoload 2026-02-24 14:47:59 +00:00
Peter Steinberger
c3680c2277 docs(changelog): credit reporter for sandbox bind-path fix 2026-02-24 14:47:56 +00:00
Peter Steinberger
9168f2147f test: add case-insensitive stop abort assertions 2026-02-24 14:47:48 +00:00
Peter Steinberger
6da03eabe2 fix: add changelog and clean regression comment for tool-result guard (#25429) (thanks @mikaeldiakhate-cell) 2026-02-24 14:42:09 +00:00
Leakim
8db7ca8c02 fix: prevent synthetic toolResult for aborted/errored assistant messages
When an assistant message with toolCalls has stopReason 'aborted' or 'error',
the guard should not add those tool call IDs to the pending map. Creating
synthetic tool results for incomplete/aborted tool calls causes API 400 errors:
'unexpected tool_use_id found in tool_result blocks'

This aligns the WRITE path (session-tool-result-guard.ts) with the READ path
(session-transcript-repair.ts) which already skips aborted messages.

Fixes: orphaned tool_result causing session corruption

Tests added:
- does NOT create synthetic toolResult for aborted assistant messages
- does NOT create synthetic toolResult for errored assistant messages
2026-02-24 14:42:09 +00:00
zzzz
31b1b20b3c docs: add WeChat community plugin listing
Add @icesword760/openclaw-wechat to the community plugins page.
This plugin connects OpenClaw to WeChat personal accounts via
WeChatPadPro (iPad protocol) with support for text, image, and
file exchange.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-24 08:41:28 -06:00
Peter Steinberger
760671e31c fix: add changelog for kimi cache usage parsing (#25436) (thanks @Elarwei001) 2026-02-24 14:40:52 +00:00
Elarwei
aa2826b5b1 fix(usage): parse Kimi K2 cached_tokens from prompt_tokens_details
Kimi K2 models use automatic prefix caching and return cache stats in
a nested field: usage.prompt_tokens_details.cached_tokens

This fixes issue #7073 where cacheRead was showing 0 for K2.5 users.

Also adds cached_tokens (top-level) for moonshot-v1 explicit caching API.

Closes #7073
2026-02-24 14:40:52 +00:00
Peter Steinberger
b511a38fc8 fix: add changelog for doctor sandbox docker warning (#25438) (thanks @mcaxtr) 2026-02-24 14:40:06 +00:00
Marcus Castro
23b9daee6f fix(doctor): improve sandbox warning when Docker unavailable 2026-02-24 14:40:06 +00:00
Peter Steinberger
d2c031de84 fix: add changelog for meta timestamp coercion (#25491) (thanks @mcaxtr) 2026-02-24 14:39:12 +00:00
Marcus Castro
2c4ebf77f3 fix(config): coerce numeric meta.lastTouchedAt to ISO string 2026-02-24 14:39:12 +00:00
Peter Steinberger
b5787e4abb fix(sandbox): harden bind validation for symlink missing-leaf paths 2026-02-24 14:37:35 +00:00
Peter Steinberger
0365125c21 fix: add changelog for reset hook fallback coverage (#25459) (thanks @chilu18) 2026-02-24 14:27:48 +00:00
chilu18
aec41a588b fix(hooks): backfill reset command hooks for native /new path 2026-02-24 14:27:48 +00:00
Peter Steinberger
bbdf895d42 fix: add changelog for slug generator model resolution (#25485) (thanks @SudeepMalipeddi) 2026-02-24 14:27:01 +00:00
SudeepMalipeddi
d32298cbd8 fix: slug-generator uses effective model instead of agent-primary
resolveAgentModelPrimary() only checks the agent-level model config and
does not fall back to the system-wide default. When users configure a
non-Anthropic provider (e.g. Gemini, Minimax) as their global default
without setting it at the agent level, the slug-generator falls through
to DEFAULT_PROVIDER (anthropic) and fails with a missing API key error.

Switch to resolveAgentEffectiveModelPrimary() which correctly respects
the full model resolution chain including global defaults.

Fixes #25365
2026-02-24 14:27:01 +00:00
Peter Steinberger
5e6fe9c160 fix: add changelog for slack dm channel-type guard (#25479) (thanks @mcaxtr) 2026-02-24 14:26:01 +00:00
Marcus Castro
3ff6e078ec test(slack): add missing allowNameMatching field to DM classification tests 2026-02-24 14:26:01 +00:00
Marcus Castro
f33d0a884e fix(slack): override wrong channel_type for D-prefix DM channels 2026-02-24 14:26:01 +00:00
Peter Steinberger
8cc841766c docs(security): enumerate dangerous config parameters 2026-02-24 14:25:43 +00:00
Peter Steinberger
39631639b7 fix: add changelog + typed omission test note (#25314) (thanks @lbo728) 2026-02-24 14:22:02 +00:00
lbo728
b863316e7b fix(models): preserve user reasoning override when merging with built-in catalog
When a built-in provider model has reasoning:true (e.g. MiniMax-M2.5) and
the user explicitly sets reasoning:false in their config, mergeProviderModels
unconditionally overwrote the user's value with the built-in catalog value.

The merge code refreshes capability metadata (input, contextWindow, maxTokens,
reasoning) from the implicit catalog. This is correct for fields like
contextWindow and maxTokens — the catalog has authoritative values that
shouldn't be stale. But reasoning is a user preference, not just a
capability descriptor: users may need to disable it to avoid 'Message
ordering conflict' errors with certain models or backends.

Fix: check whether 'reasoning' is present in the explicit (user-supplied)
model entry. If the user has set it (even to false), honour that value.
If the user hasn't set it, fall back to the built-in catalog default.

This allows users to configure tools.models.providers.minimax.models with
reasoning:false for MiniMax-M2.5 without being silently overridden.

Fixes #25244
2026-02-24 14:22:02 +00:00
Peter Steinberger
07f653ffc8 fix: polish bare wildcard allowlist handling (#25250) (thanks @widingmarcus-cyber) 2026-02-24 14:20:11 +00:00
Marcus Widing
0f0b2c0255 fix(exec): match bare * wildcard in allowlist entries (#25082)
The matchAllowlist() function skipped patterns without path separators
(/, \, ~), causing a bare "*" wildcard entry to never reach the glob
matcher. Since glob's single * maps to [^/]*, it would also fail against
absolute paths. Handle bare "*" as a special case that matches any
resolved executable path.

Closes #25082
2026-02-24 14:20:11 +00:00
Peter Steinberger
e9216cb7dc fix: add changelog for trusted-proxy pairing bypass (#25428) (thanks @SidQin-cyber) 2026-02-24 14:17:54 +00:00
SidQin-cyber
20523b918a fix(gateway): allow trusted-proxy control-ui auth to skip device pairing
Control UI connections authenticated via gateway.auth.mode=trusted-proxy were
still forced through device pairing because pairing bypass only considered
shared token/password auth (sharedAuthOk). In trusted-proxy deployments,
this produced persistent "pairing required" failures despite valid trusted
proxy headers.

Treat authenticated trusted-proxy control-ui connections as pairing-bypass
eligible and allow missing device identity in that mode.

Fixes #25293

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-24 14:17:54 +00:00
Peter Steinberger
d84659f22f fix: add changelog for block-reply flush await (#25427) (thanks @SidQin-cyber) 2026-02-24 14:11:40 +00:00
SidQin-cyber
99d854db82 fix(agents): await block-reply flush before tool execution starts
handleToolExecutionStart() flushed pending block replies and then called
onBlockReplyFlush() as fire-and-forget (`void`). This created a race where
fast tool results (especially media on Telegram) could be delivered before
the text block that preceded the tool call.

Await onBlockReplyFlush() so the block pipeline finishes before tool
execution continues, preserving delivery order.

Fixes #25267

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-24 14:11:40 +00:00
Peter Steinberger
4d124e4a9b feat(security): warn on likely multi-user trust-model mismatch 2026-02-24 14:03:19 +00:00
DoncicX
32d7756d8c iOS: extract device/platform info into DeviceInfoHelper, keep Settings platform string as iOS X.Y.Z 2026-02-24 13:56:43 +00:00
Peter Steinberger
e3ac491da3 docs(changelog): trim 2026.2.24 unreleased entries 2026-02-24 13:51:45 +00:00
Peter Steinberger
7c99a733a9 fix: harden macOS usage cost submenu recursion guard (#25341) (thanks @yingchunbai) 2026-02-24 13:48:59 +00:00
yingchunbai
96b21f4823 fix(macos): remove self-delegate on cost usage submenu to prevent recursive dropdown
The cost usage submenu set `menu.delegate = self` (the MenuSessionsInjector),
which caused `menuWillOpen(_:)` to call `inject(into:)` on the submenu when
it opened. This re-inserted the "Usage cost (30 days)" item into the submenu,
creating an infinite recursive dropdown.

Fix: remove the delegate assignment from the submenu — it does not need
the injector's delegate behavior since it only contains a static chart view.

Closes #25167

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-24 13:48:59 +00:00
Peter Steinberger
2bad30b4d3 chore(release): bump version to 2026.2.24 2026-02-24 13:42:43 +00:00
Shakker
aceb17a30e changelog: add entry for PR 18685 fix 2026-02-24 13:04:10 +00:00
Mariana Sinisterra
649d141527 fix(ui): prevent tabnabbing in chat images (#18685)
* UI: prevent tabnabbing in chat images

* ui: remove comment from image open helper

---------

Co-authored-by: Shakker <shakkerdroid@gmail.com>
2026-02-24 12:56:08 +00:00
LawrenceLuo
66e61ca6ce docs: fix broken links in README (#25368)
- /start/faq → /help/faq
- /concepts/groups → /channels/groups
- /concepts/group-messages → /channels/group-messages
- /concepts/channel-routing → /channels/channel-routing

Co-authored-by: LawrenceLuo <5390633+PinoHouse@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-02-24 06:27:23 -06:00
Peter Machona
097a6a83a0 fix(cli): replace stale doctor/restart command hints (#24485)
* fix(cli): replace stale doctor and restart hints

* fix: add changelog for CLI hint updates (#24485) (thanks @chilu18)

---------

Co-authored-by: Muhammed Mukhthar CM <mukhtharcm@gmail.com>
2026-02-24 14:49:59 +05:30
Val Alexander
1c228dc249 docs: add Val Alexander to maintainers list (#25197)
* docs: add Val Alexander to maintainers list

- Focus: UI/UX, Docs, and Agent DevX
- GitHub: @BunsDev
- X/Twitter: @BunsDev

* Update CONTRIBUTING.md

* fix: format
2026-02-24 01:50:30 -06:00
Vincent Koc
4b316c33db Auto-reply: normalize stop matching and add multilingual triggers (#25103)
* Auto-reply tests: cover multilingual abort triggers

* Auto-reply: normalize multilingual abort triggers

* Gateway: route chat stop matching through abort parser

* Gateway tests: cover chat stop parsing variants

* Auto-reply tests: cover Russian and German stop words

* Auto-reply: add Russian and German abort triggers

* Gateway tests: include Russian and German stop forms

* Telegram tests: route Russian and German stop forms to control lane

* Changelog: note multilingual abort stop coverage

* Changelog: add shared credit for abort shortcut update
2026-02-24 01:07:25 -05:00
Peter Steinberger
b817600533 chore(release): cut 2026.2.23 2026-02-24 05:39:22 +00:00
Peter Steinberger
8ea936cdda docs: clarify prompt caching intro 2026-02-24 05:22:00 +00:00
Peter Steinberger
cafa8226d7 docs(changelog): move stop-signal expansion to changes 2026-02-24 05:14:02 +00:00
Peter Steinberger
936f2449bd chore(release): prep 2026.2.23-beta.1 changelog 2026-02-24 05:02:40 +00:00
Peter Steinberger
fd10286819 docs(changelog): mark allowFrom id-only default as breaking 2026-02-24 04:47:36 +00:00
Peter Steinberger
91ea6ad8ec docs(changelog): reorder unreleased fixes by user impact 2026-02-24 04:46:19 +00:00