diff --git a/.github/workflows/docs-external-links.yml b/.github/workflows/docs-external-links.yml new file mode 100644 index 000000000000..203e85950fbe --- /dev/null +++ b/.github/workflows/docs-external-links.yml @@ -0,0 +1,61 @@ +name: Docs External Link Audit + +on: + schedule: + - cron: "47 7 * * 1" + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: docs-external-link-audit + cancel-in-progress: false + +jobs: + audit: + runs-on: ubuntu-24.04 + timeout-minutes: 45 + steps: + - name: Checkout + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false + + - name: Audit external links + uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2.9.0 + with: + args: >- + --no-progress + --base-url https://docs.openclaw.ai + --exclude-all-private + --accept '100..=399,401,403,429' + --accept-timeouts + --max-retries 2 + --retry-wait-time 2 + --timeout 20 + --scheme http + --scheme https + --exclude '^https://docs\.openclaw\.ai/' + --exclude '^https://github\.com/openclaw/maintainers/' + --exclude '^https://(claude\.ai|help\.openai\.com|openai\.com|platform\.openai\.com|support\.discord\.com|www\.npmjs\.com|www\.raspberrypi\.com)/' + './README.md' + './CONTRIBUTING.md' + './SECURITY.md' + './docs/**/*.md' + './docs/**/*.mdx' + './docs/docs.json' + fail: false + failIfEmpty: true + format: markdown + output: .artifacts/docs-external-links/report.md + + - name: Upload audit report + if: always() + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + with: + name: docs-external-link-audit + path: .artifacts/docs-external-links + include-hidden-files: true + if-no-files-found: warn + retention-days: 14 diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index d8682686f64d..eca706cb5404 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -155,7 +155,6 @@ We take security reports seriously. Report vulnerabilities directly to the repos - **iOS app** — [openclaw/openclaw](https://github.com/openclaw/openclaw) (apps/ios) - **Android app** — [openclaw/openclaw](https://github.com/openclaw/openclaw) (apps/android) - **ClawHub** — [openclaw/clawhub](https://github.com/openclaw/clawhub) -- **Trust and threat model** — [openclaw/trust](https://github.com/openclaw/trust) For issues that don't fit a specific repo, or if you're unsure, email **security@openclaw.ai** and we'll route it. diff --git a/SECURITY.md b/SECURITY.md index b152ed26d6c0..128889e7c070 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -21,7 +21,6 @@ Report vulnerabilities directly to the repository where the issue lives: - **iOS app** — [openclaw/openclaw](https://github.com/openclaw/openclaw) (apps/ios) - **Android app** — [openclaw/openclaw](https://github.com/openclaw/openclaw) (apps/android) - **ClawHub** — [openclaw/clawhub](https://github.com/openclaw/clawhub) -- **Trust and threat model** — [openclaw/trust](https://github.com/openclaw/trust) For issues that don't fit a specific repo, or if you're unsure, email **[security@openclaw.ai](mailto:security@openclaw.ai)** and we'll route it. diff --git a/docs/concepts/typebox.md b/docs/concepts/typebox.md index 0cfac563cdde..f5bfbaedb286 100644 --- a/docs/concepts/typebox.md +++ b/docs/concepts/typebox.md @@ -266,9 +266,9 @@ Unknown frame types are preserved as raw payloads for forward compatibility. ## Live schema JSON -Generated JSON Schema is a build artifact, not committed to the repo. The published raw file is typically available at: +Generated JSON Schema is a build artifact, not committed to the repo. During the package rollout, the current beta schema is available at: -- [https://raw.githubusercontent.com/openclaw/openclaw/main/dist/protocol.schema.json](https://raw.githubusercontent.com/openclaw/openclaw/main/dist/protocol.schema.json) +- [`protocol.schema.json`](https://unpkg.com/@openclaw/gateway-protocol@beta/protocol.schema.json) ## When you change schemas diff --git a/docs/gateway/clients.md b/docs/gateway/clients.md index 7542ee001f6c..b3ba002ac72c 100644 --- a/docs/gateway/clients.md +++ b/docs/gateway/clients.md @@ -31,7 +31,7 @@ install them only after the registry pages below resolve. provides schemas, runtime validators, TypeScript types, client identity and capability registries, structured error readers, and protocol version constants. Its npm tarball also includes the generated - [`protocol.schema.json`](https://unpkg.com/@openclaw/gateway-protocol/protocol.schema.json) + [`protocol.schema.json`](https://unpkg.com/@openclaw/gateway-protocol@beta/protocol.schema.json) machine-readable contract. - [`@openclaw/gateway-client`](https://www.npmjs.com/package/@openclaw/gateway-client) is the reference connection implementation. Import the package root for the Node diff --git a/docs/gateway/protocol.md b/docs/gateway/protocol.md index 3a844fa2719d..aca311721e2a 100644 --- a/docs/gateway/protocol.md +++ b/docs/gateway/protocol.md @@ -20,7 +20,7 @@ npm may return `E404` until the first package-bearing release is published. - [`@openclaw/gateway-protocol`](https://www.npmjs.com/package/@openclaw/gateway-protocol) publishes the schemas, validators, TypeScript types, lightweight frame and error helpers, and version constants. Its tarball includes the generated - [`protocol.schema.json`](https://unpkg.com/@openclaw/gateway-protocol/protocol.schema.json) + [`protocol.schema.json`](https://unpkg.com/@openclaw/gateway-protocol@beta/protocol.schema.json) machine-readable contract. - [`@openclaw/gateway-client`](https://www.npmjs.com/package/@openclaw/gateway-client) publishes the reference Node client and a browser-safe entry at diff --git a/docs/help/faq.md b/docs/help/faq.md index 13b41779573a..c269e708056b 100644 --- a/docs/help/faq.md +++ b/docs/help/faq.md @@ -1572,7 +1572,7 @@ Model Q&A - defaults, selection, aliases, switching, failover, auth profiles - l --- -Still stuck? Ask in [Discord](https://discord.com/invite/clawd) or open a [GitHub discussion](https://github.com/openclaw/openclaw/discussions). +Still stuck? Ask in [Discord](https://discord.com/invite/clawd) or use the [GitHub issue chooser](https://github.com/openclaw/openclaw/issues/new/choose). ## Related diff --git a/docs/releases/2026.7.1.md b/docs/releases/2026.7.1.md index 8e8678982865..1e77c3b3150a 100644 --- a/docs/releases/2026.7.1.md +++ b/docs/releases/2026.7.1.md @@ -473,7 +473,7 @@ Discord, Slack, WhatsApp, Apple Messages, and other supported channels also rece - When Slack accepts a reply but the confirmation is lost, OpenClaw can verify the existing post and avoid sending a duplicate. [#97480](https://github.com/openclaw/openclaw/pull/97480) Thanks @joeyfrasier. - Discord message, thread-history, and attachment requests now reject oversized successful responses before they can drive excessive Gateway memory growth. [#97693](https://github.com/openclaw/openclaw/pull/97693) Thanks @alix-007. - Discord PluralKit lookups and voice-upload setup now stop unexpectedly large JSON responses before they can exhaust memory. [#97706](https://github.com/openclaw/openclaw/pull/97706) Thanks @cxbasdev. -- Discord voice conversations in `stt-tts` mode now retain earlier spoken context across turns instead of starting over after each reply. [#97746](https://github.com/openclaw/openclaw/pull/97746) Thanks @karabaralex, @sanjays2402. +- Discord voice conversations in `stt-tts` mode now retain earlier spoken context across turns instead of starting over after each reply. [6cc534b](https://github.com/openclaw/openclaw/commit/6cc534bbad7b593b701f133daee275cfca67ff86) Thanks @karabaralex, @sanjays2402. - Malformed successful Discord responses now fail with endpoint-specific context instead of surfacing a raw parser error or crashing OpenClaw. [#97889](https://github.com/openclaw/openclaw/pull/97889) Thanks @lsr911. - An oversized Discord gateway metadata response now logs a bounded error and falls back to Discord's default gateway URL instead of risking a Gateway crash. [#98682](https://github.com/openclaw/openclaw/pull/98682) Thanks @wings1029. - Discord deployments in restricted networks can now route Gateway and REST traffic through an explicitly configured DNS or private HTTP(S) proxy without opening broad direct HTTPS egress. [#99126](https://github.com/openclaw/openclaw/pull/99126) Related [#98266](https://github.com/openclaw/openclaw/issues/98266). Thanks @joshavant, @sallyom, @svuppala2006. @@ -807,7 +807,7 @@ The [model catalog](/concepts/models) also reports availability and capability m - OpenAI embedding batch polling and Realtime setup now cancel oversized successful responses early and return a bounded error instead of growing memory without limit. [#97533](https://github.com/openclaw/openclaw/pull/97533) Thanks @hugenshen. - OpenAI OAuth usage checks now cap oversized WHAM rate-limit responses before they can destabilize the process. [#97702](https://github.com/openclaw/openclaw/pull/97702) Thanks @cxbasdev. - GPT-5.5 and other models can send valid streaming events larger than 64 KiB through ChatGPT Responses without failing the request, while malformed unbounded streams remain limited. [#98198](https://github.com/openclaw/openclaw/pull/98198) Thanks @marvinthebored, @obviyus, @peetiegonzalez. -- Custom Xiaomi MiMo and other OpenAI-compatible models without a known output limit can now complete chats instead of failing with an invented oversized cap. [#98312](https://github.com/openclaw/openclaw/pull/98312) Thanks @peole, @sanjays2402. +- Custom Xiaomi MiMo and other OpenAI-compatible models without a known output limit can now complete chats instead of failing with an invented oversized cap. [00a8dae](https://github.com/openclaw/openclaw/commit/00a8dae28beae4cef8759d34146f61f0363a680f) Thanks @peole, @sanjays2402. - `openclaw agent --local` now reports a clear first-event timeout when a provider opens a stream but never sends usable output instead of appearing to hang indefinitely. [#98525](https://github.com/openclaw/openclaw/pull/98525) Thanks @osolmaz. - OpenAI-compatible embedding batch downloads now process valid large outputs while stopping oversized files or JSONL records before they can exhaust memory. [#98554](https://github.com/openclaw/openclaw/pull/98554) Thanks @sunlit-deng, @vincentkoc. - Library and integration developers can now install a version-matched package, create independent AI runtimes, and reuse OpenClaw's supported model transports without embedding the full application. [#99059](https://github.com/openclaw/openclaw/pull/99059) @@ -1714,7 +1714,7 @@ Official packages are easier to obtain through the supported [Docker](/install/d - When a Telegram plugin approval cannot be routed, operators now receive practical Web UI, terminal UI, and configuration guidance instead of a generic failure or timeout. [#95973](https://github.com/openclaw/openclaw/pull/95973) Related [#95800](https://github.com/openclaw/openclaw/issues/95800). Thanks @chrisbot2026, @monkeyleet. - Marketplace diagnostics now show whether refresh and entries commands used a hosted feed, a saved snapshot, or a fallback without logging feed secrets. [#96194](https://github.com/openclaw/openclaw/pull/96194) Thanks @giodl73-repo. - Provider plugins that mask text now restore intended values inside tool-call inputs before messages, file operations, and other external actions run. [#97769](https://github.com/openclaw/openclaw/pull/97769) Related [#97761](https://github.com/openclaw/openclaw/issues/97761). Thanks @get-viti, @zoowh. -- Plugin install and update failures now show whether npm exited, was killed, or timed out instead of presenting a blank error that makes valid packages look invalid. [#98497](https://github.com/openclaw/openclaw/pull/98497) Thanks @sanjays2402, @vincentkoc. +- Plugin install and update failures now show whether npm exited, was killed, or timed out instead of presenting a blank error that makes valid packages look invalid. [4dcd95d](https://github.com/openclaw/openclaw/commit/4dcd95d1bcefbd832b3ae8c3bbf180f221b519ef) Thanks @sanjays2402, @vincentkoc. - Plugin and media workflows now handle malformed or truncated ffprobe output without crashing while continuing to read valid video dimensions normally. [#98613](https://github.com/openclaw/openclaw/pull/98613) Thanks @pick-cat. - `/status plugins` now groups disabled plugins by reason, including allowlist, denylist, default, and override decisions, without changing activation behavior. [#99598](https://github.com/openclaw/openclaw/pull/99598) Thanks @masatohoshino. - Plugin authors can now import shared `textResult` and `jsonResult` helpers from `openclaw/plugin-sdk/tool-results` instead of recreating common response shapes. [#99740](https://github.com/openclaw/openclaw/pull/99740) Thanks @romneyda. diff --git a/docs/security/CONTRIBUTING-THREAT-MODEL.md b/docs/security/CONTRIBUTING-THREAT-MODEL.md index 1031cdb75d05..862bae659e23 100644 --- a/docs/security/CONTRIBUTING-THREAT-MODEL.md +++ b/docs/security/CONTRIBUTING-THREAT-MODEL.md @@ -14,7 +14,7 @@ This is for adding to the threat model, not reporting live vulnerabilities. If y ## Ways to contribute -**Add a threat.** Open an issue on [openclaw/trust](https://github.com/openclaw/trust/issues) describing the attack scenario in your own words. Helpful but not required: +**Add a threat.** Open a [documentation issue](https://github.com/openclaw/openclaw/issues/new?template=docs_bug_report.yml) describing the attack scenario in your own words. Helpful but not required: - The attack scenario and how it could be exploited. - Which components are affected (CLI, gateway, channels, ClawHub, MCP servers, etc.). @@ -65,13 +65,12 @@ Threats are mapped to [MITRE ATLAS](https://atlas.mitre.org/) (Adversarial Threa ## Resources - [ATLAS website](https://atlas.mitre.org/) -- [ATLAS techniques](https://atlas.mitre.org/techniques/) -- [ATLAS case studies](https://atlas.mitre.org/studies/) +- [ATLAS data and contribution guide](https://github.com/mitre-atlas/atlas-data) ## Contact - **Security vulnerabilities:** [Trust page](https://trust.openclaw.ai) for reporting instructions, or `security@openclaw.ai`. -- **Threat model questions:** open an issue on [openclaw/trust](https://github.com/openclaw/trust/issues). +- **Threat model questions:** open a [documentation issue](https://github.com/openclaw/openclaw/issues/new?template=docs_bug_report.yml). - **General chat:** Discord `#security` channel. ## Recognition diff --git a/docs/security/THREAT-MODEL-ATLAS.md b/docs/security/THREAT-MODEL-ATLAS.md index 3dbff8314100..c73f529d0a09 100644 --- a/docs/security/THREAT-MODEL-ATLAS.md +++ b/docs/security/THREAT-MODEL-ATLAS.md @@ -10,7 +10,7 @@ read_when: This threat model documents adversarial threats to the OpenClaw AI agent platform and ClawHub skill marketplace. It is a living document maintained by the OpenClaw community. See [Contributing to the threat model](/security/CONTRIBUTING-THREAT-MODEL) for how to report new threats, propose attack chains, or suggest mitigations. -**Key ATLAS resources:** [Techniques](https://atlas.mitre.org/techniques/) | [Tactics](https://atlas.mitre.org/tactics/) | [Case studies](https://atlas.mitre.org/studies/) | [ATLAS GitHub](https://github.com/mitre-atlas/atlas-data) | [Contributing to ATLAS](https://atlas.mitre.org/resources/contribute) +**Key ATLAS resources:** [ATLAS website](https://atlas.mitre.org/) | [ATLAS data and contribution guide](https://github.com/mitre-atlas/atlas-data) --- diff --git a/docs/security/formal-verification.md b/docs/security/formal-verification.md index acf372383545..4fb75ac2398f 100644 --- a/docs/security/formal-verification.md +++ b/docs/security/formal-verification.md @@ -22,7 +22,7 @@ This is **not** a proof that OpenClaw is secure in all respects, and it does not ## Where the models live -Models are maintained in a separate repo: [vignesh07/openclaw-formal-models](https://github.com/vignesh07/openclaw-formal-models). +Models were maintained in a separate repo: `vignesh07/openclaw-formal-models`. That repository is currently unreachable (GitHub returns "Repository not found" as of this writing). If it is still broken for you, ask in the OpenClaw maintainer channels for the current location before assuming the models were removed. @@ -36,17 +36,7 @@ That repository is currently unreachable (GitHub returns "Repository not found" ## Reproducing results -Clone the models repo and run TLC: - -```bash -git clone https://github.com/vignesh07/openclaw-formal-models -cd openclaw-formal-models - -# Java 11+ required (TLC runs on the JVM). -# The repo vendors a pinned tla2tools.jar and provides bin/tlc plus Make targets. - -make -``` +Reproduction instructions are unavailable while the previously documented models repository is not publicly reachable. Ask in the OpenClaw maintainer channels for a verified current location before attempting the targets below. There is no CI integration back into this repo yet; a future iteration could add CI-run models with public artifacts (counterexample traces, run logs) or a hosted "run this model" workflow for small bounded checks. diff --git a/docs/tools/acp-agents-setup.md b/docs/tools/acp-agents-setup.md index 9e3f45189d04..9385aec00302 100644 --- a/docs/tools/acp-agents-setup.md +++ b/docs/tools/acp-agents-setup.md @@ -37,7 +37,7 @@ Built-in acpx harness aliases (from the pinned `acpx` dependency): | `cursor` | [Cursor CLI](https://cursor.com/docs/cli/acp) (`cursor-agent acp`) | | `droid` | [Factory Droid](https://www.factory.ai) | | `fast-agent` | [fast-agent](https://fast-agent.ai) | -| `gemini` | [Gemini CLI](https://github.com/google/gemini-cli) | +| `gemini` | [Gemini CLI](https://github.com/google-gemini/gemini-cli) | | `iflow` | [iFlow CLI](https://github.com/iflow-ai/iflow-cli) | | `kilocode` | [Kilocode](https://kilocode.ai) | | `kimi` | [Kimi CLI](https://github.com/MoonshotAI/kimi-cli) | @@ -45,7 +45,7 @@ Built-in acpx harness aliases (from the pinned `acpx` dependency): | `mux` | [Mux](https://mux.coder.com) | | `opencode` | [OpenCode](https://opencode.ai) | | `openclaw` | OpenClaw ACP bridge (native `openclaw acp`) | -| `pi` | [Pi Coding Agent](https://github.com/mariozechner/pi) | +| `pi` | [Pi Coding Agent](https://github.com/earendil-works/pi) | | `qoder` | [Qoder CLI](https://docs.qoder.com/cli/acp) | | `qwen` | [Qwen Code](https://github.com/QwenLM/qwen-code) | | `trae` | [Trae CLI](https://docs.trae.cn/cli) |