Expose opt-in replyToMode off while retaining threaded replies by default. Keep incoming thread/session identity and explicit tool or CLI targets intact. Resolves#120339. Thanks to @Alfridus1 for the report.
* feat(reef): operator-configurable sharing rules for the guard
Adds channels.reef.guard.rules with capped outbound/inbound free-text
policy. Rules ride the trusted instruction side of the guard call only,
may tighten decisions or explicitly allow otherwise-review cases, and can
never override the deny floor or deterministic checks. The rules text is
hashed into the effective policy version so audit rows and pending review
approvals bind to the exact policy in force.
* fix(reef): full rules digest in policy identity; align blank-rule validation
ClawSweeper review fixes: use the untruncated sha256 rules digest in the
effective policy version so approvalDigest stays collision-resistant, and
express identical non-blank (\S) rule validation in the zod schema, the
manifest JSON Schemas, and the generated channel metadata instead of a
trim-transform mismatch.
* refactor(imap): consume the core identifier-authentication scale
Use the SDK type and canonical strength comparator instead of the private
SenderStrength vocabulary and index ordering. Bind config values to the SDK
union with a compile-time exhaustiveness check, preserving all config keys.
Classify unproven From ownership, including no-evidence and DMARC temperror
results, as unverified. Only an explicit unverified minimum gains admission;
the default verified floor and asserted minimum keep their behavior. Keep
existing token admission and thrown-authenticator retries unchanged.
Document the remaining mutable token/early-rejection paths and expose only
the canonical comparator through the SDK, with packaged-consumer coverage.
The IMAP introduction has no stable release contract.
* docs(security): record landed sender-auth mitigations in the threat atlas
Record the graded exact-pair identifier-authentication gate and inert mutable
allowFrom audit findings. Mark R-008 implemented in core while retaining
per-channel verified adoption and downstream mappers as remaining work.
Keep the existing atlas structure and Medium residual risk.
After a reconnect lost the chat.send ack, the outbox reconcile only accepted
the transcript idempotency marker as delivery proof, so a send whose run was
actively streaming parked as a red 'Delivery uncertain' composer chip for the
whole run. The reconcile now also retires a queued send when the session row
reports its run id in activeRunIds or as lastRunId — the same fact live
terminal-event retirement already trusts.
Attempted unconfirmed messages now stay in the conversation as ordinary
bubbles with an amber 'Delivery unconfirmed · Retry' footer (failed keeps the
red 'Not sent'); the duplicate pane banner is suppressed for them since the
bubble owns the outcome. Command chips, never-attempted failures, and storage
errors keep their existing surfaces. Calmer copy for the remaining honest
uncertainty case.
* fix(twitch): retain native sender identity in execution audits
Forward the registered channel runtime and actual account identity, keeping native participants distinct from role authorization. Normalize the all role at the Twitch policy producer and preserve unknown and disabled-collection paths.
Cover actual registered-plugin ingress and native reply delivery, and drain asynchronous monitor test work before cleanup. Related to #122863; no shared authorization or storage change.
* test(twitch): track the registered context builder in inventory
* test(twitch): honor host and plugin contract boundaries
Run hidden Skill Workshop reviews on a private detached session so foreground messages stay responsive and isolated. Preserve prompt-cache affinity, remove closed delivery authority, and retire queued evidence before asynchronous preparation.
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
Declare the Gemini Chat Completions transport and request compatibility in the owning model manifest. Remove the private metadata decoration loop so static catalog selection and forward-compatible synthesis use the same declared contract.
Introduce on admitted bot joins using the existing sealed no-tools turn and durable room dedupe. Matrix uses room metadata and readable history; LINE uses group names and explicitly unavailable history.
Mark Matrix bridge membership provenance without changing existing event delivery, invite handling, or auto-join. Exclude startup snapshots and already-joined profile updates, including startup connection recovery.
Simplify snapshot budget accounting while preserving prompt bytes, metadata order, and oldest-first message dropping. Add channel config, docs, and regression coverage.
* feat(configure): surface the trusted-proxy loopback opt-in with its warning
Ask for explicit consent before enabling same-host trusted-proxy authentication,
and explain the runtime rejection when consent is declined. Preserve existing
loopback consent and unprompted device enrollment policy on same-mode reruns.
Reuse runtime loopback classification, add English and Chinese wizard copy,
and document the consent and preservation behavior.
* test(configure): assert wizard auth through the real builder
Remove the auth-builder mock and replacement factories so gateway prompt tests verify returned configuration across proxy, token, password, and SecretRef flows. Retain all consent regressions while reducing test scaffolding and reusing tracked environment cleanup.
* fix(openshell): preserve nested host symlinks during mirror sync
Reconcile mirror entries recursively so trusted host symlinks and their ancestors survive remote edits and deletions. Preserve unlink-before-copy hardlink safety and drain pending filesystem work before returning an error. Cover the repair with unit regressions and the real OpenShell E2E flow.
Fixes#131111
* chore(openshell): satisfy mirror callback lint rules
* feat(security): warn on inert mutable allowFrom entries
Report configured entries that cannot authorize with name matching disabled,
and preview lockout counts before disabling mutable matching. Distinguish
mutable aliases from exact identifiers with unproven ownership in audit text.
Reuse channel ingress declarations through one SDK classifier without changing
admission policy. Keep Discord audit findings redacted and exclude symbolic
access-group references from mutable-identifier warnings.
Refs #131099.
* test(security): keep entry-authentication audit coverage in its lanes
* fix(canvas): retire the legacy document root only after migration completes
* fix(canvas): preserve older migration roots and canonical aliases
Read both historical host locations with shipped plugin precedence.
Select legacy config owners from existing manifest metadata for doctor,
without broadening session-store ownership. Recognize realpath aliases
of canonical storage and cover persisted partial repairs and retries.
* fix: honor scenario drivers in generated QA commands
Carry declared driver requirements through coverage search, grouping and quoted command output. Preserve unconstrained defaults and validate generated arguments through real CLI parsing and canonical lane selection. Closes#131088.
* test: capture generated QA commands through the shell
* fix(device-pair): verify retained subscribers before archiving the migration source
Precheck remaining namespace capacity before importing legacy subscribers. Verify source and pre-existing destination keys in the shared JSON importer before reporting completion or archiving, preserving the source and warning when retention falls short. Keep runtime caps, eviction policy, and registration semantics unchanged.
Prepared for draft PR maintainer review. Review-required: persistent-state retention semantics.
* fix(device-pair): omit absent subscriber migration fields
Keep absent account and thread fields out of normalized legacy subscribers so the strict plugin-state JSON serializer accepts ordinary subscriptions. Preserve numeric zero thread IDs and exercise all optional target combinations through the real migration contract.
* fix(onboard): preserve the remote gateway TLS pin for an unchanged endpoint
* fix(onboard): honor discovery transport when preserving remote settings
Carry the discovery URL, transport, and optional pin together so a trusted Direct choice overrides saved SSH transport and a new manual tunnel cannot retain an old route behind the same loopback URL. Keep manual same-endpoint pin preservation and existing auth scoping.
Strengthen the explicit-absent origin assertion, restore test-owned environment keys, and document the discovery override behavior.
Share name-first, ambiguity-aware hook selection with toggles and carry the selected hook to rendering and exit status. Preserve unique keys, missing-hook output, plugin-managed inspection and mutation policy. Closes#131075.
* fix(network): release captured streams without waiting on their cleanup
End best-effort reader ownership before guarded request cleanup, while preserving explicit cancellation failures after cleanup. Simplify llama download reader ownership without changing transport abort policy.
Co-authored-by: zhang-guiping <zhang.guiping@xydigit.com>
* fix(network): preserve caller-owned response cleanup
Preserve cancellation for partially consumed media responses, type the captured response handoff, and clarify beta stream cleanup ownership.
* fix(tts): settle stream cancellation with request cleanup
Own binary-stream cleanup in the shared helper and remove duplicate provider release wrappers. Preserve explicit cancellation settlement and errors while allowing cleanup to abort retained capture branches.
Co-authored-by: zhang-guiping <zhang.guiping@xydigit.com>
* test(tts): preserve cancellation result tuple types
Keep both cancellation/release call orders while passing an explicit two-result tuple to Promise.allSettled. Preserve the existing outcome and error-identity assertions without casts or non-null assertions.
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
Bridge paragraph before the enterprise properties: same product spans one
laptop to hardened team deployment, configuration is the only difference,
and the enterprise checklist protects a single operator for free. Adds a
read_when bullet for the reader asking whether enterprise depth makes
OpenClaw heavyweight for personal use.
* fix(tooling): avoid shared tsx cache startup stalls
Use the shared preloader before tsx initializes so maintained build, check, and test commands retain memory transforms without scanning other checkouts' disk caches. Preserve changed-cwd forks and copied tooling closures.
* test: align command contracts with tooling bootstrap
Preserve missing-source and intentional parser-null skips while forwarding other read and JSON parse errors to the existing Doctor warning boundaries. Keep plugin import, archive, and persistence behavior unchanged.
* feat(ui): show activity cards for online people
Record live person timing independently of heartbeat freshness and expose keyboard- and touch-accessible cards with visible session links. Preserve continuous online intervals across overlapping tabs without adding persistent activity history.
Closes#130649
* build(protocol): refresh generated presence timing fields
* fix(gateway): scope presence snapshots to read-access operators
Apply one recipient projection to hello, system-presence, and events. Keep person timing and time-zone details behind read access, and filter watched references with the canonical session-list policy without leaking hidden counts. Preserve idle-person metadata for readers and prevent non-reader activity-driven frames.
* fix(plugins): preserve Gateway capability load context
Carry the owning registry's metadata generation, workspace, install records, and built-artifact preference through capability discovery. Preserve standalone source loading and existing speech eligibility while avoiding synchronous source transforms on cold Talk catalog requests.
Fixes#130777
* test: align integrated presence and capability coverage
Keep the recipient matrix in its timing-aware owner, close the suite-owned Gateway for shutdown proof, and spy on the canonical install-record reader. Remove the retired private carrier's assertion allowance.
* fix(gateway): broadcast presence when clients connect
Publish completed connection rows through the canonical scoped broadcaster so established readers see first connections and reconnects without waiting for profile edits or activity. Preserve shared online intervals and reset them only after the final socket closes.
* fix(ci): align presence fixtures and sidebar type ownership
Reuse the canonical sidebar host type to remove the type-only lazy-runtime cycle. Assert omitted scopes through hello auth and denied presence reads, and supply presence version callbacks in the shared WebSocket context fixture. Retain startup admission and drain assertions without changing deadlines.
* fix(ui): retain latest scroll commands until their destination
Do not treat the virtualizer's idle debounce or a decreasing offset as reader takeover. Settle at the actual DOM end within one pixel, retaining the separate eight-pixel UI-follow policy and explicit input cancellation. Cover retargeted idle delivery and near-end precision with the real dependency, synchronize pointer baseline capture, and type the existing composer snapshot as its textarea contract.
Fixes#130892
Validate newly authored delivery before inherited main-session cleanup,
reusing the canonical delivery and failure-destination validators.
Keep webhook edits, explicit no-delivery and clear-only requests valid.
Cover atomic rejection through Gateway and document the supported flow.
Fixes#119922. Preserves and simplifies the repair from #119923.
Co-authored-by: Peter Steinberger <steipete@gmail.com>
Co-authored-by: zyw02 <zyw02@users.noreply.github.com>
* fix(channels): keep configured accounts in JSON inventory
Keep metadata-only inventory independent of setup-runtime eligibility, while retaining setup precedence and failure visibility. Let status audits resolve channel capabilities at the audit owner instead of treating inventory metadata as complete adapters.
Fixes https://github.com/openclaw/openclaw/issues/130700
* test(status): align JSON audit owner expectations
Restore existing null-workspace and invalid-heartbeat repairs for canonical agent entries. Share roster traversal while preserving the reachable legacy-list path when include ownership blocks migration, and verify snapshot-to-repair persistence and convergence.
Allow low-memory local-memory setups to install only the verified managed server and embedding model while preserving every configured chat route.
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
* fix(browser): resolve unnamed role refs and initialize AX markers
Keep explicit raw ARIA empty names distinct from omitted serializer names and share one dependency-faithful role lookup. Bind the DOM document in the marker-owning CDP session without adding a round trip.
Related: #130879. The separate snapshot membership and ordering failures remain open.
* chore(browser): shrink ref assertion safety baseline
Record the five type assertions removed by the ref-name repair. Tighten the canonical per-file allowance from seven to two; runtime and browser-test bytes are unchanged.
* feat(channels): add identifier authentication kernel
* fix(channels): preserve exact identity provenance
* fix(channels): fail strict dynamic groups closed
* fix(channels): bind plugin allowlists to exact identity fields
Move the Twitch role normalizers into the kernel branch and keep Discord
name and tag entries on their corresponding identity fields. Repair the
same mismatch for Slack name slugs and IRC nick@host entries.
Add regressions at the channel authorization boundaries.
Related: #123782
Co-authored-by: Omar Shahine <10343873+omarshahine@users.noreply.github.com>
* refactor(channels): resolve identifier authentication at intake
Keep raw SDK inputs optional and carry required authentication through
normalized kernel subjects, entries, and state. Resolve static claims at
intake and floor omitted fields in a supplied per-message map to unverified.
Remove the deprecated internal policy wrapper, downstream strength
fallbacks, and unused type exports. Cover the partial-map floor, static
claims, and mutable alias behavior, and document the map contract.
Related: #123782
* fix(channels): retain affected admission contributions
Preserve an authentication effect when other admission contributions were
not evaluated. Prefer any affected result, then any evaluated result,
before checking for uniformly unevaluated contributions.
Cover the mixed case through the existing redacted receipt flow.
Related: #123782
* test(twitch): await monitor delivery before resetting mocks
Make the ingress fixture drain accepted deliveries on stop, matching the
real monitor lifecycle. Await those deliveries directly so prefix and
reply assertions cannot race or leak completions into the next case.
Related: #123782
* fix(feishu): match ambiguous allow entries under both id fields
---------
Co-authored-by: Omar Shahine <10343873+omarshahine@users.noreply.github.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix: preserve native session ownership during cleanup and attachment
Prepare permitted harness owners for offline session deletion. Reject direct
attachment of parent-controlled Codex children before displacing ownership.
Keep deadline and client authority through binding publication, and release
accepted subscriptions when publication fails without a remaining owner.
Unify conversation create/attach and preserve observational child monitoring.
Verified 950 focused/sibling tests, production and test types, independent
Codex review, and the real built offline CLI capacity reproduction.
* test: avoid shadowing the native binding row
Peter Steinberger