44736749eb
feat(skills): custodian-only skill library (first wave) ( #126186 )
...
* feat(skills): add custodian-only skill library
* docs: document custodian skill library
* refactor(skills): make custodian skills concrete and non-interactive
Replace docs-link-first playbooks with verified openclaw config/message/infer
one-liners; drop interactive onboard references; encode the in-session
config-write policy boundary (models.*/secrets.* via trusted shell).
* fix(skills): corrections from live A/B testing of custodian skills
--agent required for models list/auth list in multi-agent rosters; drop
hanging channels capabilities probe; telegram target is chatId; roster-safe
prove via agent turn (infer model run has no --agent and dead-ends
multi-agent setups); note expected not-found on pre-setup config get.
* fix(skills): front-load harness plugin check in add-model-provider Gather
A/B timing showed the codex plugin dependency surfacing mid-Prove, at the
most expensive point (approval gate + turn boundary). Checking and
remediating during Gather removes the stall.
* fix(skills): keep status inventory unfiltered while scoping custodian source
buildWorkspaceSkillStatus forwarding agentId activated the loader's agent
allowlist filter, dropping excluded skills from the workshop's status view
(collection-review regression on CI). New closed agentSkillFilter mode lets
agentId scope custodian-source discovery without filtering the entry list,
per the documented status invariant.
2026-08-19 00:33:02 -07:00
47442197a1
feat(ui): review install policy warnings ( #120900 )
...
* feat(ui): review install policy warnings
* fix(ui): keep install feedback on runtime plugin
2026-08-15 13:07:02 +10:00
bf40269cb7
feat(security): require acknowledgement for policy warnings ( #116489 )
2026-08-15 03:58:45 +10:00
bdf202ccc8
feat(skills): reconcile learned skill collections ( #121653 )
...
Replace divergent per-skill curation with one daily isolated collection review that can consolidate, rewrite, create, and drop writable skills atomically.
Autonomous auto mode remains automatic. Adds bounded review, transactional recovery, durable cadence, shared locking, and reuse-first /learn behavior.
Co-authored-by: Ayaan Zaidi <hi@obviy.us >
2026-08-11 02:06:26 +05:30
914f73ac99
docs: replace retired config keys with canonical schema keys ( #121330 )
2026-08-09 20:30:43 -07:00
804ae7f121
fix(security): stop recommending retired install-policy bypasses ( #120011 )
...
* fix(security): align install policy path contract
* test(security): align install policy wording
* style(security): format install policy test
* fix(security): identify failing install policy path
* test(security): track Windows ACL temp dirs
2026-08-06 18:45:18 -07:00
8fd49c84aa
feat: make self-learning automatic by default ( #115576 )
...
* feat: make self-learning automatic by default
* fix: preserve capture authorization boundaries
* test: split autonomous capture coverage
2026-07-29 02:04:57 -04:00
bb657eec93
refactor(config): retire redundant settings ( #113174 )
...
* refactor(config): retire redundant settings
* style: apply current formatter
* chore: update plugin sdk baseline
* fix: keep Codex tool caps context-aware
* chore: remove stale imports
* test: align WhatsApp QA debounce config
* fix(config): clean up retired config checks
* fix(ci): align config cleanup checks
2026-07-23 17:45:02 -07:00
edecdbd05e
refactor(config): config-surface reduction tranche 3 — product consolidations (review request) ( #111527 )
...
* refactor(config): consolidate media model lists
* refactor(config): unify memory configuration
* refactor(config): consolidate TTS ownership
* refactor(config): move typing policy to agents
* refactor(config): retire product-level config surfaces
* refactor(config): share scoped tool policy type
* chore(config): refresh generated baselines
* fix(config): honor agent typing overrides
* fix(config): migrate sibling config consumers
* refactor(infra): keep base64url decoder private
* fix(config): strip invalid legacy TTS values
* chore(config): refresh rebased baseline hash
* fix(doctor): route legacy messages.tts.realtime voice to talk during tts move
* refactor(config): polish final layout names
* refactor(config): freeze retired tuning defaults
* feat(config): add fast mode default symmetry
* refactor(config): key agent entries by id
* docs(config): update final layout reference
* test(config): cover final layout migrations
* chore(config): refresh final layout baselines
* fix(config): align final layout runtime readers
* fix(config): align remaining readers
* fix(config): stabilize final layout migrations
* fix(config): finalize config projection proof
* fix(config): address final layout review
* docs(release): preserve historical config names
* fix(config): complete keyed agent migration
* fix(config): close final migration gaps
* fix(config): finish full-branch review
* fix(config): complete runtime secret detection
* fix(config): close final review findings
* fix(config): finish canonical docs and heartbeat migration
* fix(config): integrate latest main after rebase
* refactor(env): isolate test-only controls
* refactor(env): isolate build and development controls
* refactor(env): collapse process identity indirection
* refactor(env): remove duplicate config and temp aliases
* docs(env): define the operator-facing allowlist
* ci(env): ratchet production variable count
* fix(env): remove stale provider helper import
* fix(env): make ratchet sorting explicit
* test(env): keep test seam in dead-code audit
* test(env): cover ratchet growth and boundary; document surface budgets
* docs(config): document tier-eval consolidations
* docs(config): clarify speech preference ownership
* test(memory): align retired tuning fixtures
* refactor(memory): freeze engine heuristics
* refactor(config): apply tier-eval tranche
* refactor(tts): move persona shaping to providers
* refactor(compaction): move prompt policy to providers
* test(config): align hookified prompt fixtures
* chore(deadcode): classify test-only exports
* chore(github): remove unused spawn helper
* chore(deadcode): classify queue diagnostics
* chore(deadcode): remove unused lane snapshot export
* chore(plugin-sdk): ratchet consolidated surface
* fix(config): integrate latest main after rebase
2026-07-21 20:28:43 -07:00
3976ec47d3
fix: default skill workshop approvals to auto ( #107690 )
...
Skill Workshop lifecycle actions now run without an additional Gateway approval by default, while explicit `approvalPolicy: "pending"` keeps the operator approval gate.
Prepared head SHA: 06e907797e165377636+shakkernerd@users.noreply.github.com >
Reviewed-by: @shakkernerd
2026-07-14 18:31:51 +01:00
32c84b0f41
feat(skills): capture reusable techniques from successful work ( #105674 )
...
* feat(skills): capture reusable experience safely
* feat(skills): review completed work for reusable learning
* docs(skills): explain self-learning
* docs: clarify self-learning runtime scope
* fix(skills): harden autonomous workshop reviews
* test(skills): align review prompt fixture
2026-07-13 00:22:06 -07:00
f33ab243cf
fix(sqlite): reject runtimes vulnerable to WAL corruption ( #106065 )
...
* fix(sqlite): require WAL-reset-safe Node runtime
* docs(sqlite): document safe Node runtime floor
* fix(sqlite): defer runtime library validation until use
* fix(ci): align startup memory with Node 24.15
2026-07-13 13:59:00 +08:00
f7d7148cf0
docs: rewrite published docs grounded in current source ( #100142 )
...
Source-grounded rewrite of 529 published docs pages with per-unit information-loss verification: 1,713 factual corrections cited to src/**, generated surfaces regenerated, frontmatter titles preserved for i18n, release notes pages untouched. All docs gates green.
Closes #100141
2026-07-05 00:32:47 -04:00
f5d0c370d6
fix(security): warn on agent skill MCP boundary drift ( #98352 )
...
Summary:
- Merged fix(security): warn on agent skill MCP boundary drift after ClawSweeper review.
Automerge notes:
- No ClawSweeper repair was needed after automerge opt-in.
Validation:
- ClawSweeper review passed for head ab3c29ef4cab3c29ef4chttps://github.com/openclaw/openclaw/pull/98352#issuecomment-4850104358
Co-authored-by: momothemage <niuzhengnan@163.com >
Approved-by: momothemage
2026-07-01 03:56:28 +00:00
6b0525f237
fix: gate Skill Workshop symlink writes
2026-06-11 15:20:38 +01:00
287b10a895
feat(skills): allow trusted workshop symlink targets
2026-06-11 15:20:38 +01:00
154f439c81
Add operator install policy and remove dangerous-code install scanners ( #89516 )
...
* feat: add operator install policy
* test: cover plain-file plugin install code
* fix: preserve locationless install policy findings
* refactor: remove install-time plugin scanner
* test: remove stale plugin install helper
* fix: preserve before-install builtin scan type
* fix: preserve plugin dependency denylist
---------
Co-authored-by: Mainframe <mainframe@MainfraacStudio.localdomain >
2026-06-03 14:17:29 -07:00
5976f14832
docs(skills): full rewrite of skills section with Mintlify components
...
Rewrites all skills documentation pages with rich Mintlify components
(Steps, CardGroup, AccordionGroup, ParamField, Note, Warning, Tip) and
code-verified accuracy throughout.
- tools/skills.md: CardGroup quick-nav, verified precedence table from
workspace.ts, Security accordions, Steps for env injection, token
impact formula, Related CardGroup
- tools/creating-skills.md: Steps walkthrough, gating accordion,
propose-update command (was missing), Best practices Tip, ClawHub
publish flow, Related CardGroup
- tools/skills-config.md: ParamField for every config key, agent
allowlist section, Workshop config, sandbox Warning
- tools/slash-commands.md: CardGroup for 3 command types, command tables
in AccordionGroup sections, ParamFields for all config keys, dedicated
sections for /tools /model /config /mcp /debug /plugins /trace /btw
- prose.md: Steps for install, CardGroup quick-nav, AccordionGroup for
state backends, runtime mapping table
docs.json: adds skill-workshop nav entry and redirects
(/skill-workshop, /tools/skills-workshop -> /tools/skill-workshop)
2026-05-31 12:57:16 +01:00
5a8bb1a7d2
docs: add Skill Workshop guide
2026-05-31 09:05:03 +01:00
43e4b9dc1c
fix: keep autonomous skill capture opt-in
2026-05-30 20:04:52 +01:00
3a9e7dfa1a
fix: bound skill workshop descriptions
2026-05-30 20:04:52 +01:00
e4905ce4c9
fix: enforce skill workshop proposal bounds
2026-05-30 20:04:52 +01:00
3037646d22
feat: add skill workshop runtime policy
2026-05-30 20:04:52 +01:00
045a581069
fix(sandbox): honor explicit docker env ( #82763 )
...
* fix(sandbox): honor explicit docker env
* docs(changelog): note sandbox env fix
2026-05-16 17:36:05 -05:00
cca4f3c63c
fix(skills): trust managed skill symlink roots
2026-05-14 22:11:01 +01:00
d832ad214c
[Feat] Add upload archive install RPC ( #74430 )
...
* feat(skills): add upload archive install RPC
- src/agents/skills-archive-install.ts:83 [BOT-SCOPE]: `withExtractedArchiveRoot()` still returns unstructured extract failures, so exact transient-vs-terminal classification should be moved into the shared install-flow layer in a follow-up rather than expanding this PR.
Signed-off-by: samzong <samzong.lu@gmail.com >
* fix(skills): address archive upload review findings
Signed-off-by: samzong <samzong.lu@gmail.com >
* fix(skills): regen protocol bindings and classify transient archive errors
* feat: gate uploaded skill installs by config
* test: add docker skill install proof
* docs: clarify uploaded skill archive gate
* chore: refresh config docs baseline
* style: format docker e2e plan test
* fix: use fs-safe path checks for skill archives
* fix: classify skill publish failures as unavailable
* test: update skill clawhub path mock
* fix: pass mutable archive root markers
* fix: use current json dir mode option
* test: satisfy skill upload lint
* test: refresh core support expectations
---------
Signed-off-by: samzong <samzong.lu@gmail.com >
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-05-09 20:44:18 -04:00
50cb027a88
docs: document trusted skill symlink targets
2026-05-09 14:59:34 +01:00
5618a8f8f6
feat: allow trusted skill symlink targets
2026-05-09 14:43:54 +01:00
eb4d654796
docs: typography hygiene across 6 pages (start/tools/nodes/mac/platforms)
2026-05-05 23:14:49 -07:00
180e295dc6
docs(tools): rewrite loop detection, code execution, and tighten elevated/skills
...
Loop detection (docs/tools/loop-detection.md): substantial rewrite.
Fixed the post-compaction guard default story — the guard runs whenever
tools.loopDetection.enabled is not explicitly false, even with no
config block at all (verified in src/agents/pi-embedded-runner/run.ts
near line 800: 'enabled: resolvedLoopDetectionConfig?.enabled !==
false'). The previous doc framed it as opt-in. Added the missing
unknownToolThreshold field (default 10) sourced from
src/config/schema.help.ts, a complete fields table, and a CardGroup
related links section.
Code execution (docs/tools/code-execution.md): rewrote with
Steps-driven setup, code-verified defaults from
extensions/xai/src/code-execution-shared.ts (default model
grok-4-1-fast, default timeout 30 s, optional maxTurns), the
missing_xai_api_key structured error documented as JSON, and a
properties summary table. Replaced the trailing bullet list with a
CardGroup pointing at exec, exec-approvals, web tools, and the xAI
provider page.
Elevated (docs/tools/elevated.md): converted Related to a CardGroup
and added a Note that the bash chat command (! prefix / /bash alias)
also requires tools.elevated, sourced from
src/config/schema.help.ts:1375.
Skills config (docs/tools/skills-config.md): renamed the
'Sandboxed skills + env vars' subhead to remove the brittle '+'
character per docs/CLAUDE.md, promoted the host-only env warning to a
Warning block so the most common skill-config footgun stays visible,
and converted Related to a CardGroup including a config-reference
link.
2026-05-05 16:49:29 -07:00
6667f66fd8
docs(tools): add Related sections and unify See also to Related
2026-04-23 15:41:56 -07:00
2777b089b5
docs: normalize frontmatter titles to sentence case
2026-04-23 13:15:17 -07:00
4a2cd533ac
docs: remove duplicate H1 where frontmatter title already sets it
2026-04-23 13:11:14 -07:00
938af16289
docs: deep audit documentation against source
2026-04-23 07:32:58 +01:00
a292cbf46f
docs: clarify optional Docker sandboxing
2026-04-20 19:27:45 +01:00
f2b3b3d912
docs: clarify setup node-manager refs
2026-04-04 13:34:02 +01:00
d24b9088fd
docs: refresh image generation fallback refs
2026-04-04 10:10:32 +01:00
1f660bf930
Docs: document agent skill allowlists
2026-04-03 14:23:05 -04:00
11952457af
Docs: document skill source precedence
2026-03-27 19:05:04 -04:00
654089320b
fix(image): deprecate legacy skill and clarify auth
2026-03-22 18:42:18 -07:00
21c2ba480a
Image generation: native provider migration and explicit capabilities ( #49551 )
...
* Docs: retire nano-banana skill wrapper
* Doctor: migrate nano-banana to native image generation
* Image generation: align fal aspect ratio behavior
* Image generation: make provider capabilities explicit
2026-03-18 00:04:03 -07:00
990d0d7261
docs(image-generation): remove nano banana stock docs
2026-03-17 01:09:58 -07:00
bde9cbb058
docs(secrets): align provider model and add exec resolver coverage
2026-02-26 14:47:22 +00:00
c0a3801086
Docs: document secrets refs runtime and migration
2026-02-26 14:47:22 +00:00
abcaa8c7a9
Docs: add nav titles across docs ( #5689 )
2026-01-31 15:04:03 -06:00
8cab78abbc
chore: Run pnpm format:fix.
2026-01-31 21:13:13 +09:00
9a7160786a
refactor: rename to openclaw
2026-01-30 03:16:21 +01:00
aced5dde8d
docs: switch skill metadata key to moltbot
2026-01-28 01:32:53 +01:00
6d16a658e5
refactor: rename clawdbot to moltbot with legacy compat
2026-01-27 12:21:02 +00:00
04ee9e7765
docs: clarify sandbox env + recreate guidance
2026-01-20 15:00:25 +00:00
Peter Steinberger