6e026c2fe3
fix(gateway): reject unattributable loopback proxy traffic [AI] ( #119950 )
...
* fix(gateway): bind auth limits to ingress attribution
* fix(gateway): close remaining ingress auth gaps
* fix(gateway): carry attribution into new ingress paths
* fix(gateway): close ingress ownership gaps
* fix(gateway): complete proxy ingress hardening
* fix(gateway): stabilize managed Tailscale ingress
* fix(gateway): make Tailscale cleanup ownership-safe
Refuse reset-on-exit publication until Tailscale exposes an atomic owner-bound cleanup operation, and migrate legacy configs with Doctor.
* fix(gateway): finish ingress ownership repair
* fix(gateway): own managed Tailscale route lifetime
Run managed Serve and Funnel routes as foreground claims tied to the Gateway lifecycle. Retire named Service config through Doctor because Tailscale Services cannot run in foreground mode.
Co-authored-by: Pavan Kumar Gondhi <pavangondhi@gmail.com >
* fix(gateway): align Tailscale consumers and build guards
Remove the retired named-service config from Telegram Mini App URL resolution and register the lifecycle worker as an explicit production entry.
Co-authored-by: Pavan Kumar Gondhi <pavangondhi@gmail.com >
* fix(gateway): preserve retired Tailscale inputs
Keep Funnel enabled when removing an ignored named-Service setting and accept the legacy positive reset flag as a no-op now that managed routes always follow Gateway lifetime.
Co-authored-by: Pavan Kumar Gondhi <pavangondhi@gmail.com >
* fix(gateway): preserve Tailscale route diagnostics
Prefer the actionable foreground CLI failure captured during timeout cleanup, and cover the original delayed-failure ordering.
Co-authored-by: Pavan Kumar Gondhi <pavangondhi@gmail.com >
* fix(gateway): reconcile Tailscale ingress with main
Preserve current ingress ownership contracts after the rebase, retire the obsolete device-auth migration check, validate route-owner IPC, and move Tailscale auth coverage onto the managed listener.
Co-authored-by: Pavan Kumar Gondhi <pavangondhi@gmail.com >
* fix(gateway): finish ingress rebase coverage
Unify the rebased net imports and let module-reset WebSocket tests prepare attribution through the same fresh module instance as the handler.
Co-authored-by: Pavan Kumar Gondhi <pavangondhi@gmail.com >
* test(gateway): align run-loop server fixture
---------
Co-authored-by: joshavant <830519+joshavant@users.noreply.github.com >
2026-08-16 21:01:20 -07:00
e647794c20
feat(ui): open bare pair command without a chat turn ( #120855 )
...
Co-authored-by: Patrick Erichsen <patrick.a.erichsen@gmail.com >
2026-08-12 21:09:13 -07:00
f81f9d8570
chore: enforce max-lines suppression ratchet ( #107315 )
...
* ci: enforce max-lines suppression ratchet
* chore: prune stale max-lines suppression
* fix: close max-lines ratchet enforcement gaps
* fix: harden max-lines ratchet checks
* fix(ci): satisfy max-lines ratchet checks
* style: format max-lines declarations
* fix(ci): match oxlint suppression grammar
* test: isolate max-lines git fixtures
* chore: prune resolved max-lines debt
* test: skip newline path fixture on Windows
* fix: harden max-lines suppression ratchet
* chore: refresh max-lines baseline
* fix: close max-lines ratchet bypasses
* fix: derive ratchet base from PR merge tree
* fix: support older Git in staged ratchet
* fix: align max-lines declarations and baseline
* chore: refresh max-lines baseline for current main
* fix: exclude generated wizard locales from max-lines
* chore: prune resolved max-lines debt
2026-07-14 09:27:02 -07:00
938d41014f
feat(mobile): default pairing to full node access ( #105928 )
...
* feat(mobile): default pairing to full node access
* chore: leave release notes to release workflow
* refactor(mobile): bound pairing helpers
* chore(i18n): refresh mobile access inventory
* chore(ci): lower mobile pairing LOC baseline
* fix(mobile): complete pairing validation artifacts
* ci: remove stale transcript target export baseline
* fix(ios): wrap access upgrade guidance
* fix(ios): preserve localized access key
* fix(ci): dedupe read-only SQLite guardrail
* fix(mobile): secure full-access node setup
2026-07-13 02:30:45 -07:00
a4ae95c1c6
fix(device-pair): resolve QR senders by own key ( #101652 )
...
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-09 22:31:07 +01:00
d4b38a2160
fix(device-pair): remove INADDR_ANY and IPv6 unspecified from isLoopbackHost ( #98617 )
...
* fix(device-pair): remove INADDR_ANY and IPv6 unspecified from isLoopbackHost
0.0.0.0 (INADDR_ANY — bind to all interfaces) and :: (IPv6 unspecified)
are NOT loopback addresses. The canonical implementation in
src/gateway/net.ts explicitly excludes both. Classifying them as
loopback in isLoopbackHost causes incorrect behavior in mobile
pairing cleartext host validation.
Co-Authored-By: Claude <noreply@anthropic.com >
* test(device-pair): reject unspecified setup URLs
---------
Co-authored-by: Claude <noreply@anthropic.com >
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-06 23:25:35 +01:00
e80e8a2b67
fix(device-pair): mobile pairing rejects local IPv6 cleartext URLs ( #101008 )
...
* fix(device-pair): allow local IPv6 pairing URLs
* test(device-pair): cover IPv6 cleartext lower bound
2026-07-06 22:35:09 +01:00
862de9f1a1
fix(pairing): advertise reachable Tailnet routes ( #100317 )
...
* fix(pairing): advertise reachable tailnet routes
* fix(pairing): satisfy native and SDK checks
* fix(ios): cancel stale pairing route probes
* test(pairing): document LAN-only Serve fallback
* fix(ios): preserve pairing result initializer
2026-07-05 07:43:43 -07:00
59b08b4693
refactor(shared): consolidate remaining channel lazy loaders ( #99302 )
2026-07-02 19:08:11 -07:00
ba5244c189
fix: advertise route-aware LAN Control UI links ( #98482 )
...
* Route LAN pairing URLs by default route
* Advertise route-aware LAN Control UI links
* Fix route-aware LAN test mocks
* Narrow advertised LAN SDK export
2026-07-01 04:02:12 -05:00
052dc59526
fix: /pair qr fails to show QR code in chat surfaces ( #97933 )
...
* fix(pair): render qr per chat surface
* test(plugin-sdk): update reply helper surface budget
* fix(pair): keep qr metadata internal
2026-06-29 18:17:21 -05:00
4fa5092cdc
docs: document small extension sources
2026-06-04 21:02:07 -04:00
c791e4242b
fix(gateway): gate talk secret bootstrap handoff ( #85690 )
...
Merged via squash.
Prepared head SHA: 9247cdab051540134+ngutman@users.noreply.github.com >
Co-authored-by: ngutman <1540134+ngutman@users.noreply.github.com >
Reviewed-by: @ngutman
2026-05-25 11:34:12 +03:00
827b0de0ce
refactor: reduce plugin sdk surface
2026-05-10 12:37:10 +01:00
36df0d93b9
fix: repair iOS LAN pairing
...
Fix iOS LAN/setup-code pairing policy for #47887 .
- Allow explicit private LAN and .local plaintext ws:// setup/manual connects where policy allows it.
- Keep public hosts, .ts.net, and Tailscale CGNAT plaintext fail-closed.
- Prefer explicit passwords over stale bootstrap tokens in Swift and TypeScript gateway clients.
- Update setup-code/device-pair coverage, docs, and changelog with source credit for #65185 .
Verification:
- pnpm install
- git diff --check origin/main..HEAD
- pnpm exec oxfmt --check --threads=1 src/gateway/client.ts src/gateway/client.test.ts src/pairing/setup-code.ts src/pairing/setup-code.test.ts extensions/device-pair/index.ts extensions/device-pair/index.test.ts
- pnpm format:docs:check
- pnpm test src/gateway/client.test.ts src/pairing/setup-code.test.ts extensions/device-pair/index.test.ts
- cd apps/shared/OpenClawKit && swift test --filter 'DeepLinksSecurityTests|GatewayNodeSessionTests'
- pnpm lint:swift passes with the existing TalkModeRuntime.swift type-body-length warning
Blocked locally:
- iOS app-target xcodebuild tests require unavailable watchOS 26.4 runtime here.
- Testbox check:changed previously failed because the image lacks swiftlint; local swiftlint passes.
2026-05-05 21:07:19 -05:00
37c0520a0b
fix(device-pair): require pairing scope for pair command [AI] ( #76377 )
...
* fix: restrict device pairing command access
* addressing review-skill
* addressing review-skill
* addressing codex review
* address codex review feedback
* addressing codex review
* addressing codex review
* addressing codex review
* addressing codex review
* docs: add changelog entry for PR merge
2026-05-04 22:12:06 +05:30
b2efd19648
fix(ios): harden gateway pairing setup
...
Harden iOS gateway setup-code pairing by rejecting non-loopback plaintext ws:// setup URLs before bootstrap token issuance, consolidating iOS setup parsing, and adding QR scan support from Settings.
Verification:
- pnpm test extensions/device-pair/index.test.ts
- swift test --package-path apps/shared/OpenClawKit --filter DeepLinksSecurityTests
- XcodeBuildMCP OpenClawLogicTests/DeepLinkParserTests
- targeted SwiftLint for touched iOS/OpenClawKit files
- pnpm exec oxfmt --check --threads=1 extensions/device-pair/index.ts extensions/device-pair/index.test.ts
- git diff --check origin/main...HEAD
- GitHub PR checks green on 58e5e60a5c
2026-05-04 02:11:47 -05:00
86fc9e3279
perf: trim gateway startup plugin imports
2026-05-04 07:32:37 +01:00
7c51cd2baf
fix(device-pair): reject invalid remote setup URLs
...
Fail setup-code generation when gateway.remote.url is configured but malformed, instead of falling back to a bind-derived URL and issuing a bootstrap token.
2026-04-29 20:45:33 +01:00
dabf76b3de
fix(device-pair): validate public setup urls ( #74538 )
...
* fix(device-pair): validate public setup urls
* test(cli): cover invalid qr override urls
---------
Co-authored-by: Lucenx9 <185146821+Lucenx9@users.noreply.github.com >
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-04-29 19:47:35 +01:00
1daa552d5f
refactor(qr): share PNG data URL helpers ( #70784 )
2026-04-23 15:41:45 -07:00
43a941b51c
fix(pair): render /pair qr as media ( #70047 )
...
* fix(pair): render pair qr as media
* fix(gateway): preserve media reply threading
* fix(gateway): harden webchat media replies
* fix(plugin-sdk): keep trustedLocalMedia internal
* docs(changelog): note pair qr media fix
* Update CHANGELOG with recent fixes and enhancements
Updated changelog to include recent fixes and enhancements.
2026-04-22 03:31:09 -05:00
18db265ef3
refactor: remove redundant device pair conversions
2026-04-10 22:50:29 +01:00
a93a94788a
refactor: dedupe tlon and voice-call lowercase helpers
2026-04-07 13:44:42 +01:00
775fa78b1e
refactor: dedupe device pair readers
2026-04-07 06:42:34 +01:00
05da802e1c
refactor: split device-pair command helpers
2026-04-04 19:55:04 +09:00
353d93613c
fix: enforce pairing approval scopes
2026-04-04 19:44:43 +09:00
cb0b15a195
fix(pair): guard setup fallback subcommands
2026-04-04 16:24:10 +09:00
9bb97b54fe
fix(pair): fail fast before qr setup lookup
2026-04-04 16:24:10 +09:00
83e5fe5e8b
fix(pair): enforce pairing scope for setup commands
2026-04-04 16:24:10 +09:00
63cbc097b5
refactor(channels): route core through registered plugin capabilities
2026-03-30 01:03:42 +01:00
85cf23a9d6
fix(regression): allow external device pair approvals
2026-03-27 16:07:54 -05:00
4ee4960de2
Pairing: forward caller scopes during approval ( #55950 )
...
* Pairing: require caller scopes on approvals
* Gateway: reject forbidden silent pairing results
2026-03-27 18:55:33 +00:00
ac7ca52090
Gateway: harden Compose-style gateway port parsing
2026-03-24 16:51:36 -07:00
04c69ea3a0
refactor: reuse canonical setup bootstrap profile
2026-03-23 00:15:55 -07:00
a600c72ed7
fix: bind bootstrap setup codes to node profile
2026-03-22 23:57:15 -07:00
6b9915a106
refactor!: drop legacy CLAWDBOT env compatibility
2026-03-22 22:13:39 -07:00
3fe96c7b9e
device-pair: align internal command checks
2026-03-22 17:56:33 -07:00
2fd372836e
iOS: improve QR pairing flow ( #51359 )
...
- improve QR pairing UX and bootstrap token handling
- preserve repeated optimistic user messages during refresh
- add regression coverage for refresh reconciliation
Thanks @ImLukeF
2026-03-21 01:10:29 -05:00
0f56b16d47
Plugins: internalize more extension SDK imports
2026-03-17 10:42:52 -07:00
6f795fd60e
refactor: dedupe bundled plugin entrypoints
2026-03-17 00:14:12 -07:00
86caf454f4
refactor: share device pair ipv4 parsing
2026-03-13 23:35:27 +00:00
212afb6950
refactor: clarify pairing setup auth labels
2026-03-12 22:46:28 +00:00
1c7ca391a8
refactor: trim bootstrap token metadata
2026-03-12 22:46:28 +00:00
bf89947a8e
fix: switch pairing setup codes to bootstrap tokens
2026-03-12 22:23:07 +00:00
04385a61b7
Plugins/device-pair: migrate to scoped plugin-sdk imports
2026-03-04 02:35:12 -05:00
a4850b1b8f
fix(plugins): lazily initialize runtime and split plugin-sdk startup imports ( #28620 )
...
Merged via squash.
Prepared head SHA: 8bd7d6c13b601206+hmemcpy@users.noreply.github.com >
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com >
Reviewed-by: @gumadeiras
2026-03-03 19:58:48 -05:00
4c6dec84a6
Telegram/device-pair: auto-arm one-shot notify on /pair qr with manual fallback ( #33299 )
...
Merged via squash.
Prepared head SHA: 0986691fd4132747814+mbelinky@users.noreply.github.com >
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com >
Reviewed-by: @mbelinky
2026-03-03 22:36:45 +00:00
806803b7ef
feat(secrets): expand SecretRef coverage across user-supplied credentials ( #29580 )
...
* feat(secrets): expand secret target coverage and gateway tooling
* docs(secrets): align gateway and CLI secret docs
* chore(protocol): regenerate swift gateway models for secrets methods
* fix(config): restore talk apiKey fallback and stabilize runner test
* ci(windows): reduce test worker count for shard stability
* ci(windows): raise node heap for test shard stability
* test(feishu): make proxy env precedence assertion windows-safe
* fix(gateway): resolve auth password SecretInput refs for clients
* fix(gateway): resolve remote SecretInput credentials for clients
* fix(secrets): skip inactive refs in command snapshot assignments
* fix(secrets): scope gateway.remote refs to effective auth surfaces
* fix(secrets): ignore memory defaults when enabled agents disable search
* fix(secrets): honor Google Chat serviceAccountRef inheritance
* fix(secrets): address tsgo errors in command and gateway collectors
* fix(secrets): avoid auth-store load in providers-only configure
* fix(gateway): defer local password ref resolution by precedence
* fix(secrets): gate telegram webhook secret refs by webhook mode
* fix(secrets): gate slack signing secret refs to http mode
* fix(secrets): skip telegram botToken refs when tokenFile is set
* fix(secrets): gate discord pluralkit refs by enabled flag
* fix(secrets): gate discord voice tts refs by voice enabled
* test(secrets): make runtime fixture modes explicit
* fix(cli): resolve local qr password secret refs
* fix(cli): fail when gateway leaves command refs unresolved
* fix(gateway): fail when local password SecretRef is unresolved
* fix(gateway): fail when required remote SecretRefs are unresolved
* fix(gateway): resolve local password refs only when password can win
* fix(cli): skip local password SecretRef resolution on qr token override
* test(gateway): cast SecretRef fixtures to OpenClawConfig
* test(secrets): activate mode-gated targets in runtime coverage fixture
* fix(cron): support SecretInput webhook tokens safely
* fix(bluebubbles): support SecretInput passwords across config paths
* fix(msteams): make appPassword SecretInput-safe in onboarding/token paths
* fix(bluebubbles): align SecretInput schema helper typing
* fix(cli): clarify secrets.resolve version-skew errors
* refactor(secrets): return structured inactive paths from secrets.resolve
* refactor(gateway): type onboarding secret writes as SecretInput
* chore(protocol): regenerate swift models for secrets.resolve
* feat(secrets): expand extension credential secretref support
* fix(secrets): gate web-search refs by active provider
* fix(onboarding): detect SecretRef credentials in extension status
* fix(onboarding): allow keeping existing ref in secret prompt
* fix(onboarding): resolve gateway password SecretRefs for probe and tui
* fix(onboarding): honor secret-input-mode for local gateway auth
* fix(acp): resolve gateway SecretInput credentials
* fix(secrets): gate gateway.remote refs to remote surfaces
* test(secrets): cover pattern matching and inactive array refs
* docs(secrets): clarify secrets.resolve and remote active surfaces
* fix(bluebubbles): keep existing SecretRef during onboarding
* fix(tests): resolve CI type errors in new SecretRef coverage
* fix(extensions): replace raw fetch with SSRF-guarded fetch
* test(secrets): mark gateway remote targets active in runtime coverage
* test(infra): normalize home-prefix expectation across platforms
* fix(cli): only resolve local qr password refs in password mode
* test(cli): cover local qr token mode with unresolved password ref
* docs(cli): clarify local qr password ref resolution behavior
* refactor(extensions): reuse sdk SecretInput helpers
* fix(wizard): resolve onboarding env-template secrets before plaintext
* fix(cli): surface secrets.resolve diagnostics in memory and qr
* test(secrets): repair post-rebase runtime and fixtures
* fix(gateway): skip remote password ref resolution when token wins
* fix(secrets): treat tailscale remote gateway refs as active
* fix(gateway): allow remote password fallback when token ref is unresolved
* fix(gateway): ignore stale local password refs for none and trusted-proxy
* fix(gateway): skip remote secret ref resolution on local call paths
* test(cli): cover qr remote tailscale secret ref resolution
* fix(secrets): align gateway password active-surface with auth inference
* fix(cli): resolve inferred local gateway password refs in qr
* fix(gateway): prefer resolvable remote password over token ref pre-resolution
* test(gateway): cover none and trusted-proxy stale password refs
* docs(secrets): sync qr and gateway active-surface behavior
* fix: restore stability blockers from pre-release audit
* Secrets: fix collector/runtime precedence contradictions
* docs: align secrets and web credential docs
* fix(rebase): resolve integration regressions after main rebase
* fix(node-host): resolve gateway secret refs for auth
* fix(secrets): harden secretinput runtime readers
* gateway: skip inactive auth secretref resolution
* cli: avoid gateway preflight for inactive secret refs
* extensions: allow unresolved refs in onboarding status
* tests: fix qr-cli module mock hoist ordering
* Security: align audit checks with SecretInput resolution
* Gateway: resolve local-mode remote fallback secret refs
* Node host: avoid resolving inactive password secret refs
* Secrets runtime: mark Slack appToken inactive for HTTP mode
* secrets: keep inactive gateway remote refs non-blocking
* cli: include agent memory secret targets in runtime resolution
* docs(secrets): sync docs with active-surface and web search behavior
* fix(secrets): keep telegram top-level token refs active for blank account tokens
* fix(daemon): resolve gateway password secret refs for probe auth
* fix(secrets): skip IRC NickServ ref resolution when NickServ is disabled
* fix(secrets): align token inheritance and exec timeout defaults
* docs(secrets): clarify active-surface notes in cli docs
* cli: require secrets.resolve gateway capability
* gateway: log auth secret surface diagnostics
* secrets: remove dead provider resolver module
* fix(secrets): restore gateway auth precedence and fallback resolution
* fix(tests): align plugin runtime mock typings
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-03-03 02:58:20 +00:00
0183610db3
refactor: de-duplicate channel runtime and payload helpers
2026-02-23 21:25:28 +00:00
Pavan Kumar Gondhi