b067a4dce3
fix(secrets): reject empty secret values and classify oversized input as validation ( #121947 )
2026-08-11 02:30:04 -07:00
d7df852bb4
docs(onboard): fix non-interactive command examples ( #121954 )
...
Align copyable onboarding commands with the mandatory risk acknowledgement and an explicit health disposition for config-only automation.\n\nRefs #121951 .
2026-08-11 01:35:00 -07:00
ea06d72e85
feat(secrets): manage team secrets in Control UI ( #121724 )
...
* feat(secrets): add gateway store settings
* perf(control-ui): trim secrets startup copy
* perf(control-ui): reduce secrets startup payload
* fix(secrets): harden store mutation refresh
* perf(control-ui): meet secrets startup budget
* test(control-ui): update secrets navigation copy
* fix(ui): pluralize secret-detection count and drop duplicated dialog hint
* chore(protocol): regenerate gateway clients and SDK baseline after rebase
* fix(gateway): merge secrets store methods after project RPCs in advertised order
* chore: leave changelog to release generation
* test(gateway): retain desktop launch train coverage
2026-08-11 07:20:38 +00:00
f788af0238
docs(memory): explain automatic QMD migration ( #121911 )
2026-08-10 23:57:34 -07:00
fada067277
feat(browser): add zero-click Chrome extension bootstrap ( #121586 )
...
* feat(browser): add zero-click extension bootstrap
Pre-register deterministic path-derived extension IDs and install a strict native messaging host.
Keep the popup and options UI minimal while removing the obsolete copilot and page-share flows.
* fix(browser): satisfy native bootstrap CI guards
* test(browser): isolate native bootstrap Chrome roots
* test(browser): flush native bootstrap profile before status
* test(browser): seed Linux native bootstrap identity
* fix(browser): preserve native bootstrap upgrade safety
Allow immutable root-owned package inputs while keeping mutable state, manifests, and launchers user-owned. Preserve all retired copilot keys whenever active or unrecognized recovery custody remains.
* fix(browser): preserve pending copilot custody
Retired cleanup now removes copilot state only when the durable registry is exactly empty. Any session, archive, malformed value, future shape, or read failure preserves every retired key.
* fix(browser): guard native bootstrap upgrades
Fail closed while retired copilot custody remains and make discard durable across partial failures.
Require exact launcher-embedded origins and repair full launcher drift without accepting mismatched registrations.
* fix(browser): remove stale layout export
* chore(release): leave changelog to release flow
2026-08-10 19:31:13 -07:00
52e3149ed7
feat(secrets): inject store env into agent exec ( #121773 )
2026-08-10 18:59:32 -07:00
bdf202ccc8
feat(skills): reconcile learned skill collections ( #121653 )
...
Replace divergent per-skill curation with one daily isolated collection review that can consolidate, rewrite, create, and drop writable skills atomically.
Autonomous auto mode remains automatic. Adds bounded review, transactional recovery, durable cadence, shared locking, and reuse-first /learn behavior.
Co-authored-by: Ayaan Zaidi <hi@obviy.us >
2026-08-11 02:06:26 +05:30
a0ad38e71a
feat(docs-ci): validate docs config examples against the schema ( #121336 )
...
* feat(docs-ci): validate config examples against schema
* docs: teach canonical agent roster configuration
* docs: nest inline environment variables under vars
* docs: update canonical media model keys
* docs: remove retired config keys from examples
* fix(docs-ci): keep audit internals private
* feat(docs-ci): validate plugin-owned config examples
* fix(docs-ci): validate indented config fences
* fix(ci): route manifest changes through docs audit
* chore(docs): refresh generated config baselines
2026-08-10 07:57:56 -07:00
f4bac99a81
feat(secrets): add SQLite-backed secret store ( #121559 )
2026-08-10 07:08:40 -07:00
4b0151682e
refactor(commitments): remove inferred follow-up subsystem
...
Remove hidden follow-up extraction, heartbeat delivery, CLI, docs, and supporting tests/tooling. Existing commitment records remain inert pending separately approved cleanup.
Co-authored-by: Ayaan Zaidi <hi@obviy.us >
2026-08-10 13:48:32 +05:30
914f73ac99
docs: replace retired config keys with canonical schema keys ( #121330 )
2026-08-09 20:30:43 -07:00
08507909ed
fix(cli): guard remaining embedded state writers ( #121282 )
2026-08-09 17:09:35 -07:00
055a2dc6ce
feat: continue dashboard sessions from CLI URLs ( #120893 )
...
* feat(cli): ingest session targets
* refactor(ui): remove gateway scope shim
* docs(cli): document session targets
* fix(cli): classify session target failures
* fix(cli): keep session target result private
* fix(cli): simplify timeout option warning
* build: declare session URL contract dependency
* fix(cli): parse bare session URL options symmetrically
* fix(cli): preserve command-owned URL arguments
* build: keep session URL contract build-only
* fix: address session URL review findings
* test: preserve session key mock exports
* fix: keep session URL helpers internal
* fix(tui): preserve URL agent for global sessions
* fix(tui): keep URL agent input internal
* fix(gateway): reconcile websocket protocol owner
* fix(attach): preserve global session agent ownership
* fix(attach): enforce global owner at grant boundary
2026-08-09 16:44:25 -07:00
ce53f7e82e
refactor(agents)!: remove the session write lease ( #121113 )
...
* refactor(agents): remove session write lease
* refactor(plugin-sdk): deprecate session write lease
* refactor(doctor): remove session lock checks
* test(agents): remove session lease fixtures
* test(agents): align writer rebound assertion
* refactor(infra): remove retired session lock exports
* test(tooling): preserve embedded abort race shard
2026-08-09 15:30:48 -07:00
f31d9d8fa9
fix: prevent externally supervised state schema drift ( #121069 )
...
* fix: prevent externally supervised state schema drift
* refactor: isolate schema ownership support code
* test: follow canonical additive column order
* test: keep older schema fixture valid
* fix: preserve additive schema compatibility
* chore: remove release-owned changelog entry
* test: follow schema compatibility owner
* style: format schema compatibility test
* refactor: split sqlite schema sql helpers
* fix: preserve desktop schema compatibility
* fix: preserve ownership gates across platforms
* fix: preserve detached updater long paths
* fix: close external state ownership races
* chore: refresh plugin sdk api baseline
2026-08-09 14:04:40 -07:00
b4104e29b5
fix(sessions): stop active runs before archiving ( #120892 )
...
* fix(sessions): stop active runs before archiving
Archive now fences the exact session, stops and drains active work before commit, preserves main/global-main/unknown protections and Delete behavior, and keeps patchMany per-target ordering.
* test(gateway): provide archive lifecycle context
* test(ui): expect active sessions to remain archivable
* refactor(gateway): keep archive drains internal
* fix(gateway): keep abort lifecycle contract acyclic
* fix(sessions): fence sharing across archive drains
* test(gateway): type archive lifecycle responses
* fix(sessions): reclaim cloud workers before archive
* fix(sessions): align archive request integration
* test(gateway): omit default deferred type
* docs(sessions): clarify cloud archive retries
2026-08-09 09:03:20 -07:00
7422222788
feat(claws): add local project author lifecycle ( #117037 )
...
* feat(claws): add local project lifecycle
* fix(claws): harden local project lifecycle
* fix(claws): harden project source selection
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
Copilot-Session: 3cdcdb00-ade8-4e61-85a7-8151b35f216a
* fix(claws): preserve project archive paths
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085
* fix(claws): harden author lifecycle
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085
* chore(claws): normalize authoring test mode
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085
* fix(claws): normalize archive path spellings
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085
* fix(claws): exclude repository-local sources
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085
* fix(claws): satisfy CI contracts
Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com
Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085
* chore: record CI fix attribution
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085
* fix(claws): reject excluded manifest links
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
Copilot-Session: 3cdcdb00-ade8-4e61-85a7-8151b35f216a
Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085
2026-08-09 03:30:21 -07:00
8b0735e89f
refactor(memory)!: remove the QMD backend; builtin is the only memory engine ( #120936 )
...
* refactor(memory): remove qmd backend
Make builtin the sole memory-core engine, rename the retained session helper barrel, retire QMD config with doctor migrations, and remove QMD runtime/UI/policy surfaces.
* docs(memory): remove qmd backend guidance
Delete the QMD concept page, rewrite memory documentation for builtin retrieval, and remove QMD from navigation and taxonomy source.
* refactor(memory): remove qmd-only leftovers
* refactor(memory): finish qmd integration cleanup
* build(deps): align root string-width types
* build(deps): model root string-width tooling
* refactor(memory): align qmd removal ui and docs
* fix(memory): preserve qmd external paths in doctor
* test(memory): remove obsolete backend probe case
* test(plugin-sdk): refresh private type baseline
2026-08-09 03:05:47 -07:00
917fd92686
feat(cli): openclaw resume attaches the TUI to a recent session ( #120664 )
...
* feat(cli): openclaw resume attaches the TUI to a recent session
Implements docs/plan/runners.md milestone 2.
* fix(cli): resume covers global sessions and preflights TTY
* fix(cli): require a terminal before resume
* fix(cli): adapt resume gateway disconnect state
* fix(cli): preserve global resume ownership
* test(cli): prove qualified global resume crosses the gateway boundary
2026-08-09 02:52:06 -07:00
8ede4046e2
fix(cli): guard embedded agent state ownership ( #120896 )
2026-08-08 23:59:50 -07:00
29a446f886
fix(agents): apply global fast mode to implicit agent ( #120697 )
2026-08-08 13:55:57 -07:00
6f94e7b23d
docs: clarify OpenAI fast mode precedence ( #120682 )
2026-08-08 13:14:10 -07:00
a3094582ff
feat(claws): export reviewed native bootstrap ( #115371 )
...
* feat(claws): export reviewed native bootstrap
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
Copilot-Session: 3cdcdb00-ade8-4e61-85a7-8151b35f216a
* fix(claws): fail export when the package bootstrap drifted
Export re-emitted BOOTSTRAP.md only while the seeded copy was still pending, so
an agent whose bootstrap had been edited, flagged unsafe, or become unreadable
exported a package with no bootstrap at all. That is the same class of silent
loss the managed workspace files already guard against, so treat it the same
way: drifted bootstrap state now fails with `bootstrap_drifted` unless the
author supplies a reviewed `--bootstrap` replacement. A consumed bootstrap
stays a completed lifecycle state and still exports without BOOTSTRAP.md.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
Copilot-Session: 3cdcdb00-ade8-4e61-85a7-8151b35f216a
* fix(claws): bind pending bootstrap export bytes
* fix(claws): preserve current export ownership limits
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
Copilot-Session: 3cdcdb00-ade8-4e61-85a7-8151b35f216a
2026-08-08 12:32:26 -07:00
83900e4683
feat(browser): add relay authentication v2 ( #120526 )
...
* feat(browser): add relay authentication v2
* fix(browser): cap relay test WebSocket payload
* fix(browser): keep relay E2E inside extension boundary
* fix(browser): isolate relay admission and cleanup auth
* fix(browser): finish relay auth migration hardening
* fix(browser): keep preauth transport bounded through teardown
2026-08-08 05:48:24 -07:00
de9314301f
fix(mcp): complete browser OAuth login callbacks ( #120431 )
...
* fix(mcp): complete OAuth loopback login
Co-authored-by: 李琪0668001400 <li.qi16@xydigit.com >
* fix(auth): abort loopback DNS resolution safely
* fix(mcp): move callback wait outside state lease
* fix(plugin-sdk): bind the callback redirect host by default
* fix(plugin-sdk): preserve explicit loopback bind hosts
* fix(ci): satisfy loopback callback type and lint gates
* fix(mcp): bind PKCE state to each login attempt
* refactor(mcp): keep verifier override internal
* test(mcp): preserve split OAuth CLI coverage
---------
Co-authored-by: 李琪0668001400 <li.qi16@xydigit.com >
2026-08-08 03:57:55 -07:00
2c5214f9e8
fix(mcp): listen on the OAuth loopback redirect during mcp login ( #120433 )
2026-08-07 19:29:13 -07:00
7774f9a36c
feat(claws): apply schema-v1 profile requirements ( #115962 )
...
* test(claws): model provenance columns in CLI state mock
* fix(claws): normalize owned upgrade preflight
* fix(claws): normalize owned upgrade preflight
* fix(claws): normalize owned upgrade preflight
* fix(claws): satisfy current validation gates
2026-08-07 18:51:45 -07:00
ae21eb7b93
fix(cron): treat zero sessionRetention as disabled instead of pruning all run sessions ( #120213 )
2026-08-07 17:18:20 -07:00
60fc2fe64d
feat(claws): adopt portable profiles and native bootstrap ( #115237 )
2026-08-07 04:04:51 -07:00
f4387b7a5e
feat(plugins): support the Agent Plugins bundle format ( #120115 )
...
* feat(plugins): support the Agent Plugins bundle format
* docs(plugins): document the Agent Plugins bundle format
* test(agents): preserve agent bundle runtime discovery
* fix(plugins): isolate Agent Plugins data-dir failures and align MCP support reporting
* docs(plugins): list Agent Plugins in the canonical plugin-format guides
* fix(plugins): gate Agent Plugins detection on schema, pure inspection, root-relative cwd
* fix(plugins): record Agent Plugins data-dir ownership explicitly
* docs(plugins): cover Agent Plugins in the CLI install detection guide
* fix(plugins): carry Agent Plugins data-dir and transport contracts through external MCP projections
2026-08-07 02:55:08 -07:00
21e9634f10
fix(node-cli): warn when systemd user lingering is disabled after install ( #118430 )
...
* [AI] fix(node-cli): warn when systemd user lingering is disabled after install
openclaw node install now detects when systemd user lingering is off and
warns the operator (text + JSON) to run 'sudo loginctl enable-linger <user>'.
Without lingering, the user-level node service is torn down when the last SSH
session ends, so the node silently goes offline after logout.
The check is read-only and never auto-enables lingering, matching the
operator-consent policy used elsewhere. It runs only on the verified-success
path: an optional onVerified hook is added to installDaemonServiceAndEmit
that fires after service.isLoaded() confirms the service is loaded and before
the success payload is emitted. The linger diagnostic runs there, so a failed
install or verification failure never carries a linger warning (avoids
misdirecting the operator to fix lingering for a service that was not
successfully installed). The already-installed short-circuit warns separately.
Skipped on non-Linux and when systemd user service is unavailable.
Adds unit tests for both paths, the linger=yes no-op, the install-failure
isolation, the verification-failure no-warn regression, and the
systemd-unavailable skip, plus response.test.ts cases covering onVerified
running on success and failing safely when it throws. The
readSystemdUserLingerStatus mock is typed with the full linger union to
satisfy tsgo. Documents the linger step in docs/cli/node.md and
docs/nodes/troubleshooting.md.
Real-behavior evidence captured on a Linux host by toggling
loginctl disable-linger/enable-linger and running the real install flow:
linger=no emits the warning on successful install (text + JSON) and on the
already-installed path; linger=yes emits nothing; a failed install or
verification failure emits no warning.
Fixes #107033
Co-Authored-By: deepseek-v4-flash <noreply@anthropic.com >
* fix(node-cli): align linger user with service owner
* docs(node): narrow crash-loop claim to gateway units
The duplicate-scope guard that raises on two managers running the same unit
name is enforced for gateway units (two supervisors on the same port SIGTERM
each other in a restart loop); assertNoSystemGatewayOwnership returns early
for node services, so claiming node services crash-loop misattributes gateway
behavior. Qualify the troubleshooting note accordingly.
Addresses ClawSweeper P3 finding on PR #118430 .
* fix(systemd): align linger checks with service owner
* test(doctor): align linger status mock contract
* style(doctor): format linger mock
* test(wizard): mock systemd service account
---------
Co-authored-by: deepseek-v4-flash <noreply@anthropic.com >
Co-authored-by: Patrick Erichsen <patrick.a.erichsen@gmail.com >
2026-08-06 19:28:10 -07:00
01281ad9f8
refactor(browser): remove model-backed page extraction ( #120101 )
...
* refactor(browser): remove model-backed extraction
* docs(browser): remove stale extract reference
2026-08-06 18:32:14 -07:00
d9ffbb3ed6
fix(memory): report persisted vector index state on unprobed status path ( #120048 )
2026-08-06 15:57:49 -07:00
52b8f9be80
fix(plugins): migrate Fish Audio plugin identity ( #119900 )
...
* fix(plugins): migrate Fish Audio plugin identity
* fix(plugins): tighten Fish Audio identity migration
* fix(plugins): follow catalog selector for id replacements
* fix(plugins): reject replacement install collisions
* refactor(plugins): reuse skipped update outcomes
2026-08-06 20:50:36 +08:00
c4292bc8b2
fix(diagnostics): report exporter health in doctor and status ( #119816 )
...
* fix(diagnostics): report exporter health transitions
* fix(diagnostics): retire exporter health on shutdown
* test(diagnostics): enforce OTLP protobuf content type
* test(diagnostics): satisfy exporter test type contracts
* fix(diagnostics): redact endpoint-like exporter codes
* fix(diagnostics): coordinate exporter route health
* test(diagnostics): satisfy exporter health static gates
* fix(diagnostics): keep exporter health internal
2026-08-06 20:50:18 +08:00
ed40d0599b
fix(plugins): keep targeted official updates on the core channel ( #119799 )
...
Co-authored-by: clawsweeper <274271284+clawsweeper[bot]@users.noreply.github.com>
2026-08-06 15:06:49 +08:00
9702134882
fix: settle Gemini CLI auth preparation failures
2026-08-06 01:48:09 -05:00
f461701d00
fix: quarantine expired CLI auth profiles
2026-08-06 01:48:09 -05:00
47591e7b11
docs: document control ui owner handoff
2026-08-06 02:21:45 +01:00
fd1662f49c
fix(cli): retire invalid secret flags and prove doctor recovery ( #118926 )
...
* test(qa): add doctor CLI recovery coverage
* test(qa): secure doctor exec SecretRef proof
* test(qa): gate doctor systemd recovery proof
* test(qa): normalize doctor terminal output
* test(qa): close doctor probe sockets
* test(qa): classify doctor probe as foreign
* test(qa): track doctor probe sockets
* test(qa): retain doctor instance narrowing
* test(qa): preserve observed doctor recovery proof
* test(qa): keep doctor recovery on stable dist
* test(qa): honor Windows exec ACL blocking
* test(qa): use canonical home for systemd recovery
* test(qa): follow bounded gateway recovery
* test(qa): accept lifecycle service label
* test(qa): align doctor recovery contract
Punchcard-Session: crisp-lantern-orchard-nv
* docs(secrets): remove retired provider bypasses
Punchcard-Session: crisp-lantern-orchard-nv
* test(qa): isolate doctor recovery target
Punchcard-Session: crisp-lantern-orchard-nv
* fix(cli): retire invalid secret provider flags
Punchcard-Session: crisp-lantern-orchard-nv
* test(qa): isolate doctor supervisor mode
Punchcard-Session: crisp-lantern-orchard-nv
* fix(plugins): remove dead secret path bypass
Punchcard-Session: crisp-lantern-orchard-nv
* chore: drop release-owned changelog entry
Punchcard-Session: crisp-lantern-orchard-nv
* test(qa): isolate doctor sudo scope
Punchcard-Session: crisp-lantern-orchard-nv
* fix(secrets): remove dead path bypass
Punchcard-Session: crisp-lantern-orchard-nv
* test(qa): isolate systemd user bus
Punchcard-Session: crisp-lantern-orchard-nv
2026-08-05 11:20:23 +08:00
618fba92bf
feat(audit): add execution identity inspection ( #117034 )
...
* feat(audit): add opt-in execution identity inspection
* fix(audit): gate recovery identity retention
* fix(audit): keep recovery identity type private
* test(audit): type internal recovery fixture
* test(audit): split recovery identity coverage
* docs(audit): define operator read trust boundary
* test(qa): register identity scenario child
* fix(audit): enforce shared identity retention bounds
* fix(audit): seal public ingress identity boundary
* fix(audit): keep ingress guard lint-clean
* fix(gateway): preserve advertised method order
* chore(protocol): sync advertised method order
* fix(protocol): encode audit selector invariants
* test(audit): prove exact execution guard
* fix(audit): keep identity storage lazy
2026-08-04 20:05:15 -05:00
25e3b6c9b7
fix(cli): honor local port in gateway call ( #119046 )
2026-08-03 18:50:21 -07:00
1d446ad2cc
fix(plugins): remove stale load paths during uninstall ( #118930 )
...
* test(qa): prove marketplace plugin updates
* fix(plugins): clean exact install load paths on uninstall
* fix(ci): register marketplace lifecycle assertions
2026-08-03 21:57:54 +00:00
108cec388e
fix(skills): provide safe workspace-specific malicious skill remediation ( #118969 )
2026-08-03 14:39:02 -07:00
76cc60a452
docs: correct onboarding risk flags and Google Chat credential shapes ( #118936 )
2026-08-03 13:59:29 -07:00
2efac6c999
feat(cli): add session archive and delete commands ( #118791 )
...
* feat(cli): add session lifecycle commands
* fix(deps): update brace-expansion security pin
* chore: defer session lifecycle release note
2026-08-03 11:00:17 -07:00
7fafaf50f4
fix(onboard): keep referenced provider secrets out of plaintext ( #118702 )
...
* fix(onboard): keep referenced provider secrets out of plaintext
* fix(onboard): retain public credential owner type usage
* docs(onboarding): explain preserved credential profiles in reference mode
2026-08-03 08:34:47 -07:00
1e06fd4430
docs: show canonical agent roster configuration ( #118722 )
...
Co-authored-by: Peter Steinberger <steipete@macos.shared >
2026-08-03 08:24:40 -07:00
d9393bd3cb
fix: make subagent completion delivery durable
2026-08-03 02:48:34 -05:00
8df95ccd08
fix: recover Control UI access after device-auth upgrades ( #118231 )
...
* fix: recover Control UI pairing from dashboard
* test: prove dashboard credential rotation
* test: complete gateway auth generation fixture
* test: restore QR device token verifier
* fix: preserve headless dashboard recovery
2026-08-02 16:40:53 -06:00
Peter Steinberger