ewilliams28/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-08-16 23:52:40 -06:00
Code Issues Packages Projects Releases Wiki Activity
78,555 Commits 3,962 Branches 352 Tags
fix/github-hovercard-interactive
Commit Graph

77 Commits

Author SHA1 Message Date
Peter Steinberger 914f73ac99 docs: replace retired config keys with canonical schema keys (#121330) 2026-08-09 20:30:43 -07:00
Vincent Koc d194f4b712 fix(sandbox): gate Podman versioned features 2026-07-31 18:29:53 +08:00
Vincent Koc a53caebb6f fix(sandbox): reject unsafe rootless Podman users 2026-07-31 18:02:27 +08:00
sallyom 4ba02b83e8 refactor(sandbox): share container backend with Podman 
Signed-off-by: sallyom <somalley@redhat.com>
 2026-07-31 00:06:33 -04:00
Mrunal Patel 903276c798 Add Podman sandbox backend 
Closes #101348

Adds a bundled podman sandbox backend, SDK helper exports, policy/Codex integration, generated plugin docs, and focused tests.
 2026-07-30 20:20:42 -04:00
Vincent Koc 30346f9788 fix(sandbox): scope runtimes by workspace (#115766) 
Qualify non-shared sandbox identities by resolved workspace while preserving shared runtime names. Existing non-shared runtimes reset once under the new identity.

Related: #51363

Co-authored-by: Tayoun <39609208+tayoun@users.noreply.github.com>
 2026-07-29 16:50:38 +08:00
Vincent Koc 4d439805aa fix(sandbox): reject and migrate browser network none (#115250) 
* fix(sandbox): reject browser network none

* test(ui): reset location after tools panel tests

* chore(sandbox): drop release-owned changelog entry

* fix(config): migrate unsupported sandbox browser network

* fix(sandbox): isolate browser network constant

* fix(config): preserve blank browser network overrides

* chore: leave release changelog untouched
 2026-07-29 06:22:33 +08:00
Vincent Koc 0f41b401fd docs(browser): correct Docker sandbox setup (#115254) 2026-07-28 23:18:40 +08:00
Vincent Koc ac157b3af0 fix(openshell): restore sandbox creation on current OpenShell (#115058) 
* test(openshell): use structured gateway discovery

* fix(openshell): bound sandbox runtime names

* test(openshell): bound policy sandbox fixture

* docs(sandbox): document compatibility matrix

* fix(openshell): preserve registered runtime identities

* fix(openshell): quote recreate scope safely

* fix(openshell): match shipped legacy names

* docs(sandbox): refresh generated map

* test(sandbox): mock registered runtime lookup

* fix(openshell): reject non-ready legacy runtimes
 2026-07-28 11:13:04 +02:00
Peter Steinberger edecdbd05e refactor(config): config-surface reduction tranche 3 — product consolidations (review request) (#111527) 
* refactor(config): consolidate media model lists

* refactor(config): unify memory configuration

* refactor(config): consolidate TTS ownership

* refactor(config): move typing policy to agents

* refactor(config): retire product-level config surfaces

* refactor(config): share scoped tool policy type

* chore(config): refresh generated baselines

* fix(config): honor agent typing overrides

* fix(config): migrate sibling config consumers

* refactor(infra): keep base64url decoder private

* fix(config): strip invalid legacy TTS values

* chore(config): refresh rebased baseline hash

* fix(doctor): route legacy messages.tts.realtime voice to talk during tts move

* refactor(config): polish final layout names

* refactor(config): freeze retired tuning defaults

* feat(config): add fast mode default symmetry

* refactor(config): key agent entries by id

* docs(config): update final layout reference

* test(config): cover final layout migrations

* chore(config): refresh final layout baselines

* fix(config): align final layout runtime readers

* fix(config): align remaining readers

* fix(config): stabilize final layout migrations

* fix(config): finalize config projection proof

* fix(config): address final layout review

* docs(release): preserve historical config names

* fix(config): complete keyed agent migration

* fix(config): close final migration gaps

* fix(config): finish full-branch review

* fix(config): complete runtime secret detection

* fix(config): close final review findings

* fix(config): finish canonical docs and heartbeat migration

* fix(config): integrate latest main after rebase

* refactor(env): isolate test-only controls

* refactor(env): isolate build and development controls

* refactor(env): collapse process identity indirection

* refactor(env): remove duplicate config and temp aliases

* docs(env): define the operator-facing allowlist

* ci(env): ratchet production variable count

* fix(env): remove stale provider helper import

* fix(env): make ratchet sorting explicit

* test(env): keep test seam in dead-code audit

* test(env): cover ratchet growth and boundary; document surface budgets

* docs(config): document tier-eval consolidations

* docs(config): clarify speech preference ownership

* test(memory): align retired tuning fixtures

* refactor(memory): freeze engine heuristics

* refactor(config): apply tier-eval tranche

* refactor(tts): move persona shaping to providers

* refactor(compaction): move prompt policy to providers

* test(config): align hookified prompt fixtures

* chore(deadcode): classify test-only exports

* chore(github): remove unused spawn helper

* chore(deadcode): classify queue diagnostics

* chore(deadcode): remove unused lane snapshot export

* chore(plugin-sdk): ratchet consolidated surface

* fix(config): integrate latest main after rebase
 2026-07-21 20:28:43 -07:00
Peter Steinberger b44bab171d docs(sandbox): document multiple folders per agent (#109530) 
* docs(sandbox): document multiple agent folders

* style(docs): format sandbox examples

* docs: refresh generated map
 2026-07-16 19:40:25 -07:00
Peter Steinberger aaf5ab910c fix: land ten small reliability fixes (#100483) 
* fix(agents): harden LSP process failures

Source: #100450

Co-authored-by: morluto <williamlin1327@gmail.com>

* fix(sandbox): report effective workspace layout

Sources: #100435, #100439

Co-authored-by: Aniruddha Adak <aniruddhaadak80@users.noreply.github.com>

Co-authored-by: ZengWen-DT <ceng.wen@xydigit.com>

* fix(security): fail install checks on stream errors

Source: #100413

Co-authored-by: 陈宪彪0668000387 <chen.xianbiao@xydigit.com>

* fix(android): normalize all-day calendar events

Source: #100032

Co-authored-by: NianJiuZst <180004567+NianJiuZst@users.noreply.github.com>

* fix(ios): serialize push-to-talk lifecycle

Source: #99942

Co-authored-by: NianJiuZst <180004567+NianJiuZst@users.noreply.github.com>

* fix(talk): reject inherited provider names

Source: #99849

Co-authored-by: zenglingbiao <zeng.lingbiao@xydigit.com>

* fix(android): stop voice capture in background

Source: #99840

Co-authored-by: xialonglee <li.xialong@xydigit.com>

* fix(cron): preserve fallback result classification

Source: #99913

Co-authored-by: jincheng-xydt <xu.jincheng@xydigit.com>

* fix(google): bound Vertex response decompression

Source: #99812

Co-authored-by: 黄剑雄0668001315 <huang.jianxiong@xydigit.com>

* fix(plugins): report malformed discovery JSON

Source: #99892

Co-authored-by: 陈宪彪0668000387 <chen.xianbiao@xydigit.com>

* test(sandbox): configure non-default workspace fixture

* test: fix small-fix batch validation

---------

Co-authored-by: morluto <williamlin1327@gmail.com>
Co-authored-by: ZengWen-DT <ceng.wen@xydigit.com>
Co-authored-by: 陈宪彪0668000387 <chen.xianbiao@xydigit.com>
Co-authored-by: NianJiuZst <180004567+NianJiuZst@users.noreply.github.com>
Co-authored-by: zenglingbiao <zeng.lingbiao@xydigit.com>
Co-authored-by: xialonglee <li.xialong@xydigit.com>
Co-authored-by: jincheng-xydt <xu.jincheng@xydigit.com>
Co-authored-by: 黄剑雄0668001315 <huang.jianxiong@xydigit.com>
 2026-07-06 00:08:51 +01:00
Peter Steinberger f7d7148cf0 docs: rewrite published docs grounded in current source (#100142) 
Source-grounded rewrite of 529 published docs pages with per-unit information-loss verification: 1,713 factual corrections cited to src/**, generated surfaces regenerated, frontmatter titles preserved for i18n, release notes pages untouched. All docs gates green.

Closes #100141
 2026-07-05 00:32:47 -04:00
Vincent Koc eabc12b7d6 fix(sandbox): install supported node in common image 2026-06-24 22:54:00 +08:00
brokemac79 3b6bcbfb50 fix: make sandbox skills readable in writable sandboxes 
Materializes prompt-visible skills into a protected sandbox-readable workspace for rw sandboxes, refreshes Docker/SSH/OpenShell views, and hardens stale or poisoned remote skill copies. Fixes #90410.
 2026-06-07 13:47:56 -07:00
Josh Avant ba06376c79 fix: harden codex sandbox execution 
Harden the Codex app-server native execution bridge for OpenClaw sandboxed runs. The change keeps core sandbox policy in OpenClaw while exposing the process, filesystem, and HTTP relay behavior Codex needs inside a scoped exec server.

The large exec-server/test files were split into focused modules before landing, and the PR was rebased onto current main with focused tests, Testbox changed checks, CI, and Codex autoreview green.

Co-authored-by: joshavant <830519+joshavant@users.noreply.github.com>
 2026-05-21 23:47:32 +01:00
Vincent Koc 43c6c260de fix(doctor): detect Codex bwrap namespace denials 
Fixes #83018.
 2026-05-21 16:13:53 +08:00
Peter Steinberger adc37670e8 fix(codex): preserve sandbox egress for app-server turns 
Fixes #83347.
 2026-05-18 09:00:51 +01:00
Josh Avant 045a581069 fix(sandbox): honor explicit docker env (#82763) 
* fix(sandbox): honor explicit docker env

* docs(changelog): note sandbox env fix
 2026-05-16 17:36:05 -05:00
Peter Steinberger 694f40fcee fix: constrain Codex app-server sandbox 2026-05-11 18:23:00 +01:00
Peter Steinberger 02c2160478 chore: clean up root clutter 2026-05-03 12:20:52 +01:00
Alex Knight 0a74037f6f docs(sandboxing): clarify sandbox setup scripts require source checkout (#75594) 
Add inline docker build commands for npm-installed users who don't have the
source checkout scripts. Update all docs referencing sandbox-setup.sh,
sandbox-common-setup.sh and sandbox-browser-setup.sh to note they are
source-checkout-only and link to the new inline instructions.

Fixes #75485.
 2026-05-01 20:58:26 +10:00
Vincent Koc d70191f8af feat(sandbox): add Docker GPU passthrough 
Add opt-in `sandbox.docker.gpus` config plumbing for Docker sandbox containers.

- thread the optional GPU passthrough field through config types, schema, resolution, and Docker create args
- reject empty config values and emit `--gpus` as a separate Docker argv pair
- document the Docker-only behavior and credit the original contributor in the changelog

Fixes #57976.
Carries forward #58124 from @cyan-ember.

Co-authored-by: cyan-ember <5855097+cyan-ember@users.noreply.github.com>
 2026-04-28 03:33:28 -07:00
Vincent Koc cfbf4d1fa4 docs: note default sandbox image fail-fast behavior 
For 47dc9f7fc0: docs/gateway/sandboxing.md now warns under "Build the default
image" that OpenClaw no longer silently retags plain debian:bookworm-slim as
openclaw-sandbox:bookworm-slim when the default image is missing. Sandbox runs
fail with a build instruction so the python3 tooling required by sandbox
write/edit helpers is preserved instead of being silently dropped.
 2026-04-28 02:40:26 -07:00
Peter Steinberger 78a12706ec fix(docs): make docs formatter mintlify-safe 2026-04-28 08:13:21 +01:00
Peter Steinberger 424560c6c2 docs: normalize mintlify component closings 2026-04-28 07:54:15 +01:00
Vincent Koc fe69b02951 docs(sandboxing): rewrite with Tabs for modes/backends/workspace, AccordionGroup for SSH/OpenShell details, Steps for image setup 2026-04-26 00:35:52 -07:00
Peter Steinberger 2483d1dc12 fix(browser): drop redundant setuid sandbox flag 
Co-authored-by: Sebastian Krueger <150018+sebykrueger@users.noreply.github.com>
 2026-04-25 10:09:15 +01:00
Vincent Koc 07cee914aa docs(gateway): split configuration-reference by extracting agent-defaults cluster into config-agents 2026-04-23 20:11:12 -07:00
Vincent Koc 4a2cd533ac docs: remove duplicate H1 where frontmatter title already sets it 2026-04-23 13:11:14 -07:00
Peter Steinberger a292cbf46f docs: clarify optional Docker sandboxing 2026-04-20 19:27:45 +01:00
Joe LaPenna 177ab718a0 docs(gateway): Document Docker-out-of-Docker Paradox and constraint (#65473) 
* docs: Detail Docker-out-of-Docker paradox and host path requirements

* docs: fix spelling inside sandboxing.md

* fix: grammar typo as suggested by Greptile
 2026-04-14 02:19:27 +01:00
Peter Steinberger 1ae356c40c docs: refresh sandbox bind security refs 2026-04-04 20:57:37 +01:00
Peter Steinberger 4db910698a docs: refresh sandbox and security elevated refs 2026-04-04 18:39:12 +01:00
Peter Steinberger 46cb493ac8 fix(sandbox): cover home credential bind audit 2026-04-04 20:27:10 +09:00
Vincent Koc ab8d999917 docs: fix sandbox scope default (session -> agent per resolveSandboxScope) 2026-03-31 14:24:19 +09:00
Radek Sienkiewicz ce5b0577d4 docs: fix Browserless and broken doc links (#55881) 
Merged via squash.

Prepared head SHA: 528d04e070
Co-authored-by: velvet-shark <126378+velvet-shark@users.noreply.github.com>
Co-authored-by: velvet-shark <126378+velvet-shark@users.noreply.github.com>
Reviewed-by: @velvet-shark
 2026-03-27 17:11:57 +01:00
Vincent Koc a89d9f491b fix(docs): broken anchor links across 4 more files 
- sandboxing.md: remove stale '-opt-in' suffix from Docker accordion anchor
- troubleshooting.md: remove #troubleshooting anchor (matrix has no such section)
- docker.md: drop unpredictable security heading anchor with parens/dots
- faq.md: fix SSL error accordion anchor slug
 2026-03-22 15:50:56 -07:00
Vincent Koc ed6b894873 fix(docs): correct sandbox config anchor slug in 5 files 
Mintlify strips dots from backtick headings when generating anchors.
`agents.defaults.sandbox` -> #agentsdefaultssandbox (not #agents-defaults-sandbox)
 2026-03-22 15:47:11 -07:00
Vincent Koc a94e21e0a7 docs(install): update container setup paths 2026-03-19 13:40:26 -07:00
Vincent Koc 0b11ee48f8 docs: fix 26 broken anchor links across 18 files 2026-03-19 10:33:02 -07:00
Vincent Koc 67da67b61a docs: fix tools nav A-Z, split plugin page, consolidate sandbox docs, add OpenShell page (#50055) 
* docs: fix A-Z built-in tools nav, split plugin page, consolidate sandbox docs

* docs: add dedicated OpenShell sandbox backend page

* style: format markdown tables

* docs: trim plugin page, restructure available plugins into table + categories
 2026-03-18 15:44:08 -07:00
Peter Steinberger 0a2f95916b test: expand ssh sandbox coverage and docs 2026-03-15 21:38:22 -07:00
Peter Steinberger b8bb8510a2 feat: move ssh sandboxing into core 2026-03-15 21:35:30 -07:00
Peter Steinberger be8fef3840 docs: expand openshell sandbox docs 2026-03-15 20:35:56 -07:00
Peter Steinberger ae7f18e503 feat: add remote openshell sandbox mode 2026-03-15 20:28:19 -07:00
Vincent Koc a19a7f5e6e feat(security): Harden Docker browser container chromium flags (#23889) (#31504) 
* Gateway: honor OPENCLAW_GATEWAY_URL override for remote/local calls

* Agents: fix sandbox sessionKey usage for PI embedded subagent calls

* Sandbox: tighten browser container Chromium runtime flags

* fix: add sandbox browser defaults for container hardening

* docs: expand sandbox browser default flags list

* fix: make sandbox browser flags optional and preserve gateway env auth overrides

* docs: scope PR 31504 changelog entry

* style: format gateway call override handling

* fix: dedupe sandbox browser chrome args

* fix: preserve remote tls fingerprint for env gateway override

* fix: enforce auth for env gateway URL override

* chore: document gateway override auth security expectations
 2026-03-02 11:28:27 -08:00
Vincent Koc f4785c1a7b Docs: expand sandbox guide for common image and Docker bootstrap 2026-03-01 23:16:00 -08:00
Agent 002539c01e fix(security): harden sandbox novnc observer flow 2026-03-01 22:44:28 +00:00
Peter Steinberger 14b6eea6e3 feat(sandbox): block container namespace joins by default 2026-02-24 23:20:34 +00:00