6e026c2fe3
fix(gateway): reject unattributable loopback proxy traffic [AI] ( #119950 )
...
* fix(gateway): bind auth limits to ingress attribution
* fix(gateway): close remaining ingress auth gaps
* fix(gateway): carry attribution into new ingress paths
* fix(gateway): close ingress ownership gaps
* fix(gateway): complete proxy ingress hardening
* fix(gateway): stabilize managed Tailscale ingress
* fix(gateway): make Tailscale cleanup ownership-safe
Refuse reset-on-exit publication until Tailscale exposes an atomic owner-bound cleanup operation, and migrate legacy configs with Doctor.
* fix(gateway): finish ingress ownership repair
* fix(gateway): own managed Tailscale route lifetime
Run managed Serve and Funnel routes as foreground claims tied to the Gateway lifecycle. Retire named Service config through Doctor because Tailscale Services cannot run in foreground mode.
Co-authored-by: Pavan Kumar Gondhi <pavangondhi@gmail.com >
* fix(gateway): align Tailscale consumers and build guards
Remove the retired named-service config from Telegram Mini App URL resolution and register the lifecycle worker as an explicit production entry.
Co-authored-by: Pavan Kumar Gondhi <pavangondhi@gmail.com >
* fix(gateway): preserve retired Tailscale inputs
Keep Funnel enabled when removing an ignored named-Service setting and accept the legacy positive reset flag as a no-op now that managed routes always follow Gateway lifetime.
Co-authored-by: Pavan Kumar Gondhi <pavangondhi@gmail.com >
* fix(gateway): preserve Tailscale route diagnostics
Prefer the actionable foreground CLI failure captured during timeout cleanup, and cover the original delayed-failure ordering.
Co-authored-by: Pavan Kumar Gondhi <pavangondhi@gmail.com >
* fix(gateway): reconcile Tailscale ingress with main
Preserve current ingress ownership contracts after the rebase, retire the obsolete device-auth migration check, validate route-owner IPC, and move Tailscale auth coverage onto the managed listener.
Co-authored-by: Pavan Kumar Gondhi <pavangondhi@gmail.com >
* fix(gateway): finish ingress rebase coverage
Unify the rebased net imports and let module-reset WebSocket tests prepare attribution through the same fresh module instance as the handler.
Co-authored-by: Pavan Kumar Gondhi <pavangondhi@gmail.com >
* test(gateway): align run-loop server fixture
---------
Co-authored-by: joshavant <830519+joshavant@users.noreply.github.com >
2026-08-16 21:01:20 -07:00
d44f70eb4b
feat(pairing): one-paste device pairing via oc-pair setup links ( #120768 )
...
* feat(pairing): one-paste device pairing via oc-pair setup links
Implements milestone 3 from docs/plan/runners.md.
* fix(pairing): sign bootstrap handshake, keep URL candidates, wire pairing countdown
* test(gateway): update client callsite guard
* fix(pairing): preserve setup URL context paths
* fix(ui): keep pairing help aligned with setup mode
* fix(pairing): isolate bootstrap credentials
* perf(ui): keep one-paste pairing within bundle budget
* refactor(pairing): isolate native pair URL prefix parsing
* fix(pairing): preserve candidate lifecycle state
* fix(pairing): retire shared credentials after bootstrap
* fix(pairing): apply rotated manifest through client owner
* test(pairing): prove bootstrap retirement across reconnect
* fix(pairing): preserve native gateway context paths
* fix(pairing): carry native context paths through reconnect
* fix(ios): preserve encoded gateway context path
* chore(plugin-sdk): refresh pairing API baselines
2026-08-12 02:01:33 -07:00
0c99a4e362
feat(ui): manage DM pairing requests in Channels ( #112401 )
...
* feat(ui): manage DM pairing requests
* fix(ui): clear pairing data across auth changes
* test(ui): tighten pairing page fixture type
* fix(gateway): complete pairing protocol contracts
* fix(ui): guard pairing mutations across epochs
* fix(ui): restore chat teardown gates
* fix(ui): isolate channel auth lifecycles
* fix(ui): remove stale chat view export
2026-07-22 04:54:20 -07:00
62e53919fd
improve(ui): move Devices into Settings and redesign the device inventory ( #106055 )
...
* feat(ui): move Devices page into settings and redesign device inventory
- Devices now lives at /settings/devices (System group); /nodes stays as alias
- per-device form-factor icons (phone/browser/terminal/machine) with status dot
- equal-height header actions; stale cleanup and pairing only
- drop manual Refresh button; page already auto-refreshes via presence events + 30s poll
- dynamic connected/pending summary replaces static card subtitle
* style(ui): oxfmt pass + loading empty state for devices inventory
* chore(ui): sync locale bundles for devices settings copy; docs point at Settings → Devices
* refactor(ui): split device tile + pending rows out of view-inventory; drop unused icons
Keeps the TypeScript LOC ratchet green: view-inventory.ts returns below its
baseline and icons.ts sheds unused folderOpen/micOff/volumeOff glyphs.
* fix(ui): ratchet LOC baseline, drop unused DeviceIconSource export, settle devices settings copy
- baseline: icons.ts 693, view-inventory.ts back under the 500 ceiling
- subtitles.nodes now describes the settings page; nav tests updated
- locale bundles resynced (fallbacks=0)
* refactor(ui): rename token row param for reviewer-tool clarity
* fix(ui): collapse device rows in narrow containers and classify the TUI as a terminal client
Review findings: the nodes-entry grid override beat the shared 560px
list-item collapse, overflowing phone-width rows; openclaw-tui connects
with mode ui so only its client id marks it as a terminal.
* chore(ui): translate pending locale keys after rebase (fallbacks=0)
2026-07-13 03:18:17 -07:00
938d41014f
feat(mobile): default pairing to full node access ( #105928 )
...
* feat(mobile): default pairing to full node access
* chore: leave release notes to release workflow
* refactor(mobile): bound pairing helpers
* chore(i18n): refresh mobile access inventory
* chore(ci): lower mobile pairing LOC baseline
* fix(mobile): complete pairing validation artifacts
* ci: remove stale transcript target export baseline
* fix(ios): wrap access upgrade guidance
* fix(ios): preserve localized access key
* fix(ci): dedupe read-only SQLite guardrail
* fix(mobile): secure full-access node setup
2026-07-13 02:30:45 -07:00
024b7d5aa8
refactor(pairing): store channel pairing state in SQLite ( #105802 )
...
* refactor(pairing): move channel state to SQLite
* fix(pairing): preserve doctor and SDK contracts
* fix(pairing): break SQLite storage import cycle
* fix(pairing): keep SQLite types outside SDK graph
2026-07-12 18:53:38 -07:00
c48ed95533
feat(ui): merge Instances into a unified Devices page ( #104561 )
...
* chore(i18n): regenerate locale bundles for Devices rename
* chore(i18n): regenerate locale bundles for Devices rename
* chore(i18n): sync locale metadata for Devices rename
* fix(gateway): stop tracking ephemeral control-plane clients in presence
* feat(ui): merge Instances into a unified Devices page
* docs: point Instances references at the unified Devices page
* chore(i18n): reconcile locale metadata after rebase
* fix(gateway): keep test-mode clients tracked in presence; refresh docs map
2026-07-11 13:36:07 -07:00
c2301d8e53
fix(gateway): preserve local access for specific binds ( #98479 )
...
* fix: prefer loopback for local tailnet dashboard
* fix(gateway): preserve local access for specific binds
---------
Co-authored-by: haruaiclone-droid <281899875+haruaiclone-droid@users.noreply.github.com >
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-10 19:18:47 -07:00
d395a8e6ec
docs(pairing): correct setup-code expiry payload ( #103943 )
2026-07-10 21:58:28 +01:00
e6a8feb9c2
refactor(pairing): move device pairing store to shared SQLite state DB ( #103160 )
...
* refactor(pairing): move device pairing store to shared SQLite state DB
Device pairing, pending requests, and bootstrap tokens now live in the
device_pairing_* / device_bootstrap_tokens tables of state/openclaw.sqlite
instead of devices/{paired,pending,bootstrap}.json. Gateways import legacy
paired records once at startup (before the node-surface fold) and archive
the JSON files with a .migrated suffix; transient pending/bootstrap rows
are dropped. The unshipped node_pairing_* tables are removed from the
schema and dropped from existing DBs. Doctor now flags un-imported legacy
store files instead of corrupt-JSON reads.
* refactor(pairing): drop stale awaits now that store persistence is synchronous
* refactor(pairing): extract leaf record types to break store/domain module cycle
2026-07-10 01:46:56 +01:00
e7a6ed8eb6
chore(pairing): retire vestigial node token plumbing and flatten cleanup claims ( #103140 )
2026-07-09 23:48:01 +01:00
8985598302
fix(gateway): stop paired-device duplication and redesign the Nodes page ( #102810 )
...
* fix(gateway): prune superseded silent device pairings on auto-approve
* feat(ui): unified nodes & devices inventory with dedupe and cleanup
* docs: nodes page inventory + silent pairing supersede cleanup
* refactor(gateway): run silent-pairing prune after approval broadcast
* fix(ui): surface node list errors on the nodes inventory card
* fix(gateway): restrict pairing auto-prune to same-host silent approvals
* fix(gateway): report live device connections and guard pairing prune races
* docs(ui): document bulk-cleanup name-collision tradeoff
* fix(gateway): avoid map-spread when marking live device connections
* docs: regenerate docs map
2026-07-09 15:40:30 +01:00
862de9f1a1
fix(pairing): advertise reachable Tailnet routes ( #100317 )
...
* fix(pairing): advertise reachable tailnet routes
* fix(pairing): satisfy native and SDK checks
* fix(ios): cancel stale pairing route probes
* test(pairing): document LAN-only Serve fallback
* fix(ios): preserve pairing result initializer
2026-07-05 07:43:43 -07:00
f7d7148cf0
docs: rewrite published docs grounded in current source ( #100142 )
...
Source-grounded rewrite of 529 published docs pages with per-unit information-loss verification: 1,713 factual corrections cited to src/**, generated surfaces regenerated, frontmatter titles preserved for i18n, release notes pages untouched. All docs gates green.
Closes #100141
2026-07-05 00:32:47 -04:00
129e0a8cf0
feat: pair mobile devices from the Control UI ( #94672 )
...
* feat(gateway): add device.pair.setupCode RPC for connect QR
The OpenClaw mobile/companion app scans a pairing setup code to connect to the gateway, but that code + QR could only be produced by the openclaw qr CLI (ASCII to stdout). Non-terminal clients driving onboarding had no way to display the connect QR.
Add a device.pair.setupCode gateway method that reuses resolvePairingSetupFromConfig + encodePairingSetupCode + renderQrPngDataUrl to return { setupCode, qrDataUrl?, gatewayUrl, auth, urlSource }. The embedded setup code mints a short-lived bootstrap token that hands off broad operator scopes (read/write/approvals/talk.secrets), so the method requires operator.admin (matching the wizard methods a companion already uses) and is not advertised. auth is a label only; the gateway credential is never returned, and an oversized QR is omitted so the response always satisfies the result schema.
Refs #94661 .
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
* feat(ui): pair mobile devices from Control UI
* docs: refresh generated docs map
* docs: clarify mobile QR auto-connect
* docs: clarify mobile QR auto-connect
* docs: clarify mobile QR auto-connect
---------
Co-authored-by: Barbara Kudiess <76582160+bkudiess@users.noreply.github.com >
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-04 12:41:14 -04:00
64318d7624
Rework Android gateway onboarding setup ( #98752 )
...
* feat(android): rework gateway onboarding setup
* fix(android): restore protocol mismatch onboarding guidance
* fix(android): sync onboarding native i18n
* fix(android): preserve LAN manual setup prefill
* fix(android): refine onboarding node approval step
* fix(android): polish onboarding recovery actions
* test(android): cover onboarding protocol mismatch copy
* fix(android): separate onboarding node approval
* fix(android): guard onboarding node approval transitions
* fix(android): keep onboarding approval states reachable
* fix(android): wait for node access before onboarding continue
* fix(android): refresh node approval after operator handoff
* fix(android): refresh onboarding approval states
* fix(android): require approval after onboarding permission changes
* fix(android): keep onboarding approval gates active
* fix(android): preserve permission reapproval state
* fix(android): skip node approval on legacy gateways
* fix(android): wait for node approval refresh
* fix(android): preserve camera setting on upgrade
* fix(android): avoid stuck approval check spinner
* fix(android): request talk secrets on operator connects
* fix(android): avoid missed node approval completion
* fix(android): keep nearby LAN setup local
* fix(android): complete onboarding after node approval
* fix(android): reconcile onboarding with gateway auth plans
* chore(android): refresh native i18n inventory after rebase
* Fix Android onboarding review edge cases
* Fix native i18n onboarding sentinels
2026-07-03 21:20:12 +10:00
94d8391c03
[codex] restore QR bootstrap operator handoff ( #83684 )
...
Merged via squash.
Prepared head SHA: 2dc955cfb71540134+ngutman@users.noreply.github.com >
Co-authored-by: ngutman <1540134+ngutman@users.noreply.github.com >
Reviewed-by: @ngutman
2026-05-19 20:59:09 +03:00
b17e77a22b
Require approval for setup-code device pairing [AI] ( #81292 )
...
* fix: require approval for setup-code bootstrap pairing
* addressing review-skill
* addressing codex review
* addressing codex review
* addressing codex review
* addressing codex review
* addressing codex review
* addressing ci
* addressing ci
* docs: add changelog entry for PR merge
2026-05-13 18:48:44 +05:30
694ca50e97
Revert "refactor: move runtime state to SQLite"
...
This reverts commit f91de52f0d
2026-05-13 13:33:38 +01:00
f91de52f0d
refactor: move runtime state to SQLite
...
* refactor: remove stale file-backed shims
* fix: harden sqlite state ci boundaries
* refactor: store matrix idb snapshots in sqlite
* fix: satisfy rebased CI guardrails
* refactor: store current conversation bindings in sqlite table
* refactor: store tui last sessions in sqlite table
* refactor: reset sqlite schema history
* refactor: drop unshipped sqlite table migration
* refactor: remove plugin index file rollback
* refactor: drop unshipped sqlite sidecar migrations
* refactor: remove runtime commitments kv migration
* refactor: preserve kysely sync result types
* refactor: drop unshipped sqlite schema migration table
* test: keep session usage coverage sqlite-backed
* refactor: keep sqlite migration doctor-only
* refactor: isolate device legacy imports
* refactor: isolate push voicewake legacy imports
* refactor: isolate remaining runtime legacy imports
* refactor: tighten sqlite migration guardrails
* test: cover sqlite persisted enum parsing
* refactor: isolate legacy update and tui imports
* refactor: tighten sqlite state ownership
* refactor: move legacy imports behind doctor
* refactor: remove legacy session row lookup
* refactor: canonicalize memory transcript locators
* refactor: drop transcript path scope fallbacks
* refactor: drop runtime legacy session delivery pruning
* refactor: store tts prefs only in sqlite
* refactor: remove cron store path runtime
* refactor: use cron sqlite store keys
* refactor: rename telegram message cache scope
* refactor: read memory dreaming status from sqlite
* refactor: rename cron status store key
* refactor: stop remembering transcript file paths
* test: use sqlite locators in agent fixtures
* refactor: remove file-shaped commitments and cron store surfaces
* refactor: keep compaction transcript handles out of session rows
* refactor: derive transcript handles from session identity
* refactor: derive runtime transcript handles
* refactor: remove gateway session locator reads
* refactor: remove transcript locator from session rows
* refactor: store raw stream diagnostics in sqlite
* refactor: remove file-shaped transcript rotation
* refactor: hide legacy trajectory paths from runtime
* refactor: remove runtime transcript file bridges
* refactor: repair database-first rebase fallout
* refactor: align tests with database-first state
* refactor: remove transcript file handoffs
* refactor: sync post-compaction memory by transcript scope
* refactor: run codex app-server sessions by id
* refactor: bind codex runtime state by session id
* refactor: pass memory transcripts by sqlite scope
* refactor: remove transcript locator cleanup leftovers
* test: remove stale transcript file fixtures
* refactor: remove transcript locator test helper
* test: make cron sqlite keys explicit
* test: remove cron runtime store paths
* test: remove stale session file fixtures
* test: use sqlite cron keys in diagnostics
* refactor: remove runtime delivery queue backfill
* test: drop fake export session file mocks
* refactor: rename acp session read failure flag
* refactor: rename acp row session key
* refactor: remove session store test seams
* refactor: move legacy session parser tests to doctor
* refactor: reindex managed memory in place
* refactor: drop stale session store wording
* refactor: rename session row helpers
* refactor: rename sqlite session entry modules
* refactor: remove transcript locator leftovers
* refactor: trim file-era audit wording
* refactor: clean managed media through sqlite
* fix: prefer explicit agent for exports
* fix: use prepared agent for session resets
* fix: canonicalize legacy codex binding import
* test: rename state cleanup helper
* docs: align backup docs with sqlite state
* refactor: drop legacy Pi usage auth fallback
* refactor: move legacy auth profile imports to doctor
* refactor: keep Pi model discovery auth in memory
* refactor: remove MSTeams legacy learning key fallback
* refactor: store model catalog config in sqlite
* refactor: use sqlite model catalog at runtime
* refactor: remove model json compatibility aliases
* refactor: store auth profiles in sqlite
* refactor: seed copied auth profiles in sqlite
* refactor: make auth profile runtime sqlite-addressed
* refactor: migrate hermes secrets into sqlite auth store
* refactor: move plugin install config migration to doctor
* refactor: rename plugin index audit checks
* test: drop auth file assumptions
* test: remove legacy transcript file assertions
* refactor: drop legacy cli session aliases
* refactor: store skill uploads in sqlite
* refactor: keep subagent attachments in sqlite vfs
* refactor: drop subagent attachment cleanup state
* refactor: move legacy session aliases to doctor
* refactor: require node 24 for sqlite state runtime
* refactor: move provider caches into sqlite state
* fix: harden virtual agent filesystem
* refactor: enforce database-first runtime state
* refactor: rename compaction transcript rotation setting
* test: clean sqlite refactor test types
* refactor: consolidate sqlite runtime state
* refactor: model session conversations in sqlite
* refactor: stop deriving cron delivery from session keys
* refactor: stop classifying sessions from key shape
* refactor: hydrate announce targets from typed delivery
* refactor: route heartbeat delivery from typed sqlite context
* refactor: tighten typed sqlite session routing
* refactor: remove session origin routing shadow
* refactor: drop session origin shadow fixtures
* perf: query sqlite vfs paths by prefix
* refactor: use typed conversation metadata for sessions
* refactor: prefer typed session routing metadata
* refactor: require typed session routing metadata
* refactor: resolve group tool policy from typed sessions
* refactor: delete dead session thread info bridge
* Show Codex subscription reset times in channel errors (#80456 )
* feat(plugin-sdk): consolidate session workflow APIs
* fix(agents): allow read-only agent mount reads
* [codex] refresh plugin regression fixtures
* fix(agents): restore compaction gateway logs
* test: tighten gateway startup assertions
* Redact persisted secret-shaped payloads [AI] (#79006 )
* test: tighten device pair notify assertions
* test: tighten hermes secret assertions
* test: assert matrix client error shapes
* test: assert config compat warnings
* fix(heartbeat): remap cron-run exec events to session keys (#80214 )
* fix(codex): route btw through native side threads
* fix(auth): accept friendly OpenAI order for Codex profiles
* fix(codex): rotate auth profiles inside harness
* fix: keep browser status page probe within timeout
* test: assert agents add outputs
* test: pin cron read status
* fix(agents): avoid Pi resource discovery stalls
Co-authored-by: dataCenter430 <titan032000@gmail.com >
* fix: retire timed-out codex app-server clients
* test: tighten qa lab runtime assertions
* test: check security fix outputs
* test: verify extension runtime messages
* feat(wake): expose typed sessionKey on wake protocol + system event CLI
* fix(gateway): await session_end during shutdown drain and track channel + compaction lifecycle paths (#57790 )
* test: guard talk consult call helper
* fix(codex): scale context engine projection (#80761 )
* fix(codex): scale context engine projection
* fix: document Codex context projection scaling
* fix: document Codex context projection scaling
* fix: document Codex context projection scaling
* fix: document Codex context projection scaling
* chore: align Codex projection changelog
* chore: realign Codex projection changelog
* fix: isolate Codex projection patch
---------
Co-authored-by: Eva (agent) <eva+agent-78055@100yen.org >
Co-authored-by: Josh Lehman <josh@martian.engineering >
* refactor: move agent runtime state toward piless
* refactor: remove cron session reaper
* refactor: move session management to sqlite
* refactor: finish database-first state migration
* chore: refresh generated sqlite db types
* refactor: remove stale file-backed shims
* test: harden kysely type coverage
# Conflicts:
# .agents/skills/kysely-database-access/SKILL.md
# src/infra/kysely-sync.types.test.ts
# src/proxy-capture/store.sqlite.test.ts
# src/state/openclaw-agent-db.test.ts
# src/state/openclaw-state-db.test.ts
* refactor: remove cron store path runtime
* refactor: keep compaction transcript handles out of session rows
* refactor: derive embedded transcripts from sqlite identity
* refactor: remove embedded transcript locator handoff
* refactor: remove runtime transcript file bridges
* refactor: remove transcript file handoffs
* refactor: remove MSTeams legacy learning key fallback
* refactor: store model catalog config in sqlite
* refactor: use sqlite model catalog at runtime
# Conflicts:
# docs/cli/secrets.md
# docs/gateway/authentication.md
# docs/gateway/secrets.md
* fix: keep oauth sibling sync sqlite-local
# Conflicts:
# src/commands/onboard-auth.test.ts
* refactor: remove task session store maintenance
# Conflicts:
# src/commands/tasks.ts
* refactor: keep diagnostics in state sqlite
* refactor: enforce database-first runtime state
* refactor: consolidate sqlite runtime state
* Show Codex subscription reset times in channel errors (#80456 )
* fix(codex): refresh subscription limit resets
* fix(codex): format reset times for channels
* Update CHANGELOG with latest changes and fixes
Updated CHANGELOG with recent fixes and improvements.
* fix(codex): keep command load failures on codex surface
* fix(codex): format account rate limits as rows
* fix(codex): summarize account limits as usage status
* fix(codex): simplify account limit status
* test: tighten subagent announce queue assertion
* test: tighten session delete lifecycle assertions
* test: tighten cron ops assertions
* fix: track cron execution milestones
* test: tighten hermes secret assertions
* test: assert matrix sync store payloads
* test: assert config compat warnings
* fix(codex): align btw side thread semantics
* fix(codex): honor codex fallback blocking
* fix(agents): avoid Pi resource discovery stalls
* test: tighten codex event assertions
* test: tighten cron assertions
* Fix Codex app-server OAuth harness auth
* refactor: move agent runtime state toward piless
* refactor: move device and push state to sqlite
* refactor: move runtime json state imports to doctor
* refactor: finish database-first state migration
* chore: refresh generated sqlite db types
* refactor: clarify cron sqlite store keys
* refactor: remove stale file-backed shims
* refactor: bind codex runtime state by session id
* test: expect sqlite trajectory branch export
* refactor: rename session row helpers
* fix: keep legacy device identity import in doctor
* refactor: enforce database-first runtime state
* refactor: consolidate sqlite runtime state
* build: align pi contract wrappers
* chore: repair database-first rebase
* refactor: remove session file test contracts
* test: update gateway session expectations
* refactor: stop routing from session compatibility shadows
* refactor: stop persisting session route shadows
* refactor: use typed delivery context in clients
* refactor: stop echoing session route shadows
* refactor: repair embedded runner rebase imports
# Conflicts:
# src/agents/pi-embedded-runner/run/attempt.tool-call-argument-repair.ts
* refactor: align pi contract imports
* refactor: satisfy kysely sync helper guard
* refactor: remove file transcript bridge remnants
* refactor: remove session locator compatibility
* refactor: remove session file test contracts
* refactor: keep rebase database-first clean
* refactor: remove session file assumptions from e2e
* docs: clarify database-first goal state
* test: remove legacy store markers from sqlite runtime tests
* refactor: remove legacy store assumptions from runtime seams
* refactor: align sqlite runtime helper seams
* test: update memory recall sqlite audit mock
* refactor: align database-first runtime type seams
* test: clarify doctor cron legacy store names
* fix: preserve sqlite session route projections
* test: fix copilot token cache test syntax
* docs: update database-first proof status
* test: align database-first test fixtures
* docs: update database-first proof status
* refactor: clean extension database-first drift
* test: align agent session route proof
* test: clarify doctor legacy path fixtures
* chore: clean database-first changed checks
* chore: repair database-first rebase markers
* build: allow baileys git subdependency
* chore: repair exp-vfs rebase drift
* chore: finish exp-vfs rebase cleanup
* chore: satisfy rebase lint drift
* chore: fix qqbot rebase type seam
* chore: fix rebase drift leftovers
* fix: keep auth profile oauth secrets out of sqlite
* fix: repair rebase drift tests
* test: stabilize pairing request ordering
* test: use source manifests in plugin contract checks
* fix: restore gateway session metadata after rebase
* fix: repair database-first rebase drift
* fix: clean up database-first rebase fallout
* test: stabilize line quick reply receipt time
* fix: repair extension rebase drift
* test: keep transcript redaction tests sqlite-backed
* fix: carry injected transcript redaction through sqlite
* chore: clean database branch rebase residue
* fix: repair database branch CI drift
* fix: repair database branch CI guard drift
* fix: stabilize oauth tls preflight test
* test: align database branch fast guards
* test: repair build artifact boundary guards
* chore: clean changelog rebase markers
---------
Co-authored-by: pashpashpash <nik@vault77.ai >
Co-authored-by: Eva <eva@100yen.org >
Co-authored-by: stainlu <stainlu@newtype-ai.org >
Co-authored-by: Jason Zhou <jason.zhou.design@gmail.com >
Co-authored-by: Ruben Cuevas <hi@rubencu.com >
Co-authored-by: Pavan Kumar Gondhi <pavangondhi@gmail.com >
Co-authored-by: Shakker <shakkerdroid@gmail.com >
Co-authored-by: Kaspre <36520309+Kaspre@users.noreply.github.com >
Co-authored-by: dataCenter430 <titan032000@gmail.com >
Co-authored-by: Kaspre <kaspre@gmail.com >
Co-authored-by: pandadev66 <nova.full.stack@outlook.com >
Co-authored-by: Eva <admin@100yen.org >
Co-authored-by: Eva (agent) <eva+agent-78055@100yen.org >
Co-authored-by: Josh Lehman <josh@martian.engineering >
Co-authored-by: jeffjhunter <support@aipersonamethod.com >
2026-05-13 13:15:12 +01:00
91ed1604b0
docs(imessage): make imsg the supported setup path
2026-05-07 12:53:01 -07:00
63dc7321ef
docs(imessage): deprecate bluebubbles for new setups
2026-05-06 21:58:21 +01:00
ec8283e3e5
docs: typography hygiene across 9 pages (cli/channels)
2026-05-06 08:55:00 -07:00
36df0d93b9
fix: repair iOS LAN pairing
...
Fix iOS LAN/setup-code pairing policy for #47887 .
- Allow explicit private LAN and .local plaintext ws:// setup/manual connects where policy allows it.
- Keep public hosts, .ts.net, and Tailscale CGNAT plaintext fail-closed.
- Prefer explicit passwords over stale bootstrap tokens in Swift and TypeScript gateway clients.
- Update setup-code/device-pair coverage, docs, and changelog with source credit for #65185 .
Verification:
- pnpm install
- git diff --check origin/main..HEAD
- pnpm exec oxfmt --check --threads=1 src/gateway/client.ts src/gateway/client.test.ts src/pairing/setup-code.ts src/pairing/setup-code.test.ts extensions/device-pair/index.ts extensions/device-pair/index.test.ts
- pnpm format:docs:check
- pnpm test src/gateway/client.test.ts src/pairing/setup-code.test.ts extensions/device-pair/index.test.ts
- cd apps/shared/OpenClawKit && swift test --filter 'DeepLinksSecurityTests|GatewayNodeSessionTests'
- pnpm lint:swift passes with the existing TalkModeRuntime.swift type-body-length warning
Blocked locally:
- iOS app-target xcodebuild tests require unavailable watchOS 26.4 runtime here.
- Testbox check:changed previously failed because the image lacks swiftlint; local swiftlint passes.
2026-05-05 21:07:19 -05:00
b2efd19648
fix(ios): harden gateway pairing setup
...
Harden iOS gateway setup-code pairing by rejecting non-loopback plaintext ws:// setup URLs before bootstrap token issuance, consolidating iOS setup parsing, and adding QR scan support from Settings.
Verification:
- pnpm test extensions/device-pair/index.test.ts
- swift test --package-path apps/shared/OpenClawKit --filter DeepLinksSecurityTests
- XcodeBuildMCP OpenClawLogicTests/DeepLinkParserTests
- targeted SwiftLint for touched iOS/OpenClawKit files
- pnpm exec oxfmt --check --threads=1 extensions/device-pair/index.ts extensions/device-pair/index.test.ts
- git diff --check origin/main...HEAD
- GitHub PR checks green on 58e5e60a5c
2026-05-04 02:11:47 -05:00
c3f5c20f2c
fix(cli): retry admin device approval after ownership denial
2026-05-04 00:41:55 +01:00
f64b660b24
docs: document access groups
2026-05-01 23:58:52 +01:00
20945b84b4
feat: generalize message access groups ( #75813 )
2026-05-01 23:55:26 +01:00
bd1d1f0f2b
fix: align open DM allowlist policy ( #74112 )
...
* fix: harden telegram open dm allowlist merging
* fix: align open dm allowlist policy
2026-04-29 06:52:12 +01:00
6ce1058296
Wire diagnostics through the core chat command ( #72936 )
...
* feat: wire codex diagnostics feedback
* fix: harden codex diagnostics hints
* fix: neutralize codex diagnostics output
* fix: tighten codex diagnostics safeguards
* fix: bound codex diagnostics feedback output
* fix: tighten codex diagnostics throttling
* fix: confirm codex diagnostics uploads
* docs: clarify codex diagnostics add-on
* fix: route diagnostics through core command
* fix: tighten diagnostics authorization
* fix: pin diagnostics to bundled codex command
* fix: limit owner status in plugin commands
* fix: scope diagnostics confirmations
* fix: scope codex diagnostics cooldowns
* fix: harden codex diagnostics ownership scopes
* fix: harden diagnostics command trust and display
* fix: keep diagnostics command trust internal
* fix: clarify diagnostics exec boundary
* fix: consume codex diagnostics confirmations atomically
* test: include codex diagnostics binding metadata
* test: use string codex binding timestamps
* fix: keep reserved command trust host-only
* fix: harden diagnostics trust and resume hints
* wire diagnostics through exec approval
* fix: keep diagnostics tests aligned with bundled root trust
* fix telegram diagnostics owner auth
* route trajectory exports through exec approval
* fix trajectory exec command encoding
* fix telegram group owner auth
* fix export trajectory approval hardening
* fix pairing command owner bootstrap
* fix telegram owner exec approvals
* fix: make diagnostics approval flow pasteable
* fix: route native sensitive command followups
* fix: invoke diagnostics exports with current cli
* fix: refresh exec approval protocol models
* fix: list codex diagnostics from thread bindings
* fix: fold codex diagnostics into exec approval
* fix: preserve diagnostics approval line breaks
* docs: clarify diagnostics codex workflow
2026-04-29 07:40:37 +09:00
7fb2a356e8
fix(nodes): allow removing stale paired nodes
2026-04-27 13:20:52 +01:00
6038725501
docs: batch convert remaining prose callouts to Mintlify components
...
- platforms/android: blockquote Note for Android app status, Note for canvas host port
- platforms/macos: Tip component for app vs CLI discovery comparison
- plugins/zalouser, channels/zalouser: blockquote Warning components for unofficial automation risk
- channels/pairing: convert two Important paragraphs to Note components for DM-vs-group scope and silent-upgrade behavior
2026-04-26 22:15:11 -07:00
8bbb143ab8
fix: enforce device token scope containment
2026-04-26 07:28:21 +01:00
f44759073b
feat(gateway): auto-approve trusted CIDR node pairing ( #61004 ) (thanks @sahilsatralkar)
2026-04-25 06:40:25 +01:00
4a2cd533ac
docs: remove duplicate H1 where frontmatter title already sets it
2026-04-23 13:11:14 -07:00
d63671fce0
docs(pairing): explain approval upgrades
2026-04-20 13:08:04 +05:30
8fd53cdf86
docs: refresh bootstrap scope role-prefix refs
2026-04-04 18:46:30 +01:00
13f9475f6c
docs: refresh bootstrap handoff token refs
2026-04-04 14:32:40 +01:00
d1bf2c6de1
docs: clarify device token role bounds
2026-04-04 11:36:02 +01:00
1809da659e
docs: refresh cli and node pairing references
2026-04-04 07:23:11 +01:00
6e2b46d666
docs: clarify DM pairing vs group auth
2026-04-03 18:51:51 +09:00
4f297a094a
docs: add WeChat channel via official Tencent iLink Bot plugin ( #52131 ) (thanks @MonkeyLeeT)
...
* docs: add WeChat channel via official Tencent iLink Bot plugin
Add WeChat to the README channel lists and setup section.
Uses the official Tencent-published plugin @tencent-weixin/openclaw-weixin
which connects via the iLink Bot API (QR code login, long-poll).
Requires WeChat 8.0.70+ with the ClawBot plugin enabled; the plugin
is being rolled out gradually by Tencent.
Covers: setup steps, capabilities (DM-only, media up to 100 MB,
multi-account, pairing authorization, typing indicators, config path),
and the context token restart caveat.
* docs: update WeChat plugin install for v2.0 compatibility
- Add version compatibility note (v2.x requires OpenClaw >= 2026.3.22,
@legacy tag for older hosts)
- Add plugins.allow step (required since plugins.allow was introduced)
* docs: drop manual plugins.allow/enable steps (handled by plugins install)
* docs: fix multi-account instruction to require explicit --account id
* docs: trim WeChat section to match neighboring channels, fix pairing link
* docs: sync WeChat channel docs
---------
Co-authored-by: Ayaan Zaidi <hi@obviy.us >
2026-03-26 09:07:01 +05:30
77bdb33735
docs: fix channel lists, pairing channels, and discord step title
2026-03-22 21:43:29 +00:00
1ee9611079
fix(nostr): enforce inbound dm policy before decrypt
2026-03-22 09:37:40 -07:00
8e132aed6e
Hardening: refresh stale device pairing requests and pending metadata ( #50695 )
...
* Docs: clarify device pairing supersede behavior
* Device pairing: supersede pending requests on auth changes
2026-03-19 18:26:06 -05:00
bf89947a8e
fix: switch pairing setup codes to bootstrap tokens
2026-03-12 22:23:07 +00:00
91a3f0a3fe
pairing: enforce strict account-scoped state
2026-02-26 00:31:24 -05:00
daf13dbb06
fix: enforce feishu dm policy + pairing flow ( #14876 ) (thanks @coygeek)
2026-02-13 05:48:22 +01:00
730f86dd5c
Gateway/Plugins: device pairing + phone control plugins ( #11755 )
2026-02-08 18:07:13 +01:00
929a3725d3
docs: canonicalize docs paths and align zh navigation ( #11428 )
...
* docs(navigation): canonicalize paths and align zh nav
* chore(docs): remove stray .DS_Store
* docs(scripts): add non-mint docs link audit
* docs(nav): fix zh source paths and preserve legacy redirects (#11428 ) (thanks @sebslight)
* chore(docs): satisfy lint for docs link audit script (#11428 ) (thanks @sebslight)
2026-02-07 15:40:35 -05:00
Pavan Kumar Gondhi