Commit Graph

66940 Commits

Author SHA1 Message Date
Agustin Rivera 587eefe5ad fix(imessage): require authorization for group actions (#97961) 2026-06-29 17:51:39 -07:00
dwc1997 28347ba51c test(globals): add unit tests for global CLI flag state helpers (#96735)
* test(globals): add unit tests for global CLI flag state helpers

Add unit tests for shouldLogVerbose, logVerbose, and logVerboseConsole
functions in src/globals.ts to verify verbose logging behavior.

Tests cover:
- shouldLogVerbose returns true when isVerbose is true
- shouldLogVerbose returns true when file log level is debug
- shouldLogVerbose returns false when both are false
- logVerbose does not log when shouldLogVerbose is false
- logVerbose logs to console when isVerbose is true
- logVerboseConsole does not log when isVerbose is false
- logVerboseConsole logs to console when isVerbose is true

* ci: trigger re-review

* test(globals): cover verbose logger behavior

---------

Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
2026-06-29 17:45:30 -07:00
Agustin Rivera 4aa07513fe fix(cron): scope agent wake targets (#97949)
* fix(cron): scope agent wake targets

* fix(cron): refresh prompt snapshots
2026-06-29 17:43:43 -07:00
Jason (Json) 455f813d6e fix(telegram): deliver durable reasoning when enabled
Preserve shared reasoning suppression by default while letting Telegram opt into durable reasoning payloads only when it has a deliverable reasoning lane. Covers persistent /reasoning on, separate reasoning stream lanes, and progress-stream suppression.\n\nVerification:\n- node scripts/run-vitest.mjs src/auto-reply/reply/dispatch-from-config.test.ts extensions/telegram/src/bot-message-dispatch.test.ts\n- git diff --check upstream/main...HEAD\n- .agents/skills/autoreview/scripts/autoreview --mode branch --base upstream/main --stream-engine-output\n- CI run 28411526182 green, including QA Smoke CI and check-test-types\n- Real behavior proof run 28411676681 passed\n\nPR: #97875
2026-06-29 17:31:06 -07:00
Agustin Rivera 6ead092302 fix(acp): require owner for runtime controls (#97953) 2026-06-29 17:29:08 -07:00
Hannes Rudolph 606bcc8d14 [codex] docs: add release notes placeholder (#97959) 2026-06-29 18:25:15 -06:00
Agustin Rivera e87b0df675 fix(codex): restrict computer-use installation (#97955) 2026-06-29 17:17:49 -07:00
Agustin Rivera 2cf765f732 fix(browser): block node routes when sandbox host control is disabled (#97958) 2026-06-29 17:10:12 -07:00
Dallin Romney fd3f354f46 test(qa): expand docker lane adapter (#97937)
* test(qa): expand docker lane adapter

* Extract QA Docker lane fixture
2026-06-29 17:08:43 -07:00
Vincent Koc 18b2ff683f docs(ci): update runner registration budget (#97943) 2026-06-29 16:27:32 -07:00
Dallin Romney 2acffd7f3d chore(ci): dedupe release QA credential check (#97948) 2026-06-29 16:23:34 -07:00
Dallin Romney a107b95ee7 chore(ci): dedupe QA live credential check (#97947) 2026-06-29 16:23:32 -07:00
Jiaming Guo 456c48f368 fix(gateway): require admin scope for browser proxy invoke (#85916)
* fix(gateway): require admin scope for browser proxy invoke

* fix(gateway): document trusted node scopes

* fix(gateway): align browser scope test

* fix(gateway): satisfy node test lint

---------

Co-authored-by: Agustin Rivera <agustin@rivera-web.com>
2026-06-29 16:23:02 -07:00
Dallin Romney 4f95c6969b chore(ci): dedupe Crabbox Docker check (#97950) 2026-06-29 16:22:44 -07:00
Dallin Romney a255fc6dc4 chore(ci): dedupe BuildKit pre-pull step (#97951) 2026-06-29 16:22:06 -07:00
Dallin Romney 0b2cd9cc41 chore(ci): dedupe workflow sanity checkout (#97946) 2026-06-29 16:21:41 -07:00
Josh Avant 052dc59526 fix: /pair qr fails to show QR code in chat surfaces (#97933)
* fix(pair): render qr per chat surface

* test(plugin-sdk): update reply helper surface budget

* fix(pair): keep qr metadata internal
2026-06-29 18:17:21 -05:00
Dallin Romney f7cca686f7 ci: dedupe Linux checkout step (#97940) 2026-06-29 16:09:42 -07:00
Dallin Romney 5dae3d49e6 Update QA Lab Crabline integration (#97941)
* Update QA Lab Crabline integration

* Refresh docs map
2026-06-29 16:07:38 -07:00
Agustin Rivera b7b2e1f77e fix(pdf): guard native provider requests (#97872)
* fix(pdf): guard native provider requests

* fix(pdf): preserve configured origin trust

* fix(pdf): preserve resolver compatibility
2026-06-29 15:51:26 -07:00
Yzx 3047e6c43d fix: Ollama Cloud tool calls fail on second turn (#96474)
Tested and it works.
2026-06-29 16:48:46 -06:00
Agustin Rivera cbdbb22c60 fix(voice): require admin for voice set (#97874) 2026-06-29 15:41:26 -07:00
Agustin Rivera 825aafac57 fix(voicecall): redact read-scoped status payloads (#97870)
* fix(voicecall): redact read-scoped status payloads

* fix(voicecall): make status assertion lint-safe
2026-06-29 15:38:29 -07:00
Dallin Romney 843ad14364 feat(qa): add transport scenario requirements (#97915) 2026-06-29 14:53:19 -07:00
Dallin Romney 15de9d881a ci: retry platform checkout fetch timeouts (#97912) 2026-06-29 13:30:14 -07:00
Agustin Rivera 29f787f10e fix(memory): require privileged dreaming config changes (#97869)
* fix(memory): gate dreaming config changes

* fix(memory): document dreaming privilege gate

Explain that persistent dreaming toggles require channel owner status or Gateway admin scope, while status and help remain read-only.
2026-06-29 13:03:22 -07:00
Dallin Romney 05d83125c9 test: add hosted media provider QA live evidence (#97900) 2026-06-29 13:01:47 -07:00
Patrick Erichsen d43366b4e3 ci: bump ClawHub package publish workflow (#97907) 2026-06-29 12:17:49 -07:00
Parvesh 82dfd89107 fix(agents): stop recording accepted sessions_spawn launches as tool failures (#96851)
* fix(agents): stop recording accepted sessions_spawn launches as tool failures

* fix(agents): stop recording accepted sessions_spawn launches as tool failures

* fix(clownfish): address review for live-pr-inventory-20260629T175323-001 (1)

---------

Co-authored-by: openclaw-clownfish[bot] <280122609+openclaw-clownfish[bot]@users.noreply.github.com>
2026-06-29 11:21:05 -07:00
Yuval Dinodia 38ab207591 fix(google-meet): fall back to manual OAuth paste when callback port is occupied (#96492)
The Google Meet OAuth login binds a fixed localhost:8085 callback listener
and let listener failures propagate, so meet auth login aborted entirely when
port 8085 was already in use. The sibling Gemini CLI OAuth path already
recovers by switching to the manual copy/paste flow on EADDRINUSE/listen
errors; bring Google Meet to parity by catching listener errors and reusing
the existing manual-paste handler instead of failing the login.
2026-06-29 11:20:21 -07:00
lin-hongkuan 2906d6c38f fix(auth): strip controls from masked API keys (#96445)
* fix(auth): strip controls from masked API keys

* test(auth): cover DEL and C1 masked key controls

* chore: retrigger PR checks

---------

Co-authored-by: lin-hongkuan <lin-hongkuan@users.noreply.github.com>
2026-06-29 11:15:55 -07:00
Dallin Romney 80a3c515fd test: add ClawHub release candidate QA proof (#97896)
* test: add ClawHub release candidate QA proof

* test: harden ClawHub release candidate evidence
2026-06-29 11:14:09 -07:00
Dallin Romney 5816e0194e feat(qa): wire crabline whatsapp transport (#95920) 2026-06-29 11:13:17 -07:00
Yuval Dinodia e38d64c5f8 fix(cron): keep a due recurring run when an edit re-saves the same schedule (#96159)
* fix(cron): keep a due recurring run when an edit re-saves the same schedule

update() advanced state.nextRunAtMs to the next future slot whenever a
patch carried schedule or enabled, even when the schedule was unchanged,
dropping an already-due run and re-phasing every-job anchors to now. Gate
the advance on cronSchedulingInputsEqual so only a genuine schedule or
enabled change recomputes, and inherit the previous every anchor when a
re-save omits it, matching the add/remove maintenance recompute.

* fix(cron): re-anchor every-job to edit time on a genuine interval change

Only inherit the previous cadence anchor for an unchanged-interval every
re-save. A real everyMs change (UI omits anchorMs) now re-anchors to the
edit time, matching the prior update semantics, while idempotent re-saves
still preserve a due slot and phase. Adds a regression test for the
interval-change path.
2026-06-29 11:08:11 -07:00
Glenn-Agent 7e428797ec docs: add generated docs map (#95954)
* docs: add generated docs map

* docs: format docs map headings

* docs: separate docs map sections

* fix: satisfy docs map checks
2026-06-29 11:05:58 -07:00
Zaid aa5ec51af0 fix(line): preserve uploaded file names for media detection (#96403)
* fix(line): preserve file upload filenames

* test(line): fail unexpected media downloads
2026-06-29 11:03:30 -07:00
Dallin Romney 2cc43aec2d feat(qa): wire crabline slack transport (#97891) 2026-06-29 10:57:17 -07:00
lin-hongkuan bc7f0f1223 fix(secrets): strip control characters from secret input (#96444)
* fix(secrets): strip control characters from secret input

* chore: retrigger PR checks

* fix(web-content): strip controls from provider secrets

---------

Co-authored-by: lin-hongkuan <lin-hongkuan@users.noreply.github.com>
2026-06-29 10:51:08 -07:00
dwc1997 f92ec2d4e8 test(shared): add unit tests for surrogate-safe UTF-16 string slicing helpers (#97805)
* test(shared): add unit tests for surrogate-safe UTF-16 string slicing helpers

Add unit tests for sliceUtf16Safe and truncateUtf16Safe functions in
src/shared/utf16-slice.ts to verify UTF-16 string slicing behavior.

Tests cover:
- sliceUtf16Safe slices ASCII string normally
- sliceUtf16Safe handles negative start/end
- sliceUtf16Safe handles start/end beyond length
- sliceUtf16Safe swaps start and end when start > end
- sliceUtf16Safe preserves emoji with surrogate pairs
- sliceUtf16Safe avoids splitting surrogate pair at start/end
- truncateUtf16Safe returns input when shorter than limit
- truncateUtf16Safe truncates when longer than limit
- truncateUtf16Safe handles zero/negative limit
- truncateUtf16Safe floors decimal limit
- truncateUtf16Safe preserves emoji with surrogate pairs
- truncateUtf16Safe avoids splitting surrogate pair

* fix: replace tautological surrogate assertions with exact output checks

Replace vague 'result.length >= 0' assertions with exact expected output
checks for surrogate pair boundary cases. The helper returns empty string
when slicing at surrogate pair boundaries.
2026-06-29 10:50:58 -07:00
pick-cat 09167523bf fix(nextcloud-talk): bound bot preflight error reads (#97811)
Co-authored-by: Pick-cat <266665499+Pick-cat@users.noreply.github.com>
2026-06-29 10:50:47 -07:00
pick-cat eb5fb2aa69 fix(microsoft-foundry): bound connection test error reads (#97812)
Co-authored-by: Pick-cat <266665499+Pick-cat@users.noreply.github.com>
2026-06-29 10:50:38 -07:00
Dallin Romney 2ec6708980 fix(whatsapp): validate WebSocket URL env (#97697) 2026-06-29 10:50:16 -07:00
pick-cat 9949f6bd85 fix(chutes): bound OAuth token error response reads (#97808)
* fix(chutes): bound OAuth token error response reads

* ci: re-trigger checks (fs-safe unhandled-rejection flake on prior run)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Pick-cat <266665499+Pick-cat@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-29 10:48:05 -07:00
maweibin 84cd3aa7f5 fix(cli): call process.exit(1) in root help and version fast path error handlers (#97793) (#97807)
The error handler in tryHandleRootHelpFastPath only set process.exitCode=1
without calling process.exit(). When dangling async handles exist (timers,
connections, promises), the Node event loop stays open and the CLI hangs
indefinitely instead of returning to the terminal.

In tryHandleRootVersionFastPath, the default onError handler called
process.exit(1) directly, bypassing the injected exit seam that the
success path already uses. Changed to exit(1) (deps.exit ?? process.exit)
so tests and embedded callers can observe and control exit on failure.

Added rejection-path tests for version fast path: injected exit called
on resolveVersion rejection, and caller-supplied onError honored.

Fixes #97793.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-29 10:47:55 -07:00
Yuval Dinodia 24626e5266 fix(compaction): count bashExecution and summary turns in pre-prompt overflow precheck (#97861)
estimateMessageTokenPressure special-cased toolResult, tool, and
assistant roles and otherwise read record.content. bashExecution stores
its payload in command/output and branchSummary/compactionSummary store
theirs in summary, so record.content was undefined and those turns
scored as bare boundary overhead. The provider request expands them via
convertToLlm into full user text, so bash-heavy sessions skipped the
preflight overflow gate and submitted oversized prompts.

Estimate each affected role from the exact text convertToLlm renders:
bashExecutionToText for bash turns (zero for excludeFromContext records,
which convertToLlm drops), and the summary prefix/suffix plus summary
text for the two summary roles.
2026-06-29 10:47:45 -07:00
Masato Hoshino 888f399499 fix(status): surface should-run plugin drift (#97878)
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-29 10:46:36 -07:00
Dallin Romney beab0ecb02 test: link ClawHub packaged plugin QA evidence (#97712)
* test: link ClawHub packaged plugin QA evidence

* test: narrow ClawHub QA primary links
2026-06-29 10:46:33 -07:00
ly-wang19 5f60724b6d fix(nodes): guard node scalar fields against malformed entries 2026-06-29 10:36:29 -07:00
LiLan0125 685b95b607 fix(cron): warn when allowed web_search has no provider 2026-06-29 10:36:22 -07:00
cxbAsDev 597a0ba43c fix(discord): bound PluralKit and voice-message JSON reads 2026-06-29 10:36:16 -07:00