8d6cbee1b5
fix(gateway): avoid Tailscale crash loops after upgrades ( #126069 )
...
* fix(gateway): migrate legacy Tailscale routes on upgrade
* fix(gateway): preserve unattributable Tailscale routes
2026-08-18 17:14:49 -07:00
fe816d69ef
fix(gateway): route detached announce by instance ( #125946 )
...
* test(qa): cover worker generation reload
* test(qa): anchor worker generation fixture
* test(qa): strengthen worker generation proof
* test(qa): stabilize terminal reply smoke waits
* test(qa): widen terminal reply CI budget
* test(qa): drop superseded timeout workaround
* fix(gateway): route detached announce by instance
2026-08-18 17:14:43 -07:00
10610d9f63
fix: denial gateway configuration for cron aliases ( #123847 )
...
* Fix denial gateway configuration for cron aliases.
* test(gateway): isolate chat image capability lookup
---------
Co-authored-by: joshavant <830519+joshavant@users.noreply.github.com >
2026-08-18 18:58:33 -05:00
19c916be13
fix(auth): keep session rotation on provider routes ( #123894 )
...
Keep automatic auth-profile rotation within the session current provider route so API-key sessions do not switch to subscription credentials across compaction or cooldown. Cross-route fallback remains owned by provider route planning.
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-08-18 16:38:56 -07:00
2cd87d3d27
fix(gateway): bind subagent completion dispatch to instance ( #126062 )
...
* fix(gateway): bind subagent completion dispatch to instance
* fix(gateway): keep completion binding cycle-free
* fix(gateway): consolidate resolver type imports
2026-08-18 16:37:31 -07:00
8ccfd075fe
fix(gateway): bind detached lifecycle dispatch ( #126040 )
2026-08-18 16:31:25 -07:00
1110cd09bd
improve(ui): make online sidebar section collapsible ( #125963 )
...
* improve(ui): make online sidebar section collapsible
* improve(ui): show online avatars in compact state
* improve(ui): align online section heading
* fix(ui): satisfy sidebar CI gates
* fix(ui): keep online expanded on first visit
2026-08-18 20:28:38 -03:00
4b8b2920b4
fix: fallback traces omit failed model candidates ( #126048 )
...
* fix(agents): preserve outer fallback execution traces
* fix(agents): align fallback trace contracts
* style(skills): format release validation instructions
2026-08-18 16:25:51 -07:00
e2643afb2a
fix(codex): retain terminal facts in oversized trajectories ( #126050 )
...
* fix(codex): delegate trajectory bounding to host
* fix(trajectory): preserve compact terminal facts
* style: format release validation skill
2026-08-18 16:22:25 -07:00
50720c3b8e
fix(codex): preserve native approval scope ( #125995 )
2026-08-18 16:18:01 -07:00
ffbbb64178
fix: plugin install rejects bare prerelease gateway minimums ( #126020 )
...
* fix(plugins): accept bare prerelease gateway minimums
* fix(plugins): honor prerelease host ordering
2026-08-18 16:12:10 -07:00
48c05d435e
fix(skills): restore oxfmt formatting in the release validation skill ( #126060 )
...
`oxfmt --check` fails on main, which takes check-docs red on every PR. The
drift came in with #126055 in
.agents/skills/openclaw-release-validation/SKILL.md.
Formatting only, no content change.
2026-08-18 16:09:08 -07:00
9924e2d7a7
feat(cli): prepare session-host onboarding ( #125879 )
...
* feat(cli): prepare session-host onboarding
* fix(cli): gate session-host installer capability
2026-08-18 16:08:48 -07:00
a91f1202d9
fix(ui): keep Plugins hub navigation stable ( #126061 )
...
* fix(ui): keep Plugins hub navigation stable
* chore: format release validation skill
2026-08-18 16:08:41 -07:00
11997bf211
fix(workshop): make collection restore ownership retryable ( #126014 )
2026-08-18 16:04:01 -07:00
d39a24c687
fix(ui): identify current user in owner filters ( #126052 )
...
Pin the authenticated profile first and label it as Name (You) in the shared session owner menus.
Co-authored-by: RoboClaw <309084314+roboclaw-bot@users.noreply.github.com >
2026-08-18 15:49:33 -07:00
d7fe595ebb
fix(media): honor sender tool policy for outbound file reads ( #125950 )
...
* fix(media): enforce sender policy for outbound reads
* fix(media): block denied attachment fallbacks
* fix(gateway): preserve sender aliases for media policy
* fix(media): scope wildcard and attachment actions
* test(gateway): prove denied media stays unbuffered
* fix(gateway): scope send attachment hydration
2026-08-18 15:49:18 -07:00
1d9cda833f
feat(ui): show machine CPU and RAM in the cloud picker ( #125696 )
...
The cloud machine picker described each class in prose ("Cheap smoke checks
and small repos"), which was the widest thing in the row, got ellipsized, and
did not say what the operator actually picks on. Machine options now carry the
class shape and the picker renders "32 vCPU · 64 GB" instead.
Crabbox reports per-provider class shapes from `providers --json`; the plugin
reads that catalog once per lifecycle and attaches cpu/memoryGb to each option.
A missing binary, failed command, unparseable output, absent classes, or an
unmatched provider all degrade to label-only rows, so an older Crabbox keeps
working.
`description` was never released, so it is removed rather than deprecated, and
listMachineOptions becomes async for the catalog read. Deletes the duplicate
machine-option projector in the environments server method.
2026-08-18 15:38:15 -07:00
ed7317eeb9
fix(release): streamline validation setup ( #126055 )
...
* fix(release): streamline validation setup
* docs(release): add guided testing prompt
* docs(release): orient validation testers
* docs(release): introduce validation workflow
2026-08-18 15:35:04 -07:00
f7db0a4c51
fix: show named CLI sessions in the sidebar ( #126043 )
...
* fix(gateway): preserve explicit session names
* test(ui): keep session visibility fixture isolated
2026-08-18 15:33:43 -07:00
e8312171c1
fix: direct Gateway stops wait for active work ( #126024 )
...
* fix(gateway): drain active work on direct stop
* test(ui): isolate widget fetch retry mock
2026-08-18 15:29:52 -07:00
f6f426c8e8
feat(ui): add copy session id action ( #124059 )
2026-08-18 22:29:20 +00:00
0f08ba4a6e
fix(tui): gate startup sends on restored session ( #126046 )
2026-08-18 15:20:56 -07:00
39aec9b3d7
docs(gateway): document cloud-workers settings page and machine picker ( #126049 )
...
The Control UI settings page (#124864 ) and the New Session place
picker's machine section had no doc coverage — the configuration and
dispatch walkthroughs only described the JSON/RPC paths.
2026-08-18 15:19:48 -07:00
efff6964e0
fix(ui): make assign-to-me update session owner ( #126031 )
...
Make the self shortcut use the same canonical owner payload as the Assign to submenu so Control UI ownership updates reliably.
Refs #126026
2026-08-18 15:11:50 -07:00
cd0cdfd521
fix(ui): keep the empty side panel closed ( #126047 )
...
Co-authored-by: RoboClaw <309084314+roboclaw-bot@users.noreply.github.com >
2026-08-18 15:11:24 -07:00
20b6a04036
fix(ui): vertically center session row actions ( #126041 )
...
Center sidebar session pin and menu actions across the full two-line row while reserving text width on hover and touch. Add browser geometry regression coverage.
Co-authored-by: RoboClaw <309084314+roboclaw-bot@users.noreply.github.com >
2026-08-18 15:10:22 -07:00
20c09b8088
improve(ui): label new session picker menus ( #126045 )
...
Show Agents, Environments, Projects, and Branches headings when the four New Session pickers open.
Co-authored-by: RoboClaw <309084314+roboclaw-bot@users.noreply.github.com >
2026-08-18 15:10:04 -07:00
6b68ffd3ab
fix(canvas): present widgets atomically ( #126039 )
2026-08-18 15:08:17 -07:00
670f61200b
improve(ui): slow new session spinner ( #126044 )
...
Co-authored-by: RoboClaw <309084314+roboclaw-bot@users.noreply.github.com >
2026-08-18 15:06:55 -07:00
14d43ad93c
fix(ui): reflect inherited agent skill allowlists ( #124429 )
...
* fix(ui): honor inherited agent skill filters
* test(ui): cover inherited agent skill allowlists
* test(ui): publish real gateway skill proof
* chore(proof): remove generated UI evidence
* fix(ui): show inherited skills in agent context
* fix(ui): show inherited skills in agent context
* docs(proof): record rebased gateway UI verification
* docs(proof): capture current-head agent skills UI
* docs(proof): bind agent skills capture to final head
* chore(ui): remove PR-only proof artifacts
* fix(ui): preserve list-form agent skill overrides
* fix(ui): preserve list-form agent mutations
* fix(ui): use canonical list skill replace path
* docs(ui): attach inherited skills gateway proof
* chore(proof): keep visual evidence out of source tree
* fix(ui): remove misleading enable-all action
* test(ui): reflect removed enable-all action
* fix(ui): describe skill reset as inherited defaults
* fix(ui): keep skill reset on canonical roster
* fix(ui): reset list-roster skill overrides
* fix(ui): satisfy inherited skills proof checks
* fix(ui): keep agent skill reset on canonical entries
* test(ui): focus inherited skill regression proof
---------
Co-authored-by: RoboClaw <309084314+roboclaw-bot@users.noreply.github.com >
2026-08-18 15:06:28 -07:00
4be131107f
docs(gateway): document the Cloudflare Tunnel and Access deployment ( #126029 )
...
* docs(gateway): document the Cloudflare Tunnel and Access deployment
* docs(gateway): clarify Cloudflare Access trust boundary
2026-08-18 15:03:27 -07:00
b34eb16071
fix(copilot): restore OpenClaw guidance to agent turns ( #125997 )
...
* fix(copilot): add OpenClaw prompt guidance
Copilot append-mode system messages included credential safety, workspace bootstrap, and extra context but omitted OpenClaw delegation and reply-delivery policy.
Build guidance from the final policy-filtered tool surface so visible delegated work, Skill Workshop, and source replies follow the same behavior as Codex.
* fix(copilot): break prompt guidance import cycle
The CI architecture gate detected a cycle through attempt-config and prompt-guidance. Isolate raw-run mode detection in a leaf module.
2026-08-18 15:01:15 -07:00
56fb860270
fix(agents): redact reflected credentials from native PDF provider error body and reason phrase ( #125499 )
...
* fix(agents): redact reflected credentials from native PDF provider error body and reason phrase
* fix(agents): centralize provider error credential redaction
Redact the exact authentication values sent by native PDF and MiniMax VLM requests before provider-controlled response fields reach agent-facing errors.
Co-authored-by: zenglingbiao <zeng.lingbiao@xydigit.com >
Signed-off-by: sallyom <somalley@redhat.com >
---------
Signed-off-by: sallyom <somalley@redhat.com >
Co-authored-by: sallyom <somalley@redhat.com >
2026-08-18 17:58:12 -04:00
41e3968ee4
docs(config): clarify missing unset behavior ( #126036 )
2026-08-18 14:55:19 -07:00
491dc7f8b1
fix(codex): report native project docs truthfully ( #126010 )
2026-08-18 14:42:56 -07:00
a13251825a
fix(gateway): tolerate locked terminal cleanup ( #125058 )
...
Co-authored-by: Jacqueline Henriksen <jjjhenriksen@users.noreply.github.com >
2026-08-18 14:32:45 -07:00
5cabd2b72e
Revert "fix(providers): report request acceptance consistently ( #125807 )" ( #126021 )
...
This reverts commit f5e9622fc9
2026-08-19 00:16:09 +03:00
39b39ca6ee
fix(gateway): apply configured edge auth to session-URL targets ( #125982 )
...
* fix(gateway): apply configured edge auth to session-URL targets
Follow-up to #125700 .
A URL target with explicit auth skipped config loading and silently dropped
gateway.remote.edgeAuth. Config I/O is now skipped only for plaintext loopback
targets.
Also document mandatory passEnv: ["HOME"] for the cloudflared exec provider.
* fix(gateway): keep explicit secure connections working when config is invalid
Addresses the ClawSweeper finding on #125982 by preserving the invalid-config recovery path while still applying configured edge auth.
2026-08-18 14:08:51 -07:00
695b25386d
fix(release): offer OCM installation ( #126019 )
2026-08-18 14:08:14 -07:00
fa62fccb86
refactor(gateway): remove workspace plugin generation projections ( #125990 )
...
* refactor(agents): remove workspace plugin generation projections
* test(agents): pass explicit generation in auth refresh
2026-08-18 14:03:27 -07:00
f2158a9c36
feat(sessions): keep durable work visible and auto-archive stale sessions ( #124925 )
...
* feat(agents): clarify visible session guidance
* feat(sessions): auto-archive inactive dashboard sessions
* fix(sessions): preserve active dashboard sessions during maintenance
* test(sessions): preserve admitted dashboard sessions during archive
* chore: refresh session generated artifacts
* test: align recovery id with transcript redaction
* fix(sessions): report only committed maintenance counts
2026-08-18 14:02:54 -07:00
8032e6c75e
fix(ui): restore session link hovercards ( #125968 )
...
* fix(ui): restore session link hovercards
* chore: defer session hovercard release note
2026-08-18 13:51:35 -07:00
f5e9622fc9
fix(providers): report request acceptance consistently ( #125807 )
...
* fix(providers): report request acceptance consistently
* fix(providers): retain response hook compatibility
* fix(providers): keep legacy response hook path
* fix(providers): distinguish rejected response attempts
* fix(providers): keep acceptance evidence truthful
* fix(google): preserve provider acceptance errors
* test(google): satisfy acceptance callback lint
* fix(google): exclude acceptance hooks from retry deadline
* fix(openai): report Codex websocket acceptance
* fix(openai): commit websocket state before acceptance hook
* fix(google): abort pending acceptance callbacks
* fix(providers): abort pending acceptance callbacks
* fix(mistral): report observed HTTP response
* fix(mistral): report rejected HTTP responses
* fix(providers): derive acceptance from HTTP status
* fix(providers): preserve acceptance lifecycle cleanup
* fix(anthropic): report observed HTTP response
* fix(anthropic): report rejected HTTP responses
* fix(plugin-sdk): expose provider lifecycle
* fix(providers): stop after lifecycle abort
* fix(mistral): cancel unread acceptance failures
2026-08-18 23:50:57 +03:00
549e6349f8
fix(workboard): prevent orphaned runs and overwritten cards ( #125951 )
...
* fix(workboard): make ownership updates atomic
Persist launch intent before worker acceptance, reconcile accepted identities,
fence cross-host card mutations, and deduplicate session capture in SQLite.
Closes #125932
* test(workboard): keep race fixtures plugin-local
Use a plugin-local synchronization helper and update the sessions-page capture
expectation for the new store-owned RPC.
* fix(workboard): fence lifecycle and restore races
Apply terminal lifecycle state only while the matched association is current,
and converge concurrent archived session restores on the active winner.
2026-08-18 13:50:17 -07:00
347a0eaf8c
feat(ui): activity feed automation grouping, live status, deep-link inspector ( #125981 )
...
* feat(ui): collapse automation sessions in activity feed
* feat(ui): show live run status on activity feed rows
* feat(ui): make run inspector deep-link only
* fix(ui): only link inspect run to a current active run
Addresses ClawSweeper P1: a stale observer digest could deep-link a live
row to an ended run's audit record; trust digest runId only when it is
still in activeRunIds.
2026-08-18 13:49:25 -07:00
3e2a82bc0b
feat(release): add interactive release validation skill ( #125642 )
...
* feat(release): model interactive validation campaigns
* feat(release): add validation skill workflow
* fix(release): select validation scope before missions
* fix(release): harden copied validation setup
* fix(release): require manual validation skill invocation
* fix(release): harden copied validation finalization
* fix(release): narrow validation issue feedback
* fix(release): surface upgrade results before testing
* fix(release): select validation missions one at a time
* refactor(release): simplify validation to markdown worksheet
* feat(release): prioritize validation from release notes
* refactor(release): tighten validation worksheet hierarchy
* refactor(release): summarize validation priorities by theme
* refactor(release): integrate priorities into subsystem notes
* refactor(release): align subsystem note hierarchy
* refactor(release): remove cherry-picked examples
* refactor(release): derive validation from maturity scorecard
* fix(release): publish absolute scorecard links
* docs(release): preserve scorecard generation step
* docs(release): clarify generated surface headings
* refactor(release): present validation guidance in tables
* docs(release): normalize surface table example
* refactor(release): embed notes in surface tables
* refactor(release): sequence validation campaign setup
* fix(release): trust explicit validation issue
* fix(release): preserve campaign worksheet
* fix(release): clarify validation worksheet
2026-08-18 13:48:11 -07:00
99acca309c
fix(crabbox): surface invalid cloud worker profiles ( #125991 )
2026-08-18 13:47:51 -07:00
f97a133254
fix(config): fail config unset on a missing path again ( #125958 )
...
runConfigUnset scoped its missing-path error to --dry-run, so the real
invocation printed "No change" and exited 0 while --dry-run on the same
input exited 1 with a specific message. Dry-run exists to predict the
real run, and a typo'd unset in a script reported success.
Restore the failure for both modes, keeping the strict-config assertion
introduced alongside the regression and the JSON5 byte preservation it
was added to guarantee.
2026-08-18 13:45:57 -07:00
f59392fdf5
fix(channels): redact logs and reject unknown filters ( #125939 )
...
* fix(channels): redact and validate log filters
* fix(logging): preserve filtered redacted channel tails
* fix(channels): match log filters on exact boundaries
* fix(logging): honor redaction off mode
2026-08-18 13:37:17 -07:00
Josh Avant