* fix(ui): keep streamed media pinned to the chat
* test(ui): exercise real manual media scroll gestures
* fix(ui): settle chat follow at shared end boundary
* test(mcp): split OAuth CLI coverage
* style(mcp): format split CLI tests
* fix(ui): follow media growth during active streams
* test(ui): type active stream fixture
---------
Co-authored-by: Peter Steinberger <steipete@golden-gate.local>
* fix(gateway): redact credentials from gateway URLs in status and logs diagnostics
Gateway URLs can carry basic-auth credentials or token query params. Status
output, status-all JSON, and logs-cli error diagnostics now project connection
details through a single diagnostics projection (projectGatewayConnectionDetailsForDiagnostics /
projectGatewayUrlForDiagnostics) so no diagnostic surface prints a raw URL;
the probe itself keeps using the unredacted URL.
* chore: re-fire CI
* fix(gateway): close remaining credential-leak paths in status diagnostics
ClawSweeper P1s: probe failure text (close reasons/transport errors) now
redacts URL-like credentials before status renderers print it; the status-all
remote-missing fallback line projects the environment gateway URL; gateway
transport-error JSON redacts the remote-controlled close reason and derived
message.
* feat(plugins): support the Agent Plugins bundle format
* docs(plugins): document the Agent Plugins bundle format
* test(agents): preserve agent bundle runtime discovery
* fix(plugins): isolate Agent Plugins data-dir failures and align MCP support reporting
* docs(plugins): list Agent Plugins in the canonical plugin-format guides
* fix(plugins): gate Agent Plugins detection on schema, pure inspection, root-relative cwd
* fix(plugins): record Agent Plugins data-dir ownership explicitly
* docs(plugins): cover Agent Plugins in the CLI install detection guide
* fix(plugins): carry Agent Plugins data-dir and transport contracts through external MCP projections
* refactor(test): exercise real Teams monitor lifecycle
* refactor(test): use real gateway lifecycle state
* refactor(test): use real restart delivery queue
* test: type Teams SDK boundary fixture
* [AI] fix(node-cli): warn when systemd user lingering is disabled after install
openclaw node install now detects when systemd user lingering is off and
warns the operator (text + JSON) to run 'sudo loginctl enable-linger <user>'.
Without lingering, the user-level node service is torn down when the last SSH
session ends, so the node silently goes offline after logout.
The check is read-only and never auto-enables lingering, matching the
operator-consent policy used elsewhere. It runs only on the verified-success
path: an optional onVerified hook is added to installDaemonServiceAndEmit
that fires after service.isLoaded() confirms the service is loaded and before
the success payload is emitted. The linger diagnostic runs there, so a failed
install or verification failure never carries a linger warning (avoids
misdirecting the operator to fix lingering for a service that was not
successfully installed). The already-installed short-circuit warns separately.
Skipped on non-Linux and when systemd user service is unavailable.
Adds unit tests for both paths, the linger=yes no-op, the install-failure
isolation, the verification-failure no-warn regression, and the
systemd-unavailable skip, plus response.test.ts cases covering onVerified
running on success and failing safely when it throws. The
readSystemdUserLingerStatus mock is typed with the full linger union to
satisfy tsgo. Documents the linger step in docs/cli/node.md and
docs/nodes/troubleshooting.md.
Real-behavior evidence captured on a Linux host by toggling
loginctl disable-linger/enable-linger and running the real install flow:
linger=no emits the warning on successful install (text + JSON) and on the
already-installed path; linger=yes emits nothing; a failed install or
verification failure emits no warning.
Fixes#107033
Co-Authored-By: deepseek-v4-flash <noreply@anthropic.com>
* fix(node-cli): align linger user with service owner
* docs(node): narrow crash-loop claim to gateway units
The duplicate-scope guard that raises on two managers running the same unit
name is enforced for gateway units (two supervisors on the same port SIGTERM
each other in a restart loop); assertNoSystemGatewayOwnership returns early
for node services, so claiming node services crash-loop misattributes gateway
behavior. Qualify the troubleshooting note accordingly.
Addresses ClawSweeper P3 finding on PR #118430.
* fix(systemd): align linger checks with service owner
* test(doctor): align linger status mock contract
* style(doctor): format linger mock
* test(wizard): mock systemd service account
---------
Co-authored-by: deepseek-v4-flash <noreply@anthropic.com>
Co-authored-by: Patrick Erichsen <patrick.a.erichsen@gmail.com>
Self-learning reviewer edits existing skills via targeted patches: it quotes the exact live text (or appends a section) and the service composes the full body inside the receipt-pinned read that hash-binds the proposal — untouched content survives by construction, and patches auto-apply through the scanner-gated pipeline. Full-body rewrites and oversized-skill edits stay pending for the operator. The review prompt shifts to active capture within the existing evidence gates, and shallow same-sender turns accumulate per session (provider-identity scoped, zero-iteration and duplicate-run contracts honored, aborted provenance carried, bounded state) so quick corrections get reviewed with their own transcripts. Replaces closed#119856.
The compare-and-swap revision option was parsed with raw Number(), so
hexadecimal (0x2) and scientific (1e2) values were silently accepted
and used as the CAS revision even though the validation message
requires a non-negative integer. Delegate to the shared
parseStrictNonNegativeInteger helper used across the CLI so
non-decimal input fails fast and no write is attempted.
The run loop primes cli/gateway-cli/lifecycle.runtime.ts before installing
signal handlers, so every symbol that hub re-exports loads before the HTTP
listener binds. Two of those re-exports resolved through forwarding modules:
gateway/server-reload-handlers.ts also re-exports the hot-reload and managed
reloader modules, and agents/main-session-restart-recovery.ts also re-exports
its -runtime sibling. ESM evaluates the whole forwarding module, so priming the
hub pulled both graphs onto the cold-start path.
Re-export each symbol from the module that defines it instead.
abortPendingChannelReloads lives in gateway/server-reload-contracts.ts, whose
own imports are all type-only, and markRestartAbortedMainSessions lives in
agents/main-session-restart-recovery-marking.ts. Both retargets resolve to the
same module instances, so shared reload-generation state and behavior are
unchanged, and the eager priming that protects signal handlers from dist chunk
rotation stays in place.
Add a CLI-lane import-boundary test so these re-exports cannot be routed back
through a forwarding module, and point the two run-loop test mocks at the
defining modules.
Keep `openclaw onboard --skip-ui` and `openclaw setup --skip-ui` on guided onboarding while suppressing browser and terminal handoffs.
Refs #118388 and #118038.
Prepared head SHA: 4e284c4523
Co-authored-by: Shakker <165377636+shakkernerd@users.noreply.github.com>
Reviewed-by: @shakkernerd
Peter Steinberger