Tak Hoffman
89684fab22
feat: add no_reply tuning by conversation type
2026-04-18 11:44:35 -05:00
Tak Hoffman
666270cceb
Remove GPT-5.4 lab addendum wrapper text
2026-04-18 11:11:54 -05:00
Tak Hoffman
98a6665870
Remove shipped lab example defaults
2026-04-18 11:09:10 -05:00
Tak Hoffman
dd54e6e13e
Rename Labs internals and paths to Lab
2026-04-18 11:06:45 -05:00
Tak Hoffman
d228cd1ce8
Rename user-facing Labs references to Lab
2026-04-18 10:59:52 -05:00
Tak Hoffman
73fd96f2e7
Add Labs AGENTS addenda support
2026-04-18 10:52:06 -05:00
Peter Steinberger
cdaa70facb
refactor: cache repeated lazy imports
2026-04-18 16:32:53 +01:00
Vincent Koc
d13869aab9
fix(models): resolve openrouter compat aliases ( #68579 )
...
* fix(models): resolve openrouter compat aliases
* fix(models): cover openrouter free interactive alias
* fix(models): mirror openrouter compat aliases in runtime resolver
* fix(models): align openrouter free allowlist aliases
2026-04-18 08:24:34 -07:00
Peter Steinberger
464cbbc9f9
perf: trim plugin and skills test overhead
2026-04-18 16:23:00 +01:00
Peter Steinberger
aa73df571d
perf: narrow auth test mocks
2026-04-18 16:23:00 +01:00
Peter Steinberger
4852935e8e
perf: speed exec event test waits
2026-04-18 16:23:00 +01:00
Peter Steinberger
c035c5c0d2
refactor: cache lazy runtime imports
2026-04-18 16:18:26 +01:00
Vincent Koc
68502c90d1
fix(openrouter): parse visible reasoning_details output ( #68577 )
...
* fix(openrouter): parse visible reasoning_details output
* fix(openrouter): preserve reasoning_details ordering
* fix(openrouter): harden reasoning details compat
* fix(openrouter): queue post-tool-call reasoning text
* chore(config): refresh generated schema baselines
* fix(openrouter): keep fallback reasoning with visible details
* fix(openrouter): bound streaming tool-call buffers
2026-04-18 08:18:13 -07:00
Peter Steinberger
66385670e4
refactor: reduce unnecessary dynamic imports
2026-04-18 16:15:33 +01:00
Peter Steinberger
3f2e73b723
chore(release): bump version to 2026.4.18
2026-04-18 15:46:33 +01:00
Peter Steinberger
cf88e4876d
docs(changelog): prepare 2026.4.18 notes
2026-04-18 15:46:26 +01:00
Vincent Koc
840bf00887
test(infra): avoid repeated module reloads
2026-04-18 07:21:08 -07:00
Vincent Koc
e85e6bc4fb
perf(ci): reuse macos swift build outputs
2026-04-18 07:18:21 -07:00
Vincent Koc
40c30d0062
chore(ci): remove impossible local checkout action
2026-04-18 06:49:39 -07:00
Vincent Koc
6d55fa19db
fix(ci): inline fast checkout bootstrap
2026-04-18 06:49:08 -07:00
Vincent Koc
e5747629c3
fix(test): stabilize workspace package test imports
2026-04-18 06:45:09 -07:00
Vincent Koc
552c0f22a6
refactor(ci): extract fast checkout action
2026-04-18 06:41:22 -07:00
Vincent Koc
dd618aa545
perf(ci): split protocol check from contracts lane
2026-04-18 06:36:44 -07:00
Vincent Koc
de4429ceb3
perf(ci): fan out additional checks
2026-04-18 06:28:50 -07:00
Vincent Koc
334f0a4de2
fix(ci): harden checkout on hot linux lanes
2026-04-18 06:27:27 -07:00
Frank Yang
442deb0816
fix(cli): normalize reply-media paths for agent --deliver ( #68516 )
2026-04-18 20:05:41 +08:00
@zimeg
25ce5a5822
fix(slack): resolve stream recipient team in shared channels
2026-04-18 04:11:06 -07:00
Mason Huang
992b2143dd
fix(secret-scanning): remove maintainer @<LOGIN> attribution from replacement comment template ( #68521 )
2026-04-18 19:02:46 +08:00
Altay
f7ceb98b72
docs(changelog): add $schema entry ( #68515 )
2026-04-18 13:34:47 +03:00
Efe Baran Durmaz
a2eb8fa48f
fix(config): preserve $schema field across config rewrites ( #47322 )
...
* fix(config): preserve \$schema field across config rewrites
Add \$schema to the OpenClawConfig TypeScript type so it survives
the config write-back cycle. The Zod schema already accepted it
(added in #14998 ) but the TypeScript type omitted it, causing the
field to be silently stripped during config serialization.
Adds a round-trip test through validateConfigObject to prevent
regression.
Closes #43578
* fix(config): preserve root $schema during partial writes
* fix(config): preserve root $schema only when omitted
* fix(config): preserve root-authored $schema only
---------
Co-authored-by: Altay <altay@uinaf.dev >
2026-04-18 13:32:50 +03:00
Mason Huang
26cc1bc681
changelog: move #67807 entry to Fixes section ( #68509 )
...
* changelog: move #67807 entry to Fixes section
* changelog: move #67807 entry to Fixes section with correct PR-number ordering
2026-04-18 18:29:27 +08:00
Ted Li
9501656a8e
fix(cron): clean up deleteAfterRun direct deliveries ( #67807 )
...
Merged via squash.
Prepared head SHA: d23711c2e9
Co-authored-by: MonkeyLeeT <6754057+MonkeyLeeT@users.noreply.github.com >
Co-authored-by: hxy91819 <8814856+hxy91819@users.noreply.github.com >
Reviewed-by: @hxy91819
2026-04-18 18:17:18 +08:00
junyuc25
ef3f9796c8
fix(failover): widen raw 402 detection for third-party proxy messages ( #45827 )
...
Merged via squash.
Prepared head SHA: 5f4b5d7283
Co-authored-by: junyuc25 <10862251+junyuc25@users.noreply.github.com >
Co-authored-by: altaywtf <9790196+altaywtf@users.noreply.github.com >
Reviewed-by: @altaywtf
2026-04-18 12:38:04 +03:00
Ayaan Zaidi
eaaab098fb
test(cron): use CronDeliveryMode in policy helpers
2026-04-18 14:44:37 +05:30
Ayaan Zaidi
13a0d7a9e0
fix(cron): keep runner-owned delivery off message tool
2026-04-18 14:44:37 +05:30
Ayaan Zaidi
49ae60d6ca
fix(cron): keep message tool without delivery
2026-04-18 14:44:37 +05:30
Ayaan Zaidi
31437b9e3b
test(cron): cover message tool with no delivery
2026-04-18 14:44:37 +05:30
Mason Huang
3b9e0da02d
docs(changelog): deduplicate #67679 entry ( #68439 )
...
PR #67679 landed a duplicate line under ### Changes in the Unreleased
block in addition to the detailed entry that was already present under
### Fixes. The short ### Changes line (auto-generated from the PR title
during merge) is a duplicate of the same PR's ### Fixes line and also
mis-categorizes a security redaction fix as a feature change.
Remove the duplicate and keep the ### Fixes entry, which is the right
section and carries the descriptive text.
2026-04-18 14:40:07 +08:00
Ziy
4b5987829d
fix: redact credentials in browser.cdpUrl config paths ( #67679 )
...
Merged via squash.
Prepared head SHA: 77bc2c50ce
Co-authored-by: Ziy1-Tan <49604965+Ziy1-Tan@users.noreply.github.com >
Co-authored-by: hxy91819 <8814856+hxy91819@users.noreply.github.com >
Reviewed-by: @hxy91819
2026-04-18 14:22:58 +08:00
Viz
c778562379
ci(security): harden workflow steps against template-injection ( #68431 )
...
zizmor v1.24.1 reports 8 template-injection findings across three workflow files where GitHub Actions ${{ ... }} expressions are interpolated directly into shell run: blocks. Applies the canonical fix pattern: hoist every dynamic value into a step-level env: block and reference it as a shell variable ("${VAR}") from the script.
Files changed:
- control-ui-locale-refresh.yml: move matrix.locale into env as LOCALE (1 site)
- docker-release.yml: hoist steps.tags.outputs.{value,slim} plus the four needs.build-{amd64,arm64}.outputs.{digest,slim-digest} values into env for both manifest-creation steps (6 sites)
- openclaw-npm-release.yml: hoist steps.publish_tarball.outputs.path into env as PUBLISH_TARBALL_PATH in the Publish step (1 site)
Verified locally with zizmor --persona regular on the three files: 'No findings to report. Good job!'. pnpm format:check and pnpm lint pass.
Refs #68428 . Complements #66884 , which covers the remaining 12 sites in openclaw-cross-os-release-checks-reusable.yml.
2026-04-18 02:04:55 -04:00
Val Alexander
f45bc09206
[codex] fix(auth): harden OAuth refresh and Codex CLI bootstrap flows ( #68396 )
...
* Harden OAuth refresh and Codex CLI bootstrap flows
- Treat near-expiry OAuth credentials as unusable for bootstrap and refresh
- Add clearer timeout and callback validation handling for OpenAI Codex OAuth
- Tighten file lock retry behavior for stale OAuth refresh contention
* fix(auth): address PR review threads
* fix(auth): adopt fresher imported refresh tokens
* test(auth): align oauth expiry fixtures with refresh margin
* fix(auth): tighten Codex OAuth bootstrap and local fallback
* Keep explicit local auth over CLI bootstrap
- Preserve existing non-OAuth local profiles during external CLI OAuth sync
- Add regression coverage for OpenAI Codex and generic external OAuth overlays
* fix(auth): distinguish oauth lock timeout sources
* fix(auth): reject cross-account external oauth bootstrap
* fix(auth): narrow refresh contention classification
2026-04-18 01:02:29 -05:00
Gustavo Madeira Santana
18c4fd5678
Session: skip binding lookup for system events
2026-04-18 01:50:56 -04:00
Kagura
c2fb4007c2
Matrix: forward dangerouslyAllowPrivateNetwork config to client SSRF policy ( #68332 )
...
Merged via squash.
Prepared head SHA: d8733928eb
Co-authored-by: kagura-agent <268167063+kagura-agent@users.noreply.github.com >
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com >
Reviewed-by: @gumadeiras
2026-04-18 00:50:50 -04:00
Ayaan Zaidi
dc3b10285d
fix(telegram): require authorized abort supersede
2026-04-18 10:14:08 +05:30
Marcus Castro
458a52610a
fix(whatsapp): isolate multi-account inbound state and align shared defaults ( #65700 )
...
* refactor(whatsapp): centralize inbound policy resolution
* fix(whatsapp): scope named-account group session keys
* fix(whatsapp): preserve legacy group activation during scoped-key migration
* fix(whatsapp): wire shared defaults through accounts.default
* fix(whatsapp): align schema, helpers, and monitor behavior
* fix(whatsapp): restore verbose inbound diagnostics
* chore(config): refresh whatsapp changelog and baseline hashes
2026-04-18 01:37:38 -03:00
Rubén Cuevas
996eb9a024
fix: fence Telegram stale reply delivery after abort ( #68100 ) (thanks @rubencu)
...
* fix(telegram): fence stale reply delivery after abort
* refactor(telegram): narrow abort fence scope
* fix(telegram): ignore stale reply finalization after abort
* fix(telegram): close abort supersession races
* fix(telegram): release abort fences on setup errors
* fix(telegram): discard superseded draft cleanup
* refactor(telegram): distill abort fence cleanup
* fix: fence Telegram stale reply delivery after abort (#68100 ) (thanks @rubencu)
---------
Co-authored-by: Ayaan Zaidi <hi@obviy.us >
2026-04-18 10:02:38 +05:30
Kagura
2c3542e315
fix: allow unknown properties in WakeParams schema ( #68355 ) (thanks @kagura-agent)
...
* fix: allow unknown properties in WakeParams schema (#68347 )
WakeParamsSchema used additionalProperties: false, rejecting unknown
properties like 'paperclip' from external tools. Changed to
additionalProperties: true for forward compatibility.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
* style: trim wake params schema comments
* fix: allow unknown properties in WakeParams schema (#68355 ) (thanks @kagura-agent)
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com >
Co-authored-by: Ayaan Zaidi <hi@obviy.us >
2026-04-18 09:10:05 +05:30
Rubén Cuevas
a0dd5f7e8e
Align documented bootstrap context defaults with runtime values ( #67968 )
...
* Fix bootstrap default limit docs to match runtime
* docs(context): fix stale bootstrap max/file example
2026-04-18 09:00:21 +05:30
Gustavo Madeira Santana
e910fe446a
fix(install): omit checkout alias from dist inventory
2026-04-17 23:16:19 -04:00
Gustavo Madeira Santana
110f8bd2e1
fix(plugins): resolve checkout plugin sdk imports
2026-04-17 23:04:11 -04:00