Commit Graph

32065 Commits

Author SHA1 Message Date
Tak Hoffman
89684fab22 feat: add no_reply tuning by conversation type 2026-04-18 11:44:35 -05:00
Tak Hoffman
666270cceb Remove GPT-5.4 lab addendum wrapper text 2026-04-18 11:11:54 -05:00
Tak Hoffman
98a6665870 Remove shipped lab example defaults 2026-04-18 11:09:10 -05:00
Tak Hoffman
dd54e6e13e Rename Labs internals and paths to Lab 2026-04-18 11:06:45 -05:00
Tak Hoffman
d228cd1ce8 Rename user-facing Labs references to Lab 2026-04-18 10:59:52 -05:00
Tak Hoffman
73fd96f2e7 Add Labs AGENTS addenda support 2026-04-18 10:52:06 -05:00
Peter Steinberger
cdaa70facb refactor: cache repeated lazy imports 2026-04-18 16:32:53 +01:00
Vincent Koc
d13869aab9 fix(models): resolve openrouter compat aliases (#68579)
* fix(models): resolve openrouter compat aliases

* fix(models): cover openrouter free interactive alias

* fix(models): mirror openrouter compat aliases in runtime resolver

* fix(models): align openrouter free allowlist aliases
2026-04-18 08:24:34 -07:00
Peter Steinberger
464cbbc9f9 perf: trim plugin and skills test overhead 2026-04-18 16:23:00 +01:00
Peter Steinberger
aa73df571d perf: narrow auth test mocks 2026-04-18 16:23:00 +01:00
Peter Steinberger
4852935e8e perf: speed exec event test waits 2026-04-18 16:23:00 +01:00
Peter Steinberger
c035c5c0d2 refactor: cache lazy runtime imports 2026-04-18 16:18:26 +01:00
Vincent Koc
68502c90d1 fix(openrouter): parse visible reasoning_details output (#68577)
* fix(openrouter): parse visible reasoning_details output

* fix(openrouter): preserve reasoning_details ordering

* fix(openrouter): harden reasoning details compat

* fix(openrouter): queue post-tool-call reasoning text

* chore(config): refresh generated schema baselines

* fix(openrouter): keep fallback reasoning with visible details

* fix(openrouter): bound streaming tool-call buffers
2026-04-18 08:18:13 -07:00
Peter Steinberger
66385670e4 refactor: reduce unnecessary dynamic imports 2026-04-18 16:15:33 +01:00
Peter Steinberger
3f2e73b723 chore(release): bump version to 2026.4.18 2026-04-18 15:46:33 +01:00
Peter Steinberger
cf88e4876d docs(changelog): prepare 2026.4.18 notes 2026-04-18 15:46:26 +01:00
Vincent Koc
840bf00887 test(infra): avoid repeated module reloads 2026-04-18 07:21:08 -07:00
Vincent Koc
e85e6bc4fb perf(ci): reuse macos swift build outputs 2026-04-18 07:18:21 -07:00
Vincent Koc
40c30d0062 chore(ci): remove impossible local checkout action 2026-04-18 06:49:39 -07:00
Vincent Koc
6d55fa19db fix(ci): inline fast checkout bootstrap 2026-04-18 06:49:08 -07:00
Vincent Koc
e5747629c3 fix(test): stabilize workspace package test imports 2026-04-18 06:45:09 -07:00
Vincent Koc
552c0f22a6 refactor(ci): extract fast checkout action 2026-04-18 06:41:22 -07:00
Vincent Koc
dd618aa545 perf(ci): split protocol check from contracts lane 2026-04-18 06:36:44 -07:00
Vincent Koc
de4429ceb3 perf(ci): fan out additional checks 2026-04-18 06:28:50 -07:00
Vincent Koc
334f0a4de2 fix(ci): harden checkout on hot linux lanes 2026-04-18 06:27:27 -07:00
Frank Yang
442deb0816 fix(cli): normalize reply-media paths for agent --deliver (#68516) 2026-04-18 20:05:41 +08:00
@zimeg
25ce5a5822 fix(slack): resolve stream recipient team in shared channels 2026-04-18 04:11:06 -07:00
Mason Huang
992b2143dd fix(secret-scanning): remove maintainer @<LOGIN> attribution from replacement comment template (#68521) 2026-04-18 19:02:46 +08:00
Altay
f7ceb98b72 docs(changelog): add $schema entry (#68515) 2026-04-18 13:34:47 +03:00
Efe Baran Durmaz
a2eb8fa48f fix(config): preserve $schema field across config rewrites (#47322)
* fix(config): preserve \$schema field across config rewrites

Add \$schema to the OpenClawConfig TypeScript type so it survives
the config write-back cycle. The Zod schema already accepted it
(added in #14998) but the TypeScript type omitted it, causing the
field to be silently stripped during config serialization.

Adds a round-trip test through validateConfigObject to prevent
regression.

Closes #43578

* fix(config): preserve root $schema during partial writes

* fix(config): preserve root $schema only when omitted

* fix(config): preserve root-authored $schema only

---------

Co-authored-by: Altay <altay@uinaf.dev>
2026-04-18 13:32:50 +03:00
Mason Huang
26cc1bc681 changelog: move #67807 entry to Fixes section (#68509)
* changelog: move #67807 entry to Fixes section

* changelog: move #67807 entry to Fixes section with correct PR-number ordering
2026-04-18 18:29:27 +08:00
Ted Li
9501656a8e fix(cron): clean up deleteAfterRun direct deliveries (#67807)
Merged via squash.

Prepared head SHA: d23711c2e9
Co-authored-by: MonkeyLeeT <6754057+MonkeyLeeT@users.noreply.github.com>
Co-authored-by: hxy91819 <8814856+hxy91819@users.noreply.github.com>
Reviewed-by: @hxy91819
2026-04-18 18:17:18 +08:00
junyuc25
ef3f9796c8 fix(failover): widen raw 402 detection for third-party proxy messages (#45827)
Merged via squash.

Prepared head SHA: 5f4b5d7283
Co-authored-by: junyuc25 <10862251+junyuc25@users.noreply.github.com>
Co-authored-by: altaywtf <9790196+altaywtf@users.noreply.github.com>
Reviewed-by: @altaywtf
2026-04-18 12:38:04 +03:00
Ayaan Zaidi
eaaab098fb test(cron): use CronDeliveryMode in policy helpers 2026-04-18 14:44:37 +05:30
Ayaan Zaidi
13a0d7a9e0 fix(cron): keep runner-owned delivery off message tool 2026-04-18 14:44:37 +05:30
Ayaan Zaidi
49ae60d6ca fix(cron): keep message tool without delivery 2026-04-18 14:44:37 +05:30
Ayaan Zaidi
31437b9e3b test(cron): cover message tool with no delivery 2026-04-18 14:44:37 +05:30
Mason Huang
3b9e0da02d docs(changelog): deduplicate #67679 entry (#68439)
PR #67679 landed a duplicate line under ### Changes in the Unreleased
block in addition to the detailed entry that was already present under
### Fixes. The short ### Changes line (auto-generated from the PR title
during merge) is a duplicate of the same PR's ### Fixes line and also
mis-categorizes a security redaction fix as a feature change.

Remove the duplicate and keep the ### Fixes entry, which is the right
section and carries the descriptive text.
2026-04-18 14:40:07 +08:00
Ziy
4b5987829d fix: redact credentials in browser.cdpUrl config paths (#67679)
Merged via squash.

Prepared head SHA: 77bc2c50ce
Co-authored-by: Ziy1-Tan <49604965+Ziy1-Tan@users.noreply.github.com>
Co-authored-by: hxy91819 <8814856+hxy91819@users.noreply.github.com>
Reviewed-by: @hxy91819
2026-04-18 14:22:58 +08:00
Viz
c778562379 ci(security): harden workflow steps against template-injection (#68431)
zizmor v1.24.1 reports 8 template-injection findings across three workflow files where GitHub Actions ${{ ... }} expressions are interpolated directly into shell run: blocks. Applies the canonical fix pattern: hoist every dynamic value into a step-level env: block and reference it as a shell variable ("${VAR}") from the script.

Files changed:

- control-ui-locale-refresh.yml: move matrix.locale into env as LOCALE (1 site)

- docker-release.yml: hoist steps.tags.outputs.{value,slim} plus the four needs.build-{amd64,arm64}.outputs.{digest,slim-digest} values into env for both manifest-creation steps (6 sites)

- openclaw-npm-release.yml: hoist steps.publish_tarball.outputs.path into env as PUBLISH_TARBALL_PATH in the Publish step (1 site)

Verified locally with zizmor --persona regular on the three files: 'No findings to report. Good job!'. pnpm format:check and pnpm lint pass.

Refs #68428. Complements #66884, which covers the remaining 12 sites in openclaw-cross-os-release-checks-reusable.yml.
2026-04-18 02:04:55 -04:00
Val Alexander
f45bc09206 [codex] fix(auth): harden OAuth refresh and Codex CLI bootstrap flows (#68396)
* Harden OAuth refresh and Codex CLI bootstrap flows

- Treat near-expiry OAuth credentials as unusable for bootstrap and refresh
- Add clearer timeout and callback validation handling for OpenAI Codex OAuth
- Tighten file lock retry behavior for stale OAuth refresh contention

* fix(auth): address PR review threads

* fix(auth): adopt fresher imported refresh tokens

* test(auth): align oauth expiry fixtures with refresh margin

* fix(auth): tighten Codex OAuth bootstrap and local fallback

* Keep explicit local auth over CLI bootstrap

- Preserve existing non-OAuth local profiles during external CLI OAuth sync
- Add regression coverage for OpenAI Codex and generic external OAuth overlays

* fix(auth): distinguish oauth lock timeout sources

* fix(auth): reject cross-account external oauth bootstrap

* fix(auth): narrow refresh contention classification
2026-04-18 01:02:29 -05:00
Gustavo Madeira Santana
18c4fd5678 Session: skip binding lookup for system events 2026-04-18 01:50:56 -04:00
Kagura
c2fb4007c2 Matrix: forward dangerouslyAllowPrivateNetwork config to client SSRF policy (#68332)
Merged via squash.

Prepared head SHA: d8733928eb
Co-authored-by: kagura-agent <268167063+kagura-agent@users.noreply.github.com>
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com>
Reviewed-by: @gumadeiras
2026-04-18 00:50:50 -04:00
Ayaan Zaidi
dc3b10285d fix(telegram): require authorized abort supersede 2026-04-18 10:14:08 +05:30
Marcus Castro
458a52610a fix(whatsapp): isolate multi-account inbound state and align shared defaults (#65700)
* refactor(whatsapp): centralize inbound policy resolution

* fix(whatsapp): scope named-account group session keys

* fix(whatsapp): preserve legacy group activation during scoped-key migration

* fix(whatsapp): wire shared defaults through accounts.default

* fix(whatsapp): align schema, helpers, and monitor behavior

* fix(whatsapp): restore verbose inbound diagnostics

* chore(config): refresh whatsapp changelog and baseline hashes
2026-04-18 01:37:38 -03:00
Rubén Cuevas
996eb9a024 fix: fence Telegram stale reply delivery after abort (#68100) (thanks @rubencu)
* fix(telegram): fence stale reply delivery after abort

* refactor(telegram): narrow abort fence scope

* fix(telegram): ignore stale reply finalization after abort

* fix(telegram): close abort supersession races

* fix(telegram): release abort fences on setup errors

* fix(telegram): discard superseded draft cleanup

* refactor(telegram): distill abort fence cleanup

* fix: fence Telegram stale reply delivery after abort (#68100) (thanks @rubencu)

---------

Co-authored-by: Ayaan Zaidi <hi@obviy.us>
2026-04-18 10:02:38 +05:30
Kagura
2c3542e315 fix: allow unknown properties in WakeParams schema (#68355) (thanks @kagura-agent)
* fix: allow unknown properties in WakeParams schema (#68347)

WakeParamsSchema used additionalProperties: false, rejecting unknown
properties like 'paperclip' from external tools. Changed to
additionalProperties: true for forward compatibility.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* style: trim wake params schema comments

* fix: allow unknown properties in WakeParams schema (#68355) (thanks @kagura-agent)

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
2026-04-18 09:10:05 +05:30
Rubén Cuevas
a0dd5f7e8e Align documented bootstrap context defaults with runtime values (#67968)
* Fix bootstrap default limit docs to match runtime

* docs(context): fix stale bootstrap max/file example
2026-04-18 09:00:21 +05:30
Gustavo Madeira Santana
e910fe446a fix(install): omit checkout alias from dist inventory 2026-04-17 23:16:19 -04:00
Gustavo Madeira Santana
110f8bd2e1 fix(plugins): resolve checkout plugin sdk imports 2026-04-17 23:04:11 -04:00