Conversation
…law#120902) Preserve final ChatGPT Responses stream frames when the endpoint omits the trailing blank line. Malformed final data retains the existing malformed-fragment error. Validation: public built-agent red/green with a synthetic local TLS endpoint; 114 focused tests; nine independent public acceptance scenarios; targeted lint, formatting, and ratchets. Co-authored-by: Ayaan Zaidi <hi@obviy.us>
openclaw#143798) * fix(cloud): explain unavailable operating system choices Keep provider-advertised macOS and Windows choices visible with an upgrade hint when Crabbox is outdated or its version cannot be verified. Preserve provisioning checks and Linux dispatch while preventing unavailable choices in session and profile pickers. * test(sdk): cover unavailable operating system metadata * refactor(crabbox): build OS catalog entries without map spreads
…143659) Prepare per-invocation OpenCode routing headers for standalone completions while preserving explicit headers, session ownership, and prepared-completion lifecycle checks. Document the additive SDK options and their precedence. Verified built CLI baseline failure and candidate completion, real SDK retry/header controls, excluded endpoints, and 275 focused tests. Co-authored-by: Ayaan Zaidi <hi@obviy.us>
…openclaw#143801) ## Problem Settings → Cloud workers could edit only part of a profile and could not manage repository defaults or the shared prepared-worker cap. Operators had to edit config manually for these ordinary settings. ## Solution Add an Advanced group for warm-image selection, setup environment names, ready workers, and suspend-after duration. Preserve each duration field's existing parser, including the suspend-after minimum of one minute. Empty optional fields remove their saved keys through the existing `config.patch` flow, with explicit array replacement intent for setup environment names. Add a Prepared pool row and a Repositories section in a separate component. Repository identities use the canonical normalizer, selections must name configured profiles, and edits/deletes reject mappings changed since the editor or row was displayed. Profile deletion continues removing referencing defaults and now explains that cascade in its confirmation. Update the two relevant documentation pages. ## Impact Operators can configure these fields and repository defaults from the same settings page. The defaults remain one ready worker per eligible project and a shared cap of four; zero disables the corresponding reserves. Saves retain the existing restart-required notice. Provider, install, and unrelated config values are preserved. No new config keys, schemas, Gateway methods, or dependencies are introduced. ## Evidence - `pnpm install` — passed. - `node scripts/run-vitest.mjs ui/src/pages/cloud-workers/` — passed, 94 tests across 3 files. Covers optional-key removal, duration/schema parity, setup-name validation, pool cap changes, repository CRUD, missing-profile refusal, stale mapping protection, and profile-delete cascade. - `node scripts/run-vitest.mjs ui/src/e2e/cloud-workers-settings.e2e.test.ts` — passed, 8 Chromium tests against the mock Gateway, including exact advanced-field and repository-add `config.patch` payloads. - `node scripts/check-changed.mjs` — passed, including core-test/UI typechecking, i18n, unused-export scans, and lint. Earlier attempts exposed two test narrowing errors and one unused type export; all were corrected before the passing run. - `pnpm ui:i18n:baseline` — passed; no generated locale changes required. - `pnpm ui:build` — passed. - `pnpm ui:check-performance` — passed: startup JavaScript 352,569 bytes gzip, below the 353,107-byte limit; startup CSS 45,637 bytes gzip. - `git diff --check` — passed. Independent Codex autoreview is clean through P2. Its stale-mapping finding was reproduced with a failing test and repaired before the clean review; the later unused-export cleanup only removed a type export. Proof uses the mock Gateway; no live cloud workers were provisioned. Live Crabbox proof of the snapshot flow follows in the companion PRs. ## Review follow-up Clearing and retyping a setup command preserves its environment names. Removing the command while names remain shows an error until the names are explicitly removed. Explicit warm images are rejected for non-Linux profiles, including changes to an existing profile's operating system; Auto and Off remain available. Both defects were reproduced before repair. The repaired head passed 94 focused tests, 8 browser E2E tests, changed-file checks, the i18n baseline, and independent review through P2. Before/after visual evidence is below. ## Screenshots Mock Gateway fixture with two profiles and two repository defaults (synthetic data). | Before: profile editor | After: profile editor with Advanced group | | --- | --- | |  |  | | Before: page | After: Prepared pool row and Repositories section | | --- | --- | |  |  |
…claw#121557) Keep globally disabled Web search off in both composers, preserve explicit suppression, and allow one authorized stale-override clear. Keep the checkbox aligned after selection and validate the shared menu through a matching served Gateway UI. Closes openclaw#121401 Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Ayaan Zaidi <hi@obviy.us>
…3808) Pin the reviewed Kova quantization repair without changing performance caps, coverage, or credential gates. The old crossing interval remains inconclusive; fresh hosted measurement is still required. Related: openclaw/Kova#124 Worked on by: - @steipete Co-authored-by: steipete <58493+steipete@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Five pages that exist and are linked from other docs were absent from docs.json navigation entirely, so they were reachable only by search or by following a link: - channels/bot-loop-protection -> Channels > Configuration - cli/transcripts -> Reference > CLI commands > Agents, models, and sessions - plugins/copilot -> Capabilities > Plugin guides - providers/baseten -> Models > Providers > Chat and coding models - security/incident-response -> Gateway & Ops > Security Each is inserted in the position its siblings suggest (alphabetical where the group is alphabetical) rather than appended. Refs r3-0900 r3-0901 r3-0902 r3-0903 r3-0904 Co-authored-by: Vincent Koc <vincent@openclaw.org>
…roviders (openclaw#143855) * docs: close remaining one-way link findings in cli, plugins, tools, providers Adds the back-links and anchors that PR openclaw#143157 did not cover, and gives two "see below" tables real headings to link to. - Related back-links: cli/tui -> resume, cli/doctor -> status, configuration-reference -> configure, voice-call -> voicecall CLI, onepassword -> secrets CLI, acp-agents-setup -> acpx reference, llama-cpp -> llama-cpp reference, cli/policy -> policy reference, ollama -> LM Studio and Memory LanceDB, image/video generation -> OpenRouter, google-meet -> ElevenLabs, media-understanding -> Mistral, tts service links -> Fish Audio, tools/secrets -> ask_user. - manifest/config-and-secrets: H3 headings for the dangerousFlags and secretInputs detail tables; the two "See below" cells now link to them. - sdk-overview/capabilities: new "Worker providers" heading; the manifest worker-provider contract link now lands on it instead of 36 lines above. - providers/openrouter: the model-list Note pointed at /concepts/model-providers, which carries no OpenRouter catalog; it now points at OpenRouter's own catalog and keeps a separate pointer to OpenClaw model selection. - glossary.zh-CN: 7 sources for the new list-item link labels. * docs(google): link the Gemini CLI runtime tab to the CLI backends page r3-2107. `google-gemini-cli` is the CLI backend id the bundled Google plugin registers, so the tab that configures it should point at the page documenting its argv, JSONL dialect, and session behavior. The Related card alone left the tab itself unlinked. --------- Co-authored-by: Vincent Koc <vincent@openclaw.org>
* docs(tools): fix concrete ux defects in docs/tools Works the objectively-checkable subset of the open `ux` audit findings for `docs/tools/`. Every change below is a thing a reader would otherwise get wrong, not a restructuring preference. - goal.md: drop the body `# Goal` that duplicated the frontmatter title and rendered a second H1; keep the `#goal` anchor as an `<a id>` stub. - steer.md: state in the intro that `/tell` is an alias of `/steer`. The alias appeared in a code sample before the page ever named it (`src/auto-reply/commands-registry.shared.ts:412`). - kimi-search.md: add the missing `openclaw plugins install @openclaw/moonshot-provider` step. `moonshot` is an external package (plugin-inventory "Official external packages"), so the documented setup could not work as written. - grok-search.md: say that the `xai` plugin ships with OpenClaw and needs no install, since every sibling provider page opens with an install step. - searxng-search.md, diffs.md: add `openclaw gateway restart` to the install fence, matching duckduckgo, exa, firecrawl, lobster, parallel and perplexity. - ollama-search.md: the hosted setup told readers to point `models.providers.ollama.baseUrl` at ollama.com without saying that this also moves their Ollama *model* traffic. Name the side effect and point at the page's own scoped `webSearch.baseUrl` alternative. - reactions.md: define `clearAll` and `emoji-list`, both used in the channel sections but never introduced. - browser-linux-troubleshooting.md: the verify step jumps from CDP port 18800 to 18791 with no explanation; say it is the browser control service port derived from `gateway.port`, and that `jq` is optional. Promote the second `Problem:` heading from H3 to H2 so it stops reading as a sub-part of the first (anchor id unchanged). - apply-patch.md: `*** Move to:` and `*** End of File` were named in Notes but never shown. Extend the format block with both; the block now applies cleanly against the real `apply_patch` implementation. - exec.md: fill the one empty Notes cell in the config table (`tools.exec.node`). - permission-modes.md: say what `openclaw approvals get` prints and why it is in the recommended-default sequence. - code-mode/internals.md: give the Runtime status table real header labels instead of an empty header row. - screen.md: say how a client advertises the `ui-commands` capability. - elevated.md: tag two directive fences as `text` (5 of 478 docs/tools fences were untagged; MD040 is disabled so the linter does not catch it). No anchor ids were dropped: ids enumerated with `parseDocsDocument` before and after across all 15 files; the only delta is one new Steps id in kimi-search.md. * docs(tools): address ClawSweeper review Both findings were correct. - screen.md: the connect handshake field is `caps`, not `capabilities` (`packages/gateway-protocol/src/schema/frames.ts:46`; `ui/src/api/gateway.ts:476`). A client following the old wording would not advertise the capability. - reactions.md: the `emoji-list` gate and result are channel-specific, not shared. Telegram gates `react` and `emoji-list` together under `actions.reactions` and returns the current chat's allowed reactions (`extensions/telegram/src/channel-actions.ts:160-162`), while Slack gates `emoji-list` separately under `actions.emojiList` (`extensions/slack/src/message-actions.ts:64`). The How it works bullet now only defines what the action is and says both vary by channel; the Telegram specifics moved into the Telegram accordion.
Observe the same reduced-motion style endpoint after its asynchronous reveal settles. Preserve the reveal-delay bounds, content checks, exact CSS values and existing timeout; no UI or animation behavior changes. Related: openclaw#143776.
…43813) Keep fresh and upgrade opens concurrent, wait for both integrity checks, then permit and join each worker retirement separately. Preserve original failures alongside cleanup errors so fail-fast lifecycle retirement does not obscure the initialization proof.
…43789) Pass the routed agent ID through the native /think menu and runtime-catalog adapter so the existing resolver can select that agent's per-model thinking setting instead of the shared model default. Preserve session overrides, per-agent thinkingDefault, catalog loading, and runtime selection. Cover high and off settings on an explicitly routed non-default agent whose shared model setting is low. Related: openclaw#142100
…ch cutover (openclaw#143867) `docs/cli/plugins/install.md` still described bare plugin specs as installing from npm "during the launch cutover". There is no cutover: `grep -rni cutover src/` returns nothing, no flag, date or feature gate exists, and no release note announces an end. The phrase entered in cf21bcf, which deleted the ClawHub-first resolution path outright rather than scheduling a migration. Present behaviour is `isOpenClawTrustedPluginInstallSpec` in `src/plugins/install-provenance.ts`. Drops the time-relative clause and leaves the behaviour statement, matching the phrasing already used in docs-audit/fix-accuracy-plugins for the six pages under `docs/plugins/`.
…ng (openclaw#143464) * fix(runtime): reuse an available compatible Node at startup Share startup recovery between the launcher and legacy CLI runtime admission so older updaters can run target Doctor through dist/index.js under an already installed compatible Node. Preserve process-contract exclusions, arguments, environment, standard streams, and exit status. Refs openclaw#140465 * test(runtime): include recovery proof in E2E routing * fix(runtime): secure Node discovery and decode service scripts Reject relative candidates and cwd-resolved runtimes before probing, except for explicit absolute PATH directories. Parse generated Windows command quoting and recorded code pages without loading application dependencies. Skip CP850 and CP949 with a diagnostic instead of guessing executable paths. Use real task-writer fixtures for encoding, quoting, and fallback coverage. Refs openclaw#140465 * fix(runtime): reject cwd-local manager symlinks * test(runtime): keep recovery home outside launcher cwd * fix(runtime): isolate recovery from dotenv environment * fix(runtime): canonicalize discovery paths before use * fix(runtime): preserve private Node recovery from home * refactor(runtime): trim Node recovery comments and aliases Behavior-neutral cleanup of the recovery launcher module: fold the serviceHome and managerHome aliases into homeDir and shorten five comment blocks to the invariant they protect.
Select the effective mode and source before constructing the returned state. Preserve session, agent, and model precedence, explicit false and auto modes, short-circuit reads, and the existing model-specific auto cutoff.
…anagerUid (openclaw#143859) Restore the stable-tag upgrade contract for 2026.9.2 and 2026.9.3. Revalidate their existing service identity evidence without requiring a UID those releases never recorded; continue refusing a different UID when supplied. Refs openclaw#140339. Regression: shipped stop record rejected before; 42 owner tests pass after. Changed-file checks and docs syntax pass. Independent autoreview remains with the campaign lead.
* fix: connect chat desktops to their assigned machines Open the session desktop directly instead of presenting unrelated machines or waiting for provider catalogs. Preserve worker VNC credentials and keep visible desktop streams alive when keyboard focus moves between split panes. Retain the standalone picker and explicit source pop-out contracts. Validated with focused regressions, 109 component and browser tests across runs, changed checks, and independent review. * test: use targeted desktop status in chat rail fixtures
…nclaw#143664) Compose authored and generated model sources before runtime defaults. Keep generated inventory separate from authored/current request credentials and headers. Preserve exact model identities, endpoint scope, sparse metadata and source-specific compatibility through the existing registry and merge owners. Verified with failing baseline/source and compiled HTTP reproductions, 66 affected tests, native hooks/lint, matching compiled compatibility proof, fresh scoped independent SDK/HTTP acceptance, and exact-head CI. Retain source-aware and public proof distinctions; no native login, canonical credential-writer or whole-area claim. Related: openclaw#136257 Co-authored-by: Ayaan Zaidi <hi@obviy.us>
Use the canonical provider-config merge during runtime selection so later fields on matching trimmed provider keys take effect. Preserve earlier model policies when a later entry omits its model array, honor an explicitly empty array, and retain the existing model and wildcard priorities. Related: openclaw#130706. Verified four intended baseline failures with two passing controls, 74 focused tests, the full changed gate, and an independent P2 review.
…penclaw#143799) * fix(backup): exclude private update captures from ordinary exports * fix: exclude cross-state private update captures
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
…aw#143311) * feat(telemetry): add opt-in runtime UTC-offset buckets * docs(telemetry): replace client offset collection with request geography disclosure * docs(telemetry): qualify hosted geography rollout * docs(telemetry): simplify approximate location disclosure * docs(telemetry): simplify location and anonymous statistics wording
Restore Zalo Personal common-policy migration through Doctor's installed-plugin discovery. Keep root profiles and explicit named-account overrides, inherit only missing policies, and preserve repeat-run stability. Verified public packaged baseline red and candidate green with synthetic state, disabled-plugin discovery, preserved existing defaults, malformed-input rejection, and 37 focused tests. Closes openclaw#143865. Co-authored-by: Ayaan Zaidi <hi@obviy.us>
Reuse the same policy fields for initial and prepared harness selection. Project the resolved native auth plan only at the final handoff, preserving top-level plan precedence and the existing native auth fallback behavior.
…nclaw#143837) Compose prepared static, generated, authored-file, and current configured model sources in the registry before defaults and lookup. Preserve route precedence, current request authority, the raw authored-file SDK exception, and replace-mode membership. Separate pure catalog normalization from credential resolution to remove the registry import cycle without weakening architecture checks. Validated with focused owner and sibling tests, before/after import-cycle proof, retained Gateway/SDK observations, and exact-head review and CI. Co-authored-by: Ayaan Zaidi <hi@obviy.us>
…144112) * refactor(protocol): simplify generated schema registration * fix(protocol): handle Windows paths in registry type checks Normalize diagnostic filenames using the same path rule as the compiler host, so expected readonly diagnostics are recognized on Windows. The actual package guard and both optional-mode compiler probes pass; the native Windows execution is separate evidence.
…3468) * fix(ci): isolate Android APT sources * fix(ci): use varied-color Android conversion smoke input * fix(ci): keep Android image smoke true-color * fix(ci): generate two-axis Android image fixture * fix(ci): fully inspect Android JPEG metadata
…4175) node:sqlite opens a connection with busy timeout 0, so a handle has no busy handler until one is installed. Both read-only openers of the shared state and agent databases set PRAGMA busy_timeout after opening, which left every statement issued before that PRAGMA failing outright on a transient lock. Pass the timeout to the connection constructor instead and drop the post-open PRAGMA, so lock policy no longer depends on statement order inside the opener body and cannot be bypassed by a statement added ahead of it.
…w#143735) * fix(msteams): gate reaction events on the team/channel route Reaction activities re-derived their own direct/group classification instead of reusing the message admission result. A conversation that admission classifies as direct (so it carries no team/channel route gate) could still be routed by the reaction handler into a team-scoped session, enqueuing a system event for a team excluded by `channels.msteams.teams`. Resolve the classification once through `resolveMSTeamsSenderAccess` and apply the same team/channel allowlist drop that `admitMSTeamsMessage` applies, so a reaction can never reach a route the message path would reject. * fix(msteams): reject conflicting reaction scope * fix(msteams): fail closed on conflicting activity scope
…enclaw#144167) ## What Problem This Solves The cloud-worker snapshot feature landed across openclaw#143801, openclaw#143814, openclaw#143838, openclaw#143893, and openclaw#143929 with repeated configuration-save state, profile input rendering, confirmation handling, and a separately maintained fixture row type. This is the requested maintainer consolidation of that combined surface. ## Why This Change Was Made Share config-save presentation and patch completion across profiles, repositories, and retention policy while preserving caller connection/config identity and dispatch checks. Reuse profile input rendering and the confirmation AbortController lifecycle. Keep `cancelBuild` and `recoverCapture` explicit, with their existing payloads, acknowledgement, post-confirmation checks, notices, errors, and cleanup. Share preparation predicates and the existing invalid-project response. Derive snapshot fixtures from the real view types and correct two settings-navigation paths. Every test and assertion remains; only duplicated fixture types and unconsumed fixture fields were removed. ## User Impact No behavior, config, protocol, schema, retention, or translated-copy change is intended. Production code is 99 lines smaller and test support is 43 lines smaller. Snapshot request-state and concurrency redesign remains deferred; existing plugin and persistence owners retain their contracts. ## Evidence - The coordinator completed review through P2 with no remaining actionable findings. The subsequent rebase onto `0f68d696c3cc9c93bb45048f8c72036e577490de` was conflict-free; range-diff confirmed all four commits are patch-identical. - Post-rebase `pnpm exec oxlint` on the eight changed TypeScript files and `git diff --check` passed. - Post-rebase `node scripts/run-vitest.mjs ui/src/pages/cloud-workers/ ui/src/e2e/cloud-workers-snapshots.e2e.test.ts` passed: 117 unit tests and four browser tests against the mock Gateway, including confirmation-gated cancellation and acknowledgement-gated recovery. No assertions changed. - Coordinator validation before the patch-identical rebase passed 3,225 Gateway, UI, and provider-plugin tests; 12 settings/snapshot browser tests; changed-file checks; UI build/performance checks; and i18n verification. An unchanged workspace-publication test initially hit a child-close timeout, then passed focused and complete reruns without test changes. - Exact-head CI: https://github.com/openclaw/openclaw/actions/runs/34500846798 — passed on `2353cb2c3b84be37e73634081eb9c61fc84a3f3a`; the bounded watcher completed `GREEN` with zero pending checks. - The author explicitly authorized this landing and the draft is now ready. The review bot found no introduced code defect; its outstanding coordinator-handoff item is satisfied by that instruction. - A live provider build/pin/delete run and screenshots remain outside this landing's proof; the browser tests use the mock Gateway. The overlapping openclaw#144127 remains open and unmerged at the current check.
Use the shared catalog overlay for configured selection metadata while keeping captured API and endpoint fields for final route projection. Discard stale capabilities and prepared thinking policy on known route changes, and carry explicit configured thinking-level maps. Preserve literal identity, aliases, names, explicit booleans, same-route compatibility, and final rejection of donors with missing transport. Validation: 355 focused tests, original-source 5-fail/7-control regression proof, complete changed gate, full docs checks, and fresh P2 review.
…penclaw#121871) Keep one completed channel reply as one Control UI bubble while retaining both assistant and delivery records. Resolve existing delivery keys before assigning writer-owned correlation and preserve strict replay conflicts. Use full-history reconciliation when cursor updates contain channel-final mirrors, so cached views use the same display filter. Verified real Telegram baseline/candidate behavior, public history and browser output, byte-stable replay, old-history and media controls, and retained-browser cursor refresh with distinct identical-text replies. Focused regressions failed before the correction and passed afterward. Closes openclaw#121643. Co-authored-by: Ayaan Zaidi <hi@obviy.us>
Recover source prices through the shared row materializer so aliases and literal self-prefixed rows cannot donate prices to an exact configured row. Forward captured normalization policies through runtime overrides and configured fallback, preserving same-spelling, zero, partial, and tiered pricing behavior. Remove the obsolete scoped matcher. Keep the public resolver pricing matrix and separate its test fixtures without weakening assertions. Known limitation: retained configurations still use the current global config/source projection. Baseline and candidate have identical A/B authorship-switching behavior; this change does not add retained-source isolation. Related: openclaw#130706, openclaw#142100
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What Problem This Solves
Operators using a Gateway host with isolation support cannot currently see whether Gateway isolation is enabled from the Control UI. They must leave the UI and inspect the host separately before choosing the inverse
clawctl gateway-isolationcommand.Important
This PR intentionally remains draft until Agent Session support is checked into
openclaw/openclaw-windows-packagingand the corresponding Windows packaging integration is publicly available.Why This Change Was Made
This adds an optional
gatewayIsolation: "enabled" | "disabled"field to authenticatedsystem.info. The Gateway projects it only for exactOPENCLAW_GATEWAY_ISOLATIONvalues and omits absent, empty, case-mismatched, or invalid values.The Connection UI renders a read-only Gateway Isolation section only when that optional capability is present. It shows the reported state and the inverse
clawctl gateway-isolation enable|disablecommand in a distinct copyable control. There is no platform inference, mutation RPC, process control, session implementation, or fallback behavior.User Impact
Supported Windows Gateway packages can report their isolation posture in the Connection page. When
gatewayIsolationis absent, the section is not rendered, so existing Gateways and all unsupported platforms remain unchanged.Evidence
git diff --checksuccessfully.Local Vitest, tsgo/changed checks, UI i18n verification, and browser proof could not run before PR creation because this worktree could not complete
pnpm install --frozen-lockfile. The configured Microsoft package-feed proxy returned 404 responses for required current public packages, while direct public npm registry access failed during TLS negotiation. No dependency, registry configuration, generated locale output, or product behavior was changed to bypass that environment limitation.