Commit Graph

4423 Commits

Author SHA1 Message Date
Peter Steinberger
876018f322 chore(deps): update dependencies and lockfile 2026-02-26 01:31:36 +01:00
Peter Steinberger
4258a3307f refactor(agents): unify subagent announce delivery pipeline
Co-authored-by: Smith Labs <SmithLabsLLC@users.noreply.github.com>
Co-authored-by: Do Cao Hieu <docaohieu2808@users.noreply.github.com>
2026-02-26 00:30:44 +00:00
Peter Steinberger
aedf62ac7e fix: harden discord and slack reaction ingress authorization 2026-02-26 01:26:47 +01:00
Peter Steinberger
c736f11a16 fix(gateway): harden browser websocket auth chain 2026-02-26 01:22:49 +01:00
Peter Steinberger
496a76c03b fix(security): harden browser trace/download temp path handling 2026-02-26 01:04:05 +01:00
Peter Steinberger
e56b0cf1a0 fix: enforce telegram reaction authorization 2026-02-26 01:03:03 +01:00
Shakker
f83719937a Changelog: note Discord embed fallback coverage 2026-02-25 23:58:42 +00:00
Peter Steinberger
eb73e87f18 fix(session): prevent silent overflow on parent thread forks (#26912)
Lands #26912 from @markshields-tl with configurable session.parentForkMaxTokens and docs/tests/changelog updates.

Co-authored-by: Mark Shields <239231357+markshields-tl@users.noreply.github.com>
2026-02-25 23:54:02 +00:00
Peter Steinberger
8d1481cb4a fix(gateway): require pairing for unpaired operator device auth 2026-02-26 00:52:50 +01:00
Peter Steinberger
2aa7842ade fix(signal): enforce auth before reaction notification enqueue 2026-02-26 00:44:46 +01:00
Peter Steinberger
ef326f5cd0 fix(browser): revalidate upload paths at use time 2026-02-26 00:40:56 +01:00
Youyou972
15cfba7075 fix: cron model fallback to agent defaults when payload.model fails (#26717)
Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: 06454bd55b
Co-authored-by: Youyou972 <50808411+Youyou972@users.noreply.github.com>
Co-authored-by: shakkernerd <165377636+shakkernerd@users.noreply.github.com>
Reviewed-by: @shakkernerd
2026-02-25 23:34:31 +00:00
Peter Steinberger
2011edc9e5 fix(gateway): preserve agentId through gateway send path
Landed from #23249 by @Sid-Qin.
Includes extra regression tests for agentId precedence + blank fallback.

Co-authored-by: Sid <201593046+Sid-Qin@users.noreply.github.com>
2026-02-25 23:31:35 +00:00
Peter Steinberger
125f4071bc fix(gateway): block agents.files symlink escapes 2026-02-26 00:31:08 +01:00
Peter Steinberger
45d59971e6 docs(changelog): clarify macOS beta scope for oauth fix 2026-02-26 00:26:54 +01:00
Peter Steinberger
f60d9591ef docs(changelog): add macOS auth fix note for setup-token path 2026-02-26 00:23:24 +01:00
Peter Steinberger
d512163d68 fix(security): harden nextcloud-talk webhook replay handling 2026-02-26 00:18:38 +01:00
Peter Steinberger
8f3310000a refactor(macos): remove anthropic oauth onboarding flow 2026-02-26 00:17:03 +01:00
Shadow
975c9f4b54 Agents: emphasize config.schema usage 2026-02-25 09:45:39 -06:00
Nimrod Gutman
3607b733cb fix(changelog): add typing firestart guard note (#26325) (thanks @win4r) 2026-02-25 14:49:21 +02:00
Nimrod Gutman
b3f46f0e28 fix(test): stabilize low-mem parallel runner and cron session mock (#26324)
* fix(test): stabilize low-mem parallel lane and cron session mock

* feat(android): make QR scanning first-class onboarding

* docs(android): update README for native Android workflow

* fix(android): stabilize chat composer ime and tab layout

* fix(android): stabilize chat ime insets and tab bar

* fix(android): remove tab bar gap above system nav

* fix(android): harden scanned setup code parsing

* test(android): cover non-string setupCode QR payload

* fix(test): add changelog note for low-mem test runner (#26324) (thanks @ngutman)

---------

Co-authored-by: Ayaan Zaidi <zaidi@uplause.io>
2026-02-25 12:16:17 +02:00
Nimrod Gutman
56b8c69487 docs(changelog): add discord typing fix entry (#26295) (thanks @ngutman) 2026-02-25 10:21:52 +02:00
Peter Steinberger
b247cd6d65 fix: harden Slack file-only fallback placeholder (#25181) (thanks @justinhuangcode) 2026-02-25 05:36:49 +00:00
byungsker
177386ed73 fix(tui): resolve wrong provider prefix when session has model without modelProvider (#25874)
Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: f0953a7284
Co-authored-by: lbo728 <72309817+lbo728@users.noreply.github.com>
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com>
Reviewed-by: @gumadeiras
2026-02-25 00:36:27 -05:00
Peter Steinberger
52d933b3a9 refactor: replace bot.molt identifiers with ai.openclaw 2026-02-25 05:03:24 +00:00
Peter Steinberger
b564b72dc9 docs(changelog): add missing security PR entries (#26118 #26116 #26112 #26111 #26095) 2026-02-25 04:59:10 +00:00
bmendonca3
c1964e73a8 fix(discord): gate component command authorization for guild interactions (#26119)
* Discord: gate component command authorization

* test: cover allowlisted guild component authorization path (#26119) (thanks @bmendonca3)

---------

Co-authored-by: Brian Mendonca <brianmendonca@Brians-MacBook-Air.local>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-02-25 04:57:41 +00:00
David Rudduck
24a60799be fix(hooks): include guildId and channelName in message_received metadata (#26115)
* fix(hooks): include guildId and channelName in message_received metadata

The message_received hook (both plugin and internal) already exposes
sender identity fields (senderId, senderName, senderUsername, senderE164)
but omits the guild/channel context. Plugins that track per-channel
activity receive NULL values for channel identification.

Add guildId (ctx.GroupSpace) and channelName (ctx.GroupChannel) to the
metadata block in both the plugin hook and internal hook dispatch paths.
These properties are already populated by channel providers (e.g. Discord
sets GroupSpace to the guild ID and GroupChannel to #channel-name) and
used elsewhere in the codebase (channels/conversation-label.ts).

* test: cover guild/channel hook metadata propagation (#26115) (thanks @davidrudduck)

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-02-25 04:56:19 +00:00
Sid
2e84017f23 fix(markdown): require paired || delimiters for spoiler detection (#26105)
* fix(markdown): require paired || delimiters for spoiler detection

An unpaired || (odd count across all inline tokens) would open a
spoiler that never closes, causing closeRemainingStyles to extend it
to the end of the text. This made all content after an unpaired ||
appear as hidden/spoiler in Telegram.

Pre-count || delimiters across the entire inline token group and skip
spoiler injection entirely when the count is less than 2 or odd. This
prevents single | characters and unpaired || from triggering spoiler
formatting.

Closes #26068

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix: preserve valid spoiler pairs with trailing unmatched delimiters (#26105) (thanks @Sid-Qin)

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-02-25 04:54:51 +00:00
Sid
156f13aa64 fix(agents): continue fallback loop for unrecognized provider errors (#26106)
* fix(agents): continue fallback loop for unrecognized provider errors

When a provider returns an error that coerceToFailoverError cannot
classify (e.g., custom error messages without standard HTTP status
codes), the fallback loop threw immediately instead of trying the
next candidate. This caused fallback to stop after 2 models even
when 17 were configured.

Only rethrow unrecognized errors when they occur on the last
candidate. For intermediate candidates, record the error as an
attempt and continue to the next model.

Closes #25926

Co-authored-by: Cursor <cursoragent@cursor.com>

* test: cover unknown-error fallback telemetry and land #26106 (thanks @Sid-Qin)

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-02-25 04:53:26 +00:00
Sid
f7de41ca20 fix(followup): fall back to dispatcher when same-channel origin routing fails (#26109)
* fix(followup): fall back to dispatcher when same-channel origin routing fails

When routeReply fails for an originating channel that matches the
session's messageProvider, the onBlockReply callback was created by
that same channel's handler and can safely deliver the reply.
Previously the payload was silently dropped on any routeReply failure,
causing Feishu DM replies to never reach the user.

Cross-channel fallback (origin ≠ provider) still drops the payload to
preserve origin isolation.

Closes #25767

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix: allow same-channel followup fallback routing (#26109) (thanks @Sid-Qin)

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-02-25 04:52:08 +00:00
Ayaan Zaidi
d942e5924e docs: add changelog entry for #26079 (thanks @obviyus) 2026-02-25 09:32:07 +05:30
Peter Steinberger
d2597d5ecf fix(agents): harden model fallback failover paths 2026-02-25 03:46:34 +00:00
Peter Steinberger
480cc4b85c chore: roll to 2026.2.25 unreleased 2026-02-25 03:35:33 +00:00
Peter Steinberger
2d1e6931a6 docs(changelog): reorder and backfill 2026.2.24 release notes 2026-02-25 02:33:04 +00:00
Peter Steinberger
24d7612ddf refactor(heartbeat): harden dm delivery classification 2026-02-25 02:13:07 +00:00
Peter Steinberger
885452f5c1 fix: fail-closed shared-session reply routing (#24571) (thanks @brandonwise) 2026-02-25 02:11:34 +00:00
Peter Steinberger
e28803503d fix: add sandbox bind-override regression coverage (#25410) (thanks @skyer-jian) 2026-02-25 02:09:37 +00:00
Peter Steinberger
a805d6b439 fix(heartbeat): block dm targets and internalize blocked prompts 2026-02-25 02:05:45 +00:00
Peter Steinberger
e0201c2774 fix: keep channel typing active during long inference (#25886, thanks @stakeswky)
Co-authored-by: stakeswky <stakeswky@users.noreply.github.com>
2026-02-25 02:03:27 +00:00
Peter Steinberger
c736778b3f fix: drop active heartbeat followups from queue (#25610, thanks @mcaxtr)
Co-authored-by: Marcus Castro <mcaxtr@gmail.com>
2026-02-25 01:58:51 +00:00
Peter Steinberger
6fa7226a67 fix: add changelog thanks for #25820 (thanks @bmendonca3) 2026-02-25 01:56:44 +00:00
Peter Steinberger
fa525bf212 fix(shell): prefer PowerShell 7 on Windows with tested fallbacks (#25684) 2026-02-25 01:49:33 +00:00
Peter Steinberger
bf5a96ad63 fix(agents): keep fallback chain reachable on configured fallback models (#25922) 2026-02-25 01:46:20 +00:00
Peter Steinberger
559b5eab71 fix(cli): support --query in memory search command (#25904) 2026-02-25 01:41:56 +00:00
Peter Steinberger
c7ae4ed04d fix: harden sandbox fs dash-path regression coverage (#25891) (thanks @albertlieyingadrian) 2026-02-25 01:40:30 +00:00
Peter Steinberger
b35d00aaf8 fix: sanitize Gemini 3.1 Google reasoning payloads 2026-02-25 01:40:14 +00:00
Peter Steinberger
039713c3e7 fix: suppress reasoning payload leakage in whatsapp replies 2026-02-25 01:36:37 +00:00
Peter Steinberger
e2362d352d fix(heartbeat): default target none and internalize relay prompts 2026-02-25 01:28:47 +00:00
Peter Steinberger
4d89548e59 fix(ui): inherit default model fallbacks in agents overview (#25729)
Land PR #25729 from @Suko.
Use shared fallback-resolution helper and add regression coverage for default, override, and explicit-empty cases.

Co-authored-by: suko <miha.sukic@gmail.com>
2026-02-25 01:28:17 +00:00