github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-09 09:47:40 +00:00
Code Issues Packages Projects Releases Wiki Activity
13,017 Commits 702 Branches 79 Tags
b43aadc34cba3b3575aaa9dd15304842ca3f492f
Commit Graph

1174 Commits

Author SHA1 Message Date
Vincent Koc
981d266480 security(gateway): block webchat session mutators (#20800) 
* chore(ci): local claude settings gitignore

* Gateway: block webchat session mutators

* Changelog: note webchat session mutator guard

* Changelog: credit report for webchat mutator guard
 2026-02-19 01:54:02 -08:00
Peter Steinberger
947e11c33a test(gateway): dedupe agent payload and stream fixtures 2026-02-19 09:22:16 +00:00
Peter Steinberger
b4dbe03298 refactor: unify restart gating and update availability sync 2026-02-19 10:00:41 +01:00
Peter Steinberger
34ddf0edc0 style: format gateway health state and ui render 2026-02-19 08:49:38 +00:00
orlyjamie
2ddc13cdb7 feat(ui): add update warning banner to control dashboard 
SecurityScorecard's STRIKE research recently identified over 40,000
exposed OpenClaw gateway instances, with 35.4% running known-vulnerable
versions. The gateway already performs an npm update check on startup
and compares against the registry every 24 hours — but the result is
only logged to the server console. The control UI has zero visibility
into whether the running version is outdated, which means operators
have no idea they're exposed unless they happen to read server logs.

OpenClaw's user base is broadening well beyond developers who live in
terminals. Self-hosters, small teams, and non-technical operators are
deploying gateways and relying on the control dashboard as their
primary management interface. For these users, security has to be
surfaced where they already are — not hidden behind CLI output they
will never see. Making version awareness frictionless and actionable
is a prerequisite for reducing that 35.4% number.

This PR adds a sticky red warning banner to the top of the control UI
content area whenever the gateway detects it is running behind the
latest published version. The banner includes an "Update now" button
wired to the existing update.run RPC (the same mechanism the config
page already uses), so operators can act immediately without switching
to a terminal.

Server side:
- Cache the update check result in a module-level variable with a
  typed UpdateAvailable shape (currentVersion, latestVersion, channel)
- Export a getUpdateAvailable() getter for the rest of the process
- Add an optional updateAvailable field to SnapshotSchema (backward
  compatible — old clients ignore it, old servers simply omit it)
- Include the cached update status in buildGatewaySnapshot() so it
  is delivered to every UI client on connect and reconnect

UI side:
- Add updateAvailable to GatewayHost, AppViewState, and the app's
  reactive state so it flows through the standard snapshot pipeline
- Extract updateAvailable from the hello snapshot in applySnapshot()
- Render a .update-banner.callout.danger element with role="alert"
  as the first child of <main>, before the content header
- Wire the "Update now" button to runUpdate(state), the same
  controller function used by the config tab
- Use position:sticky and negative margins to pin the banner
  edge-to-edge at the top of the scrollable content area
 2026-02-19 09:43:45 +01:00
Peter Steinberger
3c7c45e153 test(gateway): dedupe config.apply request scaffolding 2026-02-19 08:25:12 +00:00
Peter Steinberger
8bb1747ad9 test(gateway): dedupe assistant chat event assertions 2026-02-19 08:25:12 +00:00
Peter Steinberger
57ea6feb03 test(gateway): dedupe startup auth override token checks 2026-02-19 07:45:27 +00:00
Gustavo Madeira Santana
c5698caca3 Security: default gateway auth bootstrap and explicit mode none (#20686) 
Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: be1b73182c
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com>
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com>
Reviewed-by: @gumadeiras
 2026-02-19 02:35:50 -05:00
Peter Steinberger
5556675aae test(gateway): dedupe APNs wake fixture setup in node invoke tests 2026-02-19 07:33:16 +00:00
Marcus Castro
48e6b4fca3 fix: run BOOT.md for each configured agent at startup (#20569) 
Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: 9098a4cc64
Co-authored-by: mcaxtr <7562095+mcaxtr@users.noreply.github.com>
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com>
Reviewed-by: @gumadeiras
 2026-02-19 00:58:56 -05:00
Peter Steinberger
9a100d520d refactor(gateway): dedupe exec approvals node validation 2026-02-18 23:09:09 +00:00
Peter Steinberger
5e76cefc70 refactor(gateway): share session store lookup map builder 2026-02-18 22:40:26 +00:00
Peter Steinberger
fc5bcebd0a perf(test): reduce channel health monitor check slack 2026-02-18 22:39:57 +00:00
Peter Steinberger
8a6b55e715 perf(test): tighten channel health monitor timer windows 2026-02-18 22:36:44 +00:00
Peter Steinberger
f054cd6709 refactor(gateway): dedupe cron protocol param schemas 2026-02-18 22:31:45 +00:00
Peter Steinberger
bb0516655c perf(test): align node wake test waits with reconnect timeout 2026-02-18 22:31:19 +00:00
Peter Steinberger
cb488df572 perf(test): tighten fake timer windows in channel restart tests 2026-02-18 22:11:56 +00:00
Peter Steinberger
8b4d449dbc perf(test): use setImmediate for node invoke bypass yields 2026-02-18 22:09:48 +00:00
Peter Steinberger
66c1b8b4f1 perf(test): batch channel health monitor timer advances 2026-02-18 22:01:46 +00:00
Peter Steinberger
f3b7b51132 perf(test): remove fixed waits in node invoke bypass e2e 2026-02-18 21:52:55 +00:00
Xinhe Hu
b62bd290cb fix: remove hardcoded disableBlockStreaming to honor agent config for TUI (#19693) 
Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: 710d449080
Co-authored-by: neipor <191749196+neipor@users.noreply.github.com>
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com>
Reviewed-by: @gumadeiras
 2026-02-18 16:25:59 -05:00
Mariano
e67da1538c iOS/Gateway: wake disconnected iOS nodes via APNs before invoke (#20332) 
Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: 7751f9c531
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com>
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com>
Reviewed-by: @mbelinky
 2026-02-18 21:00:17 +00:00
Mariano
99d099aa84 Gateway: add APNs push test pipeline (#20307) 
Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: 6a1c442207
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com>
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com>
Reviewed-by: @mbelinky
 2026-02-18 19:32:42 +00:00
Peter Steinberger
2863661bcc refactor(gateway): share openai response text extraction 2026-02-18 18:54:22 +00:00
Peter Steinberger
079bf25fee refactor(gateway): share transcript path/fd helpers 2026-02-18 18:35:04 +00:00
Peter Steinberger
307719abe9 fix(types): align restart sentinel and typing test mocks 2026-02-18 18:25:25 +00:00
Peter Steinberger
0dc004fd21 refactor(sessions): share session thread/topic parsing 2026-02-18 18:25:25 +00:00
Peter Steinberger
6187e2afbd refactor(gateway): share gmail watcher startup flow 2026-02-18 17:48:02 +00:00
Peter Steinberger
aa3dfe8216 perf(test): replace role-update signal polling with waitFor 2026-02-18 17:35:13 +00:00
Peter Steinberger
f9e67f3f4c perf(test): replace gateway chat polling loops with waitFor 2026-02-18 17:28:25 +00:00
Peter Steinberger
c7831fdf1e refactor(gateway-test): share preview transcript fixture 2026-02-18 17:01:22 +00:00
Mariano
1437ed76a0 Gateway/CLI: add paired-device remove and clear flows (#20057) 
Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: 26523f8a38
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com>
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com>
Reviewed-by: @mbelinky
 2026-02-18 13:27:31 +00:00
Peter Steinberger
3daf730fcc test(gateway): fix send target resolution error typing 2026-02-18 12:54:22 +00:00
Peter Steinberger
56ebbf0eed test(gateway): dedupe sessions usage handler fixtures 2026-02-18 12:52:34 +00:00
Peter Steinberger
fc29588329 test(gateway): dedupe send delivery fixtures 2026-02-18 12:52:25 +00:00
Peter Steinberger
3a09d85cd3 test(gateway): fix typed respond helpers in agent tests 2026-02-18 12:49:15 +00:00
Peter Steinberger
00c2308085 test(gateway): dedupe health status scope test setup 2026-02-18 12:48:10 +00:00
Peter Steinberger
c6da37dfb5 test(gateway): dedupe agent handler request fixtures 2026-02-18 12:48:04 +00:00
Peter Steinberger
396ccf9fb1 test(gateway): dedupe agents.files.list assertions 2026-02-18 12:45:14 +00:00
Peter Steinberger
2aec380fb3 test(gateway): dedupe update and chat abort persistence fixtures 2026-02-18 12:43:54 +00:00
Peter Steinberger
87ca2a24bd test(gateway): dedupe call gateway test setup 2026-02-18 12:27:21 +00:00
Peter Steinberger
12ad708ce5 test: dedupe gateway auth and sessions patch coverage 2026-02-18 05:30:59 +00:00
Gustavo Madeira Santana
07fdceb5fd refactor: centralize presence routing and version precedence coverage (#19609) 
Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: 10d9df5263
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com>
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com>
Reviewed-by: @gumadeiras
 2026-02-18 00:02:51 -05:00
Robby
5c69e625f5 fix(cli): display correct model for sub-agents in sessions list (#18660) 
Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: ba54c5a351
Co-authored-by: robbyczgw-cla <239660374+robbyczgw-cla@users.noreply.github.com>
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com>
Reviewed-by: @gumadeiras
 2026-02-17 23:59:20 -05:00
Peter Steinberger
a69e7682c1 refactor(test): dedupe channel and monitor action suites 2026-02-18 04:49:22 +00:00
Peter Steinberger
adac9cb67f refactor: dedupe gateway and scheduler test scaffolding 2026-02-18 04:04:14 +00:00
Gustavo Madeira Santana
0bf1b38cc0 Agents: fix subagent completion thread routing 2026-02-17 22:52:58 -05:00
Peter Steinberger
99db4d13e5 fix(gateway): guard cron webhook delivery against SSRF 2026-02-18 04:48:08 +01:00
Peter Steinberger
b8b43175c5 style: align formatting with oxfmt 0.33 2026-02-18 01:34:35 +00:00