Skip to content

Commit 1511a08

Browse files
BunsDevBunsDev
authored
Merge branch 'main' into fix/control-ui-refresh-active-run
2 parents a2c2372 + e9d4cb2 commit 1511a08

386 files changed

Lines changed: 20340 additions & 3802 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.agents/skills/clawsweeper/SKILL.md‎

Lines changed: 27 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -255,12 +255,27 @@ loop. The router:
255255
- never merges autofix PRs or draft PRs;
256256
- merges automerge PRs only when ClawSweeper passed the exact current head,
257257
checks are green, GitHub says mergeable, no human-review label is present,
258-
the PR is not draft, and both merge gates are open.
258+
the PR is not draft, required user-facing OpenClaw changelog entries are
259+
present, and both merge gates are open.
259260

260261
If ClawSweeper passes while merge gates are closed, it labels
261262
`clawsweeper:merge-ready` and comments instead of merging. `@clawsweeper stop`
262263
adds `clawsweeper:human-review`.
263264

265+
When Peter asks Codex to create a PR and enable ClawSweeper automerge, do not
266+
leave his local OpenClaw checkout on the PR branch. After the PR is created,
267+
pushed, and the `@clawsweeper automerge` request is posted or otherwise
268+
confirmed, return the local checkout to `main` and fast-forward it when the
269+
working tree is clean:
270+
271+
```bash
272+
git switch main
273+
git pull --ff-only
274+
```
275+
276+
If unrelated local edits or an in-progress rebase prevent switching, report the
277+
blocker instead of stashing, deleting, or overwriting work.
278+
264279
Repair caps:
265280

266281
```bash
@@ -270,13 +285,17 @@ CLAWSWEEPER_MAX_REPAIRS_PER_HEAD=1
270285

271286
## Security Boundary
272287

273-
Do not stage security-sensitive work for ClawSweeper Repair. Route vulnerability
274-
reports, CVE/GHSA/advisory work, leaked secrets/tokens/keys, plaintext secret
275-
storage, SSRF, XSS, CSRF, RCE, auth bypass, privilege escalation, and sensitive
276-
data exposure to central OpenClaw security handling.
277-
278-
For adopted automerge jobs, trust deterministic ClawSweeper security markers,
279-
labels, and job frontmatter; do not infer security handling from vague prose.
288+
Do not stage unapproved security-sensitive work for ClawSweeper Repair. Route
289+
vulnerability reports, CVE/GHSA/advisory work, leaked secrets/tokens/keys,
290+
plaintext secret storage, SSRF, XSS, CSRF, RCE, auth bypass, privilege
291+
escalation, and sensitive data exposure to central OpenClaw security handling.
292+
293+
For PRs explicitly opted into `clawsweeper:autofix` or
294+
`clawsweeper:automerge`, security-sensitive review findings may dispatch
295+
bounded repair, but merge remains blocked until a later exact-head review is
296+
clean and the normal merge gates pass. Trust deterministic ClawSweeper security
297+
markers, labels, and job frontmatter; do not infer security handling from vague
298+
prose.
280299

281300
## Monitoring
282301

‎.agents/skills/openclaw-pr-maintainer/SKILL.md‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,28 @@ gitcrawl cluster-detail openclaw/openclaw --id <cluster-id> --member-limit 20 --
4141
- `invalid`
4242
- `dirty` for PRs only
4343

44+
## Select small high-confidence triage candidates
45+
46+
When asked for `X` issues or PRs to triage, `X` means qualified candidates, not sampled threads.
47+
48+
Only list candidates that pass all gates:
49+
50+
- small owner/surface, with a likely narrow fix and focused regression test
51+
- symptom is reproducible or provable with logs, failing test, live command, dependency contract, or current-main behavior
52+
- root cause is traceable to code with file/line and the proposed fix touches that path
53+
- no strong smell that a broader refactor, ownership rethink, migration, or product decision is the better fix
54+
- dependency-backed behavior checked against upstream docs/source/types; live or web proof used when local proof is insufficient
55+
56+
Loop:
57+
58+
1. Use `gitcrawl` / `gh` to gather candidate clusters.
59+
2. Read issue/PR body, comments, current code, adjacent tests, and dependency contracts.
60+
3. Try focused repro or proof.
61+
4. Reject unclear, stale, speculative, broad-refactor, or owner-ambiguous items.
62+
5. Continue until `X` qualified candidates or the bounded search is exhausted.
63+
64+
Output only qualifying candidates, with: ref, surface, proof, cause, fix sketch, why small, expected test/gate. If none qualify, say so; do not pad.
65+
4466
## Enforce the bug-fix evidence bar
4567

4668
- Never merge a bug-fix PR based only on issue text, PR text, or AI rationale.

‎.github/codeql/codeql-actions-critical-security.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,18 @@
11
name: openclaw-codeql-actions-critical-security
22

3+
disable-default-queries: true
4+
5+
queries:
6+
- uses: security-extended
7+
8+
query-filters:
9+
- include:
10+
precision:
11+
- high
12+
- very-high
13+
tags contain: security
14+
security-severity: /([7-9]|10)\.(\d)+/
15+
316
paths:
417
- .github/actions
518
- .github/workflows

‎.github/codeql/codeql-channel-runtime-boundary-critical-security.yml‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,8 @@ query-filters:
1010
precision:
1111
- high
1212
- very-high
13-
- exclude:
14-
problem.severity:
15-
- recommendation
16-
- warning
13+
tags contain: security
14+
security-severity: /([7-9]|10)\.(\d)+/
1715

1816
paths:
1917
- src/channels

‎.github/codeql/codeql-core-auth-secrets-critical-security.yml‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,8 @@ query-filters:
1010
precision:
1111
- high
1212
- very-high
13-
- exclude:
14-
problem.severity:
15-
- recommendation
16-
- warning
13+
tags contain: security
14+
security-severity: /([7-9]|10)\.(\d)+/
1715

1816
paths:
1917
- src/agents/*auth*.ts

‎.github/codeql/codeql-gateway-runtime-boundary-critical-quality.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,11 @@ query-filters:
1414
- security
1515

1616
paths:
17+
- src/gateway/method-scopes.ts
1718
- src/gateway/protocol
1819
- src/gateway/server-methods
20+
- src/gateway/server-methods.ts
21+
- src/gateway/server-methods-list.ts
1922

2023
paths-ignore:
2124
- "**/node_modules"

‎.github/codeql/codeql-mcp-process-tool-boundary-critical-security.yml‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,8 @@ query-filters:
1010
precision:
1111
- high
1212
- very-high
13-
- exclude:
14-
problem.severity:
15-
- recommendation
16-
- warning
13+
tags contain: security
14+
security-severity: /([7-9]|10)\.(\d)+/
1715

1816
paths:
1917
- src/mcp

‎.github/codeql/codeql-network-ssrf-boundary-critical-security.yml‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,8 @@ query-filters:
1010
precision:
1111
- high
1212
- very-high
13-
- exclude:
14-
problem.severity:
15-
- recommendation
16-
- warning
13+
tags contain: security
14+
security-severity: /([7-9]|10)\.(\d)+/
1715

1816
paths:
1917
- src/infra/net

‎.github/codeql/codeql-plugin-trust-boundary-critical-security.yml‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,8 @@ query-filters:
1010
precision:
1111
- high
1212
- very-high
13-
- exclude:
14-
problem.severity:
15-
- recommendation
16-
- warning
13+
tags contain: security
14+
security-severity: /([7-9]|10)\.(\d)+/
1715

1816
paths:
1917
- src/cli/plugin-install-config-policy.ts

‎.github/labeler.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,12 @@
99
- "extensions/azure-speech/**"
1010
- "docs/providers/azure-speech.md"
1111
- "docs/tools/tts.md"
12+
"plugin: file-transfer":
13+
- changed-files:
14+
- any-glob-to-any-file:
15+
- "extensions/file-transfer/**"
16+
- "docs/nodes/index.md"
17+
- "docs/plugins/sdk-runtime.md"
1218
"channel: discord":
1319
- changed-files:
1420
- any-glob-to-any-file:

0 commit comments

Comments
 (0)