Skip to content

Commit bad2d0e

Browse files
anup00900anup00900
authored
Merge branch 'main' into fix/cron-remove-session-cleanup-46369
2 parents fdacae6 + db20141 commit bad2d0e

167 files changed

Lines changed: 59953 additions & 1013 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/CODEOWNERS‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,51 @@
11
# Protect the ownership rules themselves.
22
/.github/CODEOWNERS @steipete
33

4+
# WARNING: GitHub CODEOWNERS uses last-match-wins semantics.
5+
# If you add overlapping rules below the secops block, include @openclaw/secops
6+
# on those entries too or you can silently remove required secops review.
7+
# Security-sensitive code, config, and docs require secops review.
8+
/SECURITY.md @openclaw/secops
9+
/.github/dependabot.yml @openclaw/secops
10+
/.github/codeql/ @openclaw/secops
11+
/.github/workflows/codeql.yml @openclaw/secops
12+
/src/security/ @openclaw/secops
13+
/src/secrets/ @openclaw/secops
14+
/src/config/*secret*.ts @openclaw/secops
15+
/src/config/**/*secret*.ts @openclaw/secops
16+
/src/gateway/*auth*.ts @openclaw/secops
17+
/src/gateway/**/*auth*.ts @openclaw/secops
18+
/src/gateway/*secret*.ts @openclaw/secops
19+
/src/gateway/**/*secret*.ts @openclaw/secops
20+
/src/gateway/security-path*.ts @openclaw/secops
21+
/src/gateway/resolve-configured-secret-input-string*.ts @openclaw/secops
22+
/src/gateway/protocol/**/*secret*.ts @openclaw/secops
23+
/src/gateway/server-methods/secrets*.ts @openclaw/secops
24+
/src/agents/*auth*.ts @openclaw/secops
25+
/src/agents/**/*auth*.ts @openclaw/secops
26+
/src/agents/auth-profiles*.ts @openclaw/secops
27+
/src/agents/auth-health*.ts @openclaw/secops
28+
/src/agents/auth-profiles/ @openclaw/secops
29+
/src/agents/sandbox.ts @openclaw/secops
30+
/src/agents/sandbox-*.ts @openclaw/secops
31+
/src/agents/sandbox/ @openclaw/secops
32+
/src/infra/secret-file*.ts @openclaw/secops
33+
/src/cron/stagger.ts @openclaw/secops
34+
/src/cron/service/jobs.ts @openclaw/secops
35+
/docs/security/ @openclaw/secops
36+
/docs/gateway/authentication.md @openclaw/secops
37+
/docs/gateway/sandbox-vs-tool-policy-vs-elevated.md @openclaw/secops
38+
/docs/gateway/sandboxing.md @openclaw/secops
39+
/docs/gateway/secrets-plan-contract.md @openclaw/secops
40+
/docs/gateway/secrets.md @openclaw/secops
41+
/docs/gateway/security/ @openclaw/secops
42+
/docs/cli/approvals.md @openclaw/secops
43+
/docs/cli/sandbox.md @openclaw/secops
44+
/docs/cli/security.md @openclaw/secops
45+
/docs/cli/secrets.md @openclaw/secops
46+
/docs/reference/secretref-credential-surface.md @openclaw/secops
47+
/docs/reference/secretref-user-supplied-credentials-matrix.json @openclaw/secops
48+
449
# Release workflow and its supporting release-path checks.
550
/.github/workflows/openclaw-npm-release.yml @openclaw/openclaw-release-managers
651
/docs/reference/RELEASING.md @openclaw/openclaw-release-managers

‎.github/workflows/workflow-sanity.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ on:
44
pull_request:
55
push:
66
branches: [main]
7+
workflow_dispatch:
78

89
concurrency:
910
group: workflow-sanity-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -14,6 +15,7 @@ env:
1415

1516
jobs:
1617
no-tabs:
18+
if: github.event_name != 'workflow_dispatch'
1719
runs-on: blacksmith-16vcpu-ubuntu-2404
1820
steps:
1921
- name: Checkout
@@ -45,6 +47,7 @@ jobs:
4547
PY
4648
4749
actionlint:
50+
if: github.event_name != 'workflow_dispatch'
4851
runs-on: blacksmith-16vcpu-ubuntu-2404
4952
steps:
5053
- name: Checkout
@@ -68,3 +71,19 @@ jobs:
6871

6972
- name: Disallow direct inputs interpolation in composite run blocks
7073
run: python3 scripts/check-composite-action-input-interpolation.py
74+
75+
config-docs-drift:
76+
if: github.event_name == 'workflow_dispatch'
77+
runs-on: blacksmith-16vcpu-ubuntu-2404
78+
steps:
79+
- name: Checkout
80+
uses: actions/checkout@v6
81+
82+
- name: Setup Node environment
83+
uses: ./.github/actions/setup-node-env
84+
with:
85+
install-bun: "false"
86+
use-sticky-disk: "false"
87+
88+
- name: Check config docs drift statefile
89+
run: pnpm config:docs:check

‎.secrets.baseline‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12314,14 +12314,14 @@
1231412314
"filename": "src/config/schema.help.ts",
1231512315
"hashed_secret": "9f4cda226d3868676ac7f86f59e4190eb94bd208",
1231612316
"is_verified": false,
12317-
"line_number": 653
12317+
"line_number": 657
1231812318
},
1231912319
{
1232012320
"type": "Secret Keyword",
1232112321
"filename": "src/config/schema.help.ts",
1232212322
"hashed_secret": "01822c8bbf6a8b136944b14182cb885100ec2eae",
1232312323
"is_verified": false,
12324-
"line_number": 686
12324+
"line_number": 690
1232512325
}
1232612326
],
1232712327
"src/config/schema.irc.ts": [
@@ -12360,14 +12360,14 @@
1236012360
"filename": "src/config/schema.labels.ts",
1236112361
"hashed_secret": "e73c9fcad85cd4eecc74181ec4bdb31064d68439",
1236212362
"is_verified": false,
12363-
"line_number": 217
12363+
"line_number": 219
1236412364
},
1236512365
{
1236612366
"type": "Secret Keyword",
1236712367
"filename": "src/config/schema.labels.ts",
1236812368
"hashed_secret": "2eda7cd978f39eebec3bf03e4410a40e14167fff",
1236912369
"is_verified": false,
12370-
"line_number": 326
12370+
"line_number": 328
1237112371
}
1237212372
],
1237312373
"src/config/slack-http-config.test.ts": [

‎AGENTS.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
- PR review conversations: if a bot leaves review conversations on your PR, address them and resolve those conversations yourself once fixed. Leave a conversation unresolved only when reviewer or maintainer judgment is still needed; do not leave bot-conversation cleanup to maintainers.
1010
- GitHub searching footgun: don't limit yourself to the first 500 issues or PRs when wanting to search all. Unless you're supposed to look at the most recent, keep going until you've reached the last page in the search
1111
- Security advisory analysis: before triage/severity decisions, read `SECURITY.md` to align with OpenClaw's trust model and design boundaries.
12+
- Do not edit files covered by security-focused `CODEOWNERS` rules unless a listed owner explicitly asked for the change or is already reviewing it with you. Treat those paths as restricted surfaces, not drive-by cleanup.
1213

1314
## Auto-close labels (issues and PRs)
1415

‎CHANGELOG.md‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,18 +8,30 @@ Docs: https://docs.openclaw.ai
88

99
- Commands/btw: add `/btw` side questions for quick tool-less answers about the current session without changing future session context, with dismissible in-session TUI answers and explicit BTW replies on external channels. (#45444) Thanks @ngutman.
1010
- Refactor/channels: remove the legacy channel shim directories and point channel-specific imports directly at the extension-owned implementations. (#45967) thanks @scoootscooob.
11+
- Feishu/streaming: add `onReasoningStream` and `onReasoningEnd` support to streaming cards, so `/reasoning stream` renders thinking tokens as markdown blockquotes in the same card — matching the Telegram channel's reasoning lane behavior.
12+
- Feishu/cards: add identity-aware structured card headers and note footers for Feishu replies and direct sends, while keeping that presentation wired through the shared outbound identity path. (#29938) Thanks @nszhsl.
13+
- Gateway/health monitor: add configurable stale-event thresholds and restart limits, plus per-channel and per-account `healthMonitor.enabled` overrides, while keeping the existing global disable path on `gateway.channelHealthCheckMinutes=0`. (#42107) Thanks @rstar327.
14+
- Android/mobile: add a system-aware dark theme across onboarding and post-onboarding screens so the app follows the device theme through setup, chat, and voice flows. (#46249) Thanks @sibbl.
1115

1216
### Fixes
1317

1418
- Z.AI/onboarding: detect a working default model even for explicit `zai-coding-*` endpoint choices, so Coding Plan setup can keep the selected endpoint while defaulting to `glm-5` when available or `glm-4.7` as fallback. (#45969)
19+
- Zalo/plugin runtime: export `resolveClientIp` from `openclaw/plugin-sdk/zalo` so installed builds no longer crash on startup when the webhook monitor loads from the packaged extension instead of the monorepo source tree. (#46549) Thanks @No898.
20+
- Z.AI/onboarding: add `glm-5-turbo` to the default Z.AI provider catalog so onboarding-generated configs expose the new model alongside the existing GLM defaults. (#46670) Thanks @tomsun28.
1521
- Control UI/chat sessions: show human-readable labels in the grouped session dropdown again, keep unique scoped fallbacks when metadata is missing, and disambiguate duplicate labels only when needed. (#45130) thanks @luzhidong.
1622
- Configure/startup: move outbound send-deps resolution into a lightweight helper so `openclaw configure` no longer stalls after the banner while eagerly loading channel plugins. (#46301) thanks @scoootscooob.
23+
- Zalo Personal/group gating: stop reapplying `dmPolicy.allowFrom` as a sender gate for already-allowlisted groups when `groupAllowFrom` is unset, so any member of an allowed group can trigger replies while DMs stay restricted. (#40146)
24+
- Plugins/install precedence: keep bundled plugins ahead of auto-discovered globals by default, but let an explicitly installed plugin record win its own duplicate-id tie so installed channel plugins load from `~/.openclaw/extensions` after `openclaw plugins install`.
1725

1826
### Fixes
1927

2028
- Slack/interactive replies: preserve `channelData.slack.blocks` through live DM delivery and preview-finalized edits so Block Kit button and select directives render instead of falling back to raw text. Thanks @vincentkoc.
2129
- CI/channel test routing: move the built-in channel suites into `test:channels` and keep them out of `test:extensions`, so extension CI no longer fails after the channel migration while targeted test routing still sends Slack, Signal, and iMessage suites to the right lane. (#46066) Thanks @scoootscooob.
22-
- Agents/usage tracking: stop forcing `supportsUsageInStreaming: false` on non-native openai-completions endpoints so providers like DashScope, DeepSeek, and other OpenAI-compatible backends report token usage and cost instead of showing all zeros. (#46142)
30+
- Node/startup: remove leftover debug `console.log("node host PATH: ...")` that printed the resolved PATH on every `openclaw node run` invocation. (#46411)
31+
- Control UI/dashboard: preserve structured gateway shutdown reasons across restart disconnects so config-triggered restarts no longer fall back to `disconnected (1006): no reason`. (#46532) Thanks @vincentkoc.
32+
- Feishu/topic threads: fetch full thread context, including prior bot replies, when starting a topic-thread session so follow-up turns in Feishu topics keep the right conversation state. Thanks @Coobiw.
33+
- Browser/profiles: drop the auto-created `chrome-relay` browser profile; users who need the Chrome extension relay must now create their own profile via `openclaw browser create-profile`. (#45777) Thanks @odysseus0.
34+
- Docs/Mintlify: fix MDX marker syntax on Perplexity, Model Providers, Moonshot, and exec approvals pages so local docs preview no longer breaks rendering or leaves stale pages unpublished. (#46695) Thanks @velvet-shark.
2335

2436
## 2026.3.13
2537

@@ -95,6 +107,8 @@ Docs: https://docs.openclaw.ai
95107
- Mattermost/thread routing: non-inbound reply paths (TUI/WebUI turns, tool-call callbacks, subagent responses) now correctly route to the originating Mattermost thread when `replyToMode: "all"` is active; also prevents stale `origin.threadId` metadata from resurrecting cleared thread routes. (#44283) thanks @teconomix
96108
- Gateway/websocket pairing bypass for disabled auth: skip device-pairing enforcement when `gateway.auth.mode=none` so Control UI connections behind reverse proxies no longer get stuck on `pairing required` (code 1008) despite auth being explicitly disabled. (#42931)
97109
- Auth/login lockout recovery: clear stale `auth_permanent` and `billing` disabled state for all profiles matching the target provider when `openclaw models auth login` is invoked, so users locked out by expired or revoked OAuth tokens can recover by re-authenticating instead of waiting for the cooldown timer to expire. (#43057)
110+
- Auto-reply/context-engine compaction: persist the exact embedded-run metadata compaction count for main and followup runner session accounting, so metadata-only auto-compactions no longer undercount multi-compaction runs. (#42629) thanks @uf-hy.
111+
- Auth/Codex CLI reuse: sync reused Codex CLI credentials into the supported `openai-codex:default` OAuth profile instead of reviving the deprecated `openai-codex:codex-cli` slot, so doctor cleanup no longer loops. (#45353) thanks @Gugu-sugar.
98112

99113
## 2026.3.12
100114

‎CONTRIBUTING.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,7 @@ Welcome to the lobster tank! 🦞
9696
- Reply to or resolve bot review conversations you addressed before asking for review again
9797
- **Include screenshots** — one showing the problem/before, one showing the fix/after (for UI or visual changes)
9898
- Use American English spelling and grammar in code, comments, docs, and UI strings
99+
- Do not edit files covered by `CODEOWNERS` security ownership unless a listed owner explicitly asked for the change or is already reviewing it with you. Treat those paths as restricted review surfaces, not opportunistic cleanup targets.
99100

100101
## Review Conversations Are Author-Owned
101102

‎Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -134,7 +134,7 @@ RUN --mount=type=cache,id=openclaw-bookworm-apt-cache,target=/var/cache/apt,shar
134134
apt-get update && \
135135
DEBIAN_FRONTEND=noninteractive apt-get upgrade -y --no-install-recommends && \
136136
DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
137-
procps hostname curl git openssl
137+
procps hostname curl git lsof openssl
138138

139139
RUN chown node:node /app
140140

‎apps/android/app/src/main/java/ai/openclaw/app/ui/ConnectTabScreen.kt‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@ import androidx.compose.ui.text.font.FontWeight
5151
import androidx.compose.ui.text.input.KeyboardType
5252
import androidx.compose.ui.unit.dp
5353
import ai.openclaw.app.MainViewModel
54+
import ai.openclaw.app.ui.mobileCardSurface
5455

5556
private enum class ConnectInputMode {
5657
SetupCode,
@@ -144,7 +145,7 @@ fun ConnectTabScreen(viewModel: MainViewModel) {
144145
Surface(
145146
modifier = Modifier.fillMaxWidth(),
146147
shape = RoundedCornerShape(14.dp),
147-
color = Color.White,
148+
color = mobileCardSurface,
148149
border = BorderStroke(1.dp, mobileBorder),
149150
) {
150151
Column {
@@ -205,7 +206,7 @@ fun ConnectTabScreen(viewModel: MainViewModel) {
205206
shape = RoundedCornerShape(14.dp),
206207
colors =
207208
ButtonDefaults.buttonColors(
208-
containerColor = Color.White,
209+
containerColor = mobileCardSurface,
209210
contentColor = mobileDanger,
210211
),
211212
border = BorderStroke(1.dp, mobileDanger.copy(alpha = 0.4f)),
@@ -298,7 +299,7 @@ fun ConnectTabScreen(viewModel: MainViewModel) {
298299
Surface(
299300
modifier = Modifier.fillMaxWidth(),
300301
shape = RoundedCornerShape(14.dp),
301-
color = Color.White,
302+
color = mobileCardSurface,
302303
border = BorderStroke(1.dp, mobileBorder),
303304
) {
304305
Column(
@@ -480,7 +481,7 @@ private fun MethodChip(label: String, active: Boolean, onClick: () -> Unit) {
480481
containerColor = if (active) mobileAccent else mobileSurface,
481482
contentColor = if (active) Color.White else mobileText,
482483
),
483-
border = BorderStroke(1.dp, if (active) Color(0xFF184DAF) else mobileBorderStrong),
484+
border = BorderStroke(1.dp, if (active) mobileAccentBorderStrong else mobileBorderStrong),
484485
) {
485486
Text(label, style = mobileCaption1.copy(fontWeight = FontWeight.Bold))
486487
}
@@ -509,10 +510,10 @@ private fun CommandBlock(command: String) {
509510
modifier = Modifier.fillMaxWidth(),
510511
shape = RoundedCornerShape(12.dp),
511512
color = mobileCodeBg,
512-
border = BorderStroke(1.dp, Color(0xFF2B2E35)),
513+
border = BorderStroke(1.dp, mobileCodeBorder),
513514
) {
514515
Row(modifier = Modifier.fillMaxWidth(), verticalAlignment = Alignment.CenterVertically) {
515-
Box(modifier = Modifier.width(3.dp).height(42.dp).background(Color(0xFF3FC97A)))
516+
Box(modifier = Modifier.width(3.dp).height(42.dp).background(mobileCodeAccent))
516517
Text(
517518
text = command,
518519
modifier = Modifier.padding(horizontal = 12.dp, vertical = 10.dp),

0 commit comments

Comments
 (0)