Skip to content

Commit d6d6c9d

Browse files
Rain120Rain120
authored
Merge branch 'main' into feature/ui-layout_usage
2 parents 68bdfa1 + 1447e2e commit d6d6c9d

4,022 files changed

Lines changed: 345309 additions & 120378 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.agent/workflows/update_clawdbot.md‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
---
2-
description: Update Clawdbot from upstream when branch has diverged (ahead/behind)
2+
description: Update OpenClaw from upstream when branch has diverged (ahead/behind)
33
---
44

5-
# Clawdbot Upstream Sync Workflow
5+
# OpenClaw Upstream Sync Workflow
66

77
Use this workflow when your fork has diverged from upstream (e.g., "18 commits ahead, 29 commits behind").
88

@@ -132,16 +132,16 @@ pnpm mac:package
132132

133133
```bash
134134
# Kill running app
135-
pkill -x "Clawdbot" || true
135+
pkill -x "OpenClaw" || true
136136

137137
# Move old version
138-
mv /Applications/Clawdbot.app /tmp/Clawdbot-backup.app
138+
mv /Applications/OpenClaw.app /tmp/OpenClaw-backup.app
139139

140140
# Install new build
141-
cp -R dist/Clawdbot.app /Applications/
141+
cp -R dist/OpenClaw.app /Applications/
142142

143143
# Launch
144-
open /Applications/Clawdbot.app
144+
open /Applications/OpenClaw.app
145145
```
146146

147147
---
@@ -235,7 +235,7 @@ If upstream introduced new model configurations:
235235
# Check for OpenRouter API key requirements
236236
grep -r "openrouter\|OPENROUTER" src/ --include="*.ts" --include="*.js"
237237

238-
# Update clawdbot.json with fallback chains
238+
# Update openclaw.json with fallback chains
239239
# Add model fallback configurations as needed
240240
```
241241

‎.agents/skills/parallels-discord-roundtrip/SKILL.md‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
---
2+
name: parallels-discord-roundtrip
3+
description: Run the macOS Parallels smoke harness with Discord end-to-end roundtrip verification, including guest send, host verification, host reply, and guest readback.
4+
---
5+
6+
# Parallels Discord Roundtrip
7+
8+
Use when macOS Parallels smoke must prove Discord two-way delivery end to end.
9+
10+
## Goal
11+
12+
Cover:
13+
14+
- install on fresh macOS snapshot
15+
- onboard + gateway health
16+
- guest `message send` to Discord
17+
- host sees that message on Discord
18+
- host posts a new Discord message
19+
- guest `message read` sees that new message
20+
21+
## Inputs
22+
23+
- host env var with Discord bot token
24+
- Discord guild ID
25+
- Discord channel ID
26+
- `OPENAI_API_KEY`
27+
28+
## Preferred run
29+
30+
```bash
31+
export OPENCLAW_PARALLELS_DISCORD_TOKEN="$(
32+
ssh peters-mac-studio-1 'jq -r ".channels.discord.token" ~/.openclaw/openclaw.json' | tr -d '\n'
33+
)"
34+
35+
pnpm test:parallels:macos \
36+
--discord-token-env OPENCLAW_PARALLELS_DISCORD_TOKEN \
37+
--discord-guild-id 1456350064065904867 \
38+
--discord-channel-id 1456744319972282449 \
39+
--json
40+
```
41+
42+
## Notes
43+
44+
- Snapshot target: closest to `macOS 26.3.1 fresh`.
45+
- Harness configures Discord inside the guest; no checked-in token/config.
46+
- Use the `openclaw` wrapper for guest `message send/read`; `node openclaw.mjs message ...` does not expose the lazy message subcommands the same way.
47+
- Write `channels.discord.guilds` in one JSON object (`--strict-json`), not dotted `config set channels.discord.guilds.<snowflake>...` paths; numeric snowflakes get treated like array indexes.
48+
- Avoid `prlctl enter` / expect for long Discord setup scripts; it line-wraps/corrupts long commands. Use `prlctl exec --current-user /bin/sh -lc ...` for the Discord config phase.
49+
- Harness cleanup deletes the temporary Discord smoke messages at exit.
50+
- Per-phase logs: `/tmp/openclaw-parallels-smoke.*`
51+
- Machine summary: pass `--json`
52+
- If roundtrip flakes, inspect `fresh.discord-roundtrip.log` and `discord-last-readback.json` in the run dir first.
53+
54+
## Pass criteria
55+
56+
- fresh lane or upgrade lane requested passes
57+
- summary reports `discord=pass` for that lane
58+
- guest outbound nonce appears in channel history
59+
- host inbound nonce appears in `openclaw message read` output

‎.dockerignore‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
.git
22
.worktrees
3+
4+
# Sensitive files – docker-setup.sh writes .env with OPENCLAW_GATEWAY_TOKEN
5+
# into the project root; keep it out of the build context.
6+
.env
7+
.env.*
8+
39
.bun-cache
410
.bun
511
.tmp

‎.github/CODEOWNERS‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
# Protect the ownership rules themselves.
2+
/.github/CODEOWNERS @steipete
3+
4+
# WARNING: GitHub CODEOWNERS uses last-match-wins semantics.
5+
# If you add overlapping rules below the secops block, include @openclaw/secops
6+
# on those entries too or you can silently remove required secops review.
7+
# Security-sensitive code, config, and docs require secops review.
8+
/SECURITY.md @openclaw/secops
9+
/.github/dependabot.yml @openclaw/secops
10+
/.github/codeql/ @openclaw/secops
11+
/.github/workflows/codeql.yml @openclaw/secops
12+
/src/security/ @openclaw/secops
13+
/src/secrets/ @openclaw/secops
14+
/src/config/*secret*.ts @openclaw/secops
15+
/src/config/**/*secret*.ts @openclaw/secops
16+
/src/gateway/*auth*.ts @openclaw/secops
17+
/src/gateway/**/*auth*.ts @openclaw/secops
18+
/src/gateway/*secret*.ts @openclaw/secops
19+
/src/gateway/**/*secret*.ts @openclaw/secops
20+
/src/gateway/security-path*.ts @openclaw/secops
21+
/src/gateway/resolve-configured-secret-input-string*.ts @openclaw/secops
22+
/src/gateway/protocol/**/*secret*.ts @openclaw/secops
23+
/src/gateway/server-methods/secrets*.ts @openclaw/secops
24+
/src/agents/*auth*.ts @openclaw/secops
25+
/src/agents/**/*auth*.ts @openclaw/secops
26+
/src/agents/auth-profiles*.ts @openclaw/secops
27+
/src/agents/auth-health*.ts @openclaw/secops
28+
/src/agents/auth-profiles/ @openclaw/secops
29+
/src/agents/sandbox.ts @openclaw/secops
30+
/src/agents/sandbox-*.ts @openclaw/secops
31+
/src/agents/sandbox/ @openclaw/secops
32+
/src/infra/secret-file*.ts @openclaw/secops
33+
/src/cron/stagger.ts @openclaw/secops
34+
/src/cron/service/jobs.ts @openclaw/secops
35+
/docs/security/ @openclaw/secops
36+
/docs/gateway/authentication.md @openclaw/secops
37+
/docs/gateway/sandbox-vs-tool-policy-vs-elevated.md @openclaw/secops
38+
/docs/gateway/sandboxing.md @openclaw/secops
39+
/docs/gateway/secrets-plan-contract.md @openclaw/secops
40+
/docs/gateway/secrets.md @openclaw/secops
41+
/docs/gateway/security/ @openclaw/secops
42+
/docs/cli/approvals.md @openclaw/secops
43+
/docs/cli/sandbox.md @openclaw/secops
44+
/docs/cli/security.md @openclaw/secops
45+
/docs/cli/secrets.md @openclaw/secops
46+
/docs/reference/secretref-credential-surface.md @openclaw/secops
47+
/docs/reference/secretref-user-supplied-credentials-matrix.json @openclaw/secops
48+
49+
# Release workflow and its supporting release-path checks.
50+
/.github/workflows/openclaw-npm-release.yml @openclaw/openclaw-release-managers
51+
/docs/reference/RELEASING.md @openclaw/openclaw-release-managers
52+
/scripts/openclaw-npm-publish.sh @openclaw/openclaw-release-managers
53+
/scripts/openclaw-npm-release-check.ts @openclaw/openclaw-release-managers
54+
/scripts/release-check.ts @openclaw/openclaw-release-managers

‎.github/FUNDING.yml‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎.github/actions/setup-node-env/action.yml‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,16 @@
11
name: Setup Node environment
22
description: >
3-
Initialize submodules with retry, install Node 22, pnpm, optionally Bun,
3+
Initialize submodules with retry, install Node 24 by default, pnpm, optionally Bun,
44
and optionally run pnpm install. Requires actions/checkout to run first.
55
inputs:
66
node-version:
77
description: Node.js version to install.
88
required: false
9-
default: "22.x"
9+
default: "24.x"
10+
cache-key-suffix:
11+
description: Suffix appended to the pnpm store cache key.
12+
required: false
13+
default: "node24"
1014
pnpm-version:
1115
description: pnpm version for corepack.
1216
required: false
@@ -16,7 +20,7 @@ inputs:
1620
required: false
1721
default: "true"
1822
use-sticky-disk:
19-
description: Use Blacksmith sticky disks for pnpm store caching.
23+
description: Request Blacksmith sticky-disk pnpm caching on trusted runs; pull_request runs fall back to actions/cache.
2024
required: false
2125
default: "false"
2226
install-deps:
@@ -45,7 +49,7 @@ runs:
4549
exit 1
4650
4751
- name: Setup Node.js
48-
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
52+
uses: actions/setup-node@v6
4953
with:
5054
node-version: ${{ inputs.node-version }}
5155
check-latest: false
@@ -54,12 +58,12 @@ runs:
5458
uses: ./.github/actions/setup-pnpm-store-cache
5559
with:
5660
pnpm-version: ${{ inputs.pnpm-version }}
57-
cache-key-suffix: "node22"
61+
cache-key-suffix: ${{ inputs.cache-key-suffix }}
5862
use-sticky-disk: ${{ inputs.use-sticky-disk }}
5963

6064
- name: Setup Bun
6165
if: inputs.install-bun == 'true'
62-
uses: oven-sh/setup-bun@v2
66+
uses: oven-sh/setup-bun@v2.1.3
6367
with:
6468
bun-version: "1.3.9"
6569

‎.github/actions/setup-pnpm-store-cache/action.yml‎

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -8,17 +8,17 @@ inputs:
88
cache-key-suffix:
99
description: Suffix appended to the cache key.
1010
required: false
11-
default: "node22"
11+
default: "node24"
1212
use-sticky-disk:
13-
description: Use Blacksmith sticky disks instead of actions/cache for pnpm store.
13+
description: Use Blacksmith sticky disks instead of actions/cache for pnpm store on trusted runs; pull_request runs fall back to actions/cache.
1414
required: false
1515
default: "false"
1616
use-restore-keys:
1717
description: Whether to use restore-keys fallback for actions/cache.
1818
required: false
1919
default: "true"
2020
use-actions-cache:
21-
description: Whether to restore/save pnpm store with actions/cache.
21+
description: Whether to restore/save pnpm store with actions/cache, including pull_request fallback when sticky disks are disabled.
2222
required: false
2323
default: "true"
2424
runs:
@@ -51,22 +51,24 @@ runs:
5151
run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
5252

5353
- name: Mount pnpm store sticky disk
54-
if: inputs.use-sticky-disk == 'true'
54+
# Keep persistent sticky-disk state off untrusted PR runs.
55+
if: inputs.use-sticky-disk == 'true' && github.event_name != 'pull_request'
5556
uses: useblacksmith/stickydisk@v1
5657
with:
57-
key: ${{ github.repository }}-pnpm-store-${{ runner.os }}-${{ inputs.cache-key-suffix }}
58+
key: ${{ github.repository }}-pnpm-store-${{ runner.os }}-${{ github.ref_name }}-${{ inputs.cache-key-suffix }}-${{ hashFiles('pnpm-lock.yaml') }}
5859
path: ${{ steps.pnpm-store.outputs.path }}
5960

6061
- name: Restore pnpm store cache (exact key only)
61-
if: inputs.use-actions-cache == 'true' && inputs.use-sticky-disk != 'true' && inputs.use-restore-keys != 'true'
62-
uses: actions/cache@v4
62+
# PRs that request sticky disks still need a safe cache restore path.
63+
if: inputs.use-actions-cache == 'true' && (inputs.use-sticky-disk != 'true' || github.event_name == 'pull_request') && inputs.use-restore-keys != 'true'
64+
uses: actions/cache@v5
6365
with:
6466
path: ${{ steps.pnpm-store.outputs.path }}
6567
key: ${{ runner.os }}-pnpm-store-${{ inputs.cache-key-suffix }}-${{ hashFiles('pnpm-lock.yaml') }}
6668

6769
- name: Restore pnpm store cache (with fallback keys)
68-
if: inputs.use-actions-cache == 'true' && inputs.use-sticky-disk != 'true' && inputs.use-restore-keys == 'true'
69-
uses: actions/cache@v4
70+
if: inputs.use-actions-cache == 'true' && (inputs.use-sticky-disk != 'true' || github.event_name == 'pull_request') && inputs.use-restore-keys == 'true'
71+
uses: actions/cache@v5
7072
with:
7173
path: ${{ steps.pnpm-store.outputs.path }}
7274
key: ${{ runner.os }}-pnpm-store-${{ inputs.cache-key-suffix }}-${{ hashFiles('pnpm-lock.yaml') }}

0 commit comments

Comments
 (0)