Add allowMissingTarget option to assertPathSafety for write, mkdirp,
and rename operations. This fixes the regression where creating new
files fails with 'cannot create directories' error, even when the
workspace has rw access.

The issue occurs because assertPathSafety was checking for file
existence before allowing directory creation, but for new files the
parent directory may not have the target file yet.

Fixes openclaw#28734

Export waitForAbortSignal from the plugin SDK so extensions can import it
from 'openclaw/plugin-sdk' instead of using a relative path that breaks
in the built project.

Fixes openclaw#30057

- Add defaultAccount field to FeishuConfigSchema
- Update resolveDefaultFeishuAccountId to check defaultAccount first
- Update resolveFeishuAccount to use configured default when accountId is not provided
- Exclude defaultAccount from base config during merge to prevent incorrect inheritance

Fixes openclaw#30045

The withRemoteHttpResponse function was not passing proxy: "env" to
fetchWithSsrFGuard, causing memory search to fail with ECONNREFUSED
on servers that require an HTTP proxy for outbound HTTPS access.

This fix ensures the Gemini embedding API call respects the system's
HTTPS_PROXY and HTTP_PROXY environment variables, consistent with
other code paths like Telegram channel and web_fetch tool.

Fixes openclaw#30075

This fix enables providers like kimi-coding that require specific headers
(e.g., User-Agent) for authentication. The kimi-coding provider already
had headers defined in its config, but they were not being passed to the
API calls.

This change adds a wrapper function that injects the provider's custom
headers into the streamFn options for every API request.

Fixes openclaw#30099

…mory-proxy-env

…tories

Docker COPY preserves original permissions from the host filesystem. When
building the Docker image, extensions directories may end up with 777
permissions (world-writable), which causes OpenClaw to block all plugins
with: 'blocked plugin candidate: world-writable path'

This change adds chmod commands after COPY to ensure:
- Directories are 755 (rwxr-xr-x)
- Files are 644 (rw-r--r--)

Fixes openclaw#30139

…(feishu:user:...)

Fixes openclaw#30324 - Feishu target normalization fails for provider-prefixed
targets like 'feishu:user:ou_xxx'. The normalizeFeishuTarget function
now strips the optional 'feishu:' prefix first, then applies existing
chat|user|open_id parsing. Also updates looksLikeFeishuId to accept
provider-prefixed forms.

…bility

Issue openclaw#30467: Control UI blank page on browsers without Array.prototype.toSorted

Replace toSorted() with slice().sort() to ensure compatibility with
older browsers (e.g., Windows 7 Chrome-based browsers) that don't
support the ES2023 toSorted method.

…tibility

Fixes openclaw#30467 - Control UI blank page on browsers without Array.prototype.toSorted

Changed .slice().toSorted() to .slice().sort() for cross-browser compatibility.
The toSorted() method is not available in older Chrome-based browsers (e.g.,
Windows 7), causing the Control UI to render a blank page with 'TypeError:
Array.from(...).toSorted is not a function' error.

…user responses

When 'steer' mode injects a user message into a heartbeat run, the agent
produces a combined response like 'HEARTBEAT_OK Sure! Here is the answer.'
The previous logic stripped HEARTBEAT_OK and then checked if the remaining
text was ≤ maxAckChars (300). Since many user responses are under 300 chars,
the entire response was treated as a brief heartbeat ack and suppressed.

This fix adds a heuristic: after stripping HEARTBEAT_OK, if the remaining
text contains multi-sentence structure (sentence-ending punctuation [.!?]
followed by more content), it is recognized as a substantive response and
NOT suppressed.

Fixes openclaw#30449

When logging.file is set to a tilde-prefixed path (e.g. ~/.openclaw/logs/gateway.log),
the gateway crashes on startup with 'ENOENT: no such file or directory, mkdir ~/.openclaw/logs'.

This fix expands the tilde (~) to the user's home directory before creating
the log directory and writing log files.

Fixes: Issue openclaw#30401

When models like Codex fail to produce properly structured tool calls, they
sometimes emit raw function-call wire format like 'assistant to=functions.xxx'
mixed with hallucinated text. This change adds a sanitization function to
strip these patterns from text before it's delivered to users.

This addresses issue openclaw#30441 where Codex subagent output was leaking raw
function-call syntax to Discord channels.