Skip to content

feat(discord): add realtime voice bootstrap context#84499

Merged
steipete merged 4 commits into
openclaw:mainfrom
fuller-stack-dev:codex/discord-realtime-bootstrap-context
May 20, 2026
Merged

feat(discord): add realtime voice bootstrap context#84499
steipete merged 4 commits into
openclaw:mainfrom
fuller-stack-dev:codex/discord-realtime-bootstrap-context

Conversation

@fuller-stack-dev

@fuller-stack-dev fuller-stack-dev commented May 20, 2026

Copy link
Copy Markdown
Contributor

Summary

  • add bounded realtime voice profile context for Discord voice sessions
  • default realtime provider instructions to the active agent's IDENTITY.md, USER.md, and SOUL.md; voice.realtime.bootstrapContextFiles: [] disables the extra profile context and a subset customizes it
  • keep AGENTS.md in normal agent context and keep workspace/tool/current-fact work behind openclaw_agent_consult
  • expose the reusable helper through openclaw/plugin-sdk/realtime-bootstrap-context
  • document the behavior and refresh config/plugin-SDK metadata

Real behavior proof

Behavior addressed: Discord realtime bidi and agent-proxy voice sessions now start with compact identity, user, and persona grounding by default, without injecting broad agent instructions or workspace policy files.

Real environment tested: Local OpenClaw checkout on macOS plus Blacksmith Testbox changed-gate proof for this PR diff.

Exact steps or command run after this patch:

  • pnpm docs:list
  • node --import tsx scripts/generate-bundled-channel-config-metadata.ts --check
  • node --import tsx scripts/generate-config-doc-baseline.ts --check
  • node --max-old-space-size=8192 --import tsx scripts/generate-plugin-sdk-api-baseline.ts --check
  • node scripts/run-vitest.mjs src/agents/realtime-bootstrap-context.test.ts extensions/discord/src/config-schema.test.ts extensions/discord/src/voice/manager.e2e.test.ts src/plugins/contracts/plugin-sdk-subpaths.test.ts src/plugins/contracts/plugin-sdk-package-contract-guardrails.test.ts src/plugins/contracts/plugin-sdk-index.bundle.test.ts
  • pnpm check:test-types
  • AUTOREVIEW_AUTO_TESTS=0 AUTOREVIEW_OPENCLAW_MAINTAINER_VALIDATION=1 .agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main
  • OPENCLAW_TESTBOX=1 pnpm check:changed

Evidence after fix: Focused Vitest passed 6 files / 81 tests; type test check passed; generated baselines check clean; bootstrapContextMaxChars/Realtime Bootstrap Context Max Chars have no matches; autoreview clean after fixing public helper validation; Testbox tbx_01ks2qt5xmq3xergs55hnvs2j0 passed with Actions run https://github.com/openclaw/openclaw/actions/runs/26164409150.

Observed result after fix: Default realtime voice instructions receive the bounded profile context; bootstrapContextFiles: [] disables it; unsupported unchecked SDK file requests are ignored and cannot inject AGENTS.md.

What was not tested: A fresh live Discord voice conversation recording after enabling realtime voice.

@github-actions github-actions Bot added the dependencies-changed PR changes dependency-related files label May 20, 2026
@github-actions

Copy link
Copy Markdown
Contributor

Dependency Changes Detected

This PR changes dependency-related files. Maintainers should confirm these changes are intentional.

Changed files:

  • package.json

Maintainer follow-up:

  • Review whether the dependency changes are intentional.
  • Inspect resolved package deltas when lockfile or workspace dependency policy changes are present.
  • Run pnpm deps:changes:report -- --base-ref origin/main --markdown /tmp/dependency-changes.md --json /tmp/dependency-changes.json locally for detailed release-style evidence.

@openclaw-barnacle openclaw-barnacle Bot added docs Improvements or additions to documentation channel: discord Channel integration: discord scripts Repository scripts agents Agent runtime and tooling size: M proof: supplied External PR includes structured after-fix real behavior proof. labels May 20, 2026
@socket-security

socket-security Bot commented May 20, 2026

Copy link
Copy Markdown

No dependency changes detected. Learn more about Socket for GitHub.

👍 No dependency changes detected in pull request

@clawsweeper

clawsweeper Bot commented May 20, 2026

Copy link
Copy Markdown
Contributor

Codex review: needs real behavior proof before merge.

Workflow note: Future ClawSweeper reviews update this same comment in place.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Summary
The branch adds Discord realtime voice profile bootstrap config/docs/SDK plumbing that injects bounded IDENTITY.md, USER.md, and SOUL.md context by default, and it also changes pi embedded tool-error suppression behavior.

Reproducibility: not applicable. for the requested feature because there is no current-main bug to reproduce. The blocking stale-base regression is source-reproducible from the PR head diff against current main's messages.suppressToolErrors test and implementation.

PR rating
Overall: 🧂 unranked krab
Proof: 🧂 unranked krab
Patch quality: 🧂 unranked krab
Summary: Not quality-ready yet because the current head has a concrete compatibility regression and the real Discord voice behavior remains unproven after the latest head.

Rank-up moves:

  • Rebase or patch the branch to preserve current main's messages.suppressToolErrors behavior and test.
  • Add redacted live Discord realtime voice proof, such as logs, terminal output, transcript, or recording that shows startup with the injected profile context.
  • Get maintainer direction on whether profile bootstrap is opt-out by default or should require explicit bootstrapContextFiles.
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Real behavior proof
Needs real behavior proof before merge: The PR body supplies focused tests, generated checks, type checks, autoreview, and Testbox changed-gate proof, but no live Discord voice transcript/log/recording showing the changed realtime startup path; contributors should add redacted runtime proof and update the PR body to trigger a fresh review, or ask a maintainer to comment @clawsweeper re-review.

Risk before merge

  • Merging the current head would undo current main's fix for messages.suppressToolErrors, so configured chat surfaces could receive mutating tool-error warnings again.
  • Existing Discord realtime users with voice.realtime.bootstrapContextFiles unset would start sending bounded profile file contents to the configured realtime provider unless maintainers deliberately accept the new opt-out default.
  • The PR does not include a fresh live Discord voice run after the latest force-push, so the final audio/provider path is still unproven outside focused tests and changed-gate checks.
  • The new openclaw/plugin-sdk/realtime-bootstrap-context subpath becomes a public plugin SDK contract and needs maintainer acceptance as a stable seam.

Maintainer options:

  1. Restore current-main suppression first (recommended)
    Rebase or patch the branch so messages.suppressToolErrors still suppresses mutating tool-error warnings and the current-main regression test/changelog line are preserved.
  2. Accept the profile-data default deliberately
    Maintainers can merge the opt-out default only if they explicitly accept that existing Discord realtime configs may now send bounded profile files to the realtime provider.
  3. Make bootstrap opt-in or pause for proof
    If the default data-sharing change is not wanted, make bootstrapContextFiles opt-in and require a redacted live Discord voice run before merge.

Next step before merge
Human follow-up is needed because the PR combines a stale-base compatibility regression, a default data-sharing decision, and missing live voice proof rather than a single safe repair-lane task.

Security
Needs attention: The code is bounded to three profile filenames, but the default changes what local profile data is sent to the realtime provider.

Review findings

  • [P1] Preserve suppressToolErrors for mutating failures — src/agents/pi-embedded-runner/run/payloads.ts:176-177
Review details

Best possible solution:

Rebase onto current main and preserve the suppression fix, then land the bootstrap feature only after maintainers choose the default data-sharing policy and accept the SDK subpath.

Do we have a high-confidence way to reproduce the issue?

Not applicable for the requested feature because there is no current-main bug to reproduce. The blocking stale-base regression is source-reproducible from the PR head diff against current main's messages.suppressToolErrors test and implementation.

Is this the best way to solve the issue?

No, not as currently headed: the bootstrap helper is a plausible narrow implementation, but the branch must not revert the current-main suppression fix. Maintainers also need to choose whether profile bootstrap should be opt-out or explicit opt-in.

Label changes:

  • add rating: 🧂 unranked krab: Current PR rating is 🧂 unranked krab because proof is 🧂 unranked krab, patch quality is 🧂 unranked krab, and Not quality-ready yet because the current head has a concrete compatibility regression and the real Discord voice behavior remains unproven after the latest head.
  • add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body supplies focused tests, generated checks, type checks, autoreview, and Testbox changed-gate proof, but no live Discord voice transcript/log/recording showing the changed realtime startup path; contributors should add redacted runtime proof and update the PR body to trigger a fresh review, or ask a maintainer to comment @clawsweeper re-review.
  • remove rating: 🦐 gold shrimp: Current PR rating is rating: 🧂 unranked krab, so this older rating label is no longer current.
  • remove status: ⏳ waiting on author: Current PR status label is status: 📣 needs proof.

Label justifications:

  • P2: This is a bounded Discord/agent feature PR with concrete merge blockers but not an emergency runtime outage.
  • merge-risk: 🚨 compatibility: The current head would regress an existing messages.suppressToolErrors setting and also changes default Discord realtime prompt content for existing configs.
  • merge-risk: 🚨 security-boundary: The PR changes the default boundary for local profile file contents by sending them to the configured realtime provider.
  • rating: 🧂 unranked krab: Current PR rating is 🧂 unranked krab because proof is 🧂 unranked krab, patch quality is 🧂 unranked krab, and Not quality-ready yet because the current head has a concrete compatibility regression and the real Discord voice behavior remains unproven after the latest head.
  • status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body supplies focused tests, generated checks, type checks, autoreview, and Testbox changed-gate proof, but no live Discord voice transcript/log/recording showing the changed realtime startup path; contributors should add redacted runtime proof and update the PR body to trigger a fresh review, or ask a maintainer to comment @clawsweeper re-review.

Full review comments:

  • [P1] Preserve suppressToolErrors for mutating failures — src/agents/pi-embedded-runner/run/payloads.ts:176-177
    This branch moves messages.suppressToolErrors below the mutating-tool branch, so a configured write failure returns a warning before the setting is honored. Current main intentionally fixed this in fix: honour tool error suppression for mutating tools #81561; rebase or move the suppression check back ahead of mutating-tool handling so existing users do not lose that setting.
    Confidence: 0.94

Overall correctness: patch is incorrect
Overall confidence: 0.9

Security concerns:

  • [medium] Accept default profile data sharing — extensions/discord/src/voice/ingress.ts:173
    When bootstrapContextFiles is unset, the new path defaults to IDENTITY.md, USER.md, and SOUL.md and appends that content to realtime provider instructions. That may be intended, but it changes the provider data boundary for existing Discord realtime users and should be an explicit maintainer decision.
    Confidence: 0.87

Acceptance criteria:

  • node scripts/run-vitest.mjs src/agents/pi-embedded-runner/run/payloads.errors.test.ts src/agents/realtime-bootstrap-context.test.ts extensions/discord/src/config-schema.test.ts extensions/discord/src/voice/manager.e2e.test.ts
  • pnpm check:test-types
  • node --import tsx scripts/generate-bundled-channel-config-metadata.ts --check
  • node --max-old-space-size=8192 --import tsx scripts/generate-plugin-sdk-api-baseline.ts --check

What I checked:

  • Current-main suppression contract: Current main checks messages.suppressToolErrors before mutating-tool warning handling, and the regression test expects a mutating write error to produce no payload when the setting is enabled. (src/agents/pi-embedded-runner/run/payloads.ts:165, 9c00268914b9)
  • Stale branch regression: The PR head moves the suppressToolErrors check after mutating-tool handling and rewrites the test to expect a warning, so merging this head would undo the current-main fix. (src/agents/pi-embedded-runner/run/payloads.ts:176, 23bf11c82b8b)
  • Regression provenance: The reverted behavior was introduced on current main by fix: honour tool error suppression for mutating tools, which touched payloads.ts, payloads.errors.test.ts, and the changelog. (src/agents/pi-embedded-runner/run/payloads.ts:165, 9c00268914b9)
  • Discord bootstrap behavior: Unset voice.realtime.bootstrapContextFiles is passed through as undefined, so the new helper defaults to the profile file list and appends the resulting text to realtime instructions. (extensions/discord/src/voice/ingress.ts:172, 23bf11c82b8b)
  • Proof gap from PR body: The supplied proof lists focused tests, generated-baseline checks, type checks, autoreview, and Testbox changed-gate proof, but explicitly says a fresh live Discord voice conversation recording was not tested. (23bf11c82b8b)
  • Feature history: Recent current-main Discord voice work in the same manager/config/docs surface was merged as feat(discord): follow configured users in voice; blame also ties the realtime instruction builder and bootstrap helpers to the existing agent/Discord runtime history. (extensions/discord/src/voice/manager.ts:652, befb0f3d39bd)

Likely related people:

  • fuller-stack-dev: Current main's recent Discord voice follow-user work touched the same Discord voice manager, config, and docs surfaces that this PR extends. (role: recent Discord voice contributor; confidence: medium; commits: befb0f3d39bd; files: extensions/discord/src/voice/manager.ts, docs/channels/discord.md, src/config/types.discord.ts)
  • obviyus: Blame in this shallow checkout attributes the existing realtime instruction builder, bootstrap-file resolver, and bootstrap context formatter to the grafted base commit authored by Ayaan Zaidi. (role: original adjacent area contributor; confidence: low; commits: efe7393064c4; files: extensions/discord/src/voice/realtime.ts, src/agents/bootstrap-files.ts, src/agents/pi-embedded-helpers/bootstrap.ts)
  • moeedahmed: Current main commit 9c00268914b9 added the mutating-tool messages.suppressToolErrors behavior that this PR head would revert. (role: introduced current suppression behavior; confidence: high; commits: 9c00268914b9; files: src/agents/pi-embedded-runner/run/payloads.ts, src/agents/pi-embedded-runner/run/payloads.errors.test.ts, CHANGELOG.md)
  • jalehman: The current-main suppression fix records @jalehman as reviewer/co-author in the merge metadata, making them a useful routing candidate for the stale-base regression. (role: reviewer and adjacent owner; confidence: medium; commits: 9c00268914b9; files: src/agents/pi-embedded-runner/run/payloads.ts, src/agents/pi-embedded-runner/run/payloads.errors.test.ts)

Codex review notes: model gpt-5.5, reasoning high; reviewed against 9c00268914b9.

@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. P2 Normal backlog priority with limited blast radius. labels May 20, 2026
@clawsweeper

clawsweeper Bot commented May 20, 2026

Copy link
Copy Markdown
Contributor

ClawSweeper PR egg

🎁 Pass real behavior proof to wake the egg and unlock a hatchable treat.

Where did the egg go?
  • The egg game starts only after the PR passes the real-behavior proof check.
  • Before that, no creature or rarity is rolled. The treat waits for real proof.
  • This is still just collectible flavor: proof affects review readiness, not creature quality.

@steipete steipete self-assigned this May 20, 2026
@openclaw-barnacle openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 20, 2026
@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. and removed rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels May 20, 2026
@steipete steipete force-pushed the codex/discord-realtime-bootstrap-context branch from ae2ab46 to 23bf11c Compare May 20, 2026 12:56
@openclaw-barnacle openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 20, 2026
fuller-stack-dev and others added 4 commits May 20, 2026 14:02
# Conflicts:
#	docs/.generated/config-baseline.sha256
#	docs/.generated/plugin-sdk-api-baseline.sha256
#	src/config/bundled-channel-config-metadata.generated.ts
@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. and removed rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. labels May 20, 2026
@steipete steipete force-pushed the codex/discord-realtime-bootstrap-context branch from 23bf11c to 7de4ec5 Compare May 20, 2026 13:08
@steipete steipete merged commit 48a14e4 into openclaw:main May 20, 2026
89 of 104 checks passed
@steipete

Copy link
Copy Markdown
Contributor

Landed in 48a14e41e233657639a777554ce4671a46cd2ba3.

Thanks @fuller-stack-dev. I rebased the branch onto current main, removed the public max-chars setting, defaulted realtime bootstrap context to IDENTITY.md, USER.md, and SOUL.md, updated the docs/config/SDK metadata, and kept AGENTS.md out of the realtime fast path.

Proof before merge:

  • node scripts/run-vitest.mjs src/agents/realtime-bootstrap-context.test.ts extensions/discord/src/config-schema.test.ts extensions/discord/src/voice/manager.e2e.test.ts src/plugins/contracts/plugin-sdk-subpaths.test.ts src/plugins/contracts/plugin-sdk-package-contract-guardrails.test.ts src/plugins/contracts/plugin-sdk-index.bundle.test.ts passed 6 files / 81 tests.
  • pnpm check:test-types passed.
  • Generated metadata checks passed.
  • Final autoreview clean.
  • Blacksmith Testbox tbx_01ks2qt5xmq3xergs55hnvs2j0 passed: https://github.com/openclaw/openclaw/actions/runs/26164409150

eleboucher pushed a commit to eleboucher/homelab that referenced this pull request May 21, 2026
…026.5.20) (#615)

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.5.19` → `2026.5.20` |

---

> ⚠️ **Warning**
>
> Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/567) for more information.

---

### Release Notes

<details>
<summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary>

### [`v2026.5.20`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#2026520)

[Compare Source](openclaw/openclaw@v2026.5.19...v2026.5.20)

##### Changes

- Exec approvals: remove the old `cat SKILL.md && printf ... && <skill-wrapper>` allowlist compatibility path so skill files must be loaded with the read tool and only the real skill executable is auto-allowed.
- Discord: let voice sessions follow configured Discord users into voice channels, with allowed-channel checks, multi-user handoff, bounded reconciliation, and DAVE recovery preservation. ([#&#8203;84264](openclaw/openclaw#84264)) Thanks [@&#8203;fuller-stack-dev](https://github.com/fuller-stack-dev).
- Discord/voice: include bounded `IDENTITY.md`, `USER.md`, and `SOUL.md` profile context in realtime voice session instructions by default, with `voice.realtime.bootstrapContextFiles: []` available to disable it. ([#&#8203;84499](openclaw/openclaw#84499)) Thanks [@&#8203;fuller-stack-dev](https://github.com/fuller-stack-dev).
- Dependencies: bump the bundled Codex harness to `@openai/codex` `0.132.0` and refresh the app-server model-list docs for the new catalog.
- CLI/policy: add the bundled Policy plugin for policy-backed channel conformance checks, doctor lint findings, and opt-in workspace repair. ([#&#8203;80407](openclaw/openclaw#80407)) Thanks [@&#8203;giodl73-repo](https://github.com/giodl73-repo).
- Agents/config: allow `agents.list[].experimental.localModelLean` so lean local-model mode can be enabled for one configured agent instead of globally.
- Providers/xAI: add device-code OAuth login so remote and headless setups can authorize xAI without a localhost browser callback. ([#&#8203;84005](openclaw/openclaw#84005)) Thanks [@&#8203;fuller-stack-dev](https://github.com/fuller-stack-dev).
- Providers/OpenRouter: honor provider-level `params.provider` routing policy for OpenRouter requests, with model and agent params overriding the defaults. Thanks [@&#8203;amknight](https://github.com/amknight).

##### Fixes

- CLI/tasks: include stale-running task maintenance decisions in `openclaw tasks maintenance --json` so retained and reconcile candidates explain backing-session, cron, CLI, and wedged-subagent state. ([#&#8203;84691](openclaw/openclaw#84691)) Thanks [@&#8203;efpiva](https://github.com/efpiva).
- Codex app-server: keep system-prompt reports working when bootstrap hooks provide workspace files with only a path and content, so hook-supplied SOUL/IDENTITY/TOOLS/USER context still reports injected characters correctly. ([#&#8203;84736](openclaw/openclaw#84736)) Thanks [@&#8203;JARVIS-Glasses](https://github.com/JARVIS-Glasses).
- Providers/MiniMax music: stop advertising `durationSeconds` control and remove prompt-injected duration hints, so `music_generate` reports MiniMax duration as an unsupported override instead of suggesting MiniMax can enforce track length. Fixes [#&#8203;84508](openclaw/openclaw#84508). Thanks [@&#8203;neeravmakwana](https://github.com/neeravmakwana).
- Doctor: warn when sandbox tool policy hides configured MCP server tools before provider requests. ([#&#8203;84699](openclaw/openclaw#84699)) Thanks [@&#8203;nxmxbbd](https://github.com/nxmxbbd).
- WhatsApp: update Baileys to `7.0.0-rc12`.
- Build: suppress per-locale `rolldown-plugin-dts:fake-js` CommonJS dts warnings emitted while bundling the intentionally-inlined `zod/v4/locales/*.d.cts` files, so `pnpm build` output stays readable after the 0.25.1 plugin bump. Thanks [@&#8203;romneyda](https://github.com/romneyda).
- CLI/nodes: route lazy plugin-registration logs to stderr for JSON-mode `openclaw nodes` commands so stdout stays parseable. ([#&#8203;84684](openclaw/openclaw#84684)) Thanks [@&#8203;TurboTheTurtle](https://github.com/TurboTheTurtle).
- Approvals: route manual `/approve` decisions through the trusted approval runtime so active exec and plugin approvals no longer look unknown or expired.
- Mac app: update the About settings copyright year to 2026. ([#&#8203;84385](openclaw/openclaw#84385)) Thanks [@&#8203;pejmanjohn](https://github.com/pejmanjohn).
- Dependencies: update `@openclaw/fs-safe` to `0.2.7` so OpenClaw's default Python-helper-off policy keeps best-effort Node write fallbacks for private stores, secret writes, run logs, and media attachments on Linux/macOS.
- Infra/secrets: restore the fail-closed contract for `tryReadSecretFileSync` so credential loaders that pass `rejectSymlink: true` (Telegram, LINE, Zalo, IRC, Nextcloud Talk tokens) refuse symlinked credential files instead of silently accepting them, and the infra-state CI shard's secret-file symlink test passes again. Thanks [@&#8203;romneyda](https://github.com/romneyda).
- Browser: honor the configured image sanitization limit for screenshots and labeled snapshots so browser-captured images follow the same resize policy as other image results. ([#&#8203;84595](openclaw/openclaw#84595))
- Doctor: remove unrecognized `models.providers.*.models[*].compat.thinkingFormat` values during `doctor --fix` so stale provider model config can validate after upgrade. Fixes [#&#8203;77803](openclaw/openclaw#77803).
- Doctor: warn when `openclaw.json` stores plaintext secret-bearing config fields, including model provider API keys and sensitive provider headers. ([#&#8203;84718](openclaw/openclaw#84718)) Thanks [@&#8203;lukaIvanic](https://github.com/lukaIvanic).
- Status: show the configured default, session-selected model, reason, clear hint, and docs link when a session remains pinned to a model that differs from `agents.defaults.model.primary`.
- WebChat: clear stale typing indicators when session change events mark the active chat run complete.
- Mac app: keep local packaging signed with a stable app identity for permission testing and fix Control UI production builds under current Vite/Highlight.js exports.
- macOS app: update the embedded Peekaboo bridge to 3.2.1 so OpenClaw-hosted UI automation works with current Peekaboo CLI capture flows.
- Cron: deliver preferred final assistant output for successful scheduled runs when trailing plain tool warnings remain in diagnostics instead of marking the run failed.
- fix(mattermost): fail closed on missing channel type \[AI]. ([#&#8203;84091](openclaw/openclaw#84091)) Thanks [@&#8203;pgondhi987](https://github.com/pgondhi987).
- Recheck rebuilt system.run argv \[AI]. ([#&#8203;84090](openclaw/openclaw#84090)) Thanks [@&#8203;pgondhi987](https://github.com/pgondhi987).
- CLI: keep the private QA subcommand out of exported command descriptors unless `OPENCLAW_ENABLE_PRIVATE_QA_CLI=1`, so root help and subcommand markers match runtime registration. ([#&#8203;84519](openclaw/openclaw#84519))
- CLI/cron: bound `openclaw cron show` job lookup pagination so non-advancing or unbounded `cron.list` responses fail instead of hanging the command. Fixes [#&#8203;83856](openclaw/openclaw#83856). ([#&#8203;83989](openclaw/openclaw#83989))
- Agents/messages: stop message-tool-only turns after a successful source-channel `message` send while keeping transcript mirrors under the session write lock. ([#&#8203;84289](openclaw/openclaw#84289))
- Agents: filter silent heartbeat response-tool transcript artifacts out of embedded context snapshots so later user turns are not polluted by heartbeat no-op messages. ([#&#8203;83477](openclaw/openclaw#83477)) Thanks [@&#8203;fuller-stack-dev](https://github.com/fuller-stack-dev).
- Agents/OpenAI: log repeated strict tool-schema downgrade diagnostics once per provider/model/tool signature, reducing duplicate debug noise while preserving `strict=false` fallback behavior. Fixes [#&#8203;82930](openclaw/openclaw#82930). ([#&#8203;82933](openclaw/openclaw#82933)) Thanks [@&#8203;galiniliev](https://github.com/galiniliev).
- Agents/code mode: spell out the `exec` tool's JavaScript/TypeScript, no Node module, and catalog-bridge constraints in model-visible schema text so agents can use enabled tools without trial-and-error. ([#&#8203;84269](openclaw/openclaw#84269)) Thanks [@&#8203;Kaspre](https://github.com/Kaspre).
- Codex: give `image_generate` dynamic-tool calls a 120s default watchdog when no per-call or configured image timeout is set, so image generation no longer falls back to the generic 30s bridge timeout. ([#&#8203;84254](openclaw/openclaw#84254)) Thanks [@&#8203;moritzmmayerhofer](https://github.com/moritzmmayerhofer).
- Codex: avoid duplicate dynamic tool terminal diagnostics while large diagnostic backlogs drain without blocking tool responses. ([#&#8203;82937](openclaw/openclaw#82937)) Thanks [@&#8203;galiniliev](https://github.com/galiniliev).
- CLI/message: include a stable top-level `messageId` in `openclaw message --json` output when channel sends return one. ([#&#8203;84191](openclaw/openclaw#84191)) Thanks [@&#8203;100menotu001](https://github.com/100menotu001).
- Cron: preserve legacy top-level array `jobs.json` stores when loading or adding scheduled jobs so old cron jobs are no longer treated as an empty store during upgrade. Fixes [#&#8203;60799](openclaw/openclaw#60799). ([#&#8203;84433](openclaw/openclaw#84433)) Thanks [@&#8203;IWhatsskill](https://github.com/IWhatsskill).
- Gateway/agents: use an agent's `identity.name` in Gateway agent summaries when `agents.list[].name` is unset, so configured agent labels remain visible in clients. ([#&#8203;84355](openclaw/openclaw#84355); refs [#&#8203;57835](openclaw/openclaw#57835)) Thanks [@&#8203;luoyanglang](https://github.com/luoyanglang).
- Channels/replies: keep normal `/verbose` failed-tool progress compact in message-tool replies and prevent late text-only tool output from appearing after the final answer. ([#&#8203;84303](openclaw/openclaw#84303)) Thanks [@&#8203;VACInc](https://github.com/VACInc).
- Plugins/hooks: apply a default 30-second timeout to `before_compaction` and `after_compaction` hooks so a hung plugin handler no longer blocks compaction completion. ([#&#8203;84153](openclaw/openclaw#84153))
- Discord: preserve disabled presentation buttons when adapting and rendering Discord message controls. ([#&#8203;84188](openclaw/openclaw#84188)) Thanks [@&#8203;100menotu001](https://github.com/100menotu001).
- Twitch: add a test-only client-manager registry reset helper so non-isolated Twitch tests can clear cached managers between cases. Fixes [#&#8203;83887](openclaw/openclaw#83887). ([#&#8203;84244](openclaw/openclaw#84244)) Thanks [@&#8203;hclsys](https://github.com/hclsys).
- Cron: run main-session scheduled work on a cron-owned wake lane while preserving reply delivery context, so background cron turns no longer block human main-session chat. Fixes [#&#8203;82766](openclaw/openclaw#82766). ([#&#8203;82767](openclaw/openclaw#82767)) Thanks [@&#8203;galiniliev](https://github.com/galiniliev).
- Cron: use structured embedded-run denial metadata for isolated scheduled tasks so blocked exec requests fail the job without treating ordinary assistant prose as a denial. ([#&#8203;84067](openclaw/openclaw#84067)) Thanks [@&#8203;abnershang](https://github.com/abnershang).
- Cron: keep recovered tool warnings diagnostic for successful scheduled runs so final cron output is delivered instead of being replaced by a post-processing warning. ([#&#8203;84045](openclaw/openclaw#84045)) Thanks [@&#8203;abnershang](https://github.com/abnershang).
- Plugins/perf: thread explicit plugin discovery results through `loadBundledCapabilityRuntimeRegistry`, `resolveBundledPluginSources`, and `listChannelCatalogEntries` so callers that already hold a discovery result skip redundant filesystem walks. Thanks [@&#8203;SebTardif](https://github.com/SebTardif).
- harden update restart script creation \[AI]. ([#&#8203;84088](openclaw/openclaw#84088)) Thanks [@&#8203;pgondhi987](https://github.com/pgondhi987).
- Docker: keep the bundled Codex plugin in official release image keep lists so the default OpenAI agent harness remains available after Docker pruning. Fixes [#&#8203;83613](openclaw/openclaw#83613). ([#&#8203;83626](openclaw/openclaw#83626)) Thanks [@&#8203;YuanHanzhong](https://github.com/YuanHanzhong).
- CLI/channels: preserve the first line of `openclaw channels logs` output when the rolling tail window starts exactly on a line boundary, mirroring the already-fixed `readLogSlice` behavior in `src/logging/log-tail.ts`.
- Control UI: treat terminal session status as authoritative over stale active-run flags so completed terminal runs stop showing abort/live UI. ([#&#8203;84057](openclaw/openclaw#84057))
- CLI: preserve embedded equals signs in inline root option values instead of truncating after the second separator. ([#&#8203;83995](openclaw/openclaw#83995)) Thanks [@&#8203;ThiagoCAltoe](https://github.com/ThiagoCAltoe).
- Matrix/config: accept `messages.queue.byChannel.matrix` queue overrides and keep queue provider schema/type keys aligned for Matrix, Google Chat, and Mattermost. Thanks [@&#8203;bdjben](https://github.com/bdjben).
- CLI: format `openclaw acp client` failures through the shared error formatter so object-shaped errors stay readable instead of printing `[object Object]`. Fixes [#&#8203;83904](openclaw/openclaw#83904). ([#&#8203;84080](openclaw/openclaw#84080))
- Providers/Ollama: default unknown-capabilities models to tool-capable so discovered native Ollama models can use tools when `/api/show` omits capabilities. ([#&#8203;84055](openclaw/openclaw#84055)) Thanks [@&#8203;dutifulbob](https://github.com/dutifulbob).
- Installer/Windows: launch `install.ps1` onboarding as an attached child process so fresh native Windows installs do not freeze visibly at `Starting setup...` or corrupt the wizard's terminal rendering.
- CLI/update: keep restart health checks working across one-version CLI/Gateway protocol skew and use the managed Gateway service Node for all follow-up commands even when the package root is unchanged, so `openclaw update` no longer silently switches the gateway to a different Node binary when multiple Node installations are present. Thanks [@&#8203;amknight](https://github.com/amknight).
- CLI/gateway: include the running Gateway version in `gateway status` JSON output, preserving existing server metadata while falling back to status RPC data for read probes. Fixes [#&#8203;56222](openclaw/openclaw#56222). Thanks [@&#8203;galiniliev](https://github.com/galiniliev).
- Memory/search: close local embedding providers when active-memory searches time out so pending local model loads and embedding contexts are aborted and released. ([#&#8203;83858](openclaw/openclaw#83858)) Thanks [@&#8203;brokemac79](https://github.com/brokemac79).
- CLI/nodes: request pending node surface approval scopes before `openclaw nodes approve` so exec-capable node approval can use admin-scoped Gateway credentials instead of failing with `missing scope: operator.admin`. ([#&#8203;84392](openclaw/openclaw#84392)) Thanks [@&#8203;joshavant](https://github.com/joshavant).
- Gateway: reject slow node event sends before outbound buffers grow unbounded and log the rejected payload diagnostic. ([#&#8203;84387](openclaw/openclaw#84387)) Thanks [@&#8203;samzong](https://github.com/samzong).
- Agents: include bounded trajectory queued-writer diagnostics in `pi-trajectory-flush` timeout warnings so flush stalls show pending writes, queued bytes, and append state. Fixes [#&#8203;82961](openclaw/openclaw#82961). ([#&#8203;82962](openclaw/openclaw#82962)) Thanks [@&#8203;galiniliev](https://github.com/galiniliev).
- Agents/subagents: recover stale completion announces by retrying unsupported transcript-wait wakes without transcript waiting and forcing a message-tool handoff when the requester run is already stale. Fixes [#&#8203;83699](openclaw/openclaw#83699). ([#&#8203;83700](openclaw/openclaw#83700)) Thanks [@&#8203;galiniliev](https://github.com/galiniliev).
- Agents/subagents: constrain wildcard subagent target allowlists to configured agents while preserving explicitly listed compatibility targets. Fixes [#&#8203;84040](openclaw/openclaw#84040). ([#&#8203;84357](openclaw/openclaw#84357)) Thanks [@&#8203;joshavant](https://github.com/joshavant).
- Providers/Anthropic: route Anthropic model refs selected with Claude CLI auth through the Claude CLI runtime so shorthand refs such as `anthropic/opus-4.7` no longer fall back to embedded Anthropic billing. Fixes [#&#8203;84222](openclaw/openclaw#84222). ([#&#8203;84374](openclaw/openclaw#84374)) Thanks [@&#8203;joshavant](https://github.com/joshavant).
- Agents: honor explicit `models.providers.<id>.timeoutSeconds` values above the default idle watchdog for cloud and self-hosted providers, so long first-token waits no longer fall back at \~120s when the provider timeout is higher. ([#&#8203;83979](openclaw/openclaw#83979)) Thanks [@&#8203;yujiawei](https://github.com/yujiawei).
- Agents/Codex: keep encrypted Responses reasoning replay provenance-bound so stale mirrored Codex transcripts drop invalid encrypted content before request assembly while preserving matching same-session replay. Fixes [#&#8203;83836](openclaw/openclaw#83836). ([#&#8203;84367](openclaw/openclaw#84367)) Thanks [@&#8203;joshavant](https://github.com/joshavant).
- Agents/subagents: skip stale embedded-run wake probes for dormant completion requesters, so late subagent completions go straight to requester-agent/direct handoff instead of producing `reason=no_active_run` queue noise. ([#&#8203;82964](openclaw/openclaw#82964)) Thanks [@&#8203;galiniliev](https://github.com/galiniliev).
- CLI: retry config snapshot reads after a transient failure so one rejected read no longer poisons later commands in the same process. ([#&#8203;83931](openclaw/openclaw#83931)) Thanks [@&#8203;honor2030](https://github.com/honor2030).
- Media: decode URL path basenames before using them as remote media fallback filenames, so files like `My%20Report.pdf` are surfaced as `My Report.pdf`. Fixes [#&#8203;84050](openclaw/openclaw#84050). ([#&#8203;84052](openclaw/openclaw#84052)) Thanks [@&#8203;jbetala7](https://github.com/jbetala7).
- WhatsApp: clarify inbound group diagnostics so observed but unregistered groups point to `channels.whatsapp.groups` without changing routing or sender authorization. ([#&#8203;83846](openclaw/openclaw#83846)) Thanks [@&#8203;neeravmakwana](https://github.com/neeravmakwana).
- WhatsApp: drain pending outbound deliveries on a 30s periodic timer in addition to the reconnect handler, so messages enqueued while the provider is already connected no longer wait for the next reconnect to send. ([#&#8203;79083](openclaw/openclaw#79083)) Thanks [@&#8203;Oviemudiaga](https://github.com/Oviemudiaga).
- CLI/TUI: include gateway plugin slash commands in TUI autocomplete, so connected sessions can suggest plugin-owned commands exposed by the running Gateway. ([#&#8203;83640](openclaw/openclaw#83640)) Thanks [@&#8203;se7en-agent](https://github.com/se7en-agent).
- Gateway/mobile: restore QR setup-code handoff of bounded operator tokens for iOS and Android onboarding while keeping admin and pairing scopes out of bootstrap. ([#&#8203;83684](openclaw/openclaw#83684)) Thanks [@&#8203;ngutman](https://github.com/ngutman).
- iOS: repair Release archive compilation for the TestFlight build. ([#&#8203;84255](openclaw/openclaw#84255)) Thanks [@&#8203;ngutman](https://github.com/ngutman).
- Agents/compaction: bound plugin-owned CLI transcript compaction with the host safety timeout so a hung context engine can no longer stall post-turn cleanup. ([#&#8203;84083](openclaw/openclaw#84083)) Thanks [@&#8203;100yenadmin](https://github.com/100yenadmin).
- Control UI/usage: truncate long context skill, tool, and file names in the usage panel while keeping the full name available on hover. ([#&#8203;42197](openclaw/openclaw#42197)) Thanks [@&#8203;Rain120](https://github.com/Rain120).
- Codex: respect explicit `models auth order set` and `config.auth.order` precedence over stale `lastGood` in `/codex account`, and show `no working credential` when every explicit-order profile is ineligible instead of marking a lower-ranked profile as active. Fixes [#&#8203;84386](openclaw/openclaw#84386). ([#&#8203;84412](openclaw/openclaw#84412)) Thanks [@&#8203;openperf](https://github.com/openperf).
- Agents: honor `messages.suppressToolErrors` for mutating tool failures so configured chat surfaces do not receive separate warning payloads. ([#&#8203;81561](openclaw/openclaw#81561)) Thanks [@&#8203;moeedahmed](https://github.com/moeedahmed).
- Agents/fallback: surface billing guidance for mixed rate-limit plus billing fallback exhaustion instead of generic failure copy. Fixes [#&#8203;79396](openclaw/openclaw#79396). ([#&#8203;79489](openclaw/openclaw#79489)) Thanks [@&#8203;aayushprsingh](https://github.com/aayushprsingh).

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDEuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEwMS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9jb250YWluZXIiLCJ0eXBlL3BhdGNoIl19-->

Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/615
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

agents Agent runtime and tooling channel: discord Channel integration: discord dependencies-changed PR changes dependency-related files docs Improvements or additions to documentation merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. P2 Normal backlog priority with limited blast radius. proof: supplied External PR includes structured after-fix real behavior proof. rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. scripts Repository scripts size: M status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants