Skip to content

fix(imessage): harden outbound send transport#91783

Merged
omarshahine merged 1 commit into
mainfrom
fix/imessage-outbound-transport-fallback
Jun 10, 2026
Merged

fix(imessage): harden outbound send transport#91783
omarshahine merged 1 commit into
mainfrom
fix/imessage-outbound-transport-fallback

Conversation

@omarshahine

@omarshahine omarshahine commented Jun 9, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Add channels.imessage.sendTransport / per-account overrides and pass the selected transport to imsg rpc send (auto default, bridge, or applescript).
  • Stop monitor final replies from reusing the long-lived watch RPC client; reply delivery now opens its own send client, so a wedged watch subscription cannot also wedge outbound sends.
  • Keep RPC send timeout recovery ambiguity-safe: approval prompts with unique IDs can recover a sent GUID from chat.db, but generic text timeouts do not resend and do not claim success from an older identical row.
  • Add iMessage troubleshooting docs for the stale-send/receive split seen when Messages sends outbound replies but inbound rows stop arriving.

Fixes #84329.
Refs #90850.

Verification

  • pnpm docs:list
  • pnpm config:channels:gen
  • pnpm config:channels:check
  • node scripts/run-vitest.mjs extensions/imessage/src/send.test.ts extensions/imessage/src/monitor/deliver.test.ts extensions/imessage/src/accounts.test.ts extensions/imessage/src/config-schema.test.ts (72 tests)
  • pnpm format:check -- extensions/imessage/src/send.ts extensions/imessage/src/send.test.ts extensions/imessage/src/monitor/deliver.ts extensions/imessage/src/monitor/deliver.test.ts extensions/imessage/src/monitor/monitor-provider.ts extensions/imessage/src/accounts.ts extensions/imessage/src/accounts.test.ts extensions/imessage/src/config-schema.test.ts extensions/imessage/src/config-ui-hints.ts src/config/types.imessage.ts src/config/zod-schema.providers-core.ts src/config/bundled-channel-config-metadata.generated.ts docs/channels/imessage.md docs/gateway/config-channels.md
  • pnpm docs:check-mdx
  • pnpm lint:extensions -- extensions/imessage/src/send.ts extensions/imessage/src/send.test.ts extensions/imessage/src/monitor/deliver.ts extensions/imessage/src/monitor/deliver.test.ts extensions/imessage/src/monitor/monitor-provider.ts extensions/imessage/src/accounts.ts extensions/imessage/src/accounts.test.ts extensions/imessage/src/config-schema.test.ts extensions/imessage/src/config-ui-hints.ts
  • pnpm tsgo:extensions
  • pnpm tsgo:core
  • git diff --check
  • .agents/skills/autoreview/scripts/autoreview --mode local --prompt "Review the revised iMessage outbound reliability/config patch. The timeout path now only recovers approval prompt GUIDs and does not resend or generically match sent rows. Focus on duplicate-send risk, false success claims after timeout, caller-owned RPC client ownership, monitor reply client reuse, and config/docs/schema consistency." (clean)

Post-rebase focused proof on head 39ea25767bbcc113520a4a8783863549b512080c:

  • pnpm config:channels:check
  • node scripts/run-vitest.mjs extensions/imessage/src/send.test.ts extensions/imessage/src/monitor/deliver.test.ts extensions/imessage/src/accounts.test.ts extensions/imessage/src/config-schema.test.ts (72 tests)

Real behavior proof

Behavior addressed: outbound iMessage send reliability and transport selection when the imsg rpc child/watch client is long-lived.
Real environment tested: lobster macOS host, OpenClaw PR head 39ea25767bbcc113520a4a8783863549b512080c, imsg 0.11.0, Node v26.0.0.
Exact steps or command run after this patch: checked out origin/fix/imessage-outbound-transport-fallback on lobster, selected the local iMessage account handle from imsg account --local --json without printing it, then invoked sendMessageIMessage through the PR source with config channels.imessage.sendTransport = "applescript" and the same per-account override. The proof send was self-addressed and redacted.
Evidence after fix:

{
  "host": "lobster",
  "proofId": "openclaw-lobster-live-proof-c74895c2-b629-4bb0-abcb-e6521069b3d8",
  "transport": "applescript",
  "targetKind": "email",
  "elapsedMs": 1087,
  "messageIdPresent": true,
  "guidPresent": true,
  "sentTextMatches": true,
  "receiptParts": 1,
  "receiptReplyToId": null
}

Observed result after fix: the configured transport path completed a live Messages send and returned a receipt with message id and GUID present; local focused tests also prove the transport value is forwarded to RPC requests, caller-owned clients are not stopped, monitor reply sends no longer receive the watch RPC client, and generic RPC send timeouts neither resend nor recover an older identical row.
What was not tested: a live private bridge/IMCore send path on lobster, and a live reproduction of an already-wedged long-lived watch RPC client.

@openclaw-barnacle openclaw-barnacle Bot added docs Improvements or additions to documentation channel: imessage Channel integration: imessage gateway Gateway runtime size: M maintainer Maintainer-authored PR labels Jun 9, 2026
@clawsweeper

clawsweeper Bot commented Jun 9, 2026

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed June 9, 2026, 8:06 PM ET / 00:06 UTC.

Summary
The branch adds iMessage sendTransport config/schema/docs, forwards the selected transport to RPC sends, stops monitor replies from reusing the watch RPC client, and tightens timeout recovery coverage.

PR surface: Source +22, Tests +156, Docs +27, Generated 0. Total +205 across 14 files.

Reproducibility: Partly: source inspection gives a high-confidence path for current main not passing transport and for monitor replies reusing the active watch RPC client. The exact already-wedged watch-client failure was not reproduced locally and remains environment-dependent.

Review metrics: 1 noteworthy metric.

  • Config/default surfaces: 1 added key, root + per-account scope. channels.imessage.sendTransport becomes a user-facing config contract that maintainers should notice before merge.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • [P2] Have a maintainer explicitly accept or reject the new channels.imessage.sendTransport config surface before merge.

Risk before merge

  • [P1] The PR adds channels.imessage.sendTransport as a new user-facing config/default surface, so maintainers should explicitly accept that operator knob instead of relying only on imsg's existing auto behavior.

Maintainer options:

  1. Approve the config knob
    Maintainers can accept channels.imessage.sendTransport as the intended operator escape hatch because it is additive and defaults to imsg's current auto behavior.
  2. Pause for config-surface decision
    If another channel config key is not wanted, pause or close this PR and solve the reliability issue through imsg defaults, docs, or a narrower internal client-ownership change.

Next step before merge

  • [P2] The remaining action is maintainer judgment on the protected config surface, not an automated code repair.

Security
Cleared: The diff changes iMessage runtime, config schema, generated metadata, tests, and docs without adding dependencies, workflows, secret handling, package scripts, or new code-execution surfaces beyond existing imsg transport selection.

Review details

Best possible solution:

Land the transport hardening only after maintainers accept the additive sendTransport config contract; otherwise keep the runtime on imsg's default auto behavior and limit the change to docs or internal send-client ownership.

Do we have a high-confidence way to reproduce the issue?

Partly: source inspection gives a high-confidence path for current main not passing transport and for monitor replies reusing the active watch RPC client. The exact already-wedged watch-client failure was not reproduced locally and remains environment-dependent.

Is this the best way to solve the issue?

Unclear until the config-surface decision is made. Technically, forwarding imsg's existing RPC transport contract and decoupling monitor reply sends is a cleaner owner-boundary fix than adding a one-shot fallback, but the new operator knob needs maintainer approval.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against c0a4a7890df4.

Label changes

Label changes:

  • add merge-risk: 🚨 compatibility: Adding a new iMessage channel config/default surface can affect operator behavior and upgrade expectations even though the default remains auto.
  • add proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes after-fix live macOS output for a configured iMessage send with redacted private details, message id, GUID, text match, and elapsed time.
  • add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
  • add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body includes after-fix live macOS output for a configured iMessage send with redacted private details, message id, GUID, text match, and elapsed time.
  • remove rating: 🧂 unranked krab: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.
  • remove status: 📣 needs proof: Current PR status label is status: 👀 ready for maintainer look.

Label justifications:

  • P2: The PR targets scoped iMessage outbound reliability rather than a core-wide outage or security issue.
  • merge-risk: 🚨 compatibility: Adding a new iMessage channel config/default surface can affect operator behavior and upgrade expectations even though the default remains auto.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body includes after-fix live macOS output for a configured iMessage send with redacted private details, message id, GUID, text match, and elapsed time.
  • proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes after-fix live macOS output for a configured iMessage send with redacted private details, message id, GUID, text match, and elapsed time.
Evidence reviewed

PR surface:

Source +22, Tests +156, Docs +27, Generated 0. Total +205 across 14 files.

View PR surface stats
Area Files Added Removed Net
Source 7 41 19 +22
Tests 4 172 16 +156
Docs 2 27 0 +27
Config 0 0 0 0
Generated 1 13 13 0
Other 0 0 0 0
Total 14 253 48 +205

What I checked:

  • Current main behavior: Current sendMessageIMessage builds RPC send params without a transport field and monitor delivery passes the active RPC client into reply sends, matching the reliability concern this PR targets. (extensions/imessage/src/send.ts:989, c0a4a7890df4)
  • PR implementation: At PR head, sendMessageIMessage defaults sendTransport to auto, includes transport in RPC send params, and closes only owned clients through a guarded helper. (extensions/imessage/src/send.ts:896, 39ea25767bbc)
  • Caller boundary: At PR head, deliverReplies and createIMessageEchoCachingSend no longer accept or forward the watch RPC client, so monitor replies create their own send client through the existing send helper. (extensions/imessage/src/monitor/deliver.ts:19, 39ea25767bbc)
  • Config contract: The PR adds sendTransport to the iMessage schema/type surface and documents it in gateway channel config docs, making this an additive but user-facing config contract. (src/config/zod-schema.providers-core.ts:1399, 39ea25767bbc)
  • Dependency contract: openclaw/imsg RPC send parses transport as auto, bridge, or applescript, defaults omitted transport to auto, and imsg's changelog documents the RPC send transport override in 0.8.2. (041b40686a6d)
  • Regression coverage: PR-head tests cover default/configured transport forwarding, generic timeout non-recovery, owned versus caller-owned client shutdown, monitor sends without watch-client reuse, and schema validation for transport values. (extensions/imessage/src/send.test.ts:124, 39ea25767bbc)

Likely related people:

  • omarshahine: Recent path history shows prior merged iMessage send/config work and review activity on the same reliability surface, including dedicated send timeout and tapback/config changes. (role: recent area contributor and reviewer; confidence: high; commits: 6c35c0d965a0, d7a924862044; files: extensions/imessage/src/send.ts, src/config/types.imessage.ts)
  • colmbrogan: Recent merged work on iMessage outbound echo/send behavior touched the same send and monitor delivery path. (role: recent adjacent contributor; confidence: medium; commits: 7e3100a12022; files: extensions/imessage/src/send.ts, extensions/imessage/src/monitor/deliver.ts)
  • steipete: Recent repository history shows broad config/docs work in the surrounding iMessage config and documentation surfaces. (role: adjacent docs/config contributor; confidence: medium; commits: 6868cde4d45f; files: docs/channels/imessage.md, docs/gateway/config-channels.md, src/config/types.imessage.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@omarshahine omarshahine force-pushed the fix/imessage-outbound-transport-fallback branch from 2a3fa7a to 39ea257 Compare June 9, 2026 23:40
@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. P2 Normal backlog priority with limited blast radius. labels Jun 9, 2026
@omarshahine

Copy link
Copy Markdown
Contributor Author

Added the requested real behavior proof to the PR body.

Lobster proof summary:

  • Host: lobster
  • PR head: 39ea25767bbcc113520a4a8783863549b512080c
  • imsg: 0.11.0
  • Runtime path: sendMessageIMessage through this PR with channels.imessage.sendTransport = "applescript"
  • Result: live self-addressed send completed in 1087 ms with message id and GUID present; text match verified; recipient/account details redacted.

Proof id: openclaw-lobster-live-proof-c74895c2-b629-4bb0-abcb-e6521069b3d8

@clawsweeper re-review

@clawsweeper

clawsweeper Bot commented Jun 9, 2026

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. and removed rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. labels Jun 10, 2026
@omarshahine

Copy link
Copy Markdown
Contributor Author

Land-ready maintainer check before merge.

  • Head: 39ea25767bbcc113520a4a8783863549b512080c
  • State: open, non-draft, mergeable
  • Checks: no non-green checks reported in gh pr checks
  • ClawSweeper: proof sufficient / ready for maintainer review after lobster live send proof
  • Maintainer decision: accepting the new channels.imessage.sendTransport config surface and compatibility-risk tradeoff for this PR

Lobster proof id: openclaw-lobster-live-proof-c74895c2-b629-4bb0-abcb-e6521069b3d8

@omarshahine omarshahine merged commit bfccbc3 into main Jun 10, 2026
220 of 231 checks passed
@omarshahine omarshahine deleted the fix/imessage-outbound-transport-fallback branch June 10, 2026 02:09
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jun 10, 2026
Merged via squash.

Prepared head SHA: 39ea257

Proof:
- Focused tests, docs/config generation, lint/type/doc checks passed before merge.
- ClawSweeper re-review marked proof and patch quality platinum after lobster live send proof.
- Maintainer accepted the `channels.imessage.sendTransport` config surface and compatibility-risk tradeoff.

Lobster proof id: openclaw-lobster-live-proof-c74895c2-b629-4bb0-abcb-e6521069b3d8

Reviewed-by: @omarshahine
eleboucher pushed a commit to eleboucher/homelab that referenced this pull request Jun 12, 2026
…26.6.6) (#1040)

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.6.5` → `2026.6.6` |

---

### Release Notes

<details>
<summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary>

### [`v2026.6.6`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#202666)

[Compare Source](openclaw/openclaw@v2026.6.5...v2026.6.6)

##### Highlights

- Security boundaries are substantially tighter across transcripts, sandbox binds, host environment inheritance, MCP stdio, Codex HTTP access, native search policy, elevated sender checks, deleted-agent ACP bypasses, loopback tools, Discord moderation, and Teams group actions; exec approvals now fail closed on timeout. ([#&#8203;91529](openclaw/openclaw#91529), [#&#8203;91618](openclaw/openclaw#91618), [#&#8203;91615](openclaw/openclaw#91615), [#&#8203;91619](openclaw/openclaw#91619), [#&#8203;91741](openclaw/openclaw#91741), [#&#8203;91745](openclaw/openclaw#91745), [#&#8203;91746](openclaw/openclaw#91746), [#&#8203;91748](openclaw/openclaw#91748), [#&#8203;91749](openclaw/openclaw#91749), [#&#8203;91750](openclaw/openclaw#91750), [#&#8203;91751](openclaw/openclaw#91751), [#&#8203;91752](openclaw/openclaw#91752), [#&#8203;91763](openclaw/openclaw#91763), [#&#8203;89938](openclaw/openclaw#89938)) Thanks [@&#8203;joshavant](https://github.com/joshavant), [@&#8203;pgondhi987](https://github.com/pgondhi987), [@&#8203;mmaps](https://github.com/mmaps), [@&#8203;eleqtrizit](https://github.com/eleqtrizit), [@&#8203;shakkernerd](https://github.com/shakkernerd), and [@&#8203;drobison00](https://github.com/drobison00).
- Telegram delivery is safer and more coherent: account-scoped topics route to the right agent, streamed text survives tool calls, `/compact` works on generic ingress, callback handling uses concrete APIs, draft chunking is shared, durable dispatch dedupe moved into the SDK, and unauthorized DM text stays out of cache and prompt context. ([#&#8203;91189](openclaw/openclaw#91189), [#&#8203;88682](openclaw/openclaw#88682), [#&#8203;89588](openclaw/openclaw#89588), [#&#8203;90212](openclaw/openclaw#90212), [#&#8203;91876](openclaw/openclaw#91876), [#&#8203;91874](openclaw/openclaw#91874), [#&#8203;91904](openclaw/openclaw#91904), [#&#8203;91478](openclaw/openclaw#91478), [#&#8203;91915](openclaw/openclaw#91915)) Thanks [@&#8203;codysai001](https://github.com/codysai001), [@&#8203;alexzhu0](https://github.com/alexzhu0), [@&#8203;joelnishanth](https://github.com/joelnishanth), [@&#8203;snowzlm](https://github.com/snowzlm), [@&#8203;obviyus](https://github.com/obviyus), and [@&#8203;sallyom](https://github.com/sallyom).
- iMessage recovery and delivery now cover always-on inbound restart, durable echo markers, block streaming, idle approval discovery, hardened outbound transport, and actionable inbound startup diagnostics. ([#&#8203;91335](openclaw/openclaw#91335), [#&#8203;91449](openclaw/openclaw#91449), [#&#8203;88969](openclaw/openclaw#88969), [#&#8203;88530](openclaw/openclaw#88530), [#&#8203;91783](openclaw/openclaw#91783), [#&#8203;91785](openclaw/openclaw#91785)) Thanks [@&#8203;omarshahine](https://github.com/omarshahine), [@&#8203;jmissig](https://github.com/jmissig), and [@&#8203;colmbrogan](https://github.com/colmbrogan).
- Browser and MCP connectivity gained existing-session CDP support, discovered WebSocket validation, default-profile `cdpUrl` handling, safer browser-output boundaries, Streamable HTTP loopback transport, corrected OAuth/SSE authorization handling, and broader schema compatibility. ([#&#8203;91422](openclaw/openclaw#91422), [#&#8203;89851](openclaw/openclaw#89851), [#&#8203;91736](openclaw/openclaw#91736), [#&#8203;91747](openclaw/openclaw#91747), [#&#8203;91451](openclaw/openclaw#91451), [#&#8203;80143](openclaw/openclaw#80143)) Thanks [@&#8203;pgondhi987](https://github.com/pgondhi987), [@&#8203;anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia), [@&#8203;lifuyue](https://github.com/lifuyue), [@&#8203;eleqtrizit](https://github.com/eleqtrizit), [@&#8203;LiuwqGit](https://github.com/LiuwqGit), and [@&#8203;HemantSudarshan](https://github.com/HemantSudarshan).
- Control UI startup and first-reply latency are lower through cached model metadata, removal of the startup catalog wait, lazy slash-command loading, and first-event tracing with slow-reply diagnostics. ([#&#8203;91531](openclaw/openclaw#91531), [#&#8203;91538](openclaw/openclaw#91538), [#&#8203;91568](openclaw/openclaw#91568), [#&#8203;91583](openclaw/openclaw#91583), [#&#8203;91598](openclaw/openclaw#91598))
- Provider support expands with OpenRouter OAuth onboarding and Claude Fable 5 adaptive thinking, while Codex sessions keep correct compaction ownership, local models skip guardian review, dynamic tool progress normalizes cleanly, and Gemma 4 reasoning replay is preserved. ([#&#8203;91830](openclaw/openclaw#91830), [#&#8203;91882](openclaw/openclaw#91882), [#&#8203;91590](openclaw/openclaw#91590), [#&#8203;88630](openclaw/openclaw#88630), [#&#8203;88768](openclaw/openclaw#88768), [#&#8203;91696](openclaw/openclaw#91696)) Thanks [@&#8203;Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@&#8203;joshavant](https://github.com/joshavant), [@&#8203;bdjben](https://github.com/bdjben), and [@&#8203;Coder-Wangyankun](https://github.com/Coder-Wangyankun).

##### Changes

- CLI progress: emit Claude CLI commentary progress events and bridge inter-tool commentary into channel progress without exposing internal protocol scaffolding. ([#&#8203;89834](openclaw/openclaw#89834), [#&#8203;90883](openclaw/openclaw#90883)) Thanks [@&#8203;anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia).
- Observability: allow trusted diagnostics channels to capture tool input/output content, add first-assistant-event traces, and warn on slow initial replies. ([#&#8203;91256](openclaw/openclaw#91256), [#&#8203;91568](openclaw/openclaw#91568), [#&#8203;91583](openclaw/openclaw#91583)) Thanks [@&#8203;amknight](https://github.com/amknight).
- Plugins/ClawHub: dogfood reusable package publishing, let dry runs skip publish approval, allow declared installed trusted hooks, report managed plugin version drift, and warn instead of failing on retired Skill Workshop configuration. ([#&#8203;91574](openclaw/openclaw#91574), [#&#8203;91591](openclaw/openclaw#91591), [#&#8203;90004](openclaw/openclaw#90004), [#&#8203;90927](openclaw/openclaw#90927), [#&#8203;90838](openclaw/openclaw#90838)) Thanks [@&#8203;Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@&#8203;brokemac79](https://github.com/brokemac79), and [@&#8203;lonexreb](https://github.com/lonexreb).
- Memory/providers: move the local llama.cpp runtime into its provider plugin, batch embeddings across files, persist the agent model catalog cache, and keep QMD JSON search one-shot while filtering stale REM recall previews. ([#&#8203;91324](openclaw/openclaw#91324), [#&#8203;89138](openclaw/openclaw#89138), [#&#8203;90457](openclaw/openclaw#90457), [#&#8203;91837](openclaw/openclaw#91837), [#&#8203;91851](openclaw/openclaw#91851)) Thanks [@&#8203;osolmaz](https://github.com/osolmaz), [@&#8203;mushuiyu886](https://github.com/mushuiyu886), [@&#8203;ai-hpc](https://github.com/ai-hpc), and [@&#8203;TurboTheTurtle](https://github.com/TurboTheTurtle).
- Channels/mobile: add the QQBot group mention toggle, improve iPad and iPhone control surfaces, and expose the active connection host in the TUI footer. ([#&#8203;91423](openclaw/openclaw#91423), [#&#8203;91557](openclaw/openclaw#91557), [#&#8203;89909](openclaw/openclaw#89909)) Thanks [@&#8203;cxyhhhhh](https://github.com/cxyhhhhh), [@&#8203;Solvely-Colin](https://github.com/Solvely-Colin), and [@&#8203;baskduf](https://github.com/baskduf).
- Performance: prewarm TUI runtime plugins, deduplicate plugin auto-enable fanout, trim dense text-delta snapshots, and reuse prepared startup model metadata. ([#&#8203;90782](openclaw/openclaw#90782), [#&#8203;89978](openclaw/openclaw#89978), [#&#8203;91580](openclaw/openclaw#91580), [#&#8203;91531](openclaw/openclaw#91531)) Thanks [@&#8203;RomneyDa](https://github.com/RomneyDa) and [@&#8203;ai-hpc](https://github.com/ai-hpc).

##### Fixes

- Agent/session recovery: drop stale approval follow-ups after session rebind, remove drained reply-queue items by identity, recover stale main and visible replies, preserve Codex context-engine compaction ownership, lower the default compaction timeout to 180 seconds while respecting explicit configuration, and keep provider-failure terminal lifecycle state correct. ([#&#8203;85679](openclaw/openclaw#85679), [#&#8203;91450](openclaw/openclaw#91450), [#&#8203;91566](openclaw/openclaw#91566), [#&#8203;91840](openclaw/openclaw#91840), [#&#8203;91590](openclaw/openclaw#91590), [#&#8203;91361](openclaw/openclaw#91361), [#&#8203;91895](openclaw/openclaw#91895)) Thanks [@&#8203;openperf](https://github.com/openperf), [@&#8203;yetval](https://github.com/yetval), [@&#8203;joshavant](https://github.com/joshavant), [@&#8203;wangmiao0668000666](https://github.com/wangmiao0668000666), and [@&#8203;TurboTheTurtle](https://github.com/TurboTheTurtle).
- User-visible content boundaries: suppress Codex/Harmony protocol artifacts, neutralize browser and LanceDB memory media directives, redact transcript images, and preserve native `/compact` replies through source suppression. ([#&#8203;89151](openclaw/openclaw#89151), [#&#8203;91422](openclaw/openclaw#91422), [#&#8203;91425](openclaw/openclaw#91425), [#&#8203;91529](openclaw/openclaw#91529), [#&#8203;90212](openclaw/openclaw#90212)) Thanks [@&#8203;joelnishanth](https://github.com/joelnishanth), [@&#8203;pgondhi987](https://github.com/pgondhi987), [@&#8203;joshavant](https://github.com/joshavant), and [@&#8203;snowzlm](https://github.com/snowzlm).
- Channel delivery: keep WhatsApp captured replies attached to the successor controller after restart, retry Feishu rate limits, preserve Mattermost thread replies, canonicalize LINE webhook paths, restore Discord reply hydration and runtime timeout exports, and show OpenAI Realtime WebRTC assistant transcripts. ([#&#8203;85823](openclaw/openclaw#85823), [#&#8203;89659](openclaw/openclaw#89659), [#&#8203;91684](openclaw/openclaw#91684), [#&#8203;91649](openclaw/openclaw#91649), [#&#8203;90263](openclaw/openclaw#90263), [#&#8203;91686](openclaw/openclaw#91686), [#&#8203;90426](openclaw/openclaw#90426)) Thanks [@&#8203;itsuzef](https://github.com/itsuzef), [@&#8203;ladygege](https://github.com/ladygege), [@&#8203;jacobtomlinson](https://github.com/jacobtomlinson), [@&#8203;fuller-stack-dev](https://github.com/fuller-stack-dev), and [@&#8203;shushushv](https://github.com/shushushv).
- Cron: cancel active task runs cleanly, preserve terminal timeout/cancel state, and recover no-deliver tool warnings instead of silently losing the outcome. ([#&#8203;90666](openclaw/openclaw#90666), [#&#8203;90678](openclaw/openclaw#90678)) Thanks [@&#8203;ai-hpc](https://github.com/ai-hpc).
- Gateway/config/auth: share the approval runtime socket token, replace arrays explicitly in `config.patch`, skip the deleted-agent guard only for valid ACP harness sessions, surface headless LaunchAgent state, verify SQLite auth migration before cleanup, and arm QMD startup maintenance. ([#&#8203;87105](openclaw/openclaw#87105), [#&#8203;91551](openclaw/openclaw#91551), [#&#8203;91219](openclaw/openclaw#91219), [#&#8203;91614](openclaw/openclaw#91614), [#&#8203;91740](openclaw/openclaw#91740), [#&#8203;91978](openclaw/openclaw#91978)) Thanks [@&#8203;fuller-stack-dev](https://github.com/fuller-stack-dev) and [@&#8203;scotthuang](https://github.com/scotthuang).
- Providers/Codex: clarify quota errors, restore the Codex synthetic usage line, canonicalize Codex protocol assets, require API-key auth for realtime voice, normalize ACP model refs, preserve Gemma 4 `reasoning_content`, and avoid guardian review for local models. ([#&#8203;91390](openclaw/openclaw#91390), [#&#8203;91709](openclaw/openclaw#91709), [#&#8203;91507](openclaw/openclaw#91507), [#&#8203;91567](openclaw/openclaw#91567), [#&#8203;88630](openclaw/openclaw#88630), [#&#8203;91696](openclaw/openclaw#91696)) Thanks [@&#8203;hxy91819](https://github.com/hxy91819), [@&#8203;brokemac79](https://github.com/brokemac79), [@&#8203;RomneyDa](https://github.com/RomneyDa), [@&#8203;joshavant](https://github.com/joshavant), and [@&#8203;Coder-Wangyankun](https://github.com/Coder-Wangyankun).
- Updates/builds: recover package Gateway restarts after refresh failure, expose plugin convergence repair, fall back to Corepack in PATH-less pnpm environments, seed the correct Docker store packages, and keep ClawHub dry-run and publish paths reusable. ([#&#8203;91581](openclaw/openclaw#91581), [#&#8203;91599](openclaw/openclaw#91599), [#&#8203;91547](openclaw/openclaw#91547), [#&#8203;91591](openclaw/openclaw#91591)) Thanks [@&#8203;fuller-stack-dev](https://github.com/fuller-stack-dev), [@&#8203;sallyom](https://github.com/sallyom), and [@&#8203;Patrick-Erichsen](https://github.com/Patrick-Erichsen).
- UI: require explicit user intent before opening chat sessions and drain restored chat queues after session switches. ([#&#8203;91480](openclaw/openclaw#91480)) Thanks [@&#8203;TurboTheTurtle](https://github.com/TurboTheTurtle).
- Android: avoid the `dataSync` foreground-service type for persistent nodes. ([#&#8203;80082](openclaw/openclaw#80082)) Thanks [@&#8203;davelutztx](https://github.com/davelutztx).
- Native hooks: bound relay lifetimes so abandoned native hook connections cannot linger indefinitely. ([#&#8203;91550](openclaw/openclaw#91550)) Thanks [@&#8203;joshavant](https://github.com/joshavant).

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDEuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEwMS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9jb250YWluZXIiLCJ0eXBlL3BhdGNoIl19-->

Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/1040
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

channel: imessage Channel integration: imessage docs Improvements or additions to documentation gateway Gateway runtime maintainer Maintainer-authored PR merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. P2 Normal backlog priority with limited blast radius. proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. size: M status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

iMessage outbound sends should prefer configurable IMCore transport when available

1 participant