Spaces:
Sleeping
Sleeping
Commit History
-
fix: allow HuggingFace Spaces iframe embedding (cookies, CSP, CSRF)
d1ade07 -
feat: add HF Dataset persistence + auto-register HuggingClaw agents
123e7c1 -
chore: track binary files with git lfs
7daa569 -
feat: adapt for HuggingFace Spaces deployment (port 7860, metadata)
7e0fa81 -
feat: add awaiting_owner task status detection (#428)
nykUnverified signatureAdd awaiting_owner column to task board with keyword-based detection for tasks requiring human action. Tasks matching keywords like "waiting for", "needs human", "approval needed" are automatically placed in a dedicated column with orange styling. Supersedes #3971ec4113 -
feat: add Dunk It button animation with CSS transitions (#427)
nykUnverified signatureAdd a CSS-only Dunk It button to task cards with a 4-phase state machine (idle, success, error, dismissing). Uses inline CSS transitions for animations with no external dependencies. Supersedes #373142b423 -
feat: discover and display per-agent workspace skill roots (#426)
nykUnverified signatureDynamically scan workspace-* directories under the openclaw state dir to discover per-agent skill roots. Display them in the Skills Hub with agent-specific labels and violet badge styling. Closes #412 Supersedes #413aab05eb -
fix: remove CSP nonce from style-src to unblock reagraph canvas (#425)
nykUnverified signatureReplace style-src nonce directive with unsafe-inline to support reagraph's runtime <style> injection. Add style-src-elem and style-src-attr directives for CSP Level 3 compliance. Extend fitNodesInView retries from 2 to 4 for more reliable canvas sizing. Closes #414 Supersedes #415394621e -
fix: use CSPRNG for password generation in install.ps1 (#424)
nykUnverified signatureReplace Get-Random (System.Random, clock-seeded) with RandomNumberGenerator in Get-RandomPassword to match the CSPRNG already used by Get-RandomHex.8a143d4 -
feat: add Windows PowerShell installer (#423)
Unverified signatureAdds install.ps1 — a PowerShell port of install.sh for Windows users. Supports local and Docker deployment modes with secure credential generation, standalone server setup, and OpenClaw fleet checks. Adds Windows install section to README.d4c6814 -
fix(i18n): add missing logViewer, pipeline, debug namespaces (#420)
BrixyyUnverified signatureAdds 70 missing translation keys across 3 namespaces (logViewer, pipeline, debug) to messages/en.json. These namespaces are referenced by existing components but were absent, causing raw keys to render.\n\nFixes #4169f739a4
-
fix(i18n): add missing agentDetail translation keys (#409)
Jonathan GillUnverified signatureAdds all missing agentDetail.* keys to messages/en.json — role, model, status, stats, action buttons, sandbox config, SOUL/identity/memory editor, sub-agent/tool/workspace management.d860fd7 -
fix: add workspace skill root to skill-sync.ts (#411)
BrixyyUnverified signatureFixes #410 — getSkillRoots() in skill-sync.ts was not updated when #408 added workspace support to route.ts, causing the scheduler sync to never populate workspace skills (always showing 0).2ffa63d -
feat: add workspace skill root and root-based filtering to Skills Hub (#408)
nykUnverified signature- Add `workspace` skill root (~/.openclaw/workspace/skills) for workspace-local skill discovery alongside the existing 5 roots - Make group cards clickable to filter the installed skills list by root - Add `workspace` as valid target for skill creation and registry install - Add `showAllRoots` i18n key to all 10 locale files Closes #36428f45a6 -
fix: migrate clawdbot CLI calls to gateway RPC and improve session labels (#407)
nykUnverified signatureReplace all `runClawdbot(['-c', ...])` invocations with `callOpenClawGateway()` RPC calls in session control, spawn, and delete routes. This eliminates the deprecated CLI dependency and uses the structured gateway protocol instead. Also add `formatSessionLabel()` helper and `useAgentSessions()` hook to task-board-panel for better session dropdown display labels. Closes #401, closes #406608b8db -
feat: GNAP sync engine for git-native task persistence (#396)
nykUnverified signatureImplements Phase 1 of GNAP (Git-Native Agent Protocol) integration: - SQLite stays primary, GNAP repo is an optional sync target - Push task create/update/delete to .gnap/tasks/{id}.json with git commits - Status/priority mapping between MC and GNAP formats - Management API at /api/gnap (status, init, manual sync) - GNAP badge in task board header with click-to-sync - 15 unit tests covering mapping, init, push, remove, pull, and status Enable with GNAP_ENABLED=true in .env. Follows the same fire-and-forget pattern as the existing GitHub sync engine. Closes #374 Supersedes #3891f1a802 -
feat: hybrid mode — show gateway + local sessions simultaneously (#392)
nykUnverified signatureAlways merge both gateway and local (Claude Code, Codex, Hermes) sessions in the sessions API instead of gating on `include_local`. The conversation list now renders all sources unconditionally, using each session's `source` field for display logic rather than the global `dashboardMode`. - Add `localSessionsAvailable` store flag, set from capabilities `claudeHome` - Remove `include_local` query param and early-return in sessions API - Remove source-based filter and `dashboardMode` branching in conversation list - Show both gateway and local active/recent groups when data exists85e41f4 -
fix(gateway): probe /api/health instead of root URL (#394)
HonzysClawdbot +1: NykUnverified signature* fix(gateway): probe /api/health instead of root URL for health checks (#390) The server-side gateway health probe was fetching the root URL (/) which returns HTTP 400 on OpenClaw 2026.3.13 gateways. The gateway exposes a dedicated /api/health endpoint that returns 200 with status info. The WebSocket ping RPC 'unknown method' issue is already handled — websocket.ts detects the INVALID_REQUEST and falls back to passive heartbeat mode. The actual bug was this HTTP probe hitting the wrong endpoint. Fixes #390 * fix(gateway): ensure gateways table exists before health probe The gateways table is created lazily by the gateways API (ensureTable). The health route was querying it directly without CREATE IF NOT EXISTS, causing SqliteError: no such table: gateways in fresh databases (E2E tests, Docker first-boot). Add ensureGatewaysTable() inline to mirror the pattern in route.ts. * fix: update health-utils test to match /api/health probe path The test file has its own copy of buildGat…11d4af9 -
feat: task assignment session targeting (#399)
HonzysClawdbotUnverified signature* feat: add task session targeting - dispatch tasks to specific agent sessions (#395) When assigning a task to an agent, users can now optionally select an existing session to dispatch the task to instead of creating a new one. Changes: - task-dispatch.ts: When target_session is set in task metadata, use gateway chat.send to dispatch to that specific session instead of creating a new one via call agent - task-board-panel.tsx: Add session selector dropdown in both Create and Edit task modals that appears when an agent is selected and has active sessions - store/index.ts: Add agent and channel fields to Session interface Closes #395 * fix(gateway): ensure gateways table exists before health probe The gateways table is created lazily by the gateways API (ensureTable). The health route was querying it directly without CREATE IF NOT EXISTS, causing SqliteError: no such table: gateways in fresh databases (E2E tests, Docker first-boot). Add ensureGatewaysTable() inline to mirror…66bd6b3 -
fix: reduce server memory footprint (#405)
nykUnverified signature* fix: reduce server memory footprint across session parsing, caching, and rate limiting - Stream-parse Claude JSONL session files instead of loading entire files into memory - Add 50MB file size cap to skip oversized session transcripts - Add 30s TTL cache to getAllGatewaySessions() to avoid redundant disk reads per scheduler tick - Cap rate limiter maps at 10,000 entries with oldest-first eviction - Add request.signal abort listener to SSE route for defense-in-depth cleanup - Add test for rate limiter maxEntries eviction behavior * fix: address audit findings across all memory-fix files claude-sessions.ts: - Wrap readline loop in try/finally to ensure rl.close() on error paths - Guard statSync in file loop to handle files deleted between readdir and stat - Fix variable shadowing: rename inner `now` to `nowSec` to avoid confusion - Update throttle timestamp on empty scan results (prevents repeated disk scans) - Skip sidechain-only sessions (zero user+assistant messages) sessions.t…c963447
-
fix: remove duplicate task title constraint, improve delete handling and scrolling (#386)
HonzysClawdbotUnverified signature- Remove duplicate title check from POST /api/tasks (closes #368)\n- Scope recurring tasks duplicate check by project_id\n- Fix task deletion error handling — show errors to user (closes #369)\n- Enable vertical scrolling on Kanban board (closes #376)\n- Refactor nodes route to use RPC via callOpenClawGateway\n- Handle read-only filesystem in gateway config registration\n- Add screenshot-drift CI workflow and guide\n- Docker compose: add host-gateway for reaching host gateway6d2b255 -
fix: use gateway call agent for notification delivery (#381)
Unverified signatureSwitches notification delivery from sessions_send to gateway call agent command. No longer requires session_key — uses agent name (recipient) directly. Timeout increased 10s to 30s.1c9ee49 -
fix: scope memory health diagnostics to allowed prefixes (#367)
BrixyyUnverified signatureWhen memoryAllowedPrefixes is configured, scan only those subdirectories instead of the entire MEMORY_PATH. Falls back to full scan if no prefixes are set.\n\nCloses #3661156e7e -
fix(i18n): add missing translations for agentHistory, documents, gatewayConfig (#378)
Unverified signatureAdds translation keys to en.json and es.json for agentHistory, documents, and gatewayConfig namespaces.54857ba -
fix: fetch notifications immediately when recipient changes (#380)
Unverified signatureNotifications were stale until the next poll after switching recipients. Now fetchNotifications() is called immediately on recipient change.6d3847b
-
fix: stop forcing dangerouslyDisableDeviceAuth + fix exec security value
nykUnverified signature- Remove unconditional `dangerouslyDisableDeviceAuth = true` from MC origin registration. MC should only add its origin to allowedOrigins, not silently downgrade the gateway's device auth security posture. - Replace invalid `sandbox` value with `allowlist` in security scan and auto-fix for `tools.exec.security`. Current OpenClaw validates only: deny, allowlist, full. The old `sandbox` value was rejected. Closes #357, closes #3564840982 -
fix(i18n): add missing agentSquadPhase3 translation namespace
BrixyyUnverified signature778f981 -
fix: docker compose pids location + clear stale update banner
nykUnverified signature- Move pids limit from service-level `pids_limit` to `deploy.resources.limits.pids` for Compose v5+ compatibility. Some Compose versions normalize both into the same field, causing "can't set distinct values" errors. - Clear OpenClaw update banner when `/api/openclaw/version` reports `updateAvailable: false`. Previously the banner could persist after a successful update because only the `true` path was handled. Closes #353, closes #3513211a63 -
test: add Docker-mode integration tests for gateway connectivity regressions
HonzysClawdbotUnverified signature* fix: show all agents in command select, disable those without active session Previously the agent select in the OrchestrationBar only listed agents with a session_key set (agents.filter(a => a.session_key)), causing the dropdown to appear completely empty when agents exist but none have an active session. This was confusing — users thought no agents were registered. Fix: show all registered agents in the dropdown. Agents without an active session_key are shown as disabled with a '— no session' suffix and a tooltip explaining why they can't be messaged. The 'No agents registered' placeholder is shown only when the agents array is truly empty. The send button remains correctly disabled when no valid agent is selected. Fixes #321 * test: add gateway health history e2e + utility unit tests - Add tests/gateway-health-history.spec.ts: Playwright e2e tests for GET /api/gateways/health/history and POST /api/gateways/health covering auth guards, response shape validation, chronologi…f5be961 -
fix: unify GitHub sync token resolution with integrations env file
BrixyyUnverified signature28d83bd -
feat(tasks): classify task complexity and route to appropriate model tier
nyk +1: tomwattscaUnverified signatureCo-authored-by: tomwattsca <17442606+tomwattsca@users.noreply.github.com>d91ef14 -
test: add gateway health history e2e + utility unit tests
HonzysClawdbotUnverified signature* fix: show all agents in command select, disable those without active session Previously the agent select in the OrchestrationBar only listed agents with a session_key set (agents.filter(a => a.session_key)), causing the dropdown to appear completely empty when agents exist but none have an active session. This was confusing — users thought no agents were registered. Fix: show all registered agents in the dropdown. Agents without an active session_key are shown as disabled with a '— no session' suffix and a tooltip explaining why they can't be messaged. The 'No agents registered' placeholder is shown only when the agents array is truly empty. The send button remains correctly disabled when no valid agent is selected. Fixes #321 * test: add gateway health history e2e + utility unit tests - Add tests/gateway-health-history.spec.ts: Playwright e2e tests for GET /api/gateways/health/history and POST /api/gateways/health covering auth guards, response shape validation, chronologi…58fae19 -
fix(tasks): use --expect-final for agent dispatch and Aegis review
Tom Watts +1: Tom WattsUnverified signatureThe two-step agent → agent.wait pattern used in dispatchAssignedTasks and runAegisReviews only returns lifecycle metadata (runId, status, timestamps). The agent's actual response text is only available via --expect-final on the initial agent call, which blocks until completion and returns the full payload including result.payloads[0].text. Without this fix: - Task resolution is stored as the raw wait JSON instead of the agent's response - Aegis cannot parse a VERDICT from the resolution, so it always defaults to rejected - Tasks are permanently stuck in a reject/retry loop and never complete Fix: replace the two-call pattern with a single --expect-final call in both dispatchAssignedTasks and runAegisReviews. Also improve sessionId extraction to use the agentMeta path from the final payload. Co-authored-by: Tom Watts <tom@techteamup.com>7ceef01 -
fix: show all agents in command select, disable those without active session
HonzysClawdbotUnverified signaturePreviously the agent select in the OrchestrationBar only listed agents with a session_key set (agents.filter(a => a.session_key)), causing the dropdown to appear completely empty when agents exist but none have an active session. This was confusing — users thought no agents were registered. Fix: show all registered agents in the dropdown. Agents without an active session_key are shown as disabled with a '— no session' suffix and a tooltip explaining why they can't be messaged. The 'No agents registered' placeholder is shown only when the agents array is truly empty. The send button remains correctly disabled when no valid agent is selected. Fixes #321eaa980c -
fix(ui): improve agent panel empty state with discovery hints (#348)
nykUnverified signatureReplace the unhelpful "POST /api/agents with X-Api-Key header" message with a user-friendly hint explaining that agents are auto-discovered from Claude, Codex, and Hermes directories, and that gateway mode shows registered agents. Adds missing noAgentsHint translation key across all 10 locales. Closes #321df40714 -
fix: cron panel crash on missing schedule + doctor parser false positive (#347)
nykUnverified signature- Filter out cron jobs with missing/empty schedule before processing, preventing TypeError on .toLowerCase() (#342) - Add defensive .localeCompare() guard in sort comparator - Exclude positive/instructional lines ("No ... warnings detected", "Run: ...") from doctor issue extraction (#331) - Strip negated warning phrases before keyword detection so "No channel security warnings detected" doesn't trigger warning level - Add 2 tests for the doctor parser fix0dcf69a -
docs(changelog): add [Unreleased] section tracking pending fixes (#340)
HonzysClawdbotUnverified signaturec0e1597 -
fix(gateway): resolve Docker connectivity — 404 endpoints, EROFS write, missing OPENCLAW_HOME (#343)
HonzysClawdbotUnverified signature* docs: add screenshot drift prevention guide and CI workflow - Add docs/SCREENSHOT-GUIDE.md with step-by-step instructions for capturing, optimising, and committing fresh README screenshots - Add .github/workflows/screenshot-drift.yml that detects UI file changes in PRs, applies a 'screenshot-drift' label, and posts a checklist comment reminding contributors to verify screenshots Addresses: README screenshots may drift as the UI evolves quickly (setup wizard, health history timeline, and onboarding were added after the last screenshot refresh on 2026-03-11) * fix(gateway): resolve Docker connectivity — 404 endpoints, EROFS write, missing OPENCLAW_HOME Fixes #332, #333 Root causes ----------- 1. nodes/route.ts called non-existent HTTP REST endpoints on the gateway (/api/presence, /api/devices, /api/rpc). The OpenClaw gateway only exposes HTTP at /health; all other operations use WebSocket RPC. 2. gateway-runtime.ts attempted fs.writeFileSync on openclaw.json which …303c344 -
test: add coverage for pure utility modules, fix Vitest 60% threshold (#339)
HonzysClawdbotUnverified signature* fix(db): add busy_timeout pragma and guard build-phase eager init - Add busy_timeout = 5000 pragma to prevent SQLITE_BUSY errors under concurrent Next.js route-handler requests (WAL mode helps but is not sufficient without a retry budget). - Guard module-level getDatabase() call with !isBuildPhase to prevent build-time vs runtime SQLite state conflicts on cold starts. - Add tests covering both pragmas and build-phase skip behaviour. * security(skill-registry): add path traversal and SSRF detection rules - Add 'path-traversal' rule: detects ../../ and URL-encoded variants - Add 'ssrf-internal-network' rule: detects fetch/curl/wget/axios targeting localhost, 127.x, 0.0.0.0, RFC-1918 private ranges, and *.internal hosts - Add 'ssrf-metadata-endpoint' rule: detects access to cloud metadata endpoints (AWS 169.254.169.254, GCP metadata.google.internal) - Add 14 new tests covering all new rules including edge cases Closes #security-completeness * test: add coverage for pure u…eb47743 -
fix(db): add busy_timeout pragma and guard build-phase eager init (#337)
HonzysClawdbotUnverified signature- Add busy_timeout = 5000 pragma to prevent SQLITE_BUSY errors under concurrent Next.js route-handler requests (WAL mode helps but is not sufficient without a retry budget). - Guard module-level getDatabase() call with !isBuildPhase to prevent build-time vs runtime SQLite state conflicts on cold starts. - Add tests covering both pragmas and build-phase skip behaviour.40f303b -
fix(onboarding): use POST for gateway health check in wizard (#334)
firefloc-nox +1: FireflocUnverified signatureThe test connection button in the onboarding wizard was using GET to call /api/gateways/health, which only exports POST — resulting in a 405 and "Gateway unreachable" shown to the user. Fixes the HTTP method to POST so the health probe works correctly. Co-authored-by: Firefloc <firefloc@MacBook-Pro-de-Firefloc.local>3a61be4 -
feat(gateway): detect port-based Tailscale Serve proxies (#330)
Unverified signatureThe existing Tailscale Serve detection only looked for a /gw path handler, missing configurations where the gateway is proxied on a separate port (e.g. :8443 → localhost:18789). This caused remote browsers to attempt direct wss connections to the gateway port, which fails through Tailscale. Extract Tailscale Serve detection into src/lib/tailscale-serve.ts and extend it to discover port-based proxy mappings from the Tailscale Serve JSON config. Also adds the macOS app bundle path for the Tailscale CLI binary, which is not on PATH when installed via the Mac App Store.11b3669 -
fix: prefer explicit public gateway websocket url (#325)
jonboiramaUnverified signature674f35f -
feat: full i18n — 1752 keys across 10 languages, all panels translated (#326)
nykUnverified signature* feat: add i18n with 10 languages (en, zh, ja, ko, es, fr, de, pt, ru, ar) Add internationalization infrastructure using next-intl with cookie-based locale detection (NEXT_LOCALE cookie -> Accept-Language header -> default). - Install next-intl and wire into Next.js config + root layout - Create translation files for 10 languages covering auth pages, navigation labels, common UI strings, and settings - Translate login page, setup page, and nav-rail labels - Add LanguageSwitcher component (compact dropdown) to login page, setup page, nav-rail sidebar, and settings panel - Support RTL layout for Arabic (dir="rtl" on html element) - No URL-based locale routing — uses cookie-only approach to avoid breaking existing URLs and the custom proxy middleware Panel internals are left with English strings for incremental translation in follow-up PRs. Based on the approach from PR #312 by richard-able, expanded to 10 languages with proper infrastructure. * test(e2e): add i18n language sw…b180108 -
fix(ui): null-safe trim calls in agent model config (#329)
nykUnverified signature* fix(ui): null-safe trim calls in agent model config (#319) Guard against undefined values in .trim() calls when editing agent model configuration (primary model and fallback array entries). Closes #319 * test: add unit tests for null-safe trim in agent model config Tests verify that undefined/null values in model primary and fallback arrays don't cause trim() TypeError crashes. * test(e2e): add agent model config edge case tests Tests verify PUT /api/agents/:id with valid config, empty fallbacks, empty primary, and whitespace-only fallback entries.db34d19 -
fix(ui): persist doctor banner dismiss with 24h expiry (#328)
nykUnverified signature* fix(ui): persist doctor banner dismiss with 24h expiry (#320) Replace ephemeral useState dismiss with Zustand store + localStorage. Banner stays hidden for 24 hours after dismiss, then resurfaces so users can re-check. Mirrors the existing UpdateBanner pattern. Closes #320 * test: add unit tests for doctor banner dismiss persistence Tests verify localStorage persistence, 24h expiry, page refresh survival, and graceful handling of corrupted values.ce66f43 -
fix(docker): Compose v5 pids_limit + copy public assets (#327)
nykUnverified signature* fix(docker): move pids to service-level pids_limit and copy public assets - Move `pids: 256` from `deploy.resources.limits` to service-level `pids_limit` for Docker Compose v5+ compatibility (#322) - Add `COPY --from=build /app/public ./public` to Dockerfile runtime stage so static assets (logos, icons) are available at runtime (#323) Closes #322, closes #323 * test: add Docker config validation tests Verifies pids_limit is at service level (Compose v5+), public dir is copied in Dockerfile, and all required COPY instructions exist.932b27c
-
Merge pull request #315 from builderz-labs/feat/first-time-setup-wizard
nykUnverified signaturefeat: first-time setup wizard and zero-config startupefe0502 -
feat: add first-time setup wizard and zero-config startup
NykEliminate friction for new users by adding a web-based setup wizard, auto-generating infrastructure secrets, and providing actionable feedback when no admin account exists. - Add /setup page with visual progress steps for admin account creation - Add /api/setup route (GET: check status, POST: create admin + auto-login) - Auto-generate AUTH_SECRET and API_KEY when not set (persisted to .data/) - Add docker-entrypoint.sh for zero-config Docker startup - Login page auto-redirects to /setup when no users exist - Login API returns NO_USERS error code with setup guidance - Remove insecure defaults from .env.example - Update README Quick Start for zero-config Docker and web setup - Add CLAUDE.md for AI agent discoverability943fe08 -
docs: update changelog with task dispatch fix and Node >=22
Nyk58ba0af