Spaces:
Sleeping
Sleeping
Commit History
-
feat: add first-time setup wizard and zero-config startup
NykEliminate friction for new users by adding a web-based setup wizard, auto-generating infrastructure secrets, and providing actionable feedback when no admin account exists. - Add /setup page with visual progress steps for admin account creation - Add /api/setup route (GET: check status, POST: create admin + auto-login) - Auto-generate AUTH_SECRET and API_KEY when not set (persisted to .data/) - Add docker-entrypoint.sh for zero-config Docker startup - Login page auto-redirects to /setup when no users exist - Login API returns NO_USERS error code with setup guidance - Remove insecure defaults from .env.example - Update README Quick Start for zero-config Docker and web setup - Add CLAUDE.md for AI agent discoverability943fe08
-
fix(session-cookie): migrate to __Host- prefix for secure contexts (#294)
HonzysClawdbot +1: NykUnverified signature* fix(session-cookie): migrate to __Host- prefix for secure contexts - Update session-cookie.ts to use __Host-mc-session for HTTPS requests - Add LEGACY_MC_SESSION_COOKIE_NAME for backward compatibility with HTTP - Add parseMcSessionCookieHeader() to parse both cookie names - Add isRequestSecure() helper to detect HTTPS requests - Update cookie options to enforce Secure, HttpOnly, SameSite=Strict - Update all call sites (login, logout, google, me, proxy, auth) - Update e2e tests to support both cookie names - Update documentation (README.md, SKILL.md, openapi.json) This addresses the high-priority TODO about migrating to the __Host- prefix for enhanced security. The __Host- prefix enforces Secure + Path=/ and prevents subdomain attacks. Legacy mc-session is still supported for HTTP contexts. * fix(tests): keep login-flow cookie name aligned with response - remove unreachable nullish expression in session cookie secure flag - use returned cookie pair in login-flow spec instead of f…c9c4e2a
-
feat(refactor): ready for manual QA after main sync (#274)
nyk +1: Claude Opus 4.6Unverified signature* fix: preserve gateway token query in websocket URLs * fix: classify secure-context device identity handshake errors * fix: normalize trailing dot in host allowlist checks * fix: support proxied gateway websocket paths and tailnet host normalization * fix: auto-connect startup to primary configured gateway * fix: keep gateway tokens server-side only * fix: allow authenticated viewers to resolve gateway connect credentials * fix: identify mission control as operator gateway client * fix: redirect remote http sessions to https for gateway auth * fix: support URL-style gateway hosts in health probes * fix: resolve primary gateway credentials from detected openclaw runtime * fix: hide duplicate gateway connection summary when managed * refactor: remove super admin and workspaces panels from UI navigation * fix: treat configured gateways as full-mode capability * refactor: move promo banner copy into subtle footer note * fix: stabilize gateway websocket connect protocol dete…b6ecafa
-
feat: phase 1 workspace isolation across auth and core APIs (#112)
nykUnverified signature* feat: add workspace-scoped auth sessions and core API filtering * feat: extend workspace scoping to search status standup and messaging * feat: scope agent connect github and alert workflows by workspace * fix: scope status sync and session alerts by workspace * feat: add phase2 workspace migration and scope chat pipeline alerts * feat: add model selection for agents and cron jobs * feat: add deterministic agent avatars to task and squad views * feat: add read-only cron calendar and agenda views * feat: render task descriptions with markdown4e0867d -
fix: healthcheck auth, secure cookie auto-detect, model object crash (#84)
nykUnverified signatureBug 1 (#78): Dockerfile HEALTHCHECK curled authenticated /api/status, always got 401 in production. Changed to /login which is public. Bug 2 (#78): Login hangs on HTTP deployments because secure=true cookie is silently rejected. Now auto-detects protocol from x-forwarded-proto header, only sets secure when request actually came over HTTPS. Bug 3 (#78): Agent model field from OpenClaw 2026.3.x is {primary: "name"} object instead of string, causing React error #31. Added normalizeModel() helper and applied it in all WebSocket/session mapping code paths.f5d72bc
-
feat: add Docker support, session controls, model catalog, API rate limiting
Nykb608851 -
fix: remove legacy auth, add login rate limiting, block SSRF metadata, parameterize migration SQL
Nyk97dff67
-
feat: initial open-source release
NykOpenClaw Mission Control — agent orchestration dashboard. Built with Next.js 16, React 19, TypeScript, SQLite, and Tailwind CSS. MIT License.bbbc03f