Spaces:
Sleeping
Sleeping
Commit History
-
fix(db): add busy_timeout pragma and guard build-phase eager init (#337)
HonzysClawdbotUnverified signature- Add busy_timeout = 5000 pragma to prevent SQLITE_BUSY errors under concurrent Next.js route-handler requests (WAL mode helps but is not sufficient without a retry budget). - Guard module-level getDatabase() call with !isBuildPhase to prevent build-time vs runtime SQLite state conflicts on cold starts. - Add tests covering both pragmas and build-phase skip behaviour.40f303b
-
feat: add first-time setup wizard and zero-config startup
NykEliminate friction for new users by adding a web-based setup wizard, auto-generating infrastructure secrets, and providing actionable feedback when no admin account exists. - Add /setup page with visual progress steps for admin account creation - Add /api/setup route (GET: check status, POST: create admin + auto-login) - Auto-generate AUTH_SECRET and API_KEY when not set (persisted to .data/) - Add docker-entrypoint.sh for zero-config Docker startup - Login page auto-redirects to /setup when no users exist - Login API returns NO_USERS error code with setup guidance - Remove insecure defaults from .env.example - Update README Quick Start for zero-config Docker and web setup - Add CLAUDE.md for AI agent discoverability943fe08
-
feat(refactor): ready for manual QA after main sync (#274)
nyk +1: Claude Opus 4.6Unverified signature* fix: preserve gateway token query in websocket URLs * fix: classify secure-context device identity handshake errors * fix: normalize trailing dot in host allowlist checks * fix: support proxied gateway websocket paths and tailnet host normalization * fix: auto-connect startup to primary configured gateway * fix: keep gateway tokens server-side only * fix: allow authenticated viewers to resolve gateway connect credentials * fix: identify mission control as operator gateway client * fix: redirect remote http sessions to https for gateway auth * fix: support URL-style gateway hosts in health probes * fix: resolve primary gateway credentials from detected openclaw runtime * fix: hide duplicate gateway connection summary when managed * refactor: remove super admin and workspaces panels from UI navigation * fix: treat configured gateways as full-mode capability * refactor: move promo banner copy into subtle footer note * fix: stabilize gateway websocket connect protocol dete…b6ecafa
-
feat(tasks): add outcome tracking and feedback analytics
Nyk3fbaffd
-
feat: add validated @mentions for tasks and comments
Nyk200c64b -
feat: add workspace discoverability and multi-project task support
Nyk64eac97 -
fix: support AUTH_PASS_B64 for seeded admin password
Nyk2b182b0 -
security: reject known-insecure default passwords during admin seeding (#123)
Mark LiuUnverified signatureThe admin seeding function previously fell back to password 'admin' when AUTH_PASS was unset, and accepted any value from .env.example including the documented default 'change-me-on-first-login'. This meant a user who copied .env.example without changing the password (or forgot to set AUTH_PASS entirely) would have an instance running with publicly known credentials. The seeding function now: - Skips seeding entirely if AUTH_PASS is not set (instead of defaulting to 'admin') - Checks AUTH_PASS against a blocklist of known insecure values (admin, password, change-me-on-first-login, changeme, testpass123) - Logs a clear warning explaining what to do in both cases Existing instances that already have users in the database are not affected — the seeding function only runs when the users table is empty. Signed-off-by: Mark Liu <mark@prove.com.au>c26ce6c
-
feat: phase 1 workspace isolation across auth and core APIs (#112)
nykUnverified signature* feat: add workspace-scoped auth sessions and core API filtering * feat: extend workspace scoping to search status standup and messaging * feat: scope agent connect github and alert workflows by workspace * fix: scope status sync and session alerts by workspace * feat: add phase2 workspace migration and scope chat pipeline alerts * feat: add model selection for agents and cron jobs * feat: add deterministic agent avatars to task and squad views * feat: add read-only cron calendar and agenda views * feat: render task descriptions with markdown4e0867d
-
fix: resolve all 44 failing CI E2E tests (#64)
nykUnverified signature* fix: resolve all 44 failing CI E2E tests - Bypass non-critical rate limiters in test env (MC_DISABLE_RATE_LIMIT=1) to prevent 429s when 165 tests share the same IP bucket - Make admin seed idempotent (INSERT OR IGNORE) to fix UNIQUE constraint race when multiple Next.js workers initialize concurrently - Add distinct x-forwarded-for headers to login-flow tests so they never share the critical login rate-limit bucket with other test suites - Add missing 018_token_usage migration that the heartbeat POST handler depends on, fixing the 500 on inline token reporting * docs: update README with latest features and test count - Update migration count from 15 to 18 - Update E2E test count from 146 to 165 - Move Direct CLI, OpenAPI docs, and GitHub sync to completed roadmap - Add Direct CLI and GitHub sync feature descriptions - Add /api/connect and /api/github to API reference - Remove resolved known limitation (vitest stubs) - Update repo description * fix: prevent build-time admi…1a89aa4
-
feat: v1.2.0 — validation hardening, unit tests, quality improvements
Nyk- Fix task status enum mismatch (blocked → quality_review) - Add 12 Zod schemas for all unvalidated mutation routes - Apply validateBody() across 11 API route handlers - Add readLimiter (120/min) for GET-heavy endpoints - Extend heavyLimiter to search, backup, cleanup routes - Add security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy) - Fill auth test stubs with real assertions (safeCompare, requireRole) - Add validation, rate-limit, and db-helpers unit test suites (60 tests total) - Replace as-any casts with typed interfaces (SessionQueryRow, UserQueryRow, CountRow) - Bump version to 1.2.0, add CHANGELOG.md, update README roadmapbfccd36
-
feat: add Docker support, session controls, model catalog, API rate limiting
Nykb608851 -
fix: enable foreign_keys pragma and add missing indexes
Nyk- Add `PRAGMA foreign_keys = ON` to db.ts — without this, all ON DELETE CASCADE constraints across 7 tables are silently ignored (SQLite disables foreign keys by default) - Add migration 015 with indexes on hot query paths: notifications(read_at), notifications(recipient, read_at), activities(actor), activities(entity_type, entity_id), messages(read_at)88c7604
-
feat: initial open-source release
NykOpenClaw Mission Control — agent orchestration dashboard. Built with Next.js 16, React 19, TypeScript, SQLite, and Tailwind CSS. MIT License.bbbc03f