Spaces:
Sleeping
Sleeping
Commit History
-
fix: remove duplicate task title constraint, improve delete handling and scrolling (#386)
HonzysClawdbotUnverified signature- Remove duplicate title check from POST /api/tasks (closes #368)\n- Scope recurring tasks duplicate check by project_id\n- Fix task deletion error handling — show errors to user (closes #369)\n- Enable vertical scrolling on Kanban board (closes #376)\n- Refactor nodes route to use RPC via callOpenClawGateway\n- Handle read-only filesystem in gateway config registration\n- Add screenshot-drift CI workflow and guide\n- Docker compose: add host-gateway for reaching host gateway6d2b255
-
test: add Docker-mode integration tests for gateway connectivity regressions
HonzysClawdbotUnverified signature* fix: show all agents in command select, disable those without active session Previously the agent select in the OrchestrationBar only listed agents with a session_key set (agents.filter(a => a.session_key)), causing the dropdown to appear completely empty when agents exist but none have an active session. This was confusing — users thought no agents were registered. Fix: show all registered agents in the dropdown. Agents without an active session_key are shown as disabled with a '— no session' suffix and a tooltip explaining why they can't be messaged. The 'No agents registered' placeholder is shown only when the agents array is truly empty. The send button remains correctly disabled when no valid agent is selected. Fixes #321 * test: add gateway health history e2e + utility unit tests - Add tests/gateway-health-history.spec.ts: Playwright e2e tests for GET /api/gateways/health/history and POST /api/gateways/health covering auth guards, response shape validation, chronologi…f5be961 -
test: add gateway health history e2e + utility unit tests
HonzysClawdbotUnverified signature* fix: show all agents in command select, disable those without active session Previously the agent select in the OrchestrationBar only listed agents with a session_key set (agents.filter(a => a.session_key)), causing the dropdown to appear completely empty when agents exist but none have an active session. This was confusing — users thought no agents were registered. Fix: show all registered agents in the dropdown. Agents without an active session_key are shown as disabled with a '— no session' suffix and a tooltip explaining why they can't be messaged. The 'No agents registered' placeholder is shown only when the agents array is truly empty. The send button remains correctly disabled when no valid agent is selected. Fixes #321 * test: add gateway health history e2e + utility unit tests - Add tests/gateway-health-history.spec.ts: Playwright e2e tests for GET /api/gateways/health/history and POST /api/gateways/health covering auth guards, response shape validation, chronologi…58fae19 -
feat: full i18n — 1752 keys across 10 languages, all panels translated (#326)
nykUnverified signature* feat: add i18n with 10 languages (en, zh, ja, ko, es, fr, de, pt, ru, ar) Add internationalization infrastructure using next-intl with cookie-based locale detection (NEXT_LOCALE cookie -> Accept-Language header -> default). - Install next-intl and wire into Next.js config + root layout - Create translation files for 10 languages covering auth pages, navigation labels, common UI strings, and settings - Translate login page, setup page, and nav-rail labels - Add LanguageSwitcher component (compact dropdown) to login page, setup page, nav-rail sidebar, and settings panel - Support RTL layout for Arabic (dir="rtl" on html element) - No URL-based locale routing — uses cookie-only approach to avoid breaking existing URLs and the custom proxy middleware Panel internals are left with English strings for incremental translation in follow-up PRs. Based on the approach from PR #312 by richard-able, expanded to 10 languages with proper infrastructure. * test(e2e): add i18n language sw…b180108 -
fix(ui): null-safe trim calls in agent model config (#329)
nykUnverified signature* fix(ui): null-safe trim calls in agent model config (#319) Guard against undefined values in .trim() calls when editing agent model configuration (primary model and fallback array entries). Closes #319 * test: add unit tests for null-safe trim in agent model config Tests verify that undefined/null values in model primary and fallback arrays don't cause trim() TypeError crashes. * test(e2e): add agent model config edge case tests Tests verify PUT /api/agents/:id with valid config, empty fallbacks, empty primary, and whitespace-only fallback entries.db34d19
-
test(tasks): replace external repo fixture with neutral local slug
Nyk37b0458 -
feat(tasks): persist implementation target metadata for deterministic routing (#297)
RazorFin +1: clawdbot_nonadminUnverified signature* Add task implementation target metadata support for heartbeat routing * test(tasks): verify implementation target metadata persistence and routing precedence --------- Co-authored-by: clawdbot_nonadmin <clawdbot_nonadmin@clawdbot-admins-MacBook-Pro.local>b09bc8b -
fix(session-cookie): migrate to __Host- prefix for secure contexts (#294)
HonzysClawdbot +1: NykUnverified signature* fix(session-cookie): migrate to __Host- prefix for secure contexts - Update session-cookie.ts to use __Host-mc-session for HTTPS requests - Add LEGACY_MC_SESSION_COOKIE_NAME for backward compatibility with HTTP - Add parseMcSessionCookieHeader() to parse both cookie names - Add isRequestSecure() helper to detect HTTPS requests - Update cookie options to enforce Secure, HttpOnly, SameSite=Strict - Update all call sites (login, logout, google, me, proxy, auth) - Update e2e tests to support both cookie names - Update documentation (README.md, SKILL.md, openapi.json) This addresses the high-priority TODO about migrating to the __Host- prefix for enhanced security. The __Host- prefix enforces Secure + Path=/ and prevents subdomain attacks. Legacy mc-session is still supported for HTTP contexts. * fix(tests): keep login-flow cookie name aligned with response - remove unreachable nullish expression in session cookie secure flag - use returned cookie pair in login-flow spec instead of f…c9c4e2a
-
feat(refactor): ready for manual QA after main sync (#274)
nyk +1: Claude Opus 4.6Unverified signature* fix: preserve gateway token query in websocket URLs * fix: classify secure-context device identity handshake errors * fix: normalize trailing dot in host allowlist checks * fix: support proxied gateway websocket paths and tailnet host normalization * fix: auto-connect startup to primary configured gateway * fix: keep gateway tokens server-side only * fix: allow authenticated viewers to resolve gateway connect credentials * fix: identify mission control as operator gateway client * fix: redirect remote http sessions to https for gateway auth * fix: support URL-style gateway hosts in health probes * fix: resolve primary gateway credentials from detected openclaw runtime * fix: hide duplicate gateway connection summary when managed * refactor: remove super admin and workspaces panels from UI navigation * fix: treat configured gateways as full-mode capability * refactor: move promo banner copy into subtle footer note * fix: stabilize gateway websocket connect protocol dete…b6ecafa
-
fix(security): enforce server-side actor identity (#224)
nykUnverified signature* fix(security): enforce server-side actor identity * test: align message schema assertion with actor hardening * fix(security): enforce server actor identity in chat and broadcast * feat(auth): add scoped agent API keys with expiry and revocationcec279d -
feat(metrics): add task regression trend endpoint
Nyk503957a -
feat(docs): add docs knowledge APIs for issue 189
Nyk5a5899d -
chore: merge main into feat/task-outcome-feedback-192 to resolve PR #207 conflicts
Nykbc8debc -
Merge pull request #206 from builderz-labs/feat/task-cost-observability-193
nykUnverified signaturefeat(costs): add task-level cost observability for issue #193a6ce3e0 -
feat(tasks): add outcome tracking and feedback analytics
Nyk3fbaffd -
feat(costs): add task-level token attribution and task-cost rollups
Nyk24822c8 -
Merge pull request #204 from builderz-labs/fix/188-task-queue
nykUnverified signaturefeat(tasks): add queue polling endpoint for agent pickup6746400 -
fix(gateway): use stored token for websocket connect payload
Nyk395fc60 -
feat(tasks): add agent queue polling endpoint
Nyk0d54fcf -
chore: resolve merge conflict with main for PR #178
Nykf3f9fd2 -
chore: resolve merge conflict with main for PR #178
Nykcb63bc4 -
chore: resolve merge conflict with main for PR #180
Nyk7f29d16 -
fix(agents): enforce attribution scope and add e2e coverage
Nyk1a8fd6d -
fix(workload): harden signal recommendations and add route e2e coverage
Nyk58cb911 -
fix(agents): enforce diagnostics self-scope and validation
Nykbe0bb92
-
feat: add validated @mentions for tasks and comments
Nyk200c64b -
merge: resolve PR conflicts and add OpenClaw offline E2E harness
Nyk39fe4a7 -
feat: scope workflows and webhooks to workspace (#132)
nykUnverified signatured1086d3 -
fix: prevent Docker build failure when pnpm lockfile is missing (#130)
nykUnverified signature* fix: make docker build resilient when lockfile is absent * test: update e2e credentials for secure admin seed policyd8f73c7
-
feat: aggregate token usage from db with stable agent grouping
nykUnverified signaturec630ac6 -
feat: Ed25519 device identity for WebSocket challenge-response handshake (#85)
nykUnverified signatureAdd client-side Ed25519 key pair generation and nonce signing for OpenClaw gateway protocol v3 connect.challenge flow. Keys persist in localStorage and are reused across sessions. The handshake falls back gracefully to auth-token-only mode when Ed25519 is unavailable. Closes #74, closes #79, closes #81a79a97a
-
feat: audit hardening, webhook retry, and local Claude session tracking (#68)
nykUnverified signatureSecurity hardening: - Fix timing-safe comparison bugs in webhooks.ts and auth.ts (was comparing buffer with itself) - Harden rate limiter IP extraction — use rightmost untrusted IP from XFF chain with MC_TRUSTED_PROXIES support - Add 12-char minimum password validation in Zod schema and runtime check - Add Zod validation on PUT /api/tasks bulk status update Webhook retry system (completing in-progress feature): - Exponential backoff with circuit breaker in webhooks.ts - POST /api/webhooks/retry endpoint for manual retry - GET /api/webhooks/verify-docs endpoint for signature verification docs - Scheduler integration for automatic retry processing - Unit tests for signature verification and backoff logic Local Claude Code session tracking: - New claude-sessions.ts scanner parses JSONL transcripts from ~/.claude/projects/ - Extracts model, tokens, messages, cost estimates, active status per session - Migration 020 adds claude_sessions table - GET/POST /api/claude/sessions endpoint with …959f8d7 -
fix: resolve all 44 failing CI E2E tests (#64)
nykUnverified signature* fix: resolve all 44 failing CI E2E tests - Bypass non-critical rate limiters in test env (MC_DISABLE_RATE_LIMIT=1) to prevent 429s when 165 tests share the same IP bucket - Make admin seed idempotent (INSERT OR IGNORE) to fix UNIQUE constraint race when multiple Next.js workers initialize concurrently - Add distinct x-forwarded-for headers to login-flow tests so they never share the critical login rate-limit bucket with other test suites - Add missing 018_token_usage migration that the heartbeat POST handler depends on, fixing the 500 on inline token reporting * docs: update README with latest features and test count - Update migration count from 15 to 18 - Update E2E test count from 146 to 165 - Move Direct CLI, OpenAPI docs, and GitHub sync to completed roadmap - Add Direct CLI and GitHub sync feature descriptions - Add /api/connect and /api/github to API reference - Remove resolved known limitation (vitest stubs) - Update repo description * fix: prevent build-time admi…1a89aa4 -
feat: add GitHub Issues sync (Phase 1, Issue #58)
NykImport GitHub issues as Mission Control tasks with duplicate detection, priority mapping from labels, and bidirectional actions (comment/close). - Migration 017: github_syncs table for sync history tracking - GitHub API client (src/lib/github.ts) with fetch, comment, close ops - POST/GET /api/github route with sync, comment, close, status actions - GitHubSyncPanel UI: import form, issue preview, sync history, linked tasks - Nav rail + page router wiring - 6 E2E tests (all passing) - Validation schema + github.synced event type8dc7515 -
feat: add direct CLI integration for gateway-free tool connections
Nyk- Add migration 016 for direct_connections table - Add POST/GET/DELETE /api/connect for CLI tool registration - Enhance heartbeat POST to accept connection_id and inline token_usage - Add connectSchema to validation - Add connection.created/disconnected event types to event bus - Show direct CLI connections in gateway manager panel - Add 5 E2E tests for connection lifecycle - Add CLI integration documentation (docs/cli-integration.md) - Fix openapi.json brace mismatch on line 642 (Phase 2 bug) - Add /api/connect endpoints to OpenAPI specf762929 -
feat: add OpenAPI 3.1 documentation with Scalar UI
Nyk- Add openapi.json spec covering all 59 API routes (~95 operations) - Serve spec at GET /api/docs (no auth required, cached) - Add interactive Scalar API reference UI at /docs - Allow unauthenticated access to /api/docs and /docs in middleware - Add @scalar/api-reference-react dependency - Add 3 E2E tests for spec validation and auth bypass13daa38 -
feat: add per-agent cost breakdown panel
Nyk- Add `agents` field to tokens action=stats response (groups by agent extracted from sessionId split on ':') - Add new action=agent-costs returning per-agent stats, model breakdown, session list, and daily cost/token timeline - New AgentCostPanel with summary cards, pie chart, trend lines, efficiency bars, and expandable ranking table - Add nav-rail entry in OBSERVE group after Tokens - Add ContentRouter case for agent-costs tab - Add 5 E2E tests for the new API endpoints473b701
-
test: add 94 E2E tests covering all CRUD routes + fix middleware location
NykAdd comprehensive Playwright E2E test coverage for all major API routes: - tasks-crud (18 tests): full lifecycle, filters, Aegis approval gate - agents-crud (15 tests): CRUD, lookup by name/id, admin-only delete - task-comments (7 tests): threaded comments, validation - workflows-crud (8 tests): workflow template lifecycle - webhooks-crud (9 tests): secret masking, regeneration - alerts-crud (8 tests): alert rule lifecycle - notifications (7 tests): delivery tracking, read status - quality-review (6 tests): reviews with batch lookup - search-and-export (7 tests): global search, export, activities - user-management (8 tests): user admin CRUD - helpers.ts: shared factory functions and cleanup utilities Infrastructure fixes: - Move middleware.ts to src/middleware.ts (Next.js 16 Turbopack requires middleware in src/ when using src/app/ directory — the root-level file was silently ignored, breaking CSRF protection) - Add MC_DISABLE_RATE_LIMIT env var to bypass non-critical rate limit…447138e
-
test: add 52 Playwright E2E tests covering all critical fixes
Nyk8 test suites verifying: - Auth guards on 19 GET endpoints (Issue #4) - Timing-safe API key comparison (Issue #5) - Legacy cookie auth removal (Issue #7) - Login rate limiting (Issue #8) - CSRF Origin header validation (Issue #20) - DELETE body standardization (Issue #18) - Query limit caps at 200 (Issue #19) - Login flow and session lifecycle Also fixes migration 013 crash on fresh DB when gateways table doesn't exist (created lazily by gateways API, not in migrations).e1e5820
-
feat: initial open-source release
NykOpenClaw Mission Control — agent orchestration dashboard. Built with Next.js 16, React 19, TypeScript, SQLite, and Tailwind CSS. MIT License.bbbc03f