Commit Graph

2096 Commits

Author SHA1 Message Date
David Iach
4e4ed2ea17 fix(security): cap Slack media downloads and validate Slack file URLs (#6639)
* Security: cap Slack media downloads and validate Slack file URLs

* Security: relax web media fetch cap for compression

* Fixes: sync pi-coding-agent options

* Fixes: align system prompt override type

* Slack: clarify fetchImpl assumptions

* fix: respect raw media fetch cap (#6639) (thanks @davidiach)

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-02-02 00:48:07 -08:00
Peter Steinberger
521b121815 fix: treat '*' tool allowlist as valid 2026-02-02 08:45:51 +00:00
Ayaan Zaidi
01449a2f41 fix: add telegram download timeouts (#6914) (thanks @hclsys) 2026-02-02 13:39:39 +05:30
Ayaan Zaidi
e25f8ed56c fix: add changelog for telegram thread spec (#6833) (thanks @obviyus) 2026-02-02 09:26:59 +05:30
Mario Zechner
4347d2468c fix: format issues and lint error in oauth.ts 2026-02-02 01:59:42 +01:00
Peter Steinberger
8c7901c984 fix(twitch): enforce allowFrom allowlist 2026-02-02 00:16:35 +00:00
Peter Steinberger
a87a07ec8a fix: harden host exec env validation (#4896) (thanks @HassanFleyah) 2026-02-01 15:37:19 -08:00
VACInc
b796f6ec01 Security: harden web tools and file parsing (#4058)
* feat: web content security wrapping + gkeep/simple-backup skills

* fix: harden web fetch + media text detection (#4058) (thanks @VACInc)

---------

Co-authored-by: VAC <vac@vacs-mac-mini.localdomain>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-02-01 15:23:25 -08:00
Peter Steinberger
92112a61db chore: add TLS 1.3 minimum changelog (#5970) (thanks @loganaden) 2026-02-01 15:14:55 -08:00
Peter Steinberger
8eb11bd304 fix: wire before_tool_call hook into tool execution (#6570) (thanks @ryancnelson) (#6660) 2026-02-01 14:52:11 -08:00
Peter Steinberger
99346314f5 chore: trim docs changelog 2026-02-01 14:17:47 -08:00
Peter Steinberger
1968a4b7d2 chore: expand changelog 2026-02-01 14:12:39 -08:00
Peter Steinberger
a68e32d95b chore: update changelog 2026-02-01 14:08:09 -08:00
Peter Steinberger
238200f652 chore: update changelog and relay formatting 2026-02-01 14:03:57 -08:00
CLAWDINATOR Bot
92803facf6 docs: preserve moonshot sync markers 2026-02-01 20:34:42 +00:00
Sebastian
a863ac9862 Docs: clarify Moonshot endpoints (#4763)
Co-authored-by: hansbbans <hansbbans@users.noreply.github.com>
2026-02-01 15:03:55 -05:00
Peter Steinberger
083ec9325e fix: cover OpenRouter attribution headers 2026-02-01 19:30:33 +00:00
CLAWDINATOR Bot
17287bc8d0 docs: add zh-CN titles (#6487) (thanks @joshp123) 2026-02-01 18:21:15 +00:00
bonald
d3e53eaf27 fix(skill): update session-logs paths from .clawdbot to .openclaw (#4502)
Co-authored-by: Jarvis <jarvis@openclaw.ai>
Co-authored-by: CLAWDINATOR Bot <clawdinator[bot]@users.noreply.github.com>
Co-authored-by: Shadow <shadow@openclaw.ai>
2026-02-01 11:42:28 -06:00
CLAWDINATOR Bot
6453f5c395 docs: add Mintlify language navigation (#6416) (thanks @joshp123) 2026-02-01 17:20:44 +00:00
CLAWDINATOR Bot
bc5b0c82ac fix(docker): avoid using host port in gateway command (#5110) (thanks @mise42) 2026-02-01 17:17:18 +00:00
shatner
8ff75eaf12 Docs: Direct link to BotFather on Telegram (#4064)
* Docs: Direct link to BotFather on Telegram, sparing users from searching and potentially encountering impostors.

* Update numbering syntax

Update numbering syntax to match PR to latest doc layout.

* Docs: add BotFather verification note

---------

Co-authored-by: Sebastian <sebslight@gmail.com>
2026-02-01 10:15:40 -05:00
Ayaan Zaidi
0992c5a809 fix: cap context window resolution (#6187) (thanks @iamEvanYT) 2026-02-01 19:52:56 +05:30
Ayaan Zaidi
1f3afa38e8 fix: use shared pairing store for telegram (#6127) (thanks @obviyus) 2026-02-01 15:22:37 +05:30
bravostation
b4e2e746b3 /new: use agent personality in session greeting (#5706)
* Slash new: use agent personality in session greeting

Previously /new and /reset used a generic greeting prompt. Agents with
personality files (IDENTITY.md, SOUL.md, etc) would respond out of
character until the conversation got going.

Now the prompt instructs the agent to greet users as their character,
using their defined voice, mannerisms, and mood from the start.

* Auto-reply: avoid workspace references in reset prompt

* fix: avoid workspace references in reset greeting (#5706) (thanks @bravostation)

---------

Co-authored-by: MoltBot <bot@moltbot.com>
Co-authored-by: Shadow <shadow@clawd.bot>
2026-01-31 20:43:19 -06:00
Tak Hoffman
3d5c03ec29 fix: resolve Windows npm spawn ENOENT (#5815) (thanks @thejhinvirtuoso) 2026-01-31 20:39:33 -06:00
Lalit Singh
01d76e4799 feat(routing): add thread parent binding inheritance for Discord (#3892)
* feat(routing): add thread parent binding inheritance for Discord

When a Discord thread message doesn't match a direct peer binding,
now checks if the parent channel has a binding and uses that agent.

This enables multi-agent setups where threads inherit their parent
channel's agent binding automatically.

Changes:
- Add parentPeer parameter to ResolveAgentRouteInput
- Add binding.peer.parent match type
- Resolve thread parent early in Discord preflight
- Pass parentPeer to resolveAgentRoute for threads

Fixes thread routing in Discord multi-agent configurations where
threads were incorrectly routed to the default agent instead of
inheriting from their parent channel's binding.

* ci: trigger fresh macOS runners

* Discord: inherit thread bindings in reactions

* fix: add changelog for thread parent binding (#3892) (thanks @aerolalit)

---------

Co-authored-by: Lalit Singh <lalit@clawd.bot>
Co-authored-by: OSS Agent <oss-agent@clawdbot.ai>
Co-authored-by: Shadow <shadow@clawd.bot>
2026-01-31 20:30:45 -06:00
Gustavo Madeira Santana
73c405f74a Docs: note MiniMax OAuth updates (#5402) (thanks @Maosghoul) 2026-01-31 21:08:56 -05:00
Shadow
8e2b17e0c5 Discord: add PluralKit sender identity resolver (#5838)
* Discord: add PluralKit sender identity resolver

* fix: resolve PluralKit sender identities (#5838) (thanks @thewilloftheshadow)
2026-01-31 19:50:06 -06:00
Vignesh
1295b67057 fix(lobster): block arbitrary exec via lobsterPath/cwd (GHSA-4mhr-g7xj-cg8j) (#5335)
* fix(lobster): prevent arbitrary exec via lobsterPath/cwd

* fix(lobster): harden lobsterPath errors + normalize cwd sandboxing

* fix(lobster): ignore tool-provided lobsterPath; validate + use plugin config

* fix(lobster): use plugin config lobsterPath + add tests (#5335) (thanks @vignesh07)

* fix(lobster): make Windows spawn fallback handle ENOENT (#5335) (thanks @vignesh07)

---------

Co-authored-by: Tyler Yust <TYTYYUST@YAHOO.COM>
2026-01-31 12:46:20 -08:00
Ayaan Zaidi
f1de88c198 fix: restore telegram draft streaming partials (#5543) (thanks @obviyus) 2026-01-31 22:46:19 +05:30
Tak Hoffman
9c29853014 Gateway: inject timestamps into agent/chat.send (#3705) (thanks @conroywhitney, @CashWilliams) 2026-01-31 09:47:27 -06:00
Peter Steinberger
83e64c1ac9 docs: start 2026.1.31 changelog 2026-01-31 16:28:19 +01:00
Peter Steinberger
7d89855c55 fix: align npm publish metadata 2026-01-31 14:21:21 +01:00
cpojer
8cab78abbc chore: Run pnpm format:fix. 2026-01-31 21:13:13 +09:00
Peter Steinberger
1287328b6f feat: add MiniMax OAuth plugin (#4521) (thanks @Maosghoul) 2026-01-31 12:42:45 +01:00
Peter Steinberger
b9b94715fa fix: avoid stderr backpressure in macOS discovery (#3304) (thanks @abhijeet117) 2026-01-31 12:03:30 +01:00
Peter Steinberger
247fab47ca chore: bump version to 2026.1.30 2026-01-31 11:37:36 +01:00
Ayaan Zaidi
310eed825e fix: preserve delivery thread fallback (#4911) (thanks @yevhen) 2026-01-31 09:31:40 +05:30
Ayaan Zaidi
e849df64dc fix: normalize telegram account token lookup (#5055) (thanks @jasonsschin) 2026-01-31 08:58:04 +05:30
Tyler Yust
0b7aa8cf1d feat(ui): refresh session list after chat commands in Web UI 2026-01-30 14:29:04 -08:00
Gustavo Madeira Santana
34bdbdb405 fix: resolve Control UI assets for global installs (#4909) (thanks @YuriNachos)
Co-authored-by: YuriNachos <YuriNachos@users.noreply.github.com>
2026-01-30 17:08:40 -05:00
Gustavo Madeira Santana
39eb0b7bc0 fix: prevent undefined gateway token defaults (#4873) (thanks @Hisleren)
Co-authored-by: Hisleren <Hisleren@users.noreply.github.com>
2026-01-30 16:16:35 -05:00
Gustavo Madeira Santana
daf27dd37e fix: add per-agent models status (#4780) (thanks @jlowin) 2026-01-30 15:47:05 -05:00
Peter Steinberger
fd00d5688a chore: update openclaw naming 2026-01-30 21:03:11 +01:00
Ayaan Zaidi
da71eaebd2 fix: correct telegram html nesting (#4578) (thanks @ThanhNguyxn) 2026-01-30 16:53:39 +05:30
Ayaan Zaidi
fa9ec6e854 fix: add docker ui install changelog entry (#4584) (thanks @obviyus) 2026-01-30 16:25:24 +05:30
Ayaan Zaidi
bc432d8435 fix: accept numeric Telegram react ids (#4533) (thanks @Ayush10) 2026-01-30 15:01:18 +05:30
Ayaan Zaidi
3a85cb1833 fix: honor Telegram proxy dispatcher (#4456) (thanks @spiceoogway) 2026-01-30 14:38:39 +05:30
Ayaan Zaidi
9025da2296 fix: scope telegram skill commands per bot (#4360) (thanks @robhparker) 2026-01-30 12:00:29 +05:30