Spaces:
Sleeping
Sleeping
Commit History
-
feat: discover and display per-agent workspace skill roots (#426)
nykUnverified signatureDynamically scan workspace-* directories under the openclaw state dir to discover per-agent skill roots. Display them in the Skills Hub with agent-specific labels and violet badge styling. Closes #412 Supersedes #413aab05eb
-
feat: add workspace skill root and root-based filtering to Skills Hub (#408)
nykUnverified signature- Add `workspace` skill root (~/.openclaw/workspace/skills) for workspace-local skill discovery alongside the existing 5 roots - Make group cards clickable to filter the installed skills list by root - Add `workspace` as valid target for skill creation and registry install - Add `showAllRoots` i18n key to all 10 locale files Closes #36428f45a6 -
fix: migrate clawdbot CLI calls to gateway RPC and improve session labels (#407)
nykUnverified signatureReplace all `runClawdbot(['-c', ...])` invocations with `callOpenClawGateway()` RPC calls in session control, spawn, and delete routes. This eliminates the deprecated CLI dependency and uses the structured gateway protocol instead. Also add `formatSessionLabel()` helper and `useAgentSessions()` hook to task-board-panel for better session dropdown display labels. Closes #401, closes #406608b8db -
feat: GNAP sync engine for git-native task persistence (#396)
nykUnverified signatureImplements Phase 1 of GNAP (Git-Native Agent Protocol) integration: - SQLite stays primary, GNAP repo is an optional sync target - Push task create/update/delete to .gnap/tasks/{id}.json with git commits - Status/priority mapping between MC and GNAP formats - Management API at /api/gnap (status, init, manual sync) - GNAP badge in task board header with click-to-sync - 15 unit tests covering mapping, init, push, remove, pull, and status Enable with GNAP_ENABLED=true in .env. Follows the same fire-and-forget pattern as the existing GitHub sync engine. Closes #374 Supersedes #3891f1a802 -
feat: hybrid mode — show gateway + local sessions simultaneously (#392)
nykUnverified signatureAlways merge both gateway and local (Claude Code, Codex, Hermes) sessions in the sessions API instead of gating on `include_local`. The conversation list now renders all sources unconditionally, using each session's `source` field for display logic rather than the global `dashboardMode`. - Add `localSessionsAvailable` store flag, set from capabilities `claudeHome` - Remove `include_local` query param and early-return in sessions API - Remove source-based filter and `dashboardMode` branching in conversation list - Show both gateway and local active/recent groups when data exists85e41f4 -
fix(gateway): probe /api/health instead of root URL (#394)
HonzysClawdbot +1: NykUnverified signature* fix(gateway): probe /api/health instead of root URL for health checks (#390) The server-side gateway health probe was fetching the root URL (/) which returns HTTP 400 on OpenClaw 2026.3.13 gateways. The gateway exposes a dedicated /api/health endpoint that returns 200 with status info. The WebSocket ping RPC 'unknown method' issue is already handled — websocket.ts detects the INVALID_REQUEST and falls back to passive heartbeat mode. The actual bug was this HTTP probe hitting the wrong endpoint. Fixes #390 * fix(gateway): ensure gateways table exists before health probe The gateways table is created lazily by the gateways API (ensureTable). The health route was querying it directly without CREATE IF NOT EXISTS, causing SqliteError: no such table: gateways in fresh databases (E2E tests, Docker first-boot). Add ensureGatewaysTable() inline to mirror the pattern in route.ts. * fix: update health-utils test to match /api/health probe path The test file has its own copy of buildGat…11d4af9 -
feat: task assignment session targeting (#399)
HonzysClawdbotUnverified signature* feat: add task session targeting - dispatch tasks to specific agent sessions (#395) When assigning a task to an agent, users can now optionally select an existing session to dispatch the task to instead of creating a new one. Changes: - task-dispatch.ts: When target_session is set in task metadata, use gateway chat.send to dispatch to that specific session instead of creating a new one via call agent - task-board-panel.tsx: Add session selector dropdown in both Create and Edit task modals that appears when an agent is selected and has active sessions - store/index.ts: Add agent and channel fields to Session interface Closes #395 * fix(gateway): ensure gateways table exists before health probe The gateways table is created lazily by the gateways API (ensureTable). The health route was querying it directly without CREATE IF NOT EXISTS, causing SqliteError: no such table: gateways in fresh databases (E2E tests, Docker first-boot). Add ensureGatewaysTable() inline to mirror…66bd6b3 -
fix: reduce server memory footprint (#405)
nykUnverified signature* fix: reduce server memory footprint across session parsing, caching, and rate limiting - Stream-parse Claude JSONL session files instead of loading entire files into memory - Add 50MB file size cap to skip oversized session transcripts - Add 30s TTL cache to getAllGatewaySessions() to avoid redundant disk reads per scheduler tick - Cap rate limiter maps at 10,000 entries with oldest-first eviction - Add request.signal abort listener to SSE route for defense-in-depth cleanup - Add test for rate limiter maxEntries eviction behavior * fix: address audit findings across all memory-fix files claude-sessions.ts: - Wrap readline loop in try/finally to ensure rl.close() on error paths - Guard statSync in file loop to handle files deleted between readdir and stat - Fix variable shadowing: rename inner `now` to `nowSec` to avoid confusion - Update throttle timestamp on empty scan results (prevents repeated disk scans) - Skip sidechain-only sessions (zero user+assistant messages) sessions.t…c963447
-
fix: remove duplicate task title constraint, improve delete handling and scrolling (#386)
HonzysClawdbotUnverified signature- Remove duplicate title check from POST /api/tasks (closes #368)\n- Scope recurring tasks duplicate check by project_id\n- Fix task deletion error handling — show errors to user (closes #369)\n- Enable vertical scrolling on Kanban board (closes #376)\n- Refactor nodes route to use RPC via callOpenClawGateway\n- Handle read-only filesystem in gateway config registration\n- Add screenshot-drift CI workflow and guide\n- Docker compose: add host-gateway for reaching host gateway6d2b255 -
fix: use gateway call agent for notification delivery (#381)
Unverified signatureSwitches notification delivery from sessions_send to gateway call agent command. No longer requires session_key — uses agent name (recipient) directly. Timeout increased 10s to 30s.1c9ee49 -
fix: scope memory health diagnostics to allowed prefixes (#367)
BrixyyUnverified signatureWhen memoryAllowedPrefixes is configured, scan only those subdirectories instead of the entire MEMORY_PATH. Falls back to full scan if no prefixes are set.\n\nCloses #3661156e7e
-
fix: stop forcing dangerouslyDisableDeviceAuth + fix exec security value
nykUnverified signature- Remove unconditional `dangerouslyDisableDeviceAuth = true` from MC origin registration. MC should only add its origin to allowedOrigins, not silently downgrade the gateway's device auth security posture. - Replace invalid `sandbox` value with `allowlist` in security scan and auto-fix for `tools.exec.security`. Current OpenClaw validates only: deny, allowlist, full. The old `sandbox` value was rejected. Closes #357, closes #3564840982 -
fix: unify GitHub sync token resolution with integrations env file
BrixyyUnverified signature28d83bd -
test: add gateway health history e2e + utility unit tests
HonzysClawdbotUnverified signature* fix: show all agents in command select, disable those without active session Previously the agent select in the OrchestrationBar only listed agents with a session_key set (agents.filter(a => a.session_key)), causing the dropdown to appear completely empty when agents exist but none have an active session. This was confusing — users thought no agents were registered. Fix: show all registered agents in the dropdown. Agents without an active session_key are shown as disabled with a '— no session' suffix and a tooltip explaining why they can't be messaged. The 'No agents registered' placeholder is shown only when the agents array is truly empty. The send button remains correctly disabled when no valid agent is selected. Fixes #321 * test: add gateway health history e2e + utility unit tests - Add tests/gateway-health-history.spec.ts: Playwright e2e tests for GET /api/gateways/health/history and POST /api/gateways/health covering auth guards, response shape validation, chronologi…58fae19 -
fix(gateway): resolve Docker connectivity — 404 endpoints, EROFS write, missing OPENCLAW_HOME (#343)
HonzysClawdbotUnverified signature* docs: add screenshot drift prevention guide and CI workflow - Add docs/SCREENSHOT-GUIDE.md with step-by-step instructions for capturing, optimising, and committing fresh README screenshots - Add .github/workflows/screenshot-drift.yml that detects UI file changes in PRs, applies a 'screenshot-drift' label, and posts a checklist comment reminding contributors to verify screenshots Addresses: README screenshots may drift as the UI evolves quickly (setup wizard, health history timeline, and onboarding were added after the last screenshot refresh on 2026-03-11) * fix(gateway): resolve Docker connectivity — 404 endpoints, EROFS write, missing OPENCLAW_HOME Fixes #332, #333 Root causes ----------- 1. nodes/route.ts called non-existent HTTP REST endpoints on the gateway (/api/presence, /api/devices, /api/rpc). The OpenClaw gateway only exposes HTTP at /health; all other operations use WebSocket RPC. 2. gateway-runtime.ts attempted fs.writeFileSync on openclaw.json which …303c344 -
feat(gateway): detect port-based Tailscale Serve proxies (#330)
Unverified signatureThe existing Tailscale Serve detection only looked for a /gw path handler, missing configurations where the gateway is proxied on a separate port (e.g. :8443 → localhost:18789). This caused remote browsers to attempt direct wss connections to the gateway port, which fails through Tailscale. Extract Tailscale Serve detection into src/lib/tailscale-serve.ts and extend it to discover port-based proxy mappings from the Tailscale Serve JSON config. Also adds the macOS app bundle path for the Tailscale CLI binary, which is not on PATH when installed via the Mac App Store.11b3669 -
fix: prefer explicit public gateway websocket url (#325)
jonboiramaUnverified signature674f35f
-
feat: add first-time setup wizard and zero-config startup
NykEliminate friction for new users by adding a web-based setup wizard, auto-generating infrastructure secrets, and providing actionable feedback when no admin account exists. - Add /setup page with visual progress steps for admin account creation - Add /api/setup route (GET: check status, POST: create admin + auto-login) - Auto-generate AUTH_SECRET and API_KEY when not set (persisted to .data/) - Add docker-entrypoint.sh for zero-config Docker startup - Login page auto-redirects to /setup when no users exist - Login API returns NO_USERS error code with setup guidance - Remove insecure defaults from .env.example - Update README Quick Start for zero-config Docker and web setup - Add CLAUDE.md for AI agent discoverability943fe08
-
Add Venice AI integration and model support (#301)
Joshua Mo +2: Cursor Agent, Joshua MoUnverified signatureCo-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Joshua Mo <joshua-mo-143@users.noreply.github.com>ccf9166 -
feat(gateways): add health history logging and timeline (#300)
nykUnverified signature058b0d8 -
feat(tasks): persist implementation target metadata for deterministic routing (#297)
RazorFin +1: clawdbot_nonadminUnverified signature* Add task implementation target metadata support for heartbeat routing * test(tasks): verify implementation target metadata persistence and routing precedence --------- Co-authored-by: clawdbot_nonadmin <clawdbot_nonadmin@clawdbot-admins-MacBook-Pro.local>b09bc8b -
fix(session-cookie): migrate to __Host- prefix for secure contexts (#294)
HonzysClawdbot +1: NykUnverified signature* fix(session-cookie): migrate to __Host- prefix for secure contexts - Update session-cookie.ts to use __Host-mc-session for HTTPS requests - Add LEGACY_MC_SESSION_COOKIE_NAME for backward compatibility with HTTP - Add parseMcSessionCookieHeader() to parse both cookie names - Add isRequestSecure() helper to detect HTTPS requests - Update cookie options to enforce Secure, HttpOnly, SameSite=Strict - Update all call sites (login, logout, google, me, proxy, auth) - Update e2e tests to support both cookie names - Update documentation (README.md, SKILL.md, openapi.json) This addresses the high-priority TODO about migrating to the __Host- prefix for enhanced security. The __Host- prefix enforces Secure + Path=/ and prevents subdomain attacks. Legacy mc-session is still supported for HTTP contexts. * fix(tests): keep login-flow cookie name aligned with response - remove unreachable nullish expression in session cookie secure flag - use returned cookie pair in login-flow spec instead of f…c9c4e2a -
fix: allow unauthenticated status health probe for container checks (#295)
nykUnverified signature- allow /api/status?action=health through proxy without session/API key - short-circuit health action in status route before role gating - add proxy regression tests for health probe allow + non-health deny Regression checks: - pnpm vitest run src/proxy.test.ts src/lib/__tests__/auth.test.ts - pnpm playwright test tests/auth-guards.spec.ts - smoke: /api/status?action=health=200, login=200, /api/auth/me=200d94b281
-
security(csp): remove unsafe-inline with nonce-based CSP (#288)
nykUnverified signature* fix: route coordinator sends to live sessions and parse boxed doctor output * feat: make coordinator routing user-configurable and deployment-agnostic * feat: add coordinator target dropdown in settings * feat(settings): preview live coordinator routing resolution * security(csp): remove unsafe-inline via per-request nonce policy * fix(ui): disable new organization CTA; improve skills registry and panel defaults - disable non-functional New organization button in nav rail - gate Hermes Memory visibility on actual Hermes CLI binary detection - optimize agents task stats API by replacing N+1 with grouped query - make task board render primary data first and hydrate quality-review async - default skills panel registry source to awesome-openclaw - add resilient registry search fallbacks for ClawdHub/skills.sh endpoint variantsa6b2e2f -
fix: dynamic coordinator routing + boxed doctor parsing (#279)
nykUnverified signature* fix: route coordinator sends to live sessions and parse boxed doctor output * feat: make coordinator routing user-configurable and deployment-agnostic * feat: add coordinator target dropdown in settings * feat(settings): preview live coordinator routing resolutioncd054b5 -
feat(refactor): ready for manual QA after main sync (#274)
nyk +1: Claude Opus 4.6Unverified signature* fix: preserve gateway token query in websocket URLs * fix: classify secure-context device identity handshake errors * fix: normalize trailing dot in host allowlist checks * fix: support proxied gateway websocket paths and tailnet host normalization * fix: auto-connect startup to primary configured gateway * fix: keep gateway tokens server-side only * fix: allow authenticated viewers to resolve gateway connect credentials * fix: identify mission control as operator gateway client * fix: redirect remote http sessions to https for gateway auth * fix: support URL-style gateway hosts in health probes * fix: resolve primary gateway credentials from detected openclaw runtime * fix: hide duplicate gateway connection summary when managed * refactor: remove super admin and workspaces panels from UI navigation * fix: treat configured gateways as full-mode capability * refactor: move promo banner copy into subtle footer note * fix: stabilize gateway websocket connect protocol dete…b6ecafa
-
fix(sync): support commented/trailing-comma OpenClaw config (#235)
nykUnverified signatured842037 -
fix(security): enforce server-side actor identity (#224)
nykUnverified signature* fix(security): enforce server-side actor identity * test: align message schema assertion with actor hardening * fix(security): enforce server actor identity in chat and broadcast * feat(auth): add scoped agent API keys with expiry and revocationcec279d -
feat(metrics): add task regression trend endpoint
Nyk503957a -
merge: sync virtual office branch with main
Nyk75f351a -
feat(docs): add docs knowledge APIs for issue 189
Nyk5a5899d -
chore: merge main into feat/task-outcome-feedback-192 to resolve PR #207 conflicts
Nykbc8debc -
Merge pull request #206 from builderz-labs/feat/task-cost-observability-193
nykUnverified signaturefeat(costs): add task-level cost observability for issue #193a6ce3e0 -
feat(tasks): add outcome tracking and feedback analytics
Nyk3fbaffd -
feat(costs): add task-level token attribution and task-cost rollups
Nyk24822c8 -
Merge pull request #204 from builderz-labs/fix/188-task-queue
nykUnverified signaturefeat(tasks): add queue polling endpoint for agent pickup6746400 -
fix(gateway): use stored token for websocket connect payload
Nyk395fc60 -
feat(tasks): add agent queue polling endpoint
Nyk0d54fcf -
chore: resolve merge conflict with main for PR #178
Nykf3f9fd2 -
chore: resolve merge conflict with main for PR #178
Nykcb63bc4 -
chore: resolve merge conflict with main for PR #180
Nyk7f29d16 -
fix(agents): enforce attribution scope and add e2e coverage
Nyk1a8fd6d -
fix(workload): harden signal recommendations and add route e2e coverage
Nyk58cb911 -
chore: resolve merge conflict with main for PR #177
Nykce1b9c7 -
fix(agents): enforce diagnostics self-scope and validation
Nykbe0bb92 -
Merge pull request #201 from builderz-labs/fix/184-assignment-status-normalization
nykUnverified signaturefix(tasks): auto-normalize assignment status transitionseca771d -
fix(tasks): auto-normalize assignment status transitions
Nyk3fd1706 -
Mission Control: Habi readiness wiring + office segmentation (#187)
ResistanceDown +1: Jeremy PhelpsUnverified signature* fix mission control wiring for habi memory/orchestration/retention * feat office org-chart segmentation controls --------- Co-authored-by: Jeremy Phelps <kokoro@Kokoro.local>ecae447 -
feat: provision full OpenClaw workspaces from agent creation
nykUnverified signature7446200 -
fix: macOS compatibility for status commands and gateway client id
Unverified signatureReplace Linux-only commands (uptime -s, free -m, df --output=pcent) with cross-platform alternatives using process.platform detection and Node.js os module. Rename gateway client ID from control-ui to openclaw-control-ui. Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>be80b82
