Spaces:
Sleeping
Sleeping
Commit History
-
feat(tasks): persist implementation target metadata for deterministic routing (#297)
RazorFin +1: clawdbot_nonadminUnverified signature* Add task implementation target metadata support for heartbeat routing * test(tasks): verify implementation target metadata persistence and routing precedence --------- Co-authored-by: clawdbot_nonadmin <clawdbot_nonadmin@clawdbot-admins-MacBook-Pro.local>b09bc8b
-
security(csp): remove unsafe-inline with nonce-based CSP (#288)
nykUnverified signature* fix: route coordinator sends to live sessions and parse boxed doctor output * feat: make coordinator routing user-configurable and deployment-agnostic * feat: add coordinator target dropdown in settings * feat(settings): preview live coordinator routing resolution * security(csp): remove unsafe-inline via per-request nonce policy * fix(ui): disable new organization CTA; improve skills registry and panel defaults - disable non-functional New organization button in nav rail - gate Hermes Memory visibility on actual Hermes CLI binary detection - optimize agents task stats API by replacing N+1 with grouped query - make task board render primary data first and hydrate quality-review async - default skills panel registry source to awesome-openclaw - add resilient registry search fallbacks for ClawdHub/skills.sh endpoint variantsa6b2e2f -
feat(refactor): ready for manual QA after main sync (#274)
nyk +1: Claude Opus 4.6Unverified signature* fix: preserve gateway token query in websocket URLs * fix: classify secure-context device identity handshake errors * fix: normalize trailing dot in host allowlist checks * fix: support proxied gateway websocket paths and tailnet host normalization * fix: auto-connect startup to primary configured gateway * fix: keep gateway tokens server-side only * fix: allow authenticated viewers to resolve gateway connect credentials * fix: identify mission control as operator gateway client * fix: redirect remote http sessions to https for gateway auth * fix: support URL-style gateway hosts in health probes * fix: resolve primary gateway credentials from detected openclaw runtime * fix: hide duplicate gateway connection summary when managed * refactor: remove super admin and workspaces panels from UI navigation * fix: treat configured gateways as full-mode capability * refactor: move promo banner copy into subtle footer note * fix: stabilize gateway websocket connect protocol dete…b6ecafa
-
fix(security): enforce server-side actor identity (#224)
nykUnverified signature* fix(security): enforce server-side actor identity * test: align message schema assertion with actor hardening * fix(security): enforce server actor identity in chat and broadcast * feat(auth): add scoped agent API keys with expiry and revocationcec279d -
feat(costs): add task-level token attribution and task-cost rollups
Nyk24822c8 -
chore: resolve merge conflict with main for PR #180
Nyk7f29d16 -
fix(agents): enforce attribution scope and add e2e coverage
Nyk1a8fd6d -
chore: resolve merge conflict with main for PR #177
Nykce1b9c7 -
fix(agents): enforce diagnostics self-scope and validation
Nykbe0bb92 -
feat: provision full OpenClaw workspaces from agent creation
nykUnverified signature7446200
-
feat(#159): add Agent-Level Identity & Attribution
- Add agent_name field to User interface for agent-level tracking - Extract X-Agent-Name header in getUserFromRequest for attribution - New GET /api/agents/[id]/attribution endpoint with sections: - identity: agent profile, lifetime stats, session info - audit: full activity trail + audit log entries for the agent - mutations: task changes, comments, status transitions attributed - cost: token usage by model with daily trend breakdown - Backward compatible: X-Agent-Name is optional, existing auth unchanged Fixes #159659dcd6 -
feat(#163): add Agent Self-Diagnostics API endpoint
New GET /api/agents/[id]/diagnostics endpoint enabling agents to query their own performance data for self-optimization. Sections (selectable via ?section= query param): - summary: KPIs (throughput, error rate, activity count) - tasks: completion breakdown by status/priority, throughput/day - errors: error frequency by type, recent error details - activity: activity breakdown with hourly timeline - trends: current vs previous period comparison with auto-alerts - tokens: token usage by model with cost totals Features: - Scoped to requesting agent only (no cross-agent data access) - Configurable time window via ?hours= param (1-720h) - Automatic trend alerts for error spikes, throughput drops, stalls - Works with existing activities, tasks, and token_usage tables Fixes #163255b4ea -
Merge pull request #155 from builderz-labs/feat/issues-146-143-145
nykUnverified signaturefeat: workspace discoverability and multi-project task support90c8b4e -
fix: unify agent config save across mission control and gateway
Nyka3ca4cc -
merge: resolve PR conflicts and add OpenClaw offline E2E harness
Nyk39fe4a7 -
feat: add workspace discoverability and multi-project task support
Nyk64eac97
-
feat: phase 1 workspace isolation across auth and core APIs (#112)
nykUnverified signature* feat: add workspace-scoped auth sessions and core API filtering * feat: extend workspace scoping to search status standup and messaging * feat: scope agent connect github and alert workflows by workspace * fix: scope status sync and session alerts by workspace * feat: add phase2 workspace migration and scope chat pipeline alerts * feat: add model selection for agents and cron jobs * feat: add deterministic agent avatars to task and squad views * feat: add read-only cron calendar and agenda views * feat: render task descriptions with markdown4e0867d -
feat: enrich agent config with workspace identity and tools
nykUnverified signature5be7cdc -
fix: sync agent SOUL content with workspace files (#91) (#95)
nykUnverified signatureWorkspace file is now the primary source for soul.md with DB as fallback. Reads prefer workspace → DB. Writes go to both. Config sync imports soul.md from each agent's workspace using double resolveWithin guard to prevent path traversal.beb89d9
-
feat: audit hardening, webhook retry, and local Claude session tracking (#68)
nykUnverified signatureSecurity hardening: - Fix timing-safe comparison bugs in webhooks.ts and auth.ts (was comparing buffer with itself) - Harden rate limiter IP extraction — use rightmost untrusted IP from XFF chain with MC_TRUSTED_PROXIES support - Add 12-char minimum password validation in Zod schema and runtime check - Add Zod validation on PUT /api/tasks bulk status update Webhook retry system (completing in-progress feature): - Exponential backoff with circuit breaker in webhooks.ts - POST /api/webhooks/retry endpoint for manual retry - GET /api/webhooks/verify-docs endpoint for signature verification docs - Scheduler integration for automatic retry processing - Unit tests for signature verification and backoff logic Local Claude Code session tracking: - New claude-sessions.ts scanner parses JSONL transcripts from ~/.claude/projects/ - Extracts model, tokens, messages, cost estimates, active status per session - Migration 020 adds claude_sessions table - GET/POST /api/claude/sessions endpoint with …959f8d7 -
feat: add direct CLI integration for gateway-free tool connections
Nyk- Add migration 016 for direct_connections table - Add POST/GET/DELETE /api/connect for CLI tool registration - Enhance heartbeat POST to accept connection_id and inline token_usage - Add connectSchema to validation - Add connection.created/disconnected event types to event bus - Show direct CLI connections in gateway manager panel - Add 5 E2E tests for connection lifecycle - Add CLI integration documentation (docs/cli-integration.md) - Fix openapi.json brace mismatch on line 642 (Phase 2 bug) - Add /api/connect endpoints to OpenAPI specf762929
-
feat: v1.2.0 — validation hardening, unit tests, quality improvements
Nyk- Fix task status enum mismatch (blocked → quality_review) - Add 12 Zod schemas for all unvalidated mutation routes - Apply validateBody() across 11 API route handlers - Add readLimiter (120/min) for GET-heavy endpoints - Extend heavyLimiter to search, backup, cleanup routes - Add security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy) - Fill auth test stubs with real assertions (safeCompare, requireRole) - Add validation, rate-limit, and db-helpers unit test suites (60 tests total) - Replace as-any casts with typed interfaces (SessionQueryRow, UserQueryRow, CountRow) - Bump version to 1.2.0, add CHANGELOG.md, update README roadmapbfccd36
-
Merge remote-tracking branch 'origin/main' into feat/medium-priority-v1.1
Nyk# Conflicts: # src/app/api/agents/route.ts # src/app/api/alerts/route.ts # src/app/api/auth/login/route.ts # src/app/api/spawn/route.ts # src/app/api/tasks/[id]/route.ts # src/app/api/tasks/route.ts # src/app/api/webhooks/route.ts # src/lib/validation.ts05adc4a -
feat: error boundaries, pino logger, a11y, HSTS, zod validation, export limits
Nyk2afed80 -
feat: add Docker support, session controls, model catalog, API rate limiting
Nykb608851 -
chore: CODE_OF_CONDUCT, issue templates, DELETE patterns, limit caps, CSRF origin check
Nyk- Add Contributor Covenant 2.1 Code of Conduct (Closes #16) - Add bug report and feature request issue templates (Closes #17) - Standardize DELETE handlers to use request body instead of query params (Closes #18) - Cap unbounded limit params to Math.min(limit, 200) on 12 endpoints (Closes #19) - Add CSRF Origin header validation for mutating requests in middleware (Closes #20)391842a -
fix: strict mode, test stubs, pagination counts, N+1 queries, CSP hardening
Nyk- Enable TypeScript strict mode and fix all resulting type errors - Add auth test stubs for requireRole and safeCompare - Add proper COUNT(*) pagination totals to agents, tasks, notifications, messages, conversations, and standup history endpoints - Fix N+1 queries by hoisting db.prepare() outside loops in agents, activities, notifications, conversations, standup, gateway health, and notification delivery routes - Remove unsafe-eval from CSP script-src directive - Remove deprecated X-XSS-Protection headerd258620 -
fix: add auth checks on all GET endpoints, timing-safe comparisons, and XSS sanitization
Nyk1dc7696
-
feat: initial open-source release
NykOpenClaw Mission Control — agent orchestration dashboard. Built with Next.js 16, React 19, TypeScript, SQLite, and Tailwind CSS. MIT License.bbbc03f