b8af4d6739
fix: start tailscale exposure before sidecars
2026-04-09 17:21:56 +05:30
7f714609f7
fix: allow CLI task cancel for stuck background tasks ( #62506 ) (thanks @neeravmakwana)
...
* Tasks: allow openclaw tasks cancel for CLI runtime (#62419 )
Made-with: Cursor
* Tasks: address review — changelog order, CLI cancel without session, lock terminal status
Made-with: Cursor
* fix: freeze terminal task listener updates
* fix: clean changelog block for CLI task cancel (#62506 ) (thanks @neeravmakwana)
---------
Co-authored-by: Ayaan Zaidi <hi@obviy.us >
2026-04-09 17:16:07 +05:30
9267c3f8f2
fix: preserve iMessage self-chat aliases ( #61619 ) (thanks @neeravmakwana)
...
* fix(imessage): avoid DM self-chat false positives
* fix(imessage): treat blank destination caller id as missing
* fix(imessage): preserve alias self-chat
* fix: preserve iMessage self-chat aliases (#61619 ) (thanks @neeravmakwana)
---------
Co-authored-by: Ayaan Zaidi <hi@obviy.us >
2026-04-09 17:13:22 +05:30
5577e2d441
fix: keep gateway RPC up during startup ( #63480 )
...
Thanks @neeravmakwana.
2026-04-09 17:09:18 +05:30
12544e24d7
fix: stable auth profile resolution for isolated cron jobs ( #62797 ) (thanks @neeravmakwana)
...
* Cron: stable auth profile resolution for isolated jobs (#62783 )
* Tests: clearer assertion for isolated cron auth profile spy (#62797 )
2026-04-09 16:48:05 +05:30
4977c4ab82
fix(control-ui): preserve configured model metadata in picker ( #61382 )
...
Merged via squash.
Prepared head SHA: c738f6f146edfd7468a67073cbe93660b3c0e4cd
Co-authored-by: Mule-ME <83214007+Mule-ME@users.noreply.github.com >
Co-authored-by: mukhtharcm <56378562+mukhtharcm@users.noreply.github.com >
Reviewed-by: @mukhtharcm
2026-04-09 16:28:43 +05:30
46b1ecd6ed
docs: add changelog entry for FirePass Kimi fix
2026-04-09 17:27:02 +08:00
828c64e6b5
style: format web fetch ssrf test
2026-04-09 10:18:32 +01:00
8be3a4466c
fix(feishu): read webhook bodies through pre-auth guard
2026-04-09 10:18:07 +01:00
fa2fab7060
fix(plugins): prevent schema load from re-activating plugin registry ( #54971 )
...
Merged via squash.
Prepared head SHA: dd1ed1d519d8f8f8fc3bd127eb272061fe9b8f9d
Co-authored-by: Aftabbs <112916888+Aftabbs@users.noreply.github.com >
Co-authored-by: altaywtf <9790196+altaywtf@users.noreply.github.com >
Reviewed-by: @altaywtf
2026-04-09 10:17:26 +01:00
fbbb4f02d1
test: allow slower CLI metadata help rendering
2026-04-09 10:13:20 +01:00
7497abc124
test: stabilize gateway background tests
2026-04-09 10:13:20 +01:00
1b24560392
fix(status): show configured fallback models in /status output ( #33111 )
...
Merged via squash.
Prepared head SHA: 5e590aa68c734b0c513bc2f6935305a3766b4760
Co-authored-by: AnCoSONG <32268203+AnCoSONG@users.noreply.github.com >
Co-authored-by: altaywtf <9790196+altaywtf@users.noreply.github.com >
Reviewed-by: @altaywtf
2026-04-09 10:13:09 +01:00
905e56d191
fix: treat zero nextRunAtMs as invalid ( #63507 ) (thanks @WarrenJones)
...
* fix(cron): repair nextRunAtMs=0 on non-schedule edits
Treat nextRunAtMs <= 0 as invalid during non-schedule updates so editing
a description or other metadata field recomputes the next run time instead
of silently keeping the corrupt value.
Made-with: Cursor
* fix(cron): treat zero nextRunAtMs as invalid
* fix: treat zero nextRunAtMs as invalid (#63507 ) (thanks @WarrenJones)
---------
Co-authored-by: WarrenJones <8704779+WarrenJones@users.noreply.github.com >
Co-authored-by: Ayaan Zaidi <hi@obviy.us >
2026-04-09 14:39:53 +05:30
3e062acbcb
fix(fireworks): disable FirePass Kimi reasoning leak ( #63607 )
...
* fix: disable FirePass Kimi reasoning leak
* fix: preserve Fireworks wrapper fallbacks
* fix: harden Fireworks Kimi model matching
* fix: restore Fireworks payload sanitization
2026-04-09 17:09:17 +08:00
40c5edb5b1
fix: preserve safe gateway env vars on reinstall ( #63136 ) (thanks @WarrenJones)
...
* fix(daemon): preserve safe env vars on gateway reinstall
Pass the existing service environment into gateway reinstall planning so safe custom variables survive LaunchAgent rewrites and existing PATH entries are merged instead of being silently dropped.
Made-with: Cursor
* fix(daemon): track managed env keys on reinstall
* fix: preserve safe gateway env vars on reinstall (#63136 ) (thanks @WarrenJones)
* fix: validate preserved PATH entries on reinstall (#63136 ) (thanks @WarrenJones)
---------
Co-authored-by: WarrenJones <8704779+WarrenJones@users.noreply.github.com >
Co-authored-by: Ayaan Zaidi <hi@obviy.us >
2026-04-09 14:29:54 +05:30
08ae021d1f
fix(qqbot): guard image-size probe against SSRF ( #63495 )
...
* fix(qqbot): replace raw fetch in image-size probe with SSRF-guarded fetchRemoteMedia
Replace the bare fetch() in getImageSizeFromUrl() with fetchRemoteMedia()
from the plugin SDK, closing the blind SSRF via markdown image dimension
probing (GHSA-2767-2q9v-9326).
fetchRemoteMedia options: maxBytes 65536, maxRedirects 0, generic
public-network-only SSRF policy (no hostname allowlist, blocks
private/reserved/loopback/link-local/metadata IPs after DNS resolution).
Also fixes the repo-root resolution in scripts/lib/ts-guard-utils.mjs
which caused lint:tmp:no-raw-channel-fetch to miss extension files
entirely. The guard now walks up to .git instead of hardcoding two parent
traversals, and the allowlist is refreshed with all pre-existing raw
fetch callsites that became visible.
* fix(qqbot): guard image-size probe against SSRF (#63495 ) (thanks @dims)
---------
Co-authored-by: sliverp <870080352@qq.com >
2026-04-09 16:48:04 +08:00
ab49afcd27
fix: surface specific sub-issue for config validation union errors ( #40841 )
...
Merged via squash.
Prepared head SHA: 6d7da516292b19af7fcd6b9194ca17824c141ab6
Co-authored-by: Hollychou924 <128659251+Hollychou924@users.noreply.github.com >
Co-authored-by: altaywtf <9790196+altaywtf@users.noreply.github.com >
Reviewed-by: @altaywtf
2026-04-09 09:40:22 +01:00
89acb92011
test(boundary): guard src imports from bundled plugin paths
2026-04-09 09:30:45 +01:00
38100a098e
fix(qa): route cli registration through facade
2026-04-09 09:27:55 +01:00
3f7e6c7c64
fix(feishu): remove runtime api type cycle
2026-04-09 09:23:52 +01:00
60a3733f12
fix(bluebubbles): remove status type barrel cycle
2026-04-09 09:22:11 +01:00
2a372577d4
fix(memory-core): route bundled helpers through facade
2026-04-09 09:21:33 +01:00
68781bf2c2
fix: add web_fetch RFC2544 SSRF opt-in ( #61830 ) (thanks @xing-xing-coder)
2026-04-09 13:50:18 +05:30
ac3999ac8c
refactor(web-fetch): distill rfc2544 policy handling
2026-04-09 13:50:18 +05:30
9ed448088b
fix(web-fetch): finalize RFC2544 SSRF policy support
2026-04-09 13:50:18 +05:30
ce32697250
fix(openshell): split fs bridge backend types
2026-04-09 09:17:29 +01:00
62eca3770f
test(boundary): guard sdk and package imports from bundled plugin paths
2026-04-09 09:10:05 +01:00
c87994bc9a
fix(plugins): split registry type surface
2026-04-09 09:05:11 +01:00
7d6af7e154
fix(agents): split sandbox backend handle types
2026-04-09 08:52:14 +01:00
f374fff3bd
fix(browser): move browser sdk helper seams into core
2026-04-09 08:48:49 +01:00
77e0e3bac5
fix(memory): split embedding provider types
2026-04-09 08:32:32 +01:00
c1969ebf2a
fix(agents): split sandbox fs bridge types
2026-04-09 08:26:41 +01:00
dbcc574e1f
fix(agents): split embedded run shared types
2026-04-09 08:24:22 +01:00
8a07ac510b
test: isolate tasks reply registry state
2026-04-09 08:23:53 +01:00
5342cc49b1
fix(memory-host-sdk): route ollama shim through sdk runtime facade
2026-04-09 08:23:06 +01:00
3d60ed0544
fix(infra): split restart attempt types
2026-04-09 08:17:53 +01:00
04f9cc9f6c
fix(config): remove schema hints type cycle
2026-04-09 08:15:04 +01:00
2ac71d9488
fix(config): split plugin auto enable types
2026-04-09 08:13:41 +01:00
7c72b694f1
macOS: add MLX Talk provider MVP ( #63539 )
...
Merged via squash.
Prepared head SHA: da4356351315f95da6082ba8e352ed1b9375534f
Co-authored-by: ImLukeF <92253590+ImLukeF@users.noreply.github.com >
Co-authored-by: ImLukeF <92253590+ImLukeF@users.noreply.github.com >
Reviewed-by: @ImLukeF
2026-04-09 17:13:34 +10:00
2729c91ad5
test(boundary): route security audit helper through public plugin surfaces
2026-04-09 08:10:27 +01:00
714adcb124
fix(commands): split doctor allow-from mode types
2026-04-09 08:08:25 +01:00
03d056989a
test: isolate discord model picker dispatch mock
2026-04-09 08:04:53 +01:00
5ece17a865
fix(plugin-sdk): route opencode shim through core onboard helper
2026-04-09 07:57:12 +01:00
a81dc153c6
fix(cron): split isolated run result types
2026-04-09 07:50:14 +01:00
b7cc36161c
fix(agents): split skill install result types
2026-04-09 07:45:18 +01:00
ea54beb08a
fix(gateway): split hook channel types
2026-04-09 07:41:40 +01:00
1801702ed9
Matrix: gate legacy crypto migration on inspector availability
2026-04-09 01:38:58 -04:00
e30d0cffc4
fix(whatsapp): drain reconnect queue after WhatsApp reconnects ( #30806 ) ( #46299 )
...
Merged via squash.
Prepared head SHA: 5ce763406e8e0217115f0d0331176c0162106781
Co-authored-by: manuel-claw <268194568+manuel-claw@users.noreply.github.com >
Co-authored-by: mcaxtr <7562095+mcaxtr@users.noreply.github.com >
Reviewed-by: @mcaxtr
2026-04-09 02:33:36 -03:00
b7c28f3e1f
Matrix: trim dead client config exports
2026-04-09 01:28:03 -04:00
Ayaan Zaidi