- Added max-width to chat controls and session select for better layout.
- Increased CHAT_SESSIONS_ACTIVE_MINUTES from 10 to 120 for extended session duration.
- Changed brand logo source to a local favicon for improved asset management.
- Added systemPrompt for overriding the default system prompt.
- Introduced skills for pre-loaded skills management.
- Added contextFiles for handling pre-loaded context files with path and content attributes.
* Fix missing before_tool_call hook integration
- Add hook call in handleToolExecutionStart before tool execution begins
- Support parameter modification via hookResult.params
- Support tool call blocking via hookResult.block with custom blockReason
- Fix try/catch logic to properly re-throw blocking errors using __isHookBlocking flag
- Maintain tool event consistency by emitting start/end events when blocked
- Addresses GitHub issue #6535 (1 of 8 unimplemented hooks now working)
Co-Authored-By: Claude Sonnet 4 <noreply@anthropic.com>
* Add comprehensive test suite for before_tool_call hook
- 9 tests covering all hook scenarios: no hooks, parameter passing, modification, blocking, error handling
- Tests tool name normalization and different argument types
- Verifies proper error re-throwing and logging behavior
- Maintained in fork for regression testing
* Fix all issues identified by Greptile code review
Address P0/P1/P3 bugs:
P0 - Fix parameter mutation crash for non-object args:
- Normalize args to objects before passing to hooks (maintains hook contract)
- Handle parameter merging safely for both object and non-object args
P1 - Add missing internal state updates when blocking tools:
- Set toolMetaById metadata like normal flow
- Call onAgentEvent callback to maintain consistency
- Emit events in same order as normal tool execution
P1 - Fix test expectations to match implementation reality:
- Non-object args normalized to {} for hook params (not passed as-is)
- Add test for safe parameter modification with various arg types
- Update mocks to verify state updates when blocking
P3 - Replace magic __isHookBlocking property with dedicated ToolBlockedError class:
- More robust error handling without property collision risk
- Cleaner control flow that's serialization-safe
Co-Authored-By: Claude Sonnet 4 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4 <noreply@anthropic.com>
* security(web): sanitize WhatsApp accountId to prevent path traversal
Apply normalizeAccountId() from routing/session-key to
resolveDefaultAuthDir() so that malicious config values like
"../../../etc" cannot escape the intended auth directory.
Fixes#2692
* fix(web): check sanitized segment instead of full path in Windows test
* style(web): fix oxfmt formatting in accounts test
* improve exe.dev setup instructions
1. Fix device approval command
2. Clarify where Gateway token can be found
* Update device approval instructions in exe-dev.md
Clarify instructions for approving devices in OpenClaw.
- Fix @1 -> $1 in landpr.md
- Fix $@ -> $1 in reviewpr.md
- Remove stray /reviewpr line from reviewpr.md
- Delete old pr.md (replaced by reviewpr.md and landpr.md)
* docs(discord): clarify exec approvals UI
* Add link for slash command in Discord exec approvals
Updated documentation to include a link for the slash command used in Discord exec approvals.
* docs(discord): move exec approvals note
* docs(discord): document exec approvals config
* docs(discord): reorder exec approvals config
---------
Co-authored-by: Luke K (pr-0f3t) <2609441+lc0rp@users.noreply.github.com>
* docs: add device pairing section to Control UI docs
Explains that new browser connections require one-time pairing approval,
what error message users will see, and how to approve devices using the
CLI. This was a gap in the documentation that caused confusion for users
connecting via Tailscale Serve.
* docs: clarify Control UI pairing error
* docs: clarify device revoke flags
---------
Co-authored-by: Lucifer (via OpenClaw) <lucy@neuwirth.cc>
Co-authored-by: Sebastian <sebslight@gmail.com>
* Docs: Direct link to BotFather on Telegram, sparing users from searching and potentially encountering impostors.
* Update numbering syntax
Update numbering syntax to match PR to latest doc layout.
* Docs: add BotFather verification note
---------
Co-authored-by: Sebastian <sebslight@gmail.com>
* docs(install): add pnpm approve-builds step for global installs
pnpm requires explicit approval for packages with build scripts.
Without running `pnpm approve-builds -g`, openclaw and its dependencies
(node-llama-cpp, sharp, protobufjs) won't have their postinstall scripts
executed, causing runtime errors.
Fixes#5579
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* docs(install): clarify pnpm reinstall step after approve-builds
Address review feedback: after running `pnpm approve-builds -g`,
users need to re-run the install command for postinstall scripts
to actually execute.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* docs: fix anchor link for Google Vertex/Antigravity/Gemini section
* Docs: fix model provider MDX markers
---------
Co-authored-by: Sebastian <sebslight@gmail.com>
