226 Commits

Author SHA1 Message Date
Vincent Koc
ce2a39a271 Security: bump hono for timing-safe auth hardening 2026-02-19 15:13:38 -08:00
Peter Steinberger
d9046f0d2a chore(deps): update dependencies to latest 2026-02-19 14:46:16 +01:00
Vincent Koc
3904d7ca06 deps: migrate request to @cypress/request (#20836) 2026-02-19 02:41:13 -08:00
Vincent Koc
942ed89277 deps: update overrides for minimatch and fast-xml-parser (#20832) 2026-02-19 02:31:20 -08:00
Peter Steinberger
653add918b chore: bump workspace dependencies 2026-02-18 01:59:08 +01:00
Nimrod Gutman
5db95cd8d5 fix(extensions): revert openai codex auth plugin (PR #18009) 2026-02-17 10:40:13 +02:00
Peter Steinberger
2992639f88 Revert "feat: add Linq channel — real iMessage via API, no Mac required"
This reverts commit d4a142fd8f.
2026-02-17 02:30:55 +01:00
cpojer
1e13a3933c chore: Update deps. 2026-02-17 09:14:42 +09:00
Ralph
45b3c883b8 fix: regenerate pnpm lockfile 2026-02-17 00:01:00 +01:00
boris
4cd75d5d0f fix: remove accidental openclaw link dependency 2026-02-17 00:00:57 +01:00
boris
ffe700bf94 fix: use proper pi-mono dark theme colors for export HTML 2026-02-17 00:00:57 +01:00
George McCain
d4a142fd8f feat: add Linq channel — real iMessage via API, no Mac required
Adds a complete Linq iMessage channel adapter that replaces the existing
iMessage channel's Mac Mini + dedicated Apple ID + SSH wrapper + Full Disk
Access setup with a single API key and phone number.

Core implementation (src/linq/):
- types.ts: Linq webhook event and message types
- accounts.ts: Multi-account resolution from config (env/file/inline token)
- send.ts: REST outbound via Linq Blue V3 API (messages, typing, reactions)
- probe.ts: Health check via GET /v3/phonenumbers
- monitor.ts: Webhook HTTP server with HMAC-SHA256 signature verification,
  replay protection, inbound debouncing, and full dispatch pipeline integration

Extension plugin (extensions/linq/):
- ChannelPlugin implementation with config, security, setup, outbound,
  gateway, and status adapters
- Supports direct and group chats, reactions, and media

Wiring:
- Channel registry, dock, config schema, plugin-sdk exports, and plugin
  runtime all updated to include the new linq channel

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-16 23:52:56 +01:00
Shadow
d3707147c0 chore: update carbon 2026-02-16 12:45:08 -06:00
Peter Steinberger
fb6dba2058 fix(ci): align tar override and lockfile to 7.5.9 2026-02-16 05:30:02 +01:00
Peter Steinberger
61a865031f fix: sync pnpm lockfile for docker onboard 2026-02-16 04:45:42 +01:00
Peter Steinberger
ab1dc89a2d chore(deps): update dependencies 2026-02-16 04:15:03 +01:00
cpojer
c07036e813 chore: Update deps. 2026-02-16 09:03:29 +09:00
Vignesh Natarajan
f50db0e835 Lockfile: sync msteams specifiers 2026-02-14 17:11:44 -08:00
Peter Steinberger
d9d321f94b chore(security): bump qs and golang.org/x/net 2026-02-14 21:22:46 +01:00
Peter Steinberger
185792b6cd chore(deps): update dependencies 2026-02-14 21:10:20 +01:00
Peter Steinberger
bfa7d21e99 fix(security): harden tlon Urbit requests against SSRF 2026-02-14 18:42:10 +01:00
Tanwa Arpornthip
c76288bdf1 fix(slack): download all files in multi-image messages (#15447)
* fix(slack): download all files in multi-image messages

resolveSlackMedia() previously returned after downloading the first
file, causing multi-image Slack messages to lose all but the first
attachment. This changes the function to collect all successfully
downloaded files into an array, matching the pattern already used by
Telegram, Line, Discord, and iMessage adapters.

The prepare handler now populates MediaPaths, MediaUrls, and
MediaTypes arrays so downstream media processing (vision, sandbox
staging, media notes) works correctly with multiple attachments.

Fixes #11892, #7536

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(slack): preserve MediaTypes index alignment with MediaPaths/MediaUrls

The filter(Boolean) on MediaTypes removed entries with undefined contentType,
shrinking the array and breaking index correlation with MediaPaths and MediaUrls.
Downstream code (media-note.ts, attachments.ts) requires these arrays to have
equal lengths for correct per-attachment MIME type lookup. Replace filter(Boolean)
with a nullish coalescing fallback to "application/octet-stream".

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(slack): align MediaType fallback and tests (#15447) (thanks @CommanderCrowCode)

* fix: unblock plugin-sdk account-id typing (#15447)

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-02-14 14:16:02 +01:00
ludd50155
0cb69b0f28 Discord: add gateway proxy support
Conflicts:
	package.json
	pnpm-lock.yaml
	src/config/schema.ts
	src/discord/monitor/provider.ts
2026-02-13 13:26:51 -06:00
cpojer
7b34b46363 chore: Update deps. 2026-02-13 09:43:41 +09:00
Peter Steinberger
722c010b95 chore(deps): update dependencies 2026-02-12 22:58:42 +01:00
Tak Hoffman
18610a587d chore: refresh lockfile after feishu dep removal (openclaw#14423) thanks @jackcooper2015
Co-authored-by: jack-cooper <10961327+jackcooper2015@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
2026-02-11 22:53:40 -06:00
cpojer
9df89ceda2 chore: Update deps. 2026-02-12 09:15:12 +09:00
Vignesh
fa906b26ad feat: IRC — add first-class channel support
Adds IRC as a first-class channel with core config surfaces (schema/hints/dock), plugin auto-enable detection, routing/policy alignment, and docs/tests.

Co-authored-by: Vignesh <vigneshnatarajan92@gmail.com>
2026-02-10 17:33:57 -06:00
quotentiroler
8fad4c2844 chore(deps): update dependencies, remove hono pinning 2026-02-09 19:35:37 -08:00
cpojer
fa21050af0 chore: Update deps. 2026-02-10 08:52:07 +09:00
cpojer
0244d521a1 chore: Fix lockfile + pnpm dedupe. 2026-02-09 10:00:53 +09:00
cpojer
3573f26d40 chore: Update deps. 2026-02-09 09:58:58 +09:00
max
28e1a65ebc chore: project hygiene — fix workspace:*, sandbox USER, dead config (#11289)
* chore: project hygiene fixes (workspace:*, sandbox USER, dead config)

* chore: also fix workspace:* in zalouser dependencies
2026-02-08 02:36:42 -08:00
Gustavo Madeira Santana
ff80646085 chore: bump pi to 0.52.8 2026-02-07 15:41:27 -05:00
Peter Steinberger
0dd7033521 chore(lockfile): fix pnpm-lock 2026-02-06 17:56:22 -08:00
Peter Steinberger
94b2fc14f2 chore(deps): bump carbon beta 2026-02-06 16:56:25 -08:00
Peter Steinberger
dca8cf958b chore(deps): update deps 2026-02-06 16:37:56 -08:00
Yifeng Wang
7e005acd3c chore: update pnpm-lock.yaml for feishu extension deps
Add lockfile entries for:
- @larksuiteoapi/node-sdk@^1.56.1
- @sinclair/typebox@0.34.47
- zod@^4.3.6

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-06 09:32:10 +09:00
cpojer
6f4665dda3 chore: Update deps. 2026-02-06 09:11:46 +09:00
Gustavo Madeira Santana
3299aeb904 Agents: bump pi-mono to 0.52.5 (#9949)
* Agents: bump pi-mono to 0.52.5

* Changelog: add PR reference for pi bump
2026-02-05 17:36:25 -05:00
Gustavo Madeira Santana
4629054403 chore: apply local workspace updates (#9911)
* chore: apply local workspace updates

* fix: resolve prep findings after rebase (#9898) (thanks @gumadeiras)

* refactor: centralize model allowlist normalization (#9898) (thanks @gumadeiras)

* fix: guard model allowlist initialization (#9911)

* docs: update changelog scope for #9911

* docs: remove model names from changelog entry (#9911)

* fix: satisfy type-aware lint in model allowlist (#9911)
2026-02-05 16:54:44 -05:00
Michael Lee
eb80b9acb3 feat: add Claude Opus 4.6 to built-in model catalog (#9853)
* feat: add Claude Opus 4.6 to built-in model catalog

- Update default model from claude-opus-4-5 to claude-opus-4-6
- Add opus-4.6 model ID normalization
- Add claude-opus-4-6 to live model filter prefixes
- Update image tool to prefer claude-opus-4-6 for vision
- Add CLI backend alias for opus-4.6
- Update onboard auth default selections to include opus-4.6
- Update model picker placeholder

Closes #9811

* test: update tests for claude-opus-4-6 default

- Fix model-alias-defaults test to use claude-opus-4-6
- Fix image-tool test to expect claude-opus-4-6 in fallbacks

* feat: support claude-opus-4-6

* docs: update changelog for opus 4.6 (#9853) (thanks @TinyTb)

* chore: bump pi to 0.52.0

---------

Co-authored-by: Slurpy <slurpy@openclaw.ai>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-02-05 12:09:23 -08:00
cpojer
460808e0c8 Update deps. 2026-02-05 19:44:08 +09:00
Gustavo Madeira Santana
38e6da1fe0 TUI/Gateway: fix pi streaming + tool routing + model display + msg updating (#8432)
* TUI/Gateway: fix pi streaming + tool routing

* Tests: clarify verbose tool output expectation

* fix: avoid seq gaps for targeted tool events (#8432) (thanks @gumadeiras)
2026-02-04 17:12:16 -05:00
Josh Palmer
0223416c61 Channels: finish Feishu/Lark integration 2026-02-03 14:27:39 -08:00
cpojer
a03d852d65 chore: Migrate to tsdown, speed up JS bundling by ~10x (thanks @hyf0).
The previous migration to tsdown was reverted because it caused a ~20x slowdown when running OpenClaw from the repo. @hyf0 investigated and found that simply renaming the `dist` folder also caused the same slowdown. It turns out the Plugin script loader has a bunch of voodoo vibe logic to determine if it should load files from source and compile them, or if it should load them from dist. When building with tsdown, the filesystem layout is different (bundled), and so some files weren't in the right location, and the Plugin script loader decided to compile source files from scratch using Jiti.

The new implementation uses tsdown to embed `NODE_ENV: 'production'`, which we now use to determine if we are running OpenClaw from a "production environmen" (ie. from dist). This removes the slop in favor of a deterministic toggle, and doesn't rely on directory names or similar.

There is some code reaching into `dist` to load specific modules, primarily in the voice-call extension, which I simplified into loading an "officially" exported `extensionAPI.js` file. With tsdown, entry points need to be explicitly configured, so we should be able to avoid sloppy code reaching into internals from now on. This might break some existing users, but if it does, it's because they were using "private" APIs.
2026-02-03 20:18:16 +09:00
cpojer
9e3ea2687c chore: Update deps. 2026-02-03 09:09:03 +09:00
cpojer
bd259eeb23 chore: Update deps. 2026-02-02 11:11:12 +09:00
Mario Zechner
cf1d3f7a7c fix: update pi packages to 0.51.0, remove bogus type augmentation
- Update @mariozechner/pi-agent-core, pi-ai, pi-coding-agent, pi-tui to 0.51.0
- Delete src/types/pi-coding-agent.d.ts (declared additionalExtensionPaths which SDK never supported)
- Fix ToolDefinition.execute signature (parameter order changed in 0.51.0)
- Remove dead additionalExtensionPaths from createAgentSession calls
2026-02-02 01:52:33 +01:00
Peter Steinberger
e550e252a7 Revert "fix: override request dependency"
This reverts commit e4d572192d.
2026-02-01 14:35:04 -08:00