Commit Graph

192 Commits

Author SHA1 Message Date
Peter Steinberger
1316e57403 fix: enforce inbound attachment root policy across pipelines 2026-02-19 14:15:51 +01:00
Peter Steinberger
3c419b7bd3 docs(security): document webhook hardening and changelog 2026-02-19 13:31:44 +01:00
Peter Steinberger
49d0def6d1 fix(security): harden imessage remote scp/ssh handling 2026-02-19 11:08:23 +01:00
Peter Steinberger
9c2640a810 docs: clarify WhatsApp group allowlist and reply mention behavior 2026-02-19 09:19:34 +01:00
Pejman Pour-Moezzi
a0d904dc23 docs(discord): replace quick setup and add recommended guild setup (#20088)
Co-authored-by: Shadow <shadow@openclaw.ai>
2026-02-18 09:39:09 -06:00
Peter Steinberger
bb9a539d1d Merge remote-tracking branch 'prhead/feat/slack-text-streaming'
# Conflicts:
#	docs/channels/slack.md
#	src/config/types.slack.ts
#	src/slack/monitor/message-handler/dispatch.ts
2026-02-18 00:49:30 +01:00
Shadow
2cf82c357e Docs: expand multi-agent routing 2026-02-17 14:28:08 -06:00
Onur
ab94295541 docs(slack): add assistant:write requirement for typing status 2026-02-18 02:22:54 +08:00
Sebastian
dd0b789669 fix(mattermost): surface reactions support 2026-02-17 09:30:50 -05:00
Nimrod Gutman
b2fef5ebc4 Revert "Default Telegram polls to public"
This reverts commit c43e95e011.
2026-02-17 09:38:15 +02:00
Peter Steinberger
d6226355e6 fix(slack): validate interaction payloads and handle malformed actions 2026-02-17 02:51:00 +01:00
Peter Steinberger
c0c367fde7 docs: clarify discord proxy scope for startup REST calls 2026-02-17 02:30:55 +01:00
Krish
0a02b91638 Handle Telegram poll vote updates for agent context 2026-02-16 23:54:56 +01:00
Shadow
c593709d25 Discord: add per-button component allowlist 2026-02-16 15:15:00 -06:00
Shadow
05a83b9e97 Discord: add reusable component option 2026-02-16 14:22:49 -06:00
Shadow
a61c2dc4bd Discord: add component v2 UI tool support (#17419) 2026-02-15 21:19:25 -06:00
Peter Steinberger
1b6704ef53 docs: update sandbox bind mount guidance 2026-02-16 03:05:16 +01:00
Shadow
b6069fc68c feat: support per-channel ackReaction config (#17092) (thanks @zerone0x) 2026-02-15 11:30:25 -06:00
Shadow
9203a2fdb1 Discord: CV2! (#16364) 2026-02-15 10:24:53 -06:00
Ayaan Zaidi
a69e82765f fix(telegram): stream replies in-place without duplicate final sends 2026-02-15 20:32:51 +05:30
Peter Steinberger
ddfdd20d79 docs: update Slack/Discord allowFrom references 2026-02-15 03:49:33 +01:00
Peter Steinberger
6a1ad2b499 docs(matrix): clarify allowlist requires full MXIDs 2026-02-14 22:13:41 +01:00
Peter Steinberger
2a1ed0ed41 docs(whatsapp): document account-level dmPolicy precedence 2026-02-14 21:09:30 +01:00
Peter Steinberger
21f0e3fa0c docs: prefer Slack/Discord dmPolicy keys 2026-02-14 21:04:27 +01:00
Peter Steinberger
743f4b2849 fix(security): harden BlueBubbles webhook auth behind proxies 2026-02-14 19:47:51 +01:00
Shadow
5ba72bd9bf fix: add discord exec approval channel targeting (#16051) (thanks @leonnardo) 2026-02-14 12:05:53 -06:00
Mariano
71f357d949 bluebubbles: harden local media path handling against LFI (#16322)
* bluebubbles: harden local media path handling

* bluebubbles: remove racy post-open symlink lstat

* fix: bluebubbles mediaLocalRoots docs + typing fix (#16322) (thanks @mbelinky)
2026-02-14 17:43:44 +00:00
Peter Steinberger
bfa7d21e99 fix(security): harden tlon Urbit requests against SSRF 2026-02-14 18:42:10 +01:00
Peter Steinberger
226bf74634 docs(telegram): document allowlist id requirement 2026-02-14 16:51:59 +01:00
Peter Steinberger
e3b432e481 fix(telegram): require sender ids for allowlist auth 2026-02-14 16:09:00 +01:00
Robby
09e1cbc35d fix(cron): pass agent identity through delivery path (#16218) (#16242)
* fix(cron): pass agent identity through delivery path

Cron delivery messages now include agent identity (name, avatar) in
outbound messages. Identity fields are passed best-effort for Slack
(graceful fallback if chat:write.customize scope is missing).

Fixes #16218

* fix: fix Slack cron delivery identity (#16242) (thanks @robbyczgw-cla)

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-02-14 16:08:51 +01:00
Peter Steinberger
c8424bf29a fix(googlechat): deprecate users/<email> allowlists (#16243) 2026-02-14 15:31:26 +01:00
Aldo
7b39543e8d fix(reply): honour explicit [[reply_to_*]] tags when replyToMode is off (#16174)
Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: 778fc2559a
Co-authored-by: aldoeliacim <17973757+aldoeliacim@users.noreply.github.com>
Co-authored-by: steipete <58493+steipete@users.noreply.github.com>
Reviewed-by: @steipete
2026-02-14 13:29:42 +01:00
Pejman Pour-Moezzi
c17a109daa fix: align extension plugin and docs with new replyToMode default
Update the Telegram extension channel plugin fallback and documentation
to reflect the new "off" default, as flagged by Greptile review.
2026-02-13 23:31:17 -08:00
大猫子
dbe026214f fix(routing): exclude peer-specific bindings from guild-wide matching (#15274)
* fix(routing): exclude peer-specific bindings from guild-wide matching (#14752)

* fix(routing): enforce binding scope AND semantics + regressions

* fix(routing): document strict binding-scope behavior (#15274) (thanks @lailoo)

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-02-14 03:05:09 +01:00
Monty Taylor
caf5d2dd7c feat(matrix): Add multi-account support to Matrix channel
The Matrix channel previously hardcoded `listMatrixAccountIds` to always
return only `DEFAULT_ACCOUNT_ID`, ignoring any accounts configured in
`channels.matrix.accounts`. This prevented running multiple Matrix bot
accounts simultaneously.

Changes:
- Update `listMatrixAccountIds` to read from `channels.matrix.accounts`
  config, falling back to `DEFAULT_ACCOUNT_ID` for legacy single-account
  configurations
- Add `resolveMatrixConfigForAccount` to resolve config for a specific
  account ID, merging account-specific values with top-level defaults
- Update `resolveMatrixAccount` to use account-specific config when
  available
- The multi-account config structure (channels.matrix.accounts) was not
  defined in the MatrixConfig type, causing TypeScript to not recognize
  the field. Added the accounts field to properly type the multi-account
  configuration.
- Add stopSharedClientForAccount() to stop only the specific account's
  client instead of all clients when an account shuts down
- Wrap dynamic import in try/finally to prevent startup mutex deadlock
  if the import fails
- Pass accountId to resolveSharedMatrixClient(), resolveMatrixAuth(),
  and createMatrixClient() to ensure the correct account's credentials
  are used for outbound messages
- Add accountId parameter to resolveMediaMaxBytes to check account-specific
  config before falling back to top-level config
- Maintain backward compatibility with existing single-account setups

This follows the same pattern already used by the WhatsApp channel for
multi-account support.

Fixes #3165
Fixes #3085

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-13 20:39:58 +01:00
Peter Steinberger
e0c04c62c9 docs(signal): improve setup, verification, and troubleshooting guidance 2026-02-13 20:38:56 +01:00
Shadow
c82cd9e5d1 Docs: add discord presence config notes (#10855) 2026-02-13 13:34:19 -06:00
Shadow
5645f227f6 Discord: add gateway proxy docs and tests (#10400) (thanks @winter-loo) 2026-02-13 13:26:51 -06:00
Shadow
1c9c01ff49 Discord: refine voice message handling 2026-02-13 12:44:14 -06:00
David Rudduck
5643a93479 fix(security): default standalone servers to loopback bind (#13184)
* fix(security): default standalone servers to loopback bind (#4)

Change canvas host and telegram webhook default bind from 0.0.0.0
(all interfaces) to 127.0.0.1 (loopback only) to prevent unintended
network exposure when no explicit host is configured.

* fix: restore telegram webhook host override while keeping loopback defaults (openclaw#13184) thanks @davidrudduck

* style: format telegram docs after rebase (openclaw#13184) thanks @davidrudduck

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-02-13 16:39:56 +01:00
Hyojin Kwak
73c6c80b77 Docs: add User.Read.All permission info for MS Teams user mentions
Clarify that User.Read.All permission is only needed for searching
users not in the current conversation. Mentions work out of the box
for conversation participants.
2026-02-13 15:10:57 +01:00
Masataka Shinohara
b93ad2cd48 fix(slack): populate thread session with existing thread history (#7610)
* feat(slack): populate thread session with existing thread history

When a new session is created for a Slack thread, fetch and inject
the full thread history as context. This preserves conversation
continuity so the bot knows what it previously said in the thread.

- Add resolveSlackThreadHistory() to fetch all thread messages
- Add ThreadHistoryBody to context payload
- Use thread history instead of just thread starter for new sessions

Fixes #4470

* chore: remove redundant comments

* fix: use threadContextNote in queue body

* fix(slack): address Greptile review feedback

- P0: Use thread session key (not base session key) for new-session check
  This ensures thread history is injected when the thread session is new,
  even if the base channel session already exists.

- P1: Fetch up to 200 messages and take the most recent N
  Slack API returns messages in chronological order (oldest first).
  Previously we took the first N, now we take the last N for relevant context.

- P1: Batch resolve user names with Promise.all
  Avoid N sequential API calls when resolving user names in thread history.

- P2: Include file-only messages in thread history
  Messages with attachments but no text are now included with a placeholder
  like '[attached: image.png, document.pdf]'.

- P2: Add documentation about intentional 200-message fetch limit
  Clarifies that we intentionally don't paginate; 200 covers most threads.

* style: add braces for curly lint rule

* feat(slack): add thread.initialHistoryLimit config option

Allow users to configure the maximum number of thread messages to fetch
when starting a new thread session. Defaults to 20. Set to 0 to disable
thread history fetching entirely.

This addresses the optional configuration request from #2608.

* chore: trigger CI

* fix(slack): ensure isNewSession=true on first thread turn

recordInboundSession() in prepare.ts creates the thread session entry
before session.ts reads the store, causing isNewSession to be false
on the very first user message in a thread. This prevented thread
context (history/starter) from being injected.

Add IsFirstThreadTurn flag to message context, set when
readSessionUpdatedAt() returns undefined for the thread session key.
session.ts uses this flag to force isNewSession=true.

* style: format prepare.ts for oxfmt

* fix: suppress InboundHistory/ThreadStarterBody when ThreadHistoryBody present (#13912)

When ThreadHistoryBody is fetched from the Slack API (conversations.replies),
it already contains pending messages and the thread starter. Passing both
InboundHistory and ThreadStarterBody alongside ThreadHistoryBody caused
duplicate content in the LLM context on new thread sessions.

Suppress InboundHistory and ThreadStarterBody when ThreadHistoryBody is
present, since it is a strict superset of both.

* remove verbose comment

* fix(slack): paginate thread history context fetch

* fix(slack): wire session file path options after main merge

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-02-13 05:51:04 +01:00
Peter Steinberger
daf13dbb06 fix: enforce feishu dm policy + pairing flow (#14876) (thanks @coygeek) 2026-02-13 05:48:22 +01:00
Shadow
22fe30c1df fix: add discord role allowlists (#10650) (thanks @Minidoracat) 2026-02-12 19:52:24 -06:00
Seb Slight
6758b6bfe4 docs(channels): modernize imessage docs page (#14213) 2026-02-11 12:58:02 -05:00
Seb Slight
2c6569a488 docs(channels): modernize slack docs page (#14205) 2026-02-11 12:49:10 -05:00
Seb Slight
8c963dc5a6 docs(channels): modernize whatsapp docs page (#14202) 2026-02-11 12:31:56 -05:00
Seb Slight
6bee638648 docs(channels): modernize discord docs page (#14190) 2026-02-11 12:12:31 -05:00
Seb Slight
a98d7c26df docs(channels): fix telegram card icon (#14193) 2026-02-11 12:10:52 -05:00