Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2697 commits
Select commit Hold shift + click to select a range
bd4fdfc
test(reply): dedupe compaction session fixture setup
steipete Feb 19, 2026
781b1c1
test(memory): dedupe voyage embedding provider test setup
steipete Feb 19, 2026
7e54b6c
fix(browser): unify extension relay auth on gateway token
steipete Feb 19, 2026
ff1189c
test: remove duplicate inbound-meta coverage from reply-flow
steipete Feb 19, 2026
1c04f5f
style: format extension relay imports
steipete Feb 19, 2026
3cb0c96
test(image-tool): dedupe repeated image tool fixture assertions
steipete Feb 19, 2026
d7b2efc
test(agents): dedupe ping-pong loop test scaffolding
steipete Feb 19, 2026
ccd68d8
test(subagents): dedupe sessions_spawn model expectation paths
steipete Feb 19, 2026
57ea6fe
test(gateway): dedupe startup auth override token checks
steipete Feb 19, 2026
8d7df30
test: remove duplicate target-resolution cases from outbound suite
steipete Feb 19, 2026
9bd2261
fix(ios): auto-generate local signing overrides (#20716)
ngutman Feb 19, 2026
ca71b5c
test(shell-env): dedupe repeated login-shell path lookups
steipete Feb 19, 2026
bbb07bd
test(media): dedupe active-model fallback resolver setup
steipete Feb 19, 2026
18d4ad6
test: trim duplicate cross-context policy cases
steipete Feb 19, 2026
a82a412
test(web): dedupe creds-update trigger helper in session tests
steipete Feb 19, 2026
9a490fb
test: drop duplicate followup compaction token assertion
steipete Feb 19, 2026
5f2bcfc
ci: skip bun bootstrap in check and docs-check jobs
steipete Feb 19, 2026
b97b890
test: remove duplicate telegram .co link formatting case
steipete Feb 19, 2026
2cbf15e
ci: pin bun setup version to avoid API rate-limit flakes
steipete Feb 19, 2026
221d50b
fix: preserve assistant partial stream during reasoning
obviyus Feb 19, 2026
0ff5061
fix: clear matched tool errors and dedupe reasoning end
vignesh07 Feb 19, 2026
d3dab08
fix: preserve reasoning stream partial contract (#20635) (thanks @obv…
vignesh07 Feb 19, 2026
b78fa57
test: remove duplicate telegram de-linkify case
steipete Feb 19, 2026
ad4c784
test: collapse duplicate gateway token-generation cases
steipete Feb 19, 2026
9c2640a
docs: clarify WhatsApp group allowlist and reply mention behavior
steipete Feb 19, 2026
4e5cffe
test: fix flaky run-node spawn side-effects
steipete Feb 19, 2026
ab924eb
test(infra): dedupe outbound recovery test scaffolding
steipete Feb 19, 2026
644d037
test(config): dedupe OPENCLAW_HOME path assertions
steipete Feb 19, 2026
8bb1747
test(gateway): dedupe assistant chat event assertions
steipete Feb 19, 2026
d8b720c
test(config): dedupe model provider fixture setup
steipete Feb 19, 2026
733e385
test(hooks): dedupe gmail runtime path assertions
steipete Feb 19, 2026
edce5a5
test(cron): dedupe applyJobPatch fixture setup
steipete Feb 19, 2026
e0c3cc4
test(browser): dedupe auth mode no-token assertions
steipete Feb 19, 2026
3c7c45e
test(gateway): dedupe config.apply request scaffolding
steipete Feb 19, 2026
69e6da0
test(auto-reply): dedupe heartbeat typing flow setup
steipete Feb 19, 2026
53a4e51
test(agents): dedupe tool image fixture setup
steipete Feb 19, 2026
a76f552
test(agents): dedupe workspace memory-entry assertions
steipete Feb 19, 2026
1481160
test(cli): dedupe browser state command setup
steipete Feb 19, 2026
fe3bd9d
test: merge duplicate gateway token coercion checks
steipete Feb 19, 2026
47bbef3
test: merge duplicate undefined api-key persistence checks
steipete Feb 19, 2026
c4c2060
test(agents): dedupe sessions_spawn requester run setup
steipete Feb 19, 2026
3cfcb25
test(agents): dedupe transcript duplicate-tool fixtures
steipete Feb 19, 2026
7d12c5e
test: remove duplicate extra-high think-level case
steipete Feb 19, 2026
cdee433
test(browser): dedupe explicit auth-mode auto-token checks
steipete Feb 19, 2026
e4bb6e0
test(cron): dedupe delayed-timer job assertions
steipete Feb 19, 2026
65cf56d
test(agents): dedupe generic repeat loop fixtures
steipete Feb 19, 2026
647a46a
ci: skip bun setup for windows checks
steipete Feb 19, 2026
072b16b
ci: use git context for docker metadata extraction
steipete Feb 19, 2026
64546d3
test(cli): dedupe cron edit existing-job lookup mocks
steipete Feb 19, 2026
13f2fa0
ci: avoid bun setup API flake in node checks
steipete Feb 19, 2026
2ddc13c
feat(ui): add update warning banner to control dashboard
orlyjamie Feb 19, 2026
586b1f6
ci: drop docker metadata action to avoid API throttling
steipete Feb 19, 2026
429b878
test(agents): dedupe avatar and compaction fixtures
steipete Feb 19, 2026
50805d8
test(agents): dedupe patch and cli credential assertions
steipete Feb 19, 2026
c9b5def
test(agents): dedupe openai reasoning replay fixtures
steipete Feb 19, 2026
d1cb779
test(agents): dedupe embedded runner and sessions lifecycle fixtures
steipete Feb 19, 2026
34ddf0e
style: format gateway health state and ui render
steipete Feb 19, 2026
28377b1
test: merge logger subsystem prefix drop cases
steipete Feb 19, 2026
5e7cffc
test: merge duplicate plugin memory-none cases
steipete Feb 19, 2026
cfc5e7b
fix(media): harden saveMediaSource against symlink TOCTOU
steipete Feb 19, 2026
5a98a79
Remove triage order section from PR_WORKFLOW.md
gumadeiras Feb 19, 2026
4344699
build: regenerate swift protocol models for updateAvailable
steipete Feb 19, 2026
f57ba32
ci: skip bun matrix lane on push
steipete Feb 19, 2026
b41fd20
test(agents): share assistant error message test fixture
steipete Feb 19, 2026
745068a
test(agents): share overflow retry compaction fixture
steipete Feb 19, 2026
47bfb76
ci: skip bun matrix steps on push runs
steipete Feb 19, 2026
4cd5fad
style: sort media store test imports
steipete Feb 19, 2026
d51929e
fix: block ISATAP SSRF bypass via shared host/ip guard
steipete Feb 19, 2026
18179fc
ci: move bun push-skip condition out of job-level matrix if
steipete Feb 19, 2026
b4dbe03
refactor: unify restart gating and update availability sync
steipete Feb 19, 2026
0900ec3
test(agents): dedupe copilot models-config token setup
steipete Feb 19, 2026
4c539f6
test(agents): dedupe subagent registry test mocks
steipete Feb 19, 2026
6f568f3
test(agents): dedupe media and thinking sanitize test setup
steipete Feb 19, 2026
749edf2
test: dedupe repeated onboarding provider config cases
steipete Feb 19, 2026
317b7d3
test(agents): dedupe subscribe reasoning tag fixtures
steipete Feb 19, 2026
90b05b1
test: collapse duplicate onboard auth assertions
steipete Feb 19, 2026
c821099
Feishu: harden temp media download paths
Feb 19, 2026
65a7fc6
Changelog: note Feishu traversal hardening
Feb 19, 2026
bf3f8ec
refactor(media): unify safe local file reads
steipete Feb 19, 2026
b96419f
test(agents): share pi-tools sandbox fixture context
steipete Feb 19, 2026
947e11c
test(gateway): dedupe agent payload and stream fixtures
steipete Feb 19, 2026
ba7be01
fix(security): remove lobster windows shell fallback
steipete Feb 19, 2026
c241bf0
test: dedupe voice-call provider config validation cases
steipete Feb 19, 2026
b4792c7
style: format fs-safe and web media
steipete Feb 19, 2026
d05c8eb
refactor: unify SSRF hostname/ip precheck and add policy regression
steipete Feb 19, 2026
8b34719
style: apply oxfmt import ordering for ci
steipete Feb 19, 2026
f38e1a8
chore(format): align oxfmt local/CI behavior (#12579)
vincentkoc Feb 19, 2026
6b14498
test(lobster): use lobster.exe in windows plugin path case
steipete Feb 19, 2026
8e6d1e6
LINE/Security: harden inbound media temp-file naming (#20792)
mbelinky Feb 19, 2026
96a3d5b
test: collapse duplicate unhandled rejection fatal cases
steipete Feb 19, 2026
02123e5
refactor(lobster): extract windows spawn resolver
steipete Feb 19, 2026
7255c20
fix(docker): harden docker-setup mount validation
steipete Feb 19, 2026
0c1d3b8
test(bluebubbles): collapse duplicate credential and chatGuid cases
steipete Feb 19, 2026
150a76c
test(agents): add shared subscribe stream emit helpers
steipete Feb 19, 2026
fa72679
refactor(agents): dedupe pi subscribe e2e stream fixtures
steipete Feb 19, 2026
32ba62d
test(bluebubbles): merge setGroupIcon credential checks
steipete Feb 19, 2026
981d266
security(gateway): block webchat session mutators (#20800)
vincentkoc Feb 19, 2026
c06ad38
test(voice-call): merge provider credential source cases
steipete Feb 19, 2026
c275932
fix(security): OC-22 prevent Zip Slip and symlink following in skill …
aether-ai-agent Feb 19, 2026
ee1d642
fix(security): enforce symlink-safe skill packaging
steipete Feb 19, 2026
a7c0aa9
refactor(security): share safe temp media path builder (#20810)
mbelinky Feb 19, 2026
88f6989
fix(otel): sanitize OTLP endpoint URL resolution (#13791)
vincentkoc Feb 19, 2026
be7462a
Gateway: clarify launchctl domain bootstrap error (#13795)
vincentkoc Feb 19, 2026
70900fe
refactor(daemon): share service arg types across backends
steipete Feb 19, 2026
1b46f7d
refactor(daemon): simplify gateway service backend delegates
steipete Feb 19, 2026
cdb00fe
fix(feishu): isolate temp download writes in mkdtemp dirs
steipete Feb 19, 2026
49d0def
fix(security): harden imessage remote scp/ssh handling
steipete Feb 19, 2026
53aecf7
test(bluebubbles): merge typing start stop method checks
steipete Feb 19, 2026
771af40
chore(ci): fix main check blockers and stabilize tests
steipete Feb 19, 2026
45db2aa
Security: disable plugin runtime command execution primitive (#20828)
mbelinky Feb 19, 2026
e8e343a
test(ci): fix launchd and diagnostics-otel test harnesses
steipete Feb 19, 2026
da341bf
test(daemon): dedupe service path cases and bootstrap failures
steipete Feb 19, 2026
a14dcaf
Format: fix import ordering in two files (#20829)
vincentkoc Feb 19, 2026
942ed89
deps: update overrides for minimatch and fast-xml-parser (#20832)
vincentkoc Feb 19, 2026
1faa7a8
lobster: parse windows cmd shim paths with rooted tokens (#20833)
vincentkoc Feb 19, 2026
de656e3
fix(otel): complete diagnostics-otel OpenTelemetry v2 API migration (…
vincentkoc Feb 19, 2026
3904d7c
deps: migrate request to @cypress/request (#20836)
vincentkoc Feb 19, 2026
267bb3c
changelog: backfill PR release-note entries (#20839)
vincentkoc Feb 19, 2026
f7a7a28
fix: enforce hooks token separation from gateway auth (#20813)
coygeek Feb 19, 2026
9edec67
fix(security): block plaintext WebSocket connections to non-loopback …
jscaldwell55 Feb 19, 2026
baf4a79
fix(security): use YAML core schema to prevent type coercion (#20857)
davidrudduck Feb 19, 2026
f1e1ad7
fix(security): SHA-256 hash before timingSafeEqual to prevent length …
davidrudduck Feb 19, 2026
ee6d0bd
fix(security): escape backticks in exec-approval command previews (#2…
davidrudduck Feb 19, 2026
fb35635
Security: use execFileSync instead of execSync with shell strings (#2…
mahanandhi Feb 19, 2026
57102cb
Security: use crypto.randomBytes for temp file names (#20654)
mahanandhi Feb 19, 2026
e955582
security: add baseline security headers to gateway HTTP responses (#1…
thebenignhacker Feb 19, 2026
db73402
Security: add explicit opt-in for deprecated plugin runtime exec (#20…
mbelinky Feb 19, 2026
825cc70
test: dedupe gateway auth and sessions patch coverage (#20087)
habakan Feb 19, 2026
3feb7fc
fix(matrix): detect mentions in formatted_body matrix.to links (#16941)
zerone0x Feb 19, 2026
466a1e1
fix(clawdock): include docker-compose.extra.yml in helper commands (#…
zerone0x Feb 19, 2026
043b2f5
changelog: add unreleased fixes from recent PRs (#20897)
vincentkoc Feb 19, 2026
e0aaf2d
fix(security): block prototype-polluting keys in deepMerge (#20853)
davidrudduck Feb 19, 2026
a23e0d5
fix(security): harden feishu and zalo webhook ingress
steipete Feb 19, 2026
aa26781
test(security): add webhook hardening regressions
steipete Feb 19, 2026
3c419b7
docs(security): document webhook hardening and changelog
steipete Feb 19, 2026
6195660
fix(browser): unify SSRF guard path for navigation
steipete Feb 19, 2026
badafdc
refactor: dedupe provider usage fetch logic and tests
steipete Feb 19, 2026
9f9cd5c
refactor(browser): unify navigation guard path and error typing
steipete Feb 19, 2026
ec232a9
refactor(security): harden temp-path handling for inbound media
steipete Feb 19, 2026
3c127b6
test: dedupe provider usage tests and expand coverage
steipete Feb 19, 2026
cfe8457
fix(security): harden safeBins stdin-only enforcement
steipete Feb 19, 2026
1316e57
fix: enforce inbound attachment root policy across pipelines
steipete Feb 19, 2026
bafdbb6
fix(security): eliminate safeBins file-existence oracle
steipete Feb 19, 2026
b45bb68
fix(doctor): skip embedding provider check when QMD backend is active…
miloudbelarebia Feb 19, 2026
fec48a5
refactor(exec): split host flows and harden safe-bin trust
steipete Feb 19, 2026
808a60d
docs: clarify intentional network-visible canvas model in security po…
steipete Feb 19, 2026
e3e0ffd
feat(security): audit gateway HTTP no-auth exposure
steipete Feb 19, 2026
0e85380
style: format files and fix safe-bins e2e typing
steipete Feb 19, 2026
2d485cd
refactor(security): extract safe-bin policy and dedupe tests
steipete Feb 19, 2026
14b4c7f
refactor: dedupe provider usage auth/fetch logic and expand coverage
steipete Feb 19, 2026
ff74d89
fix: harden gateway control-plane restart protections
steipete Feb 19, 2026
268b0dc
style: fix formatting drift in security allowlist checks
steipete Feb 19, 2026
7c9130f
docs: require SECURITY.md before GHSA reviews
steipete Feb 19, 2026
74c51ae
style: format gateway server methods
steipete Feb 19, 2026
165c188
refactor(security): simplify safe-bin validation structure
steipete Feb 19, 2026
a40c10d
fix: harden agent gateway authorization scopes
steipete Feb 19, 2026
08a7967
fix(security): fail closed on gateway bind fallback and tighten canva…
steipete Feb 19, 2026
758ea3c
style: apply oxfmt import ordering for check
steipete Feb 19, 2026
cf6edc6
docs(changelog): credit allsmog for Lobster security report
steipete Feb 19, 2026
722a898
refactor: dedupe openclaw root traversal and add coverage
steipete Feb 19, 2026
177654f
refactor: dedupe APNs push send flow and add wake default test
steipete Feb 19, 2026
d9046f0
chore(deps): update dependencies to latest
steipete Feb 19, 2026
182ffdf
test: dedupe zai env test setup and cover blank legacy key
steipete Feb 19, 2026
0bda020
fix(security): require explicit approval for device access upgrades
steipete Feb 19, 2026
4ddc4df
test: dedupe fetch cleanup-throw signal harness
steipete Feb 19, 2026
e01011e
fix(acp): harden session lifecycle against flooding
steipete Feb 19, 2026
7e67ab7
fix(feishu): escape regex metacharacters in stripBotMention
orlyjamie Feb 19, 2026
7426848
test(feishu): add mention regex injection regressions
steipete Feb 19, 2026
79ab492
test: dedupe extracted-size budget assertions in archive tests
steipete Feb 19, 2026
d900d5e
style: normalize ws message handler import ordering
steipete Feb 19, 2026
7a89049
refactor: dedupe pending pairing request flow and add reuse tests
steipete Feb 19, 2026
1934805
style: normalize acp translator import ordering
steipete Feb 19, 2026
f8b61bb
refactor(acp): split session tests and share rate limiter
steipete Feb 19, 2026
2911899
refactor(lobster): remove lobsterPath overrides
steipete Feb 19, 2026
b54ba33
fix: credit contributor in changelog (#20916) (thanks @orlyjamie)
steipete Feb 19, 2026
f4b288b
refactor(feishu): dedupe mention regex escaping
steipete Feb 19, 2026
2777d8a
refactor(security): unify gateway scope authorization flows
steipete Feb 19, 2026
5dc50b8
fix(security): harden npm plugin and hook install integrity flow
steipete Feb 19, 2026
3561442
fix(plugins): harden discovery trust checks
steipete Feb 19, 2026
baa335f
fix(security): harden SSRF IPv4 literal parsing
steipete Feb 19, 2026
7758160
fix(security): enforce trusted sender auth for discord moderation
steipete Feb 19, 2026
77c7483
refactor(plugins): extract safety and provenance helpers
steipete Feb 19, 2026
26c9b37
fix(security): enforce strict IPv4 SSRF literal handling
steipete Feb 19, 2026
cb6b835
test: dedupe heartbeat and action-runner fixtures
steipete Feb 19, 2026
672b1c5
refactor: dedupe slack monitor mrkdwn and modal event base
steipete Feb 19, 2026
a99fd8f
refactor: reuse daemon action response type in lifecycle core
steipete Feb 19, 2026
397f243
refactor: dedupe gateway session guards and agent test fixtures
steipete Feb 19, 2026
ba538c9
refactor: share plain object guard across config and utils
steipete Feb 19, 2026
ffd4e85
refactor: share allow-from merge and sender-id checks
steipete Feb 19, 2026
3179097
refactor: dedupe redact snapshot restore prelude
steipete Feb 19, 2026
2581b67
refactor: share exec approval request helper
steipete Feb 19, 2026
eb9861b
test: share memory manager bootstrap helper
steipete Feb 19, 2026
efca61e
test: share cron tool mock harness
steipete Feb 19, 2026
9130fd2
ci: harden workflow action input handling
steipete Feb 19, 2026
3d7ad1c
fix(security): centralize owner-only tool gating and scope maps
steipete Feb 19, 2026
b40821b
fix: harden ACP secret handling and exec preflight boundaries
steipete Feb 19, 2026
10379e7
fix: harden voice-call tts deep merge
steipete Feb 19, 2026
81b19aa
fix(security): enforce plugin and hook path containment
steipete Feb 19, 2026
c9dee59
refactor(security): centralize trusted sender checks for discord mode…
steipete Feb 19, 2026
732e531
fix(security): OC-53 enforce 2MB prompt size limit to prevent ACP DoS…
aether-ai-agent Feb 18, 2026
ebcf197
fix(security): OC-53 validate prompt size before string concatenation…
aether-ai-agent Feb 18, 2026
63e39d7
fix(security): harden ACP prompt size guardrails
steipete Feb 19, 2026
f76f98b
chore: fix formatting drift and stabilize cron tool mocks
steipete Feb 19, 2026
c45f3c5
fix(gateway): harden canvas auth with session capabilities
steipete Feb 19, 2026
dafe52e
fix(daemon): escape schtasks environment assignments
steipete Feb 19, 2026
8288702
docs(changelog): add Windows schtasks injection fix note
steipete Feb 19, 2026
2e421f3
fix(security): restore trusted plugin runtime exec default
steipete Feb 19, 2026
a688ccf
refactor(security): unify safe-bin argv parsing and harden regressions
steipete Feb 19, 2026
e1059e9
refactor(daemon): extract schtasks cmd-set codec helpers
steipete Feb 19, 2026
72e426b
test: reuse isolated agent mock module
steipete Feb 19, 2026
edf92f1
refactor: share npm integrity drift handling
steipete Feb 19, 2026
0213a09
test: share temp home env harness
steipete Feb 19, 2026
7198371
test: share channels command mock harness
steipete Feb 19, 2026
dcd592a
refactor: eliminate jscpd clones and boost tests
steipete Feb 19, 2026
4574f32
test: cover npm pack install drift branches
steipete Feb 19, 2026
d3bf6e1
test: harden mock order and shell path coverage
steipete Feb 19, 2026
e1e91bd
test: cover plugin status helper branches
steipete Feb 19, 2026
cc9be84
refactor(runtime): split runtime builders and stabilize cron tool seam
steipete Feb 19, 2026
bc6f983
fix(ci): resolve format drift and acp mock typing
steipete Feb 19, 2026
e96c6a7
fix(ci): format cron tool imports
steipete Feb 19, 2026
3a258e7
fix(ci): add explicit mock export types for harnesses
steipete Feb 19, 2026
280c6b1
fix(daemon): harden windows schtasks script quoting
steipete Feb 19, 2026
b0e5528
chore: bump release metadata to 2026.2.19
steipete Feb 19, 2026
a1cb700
test: dedupe and optimize test suites
steipete Feb 19, 2026
035832b
refactor(daemon): extract windows cmd argv helpers
steipete Feb 19, 2026
38fc2c2
pnpm protocol:gen
alterlife Feb 19, 2026
018370e
fix(ci): normalize path assertions across platforms
steipete Feb 19, 2026
30e36c3
fix(ci): tighten test typing for browser and cron cli
steipete Feb 19, 2026
3077c35
fix(ui): unblock docker onboarding build
steipete Feb 19, 2026
869ebbc
fix(ci): verify actionlint release checksum before install
steipete Feb 19, 2026
9f5429e
docs: trim refactor-only and duplicate changelog entries
steipete Feb 19, 2026
2435499
ci: move blacksmith runners to 8 vcpu
steipete Feb 19, 2026
2c05cbb
fix(ci): use versioned actionlint checksum asset
steipete Feb 19, 2026
ce1f0c0
ci: move workflows to blacksmith 16vcpu runners
steipete Feb 19, 2026
e500110
fix(ci): allow blacksmith 16vcpu labels in actionlint
steipete Feb 19, 2026
7880947
fix(ci): restore actionlint rules and add blacksmith 16 ignore
steipete Feb 19, 2026
45d9b20
fix(cli): refresh gateway service env during update (#21071)
vincentkoc Feb 19, 2026
03d7aad
fix(test): mock runDaemonInstall with vi.mocked
steipete Feb 19, 2026
0a607bd
fix: make exec-approvals tests platform-independent
tediferJones Feb 19, 2026
e741a53
chore(ci): trigger push workflows after main CI fix
steipete Feb 19, 2026
bf8117a
fix(update): silence npm deprecation/funding noise
steipete Feb 19, 2026
0d143ea
Merge remote-tracking branch 'upstream/main' into jj+theo/conflict_re…
tediferJones Feb 19, 2026
ebcfe8c
fix: formatting issue
tediferJones Feb 19, 2026
e409a5d
empty commit
tediferJones Feb 19, 2026
c87fe85
fix: type issue
tediferJones Feb 19, 2026
c09c8a6
retrigger CI
tediferJones Feb 19, 2026
17f9581
fix: testing issue
tediferJones Feb 19, 2026
cc57ae1
fix: macOS CI tests
tediferJones Feb 20, 2026
075aa48
fix: swift formatting issue
tediferJones Feb 20, 2026
8ec77f5
fix: protocol gen
tediferJones Feb 20, 2026
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
The diff you're trying to view is too large. We only load the first 3000 changed files.
6 changes: 1 addition & 5 deletions .agents/skills/PR_WORKFLOW.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,6 @@
Please read this in full and do not skip sections.
This is the single source of truth for the maintainer PR workflow.

## Triage order

Process PRs **oldest to newest**. Older PRs are more likely to have merge conflicts and stale dependencies; resolving them first keeps the queue healthy and avoids snowballing rebase pain.

## Working rule

Skills execute workflow. Maintainers provide judgment.
Expand Down Expand Up @@ -110,7 +106,7 @@ Before any substantive review or prep work, **always rebase the PR branch onto c
- During `prepare-pr`, use concise, action-oriented subjects **without** PR numbers or thanks; reserve `(#<PR>) thanks @<pr-author>` for the final merge/squash commit.
- Group related changes; avoid bundling unrelated refactors.
- Changelog workflow: keep the latest released version at the top (no `Unreleased`); after publishing, bump the version and start a new top section.
- When working on a PR: add a changelog entry with the PR number and thank the contributor (mandatory in this workflow).
- When working on a PR: add a changelog entry line with the PR number `(#<PR>)` and `thanks @<pr-author>` when author metadata is available (mandatory in this workflow).
- When working on an issue: reference the issue in the changelog entry.
- In this workflow, changelog is always required even for internal/test-only changes.

Expand Down
10 changes: 6 additions & 4 deletions .agents/skills/merge-pr/SKILL.md
Original file line number Diff line number Diff line change
Expand Up @@ -41,11 +41,12 @@ scripts/pr-merge <PR>
scripts/pr-merge run <PR>
```

3. Ensure output reports:
3. Capture and report these values in a human-readable summary (not raw `key=value` lines):

- `merge_sha=<sha>`
- `merge_author_email=<email>`
- `comment_url=<url>`
- Merge commit SHA
- Merge author email
- Merge completion comment URL
- PR URL

## Steps

Expand Down Expand Up @@ -97,3 +98,4 @@ Cleanup is handled by `run` after merge success.

- End in `MERGED`, never `CLOSED`.
- Cleanup only after confirmed merge.
- In final chat output, use labeled lines or bullets; do not paste raw wrapper diagnostics unless debugging.
5 changes: 5 additions & 0 deletions .agents/skills/prepare-pr/SKILL.md
Original file line number Diff line number Diff line change
Expand Up @@ -74,6 +74,11 @@ jq -r '.changelog' .local/review.json
jq -r '.docs' .local/review.json
```

Changelog gate requirement:

- `CHANGELOG.md` must include a newly added changelog entry line.
- When PR author metadata is available, that same changelog entry line must include `(#<PR>) thanks @<pr-author>`.

4. Commit scoped changes

Use concise, action-oriented subject lines without PR numbers/thanks. The final merge/squash commit is the only place we include PR numbers and contributor thanks.
Expand Down
10 changes: 10 additions & 0 deletions .env.example
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,16 @@ OPENCLAW_GATEWAY_TOKEN=change-me-to-a-long-random-token
# ANTHROPIC_API_KEY=sk-ant-...
# GEMINI_API_KEY=...
# OPENROUTER_API_KEY=sk-or-...
# OPENCLAW_LIVE_OPENAI_KEY=sk-...
# OPENCLAW_LIVE_ANTHROPIC_KEY=sk-ant-...
# OPENCLAW_LIVE_GEMINI_KEY=...
# OPENAI_API_KEY_1=...
# ANTHROPIC_API_KEY_1=...
# GEMINI_API_KEY_1=...
# GOOGLE_API_KEY=...
# OPENAI_API_KEYS=sk-1,sk-2
# ANTHROPIC_API_KEYS=sk-ant-1,sk-ant-2
# GEMINI_API_KEYS=key-1,key-2

# Optional additional providers
# ZAI_API_KEY=...
Expand Down
9 changes: 7 additions & 2 deletions .github/actionlint.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,11 @@
self-hosted-runner:
labels:
# Blacksmith CI runners
- blacksmith-4vcpu-ubuntu-2404
- blacksmith-4vcpu-windows-2025
- blacksmith-8vcpu-ubuntu-2404
- blacksmith-8vcpu-windows-2025
- blacksmith-16vcpu-ubuntu-2404
- blacksmith-16vcpu-windows-2025
- blacksmith-16vcpu-ubuntu-2404-arm

# Ignore patterns for known issues
paths:
Expand All @@ -15,3 +18,5 @@ paths:
- "shellcheck reported issue.+"
# Ignore intentional if: false for disabled jobs
- 'constant expression "false" in condition'
# actionlint's built-in runner label allowlist lags Blacksmith additions.
- 'label "blacksmith-16vcpu-[^"]+" is unknown\.'
29 changes: 22 additions & 7 deletions .github/actions/setup-node-env/action.yml
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ runs:
exit 1

- name: Setup Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
node-version: ${{ inputs.node-version }}
check-latest: true
Expand All @@ -52,7 +52,7 @@ runs:
if: inputs.install-bun == 'true'
uses: oven-sh/setup-bun@v2
with:
bun-version: latest
bun-version: "1.3.9+cf6cdbbba"

- name: Runtime versions
shell: bash
Expand All @@ -70,14 +70,29 @@ runs:
shell: bash
env:
CI: "true"
FROZEN_LOCKFILE: ${{ inputs.frozen-lockfile }}
run: |
set -euo pipefail
export PATH="$NODE_BIN:$PATH"
which node
node -v
pnpm -v
LOCKFILE_FLAG=""
if [ "${{ inputs.frozen-lockfile }}" = "true" ]; then
LOCKFILE_FLAG="--frozen-lockfile"
case "$FROZEN_LOCKFILE" in
true) LOCKFILE_FLAG="--frozen-lockfile" ;;
false) LOCKFILE_FLAG="" ;;
*)
echo "::error::Invalid frozen-lockfile input: '$FROZEN_LOCKFILE' (expected true or false)"
exit 2
;;
esac

install_args=(
install
--ignore-scripts=false
--config.engine-strict=false
--config.enable-pre-post-scripts=true
)
if [ -n "$LOCKFILE_FLAG" ]; then
install_args+=("$LOCKFILE_FLAG")
fi
pnpm install $LOCKFILE_FLAG --ignore-scripts=false --config.engine-strict=false --config.enable-pre-post-scripts=true || \
pnpm install $LOCKFILE_FLAG --ignore-scripts=false --config.engine-strict=false --config.enable-pre-post-scripts=true
pnpm "${install_args[@]}" || pnpm "${install_args[@]}"
8 changes: 7 additions & 1 deletion .github/actions/setup-pnpm-store-cache/action.yml
Original file line number Diff line number Diff line change
Expand Up @@ -14,11 +14,17 @@ runs:
steps:
- name: Setup pnpm (corepack retry)
shell: bash
env:
PNPM_VERSION: ${{ inputs.pnpm-version }}
run: |
set -euo pipefail
if [[ ! "$PNPM_VERSION" =~ ^[0-9]+(\.[0-9]+){1,2}([.-][0-9A-Za-z.-]+)?$ ]]; then
echo "::error::Invalid pnpm-version input: '$PNPM_VERSION'"
exit 2
fi
corepack enable
for attempt in 1 2 3; do
if corepack prepare "pnpm@${{ inputs.pnpm-version }}" --activate; then
if corepack prepare "pnpm@$PNPM_VERSION" --activate; then
pnpm -v
exit 0
fi
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/auto-response.yml
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ jobs:
permissions:
issues: write
pull-requests: write
runs-on: ubuntu-latest
runs-on: blacksmith-16vcpu-ubuntu-2404
steps:
- uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1
id: app-token
Expand Down Expand Up @@ -48,7 +48,7 @@ jobs:
label: "r: third-party-extension",
close: true,
message:
"This would be better made as a third-party extension with our SDK that you maintain yourself. Docs: https://docs.openclaw.ai/plugin.",
"Please make this as a third-party plugin that you maintain yourself in your own repo. Docs: https://docs.openclaw.ai/plugin. Feel free to open a PR after to add it to our community plugins page: https://docs.openclaw.ai/plugins/community",
},
{
label: "r: moltbook",
Expand Down
64 changes: 40 additions & 24 deletions .github/workflows/ci.yml
Original file line number Diff line number Diff line change
Expand Up @@ -6,14 +6,14 @@ on:
pull_request:

concurrency:
group: ci-${{ github.event.pull_request.number || github.sha }}
cancel-in-progress: true
group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
# Detect docs-only changes to skip heavy jobs (test, build, Windows, macOS, Android).
# Lint and format always run. Fail-safe: if detection fails, run everything.
docs-scope:
runs-on: ubuntu-latest
runs-on: blacksmith-16vcpu-ubuntu-2404
outputs:
docs_only: ${{ steps.check.outputs.docs_only }}
docs_changed: ${{ steps.check.outputs.docs_changed }}
Expand All @@ -33,7 +33,7 @@ jobs:
changed-scope:
needs: [docs-scope]
if: needs.docs-scope.outputs.docs_only != 'true'
runs-on: ubuntu-latest
runs-on: blacksmith-16vcpu-ubuntu-2404
outputs:
run_node: ${{ steps.scope.outputs.run_node }}
run_macos: ${{ steps.scope.outputs.run_macos }}
Expand Down Expand Up @@ -127,7 +127,7 @@ jobs:
build-artifacts:
needs: [docs-scope, changed-scope, check]
if: needs.docs-scope.outputs.docs_only != 'true' && (github.event_name == 'push' || needs.changed-scope.outputs.run_node == 'true')
runs-on: blacksmith-4vcpu-ubuntu-2404
runs-on: blacksmith-16vcpu-ubuntu-2404
steps:
- name: Checkout
uses: actions/checkout@v4
Expand All @@ -153,7 +153,7 @@ jobs:
release-check:
needs: [docs-scope, build-artifacts]
if: github.event_name == 'push' && needs.docs-scope.outputs.docs_only != 'true'
runs-on: blacksmith-4vcpu-ubuntu-2404
runs-on: blacksmith-16vcpu-ubuntu-2404
steps:
- name: Checkout
uses: actions/checkout@v4
Expand All @@ -177,7 +177,7 @@ jobs:
checks:
needs: [docs-scope, changed-scope, check]
if: needs.docs-scope.outputs.docs_only != 'true' && (github.event_name == 'push' || needs.changed-scope.outputs.run_node == 'true')
runs-on: blacksmith-4vcpu-ubuntu-2404
runs-on: blacksmith-16vcpu-ubuntu-2404
strategy:
fail-fast: false
matrix:
Expand All @@ -192,29 +192,46 @@ jobs:
task: test
command: pnpm canvas:a2ui:bundle && bunx vitest run --config vitest.unit.config.ts
steps:
- name: Skip bun lane on push
if: github.event_name == 'push' && matrix.runtime == 'bun'
run: echo "Skipping bun test lane on push events."

- name: Checkout
if: github.event_name != 'push' || matrix.runtime != 'bun'
uses: actions/checkout@v4
with:
submodules: false

- name: Setup Node environment
if: matrix.runtime != 'bun' || github.event_name != 'push'
uses: ./.github/actions/setup-node-env
with:
install-bun: "${{ matrix.runtime == 'bun' }}"

- name: Configure vitest JSON reports
if: matrix.task == 'test' && matrix.runtime == 'node'
if: (github.event_name != 'push' || matrix.runtime != 'bun') && matrix.task == 'test' && matrix.runtime == 'node'
run: echo "OPENCLAW_VITEST_REPORT_DIR=$RUNNER_TEMP/vitest-reports" >> "$GITHUB_ENV"

- name: Configure Node test resources
if: (github.event_name != 'push' || matrix.runtime != 'bun') && matrix.task == 'test' && matrix.runtime == 'node'
run: |
# `pnpm test` runs `scripts/test-parallel.mjs`, which spawns multiple Node processes.
# Default heap limits have been too low on Linux CI (V8 OOM near 4GB).
echo "OPENCLAW_TEST_WORKERS=2" >> "$GITHUB_ENV"
echo "OPENCLAW_TEST_MAX_OLD_SPACE_SIZE_MB=6144" >> "$GITHUB_ENV"

- name: Run ${{ matrix.task }} (${{ matrix.runtime }})
if: matrix.runtime != 'bun' || github.event_name != 'push'
run: ${{ matrix.command }}

- name: Summarize slowest tests
if: matrix.task == 'test' && matrix.runtime == 'node'
if: (github.event_name != 'push' || matrix.runtime != 'bun') && matrix.task == 'test' && matrix.runtime == 'node'
run: |
node scripts/vitest-slowest.mjs --dir "$OPENCLAW_VITEST_REPORT_DIR" --top 50 --out "$RUNNER_TEMP/vitest-slowest.md" > /dev/null
echo "Slowest test summary written to $RUNNER_TEMP/vitest-slowest.md"

- name: Upload vitest reports
if: matrix.task == 'test' && matrix.runtime == 'node'
if: (github.event_name != 'push' || matrix.runtime != 'bun') && matrix.task == 'test' && matrix.runtime == 'node'
uses: actions/upload-artifact@v4
with:
name: vitest-reports-${{ runner.os }}-${{ matrix.runtime }}
Expand All @@ -227,7 +244,7 @@ jobs:
name: "check"
needs: [docs-scope]
if: needs.docs-scope.outputs.docs_only != 'true'
runs-on: blacksmith-4vcpu-ubuntu-2404
runs-on: blacksmith-16vcpu-ubuntu-2404
steps:
- name: Checkout
uses: actions/checkout@v4
Expand All @@ -236,6 +253,8 @@ jobs:

- name: Setup Node environment
uses: ./.github/actions/setup-node-env
with:
install-bun: "false"

- name: Check types and lint and oxfmt
run: pnpm check
Expand All @@ -244,7 +263,7 @@ jobs:
check-docs:
needs: [docs-scope]
if: needs.docs-scope.outputs.docs_changed == 'true'
runs-on: blacksmith-4vcpu-ubuntu-2404
runs-on: blacksmith-16vcpu-ubuntu-2404
steps:
- name: Checkout
uses: actions/checkout@v4
Expand All @@ -253,12 +272,14 @@ jobs:

- name: Setup Node environment
uses: ./.github/actions/setup-node-env
with:
install-bun: "false"

- name: Check docs
run: pnpm check:docs

secrets:
runs-on: blacksmith-4vcpu-ubuntu-2404
runs-on: blacksmith-16vcpu-ubuntu-2404
steps:
- name: Checkout
uses: actions/checkout@v4
Expand All @@ -285,10 +306,10 @@ jobs:
checks-windows:
needs: [docs-scope, changed-scope, build-artifacts, check]
if: needs.docs-scope.outputs.docs_only != 'true' && (github.event_name == 'push' || needs.changed-scope.outputs.run_node == 'true')
runs-on: blacksmith-4vcpu-windows-2025
runs-on: blacksmith-16vcpu-windows-2025
env:
NODE_OPTIONS: --max-old-space-size=4096
# Keep total concurrency predictable on the 4 vCPU runner:
# Keep total concurrency predictable on the 16 vCPU runner:
# `scripts/test-parallel.mjs` runs some vitest suites in parallel processes.
OPENCLAW_TEST_WORKERS: 2
defaults:
Expand Down Expand Up @@ -347,7 +368,7 @@ jobs:
test -s dist/plugin-sdk/index.js

- name: Setup Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
node-version: 22.x
check-latest: true
Expand All @@ -358,16 +379,10 @@ jobs:
pnpm-version: "10.23.0"
cache-key-suffix: "node22"

- name: Setup Bun
uses: oven-sh/setup-bun@v2
with:
bun-version: latest

- name: Runtime versions
run: |
node -v
npm -v
bun -v
pnpm -v

- name: Capture node path
Expand Down Expand Up @@ -645,7 +660,7 @@ jobs:
android:
needs: [docs-scope, changed-scope, check]
if: needs.docs-scope.outputs.docs_only != 'true' && (github.event_name == 'push' || needs.changed-scope.outputs.run_android == 'true')
runs-on: blacksmith-4vcpu-ubuntu-2404
runs-on: blacksmith-16vcpu-ubuntu-2404
strategy:
fail-fast: false
matrix:
Expand All @@ -664,7 +679,8 @@ jobs:
uses: actions/setup-java@v4
with:
distribution: temurin
java-version: 21
# setup-android's sdkmanager currently crashes on JDK 21 in CI.
java-version: 17

- name: Setup Android SDK
uses: android-actions/setup-android@v3
Expand Down
Loading
Loading