Skip to content

Commit 3d1f3ab

Browse files
EruditiEruditi
authored
Merge branch 'openclaw:main' into fix/cron-parse-undefined
2 parents 80a0b61 + 1b25dcf commit 3d1f3ab

626 files changed

Lines changed: 13661 additions & 6486 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.agents/skills/clawsweeper/SKILL.md‎

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
---
2+
name: clawsweeper
3+
description: Inspect ClawSweeper commit-review and issue/PR-sweeper reports for OpenClaw, including recent per-commit reports, finding summaries, GitHub Checks, Actions monitoring, manual backfills, and report links.
4+
---
5+
6+
# ClawSweeper
7+
8+
ClawSweeper lives at `~/Projects/clawsweeper`. Use this skill when Peter asks
9+
about ClawSweeper reports, commit-review checks, recent findings, historic
10+
backfills, or whether the sweeper/dispatch lane is healthy.
11+
12+
## Start
13+
14+
```bash
15+
cd ~/Projects/clawsweeper
16+
git status --short
17+
git pull --ff-only
18+
pnpm run build
19+
```
20+
21+
Do not overwrite unrelated local edits. If the tree is dirty, inspect status
22+
and keep report-reading commands read-only unless Peter asked to commit.
23+
24+
## Recent Commit Reports
25+
26+
Canonical reports are flat:
27+
28+
```text
29+
records/<repo-slug>/commits/<40-char-sha>.md
30+
```
31+
32+
Use the lister instead of browsing date folders:
33+
34+
```bash
35+
pnpm commit-reports -- --since 6h
36+
pnpm commit-reports -- --since "24 hours ago" --findings
37+
pnpm commit-reports -- --since 7d --non-clean
38+
pnpm commit-reports -- --repo openclaw/openclaw --author steipete --since 7d
39+
pnpm commit-reports -- --since 24h --json
40+
```
41+
42+
One report per commit. Reruns overwrite the same SHA-named file. Results:
43+
`nothing_found`, `findings`, `inconclusive`, `failed`, `skipped_non_code`.
44+
45+
## Monitor Actions
46+
47+
Receiver lane in `openclaw/clawsweeper`:
48+
49+
```bash
50+
gh run list --repo openclaw/clawsweeper --workflow "ClawSweeper Commit Review" \
51+
--limit 12 --json databaseId,displayTitle,event,status,conclusion,createdAt,updatedAt,url
52+
gh run list --repo openclaw/clawsweeper --workflow "ClawSweeper Commit Review" \
53+
--status in_progress --limit 20 --json databaseId,displayTitle,event,status,createdAt,url
54+
```
55+
56+
Target dispatcher in `openclaw/openclaw`:
57+
58+
```bash
59+
gh run list --repo openclaw/openclaw --workflow "ClawSweeper Dispatch" \
60+
--event push --limit 8 --json databaseId,displayTitle,event,status,conclusion,headSha,url
61+
git ls-remote https://github.com/openclaw/openclaw.git refs/heads/main
62+
```
63+
64+
Check the target commit's published report check:
65+
66+
```bash
67+
gh api "repos/openclaw/openclaw/commits/<sha>/check-runs?per_page=100" \
68+
--jq '.check_runs[] | select(.name=="ClawSweeper Commit Review") | [.status,.conclusion,.details_url] | @tsv'
69+
```
70+
71+
## Manual Commit Rerun / Backfill
72+
73+
Use the receiver workflow when Peter asks to rerun a specific commit report,
74+
review a specific commit, or backfill a historic range. Reruns overwrite the
75+
same canonical report file:
76+
`records/<repo-slug>/commits/<40-char-sha>.md`.
77+
78+
Single-commit rerun:
79+
80+
```bash
81+
gh workflow run commit-review.yml --repo openclaw/clawsweeper \
82+
-f target_repo=openclaw/openclaw \
83+
-f commit_sha=<sha> \
84+
-f before_sha=<parent-sha> \
85+
-f create_checks=false \
86+
-f enabled=true
87+
```
88+
89+
Historic range backfill:
90+
91+
```bash
92+
gh workflow run commit-review.yml --repo openclaw/clawsweeper \
93+
-f target_repo=openclaw/openclaw \
94+
-f commit_sha=<end-sha> \
95+
-f before_sha=<start-sha> \
96+
-f create_checks=false \
97+
-f enabled=true
98+
```
99+
100+
Use `create_checks=true` only when Peter explicitly wants target commit check
101+
runs. Checks are opt-in; markdown reports are the primary surface.
102+
103+
For a targeted rerun with extra instructions, add `additional_prompt`:
104+
105+
```bash
106+
-f additional_prompt="Review this commit with focus on <topic>."
107+
```
108+
109+
After dispatch, monitor and then pull the regenerated report:
110+
111+
```bash
112+
gh run list --repo openclaw/clawsweeper --workflow "ClawSweeper Commit Review" \
113+
--limit 5 --json databaseId,displayTitle,status,conclusion,url
114+
gh run watch <run-id> --repo openclaw/clawsweeper --interval 30 --exit-status
115+
git pull --ff-only
116+
sed -n '1,180p' records/openclaw-openclaw/commits/<sha>.md
117+
```
118+
119+
## Report Reading
120+
121+
Lead with counts and useful findings:
122+
123+
```bash
124+
pnpm commit-reports -- --since 24h
125+
pnpm commit-reports -- --since 24h --findings
126+
```
127+
128+
If findings exist, open the markdown report and summarize:
129+
130+
- SHA and author/co-authors
131+
- result, confidence, severity, check conclusion
132+
- concrete finding and affected file
133+
- whether the report includes tests/live checks
134+
- GitHub report URL:
135+
`https://github.com/openclaw/clawsweeper/blob/main/<report-path>`
136+
137+
Do not post GitHub comments from this lane. Commit Sweeper's public surfaces are
138+
markdown reports and the `ClawSweeper Commit Review` check.

‎.agents/skills/clawsweeper/agents/openai.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
interface:
2+
display_name: "ClawSweeper"
3+
short_description: "Inspect ClawSweeper commit review reports and Actions runs."
4+
default_prompt: "Review recent ClawSweeper commit reports and summarize findings."

‎.agents/skills/clownfish-cloud-pr/SKILL.md‎

Lines changed: 118 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,42 @@
11
---
22
name: clownfish-cloud-pr
3-
description: Use when launching Clownfish in GitHub Actions to create or update one guarded GitHub implementation PR from issue/PR refs, a ClawSweeper report, or a custom maintainer prompt.
3+
description: Use when launching Clownfish in GitHub Actions to create or update one guarded GitHub implementation PR from issue/PR refs, a ClawSweeper report, a custom maintainer prompt, or to opt an existing Clownfish PR into ClawSweeper-reviewed cloud automerge.
44
---
55

66
# Clownfish Cloud PR
77

88
Use this skill when the user wants Codex to ask Clownfish to create a PR in the
99
cloud from issue/PR refs plus a custom prompt.
1010

11-
## Create One Job
11+
## Start
1212

1313
```bash
1414
cd ~/Projects/clownfish
1515
git status --short --branch
16+
gh variable list --repo openclaw/clownfish --json name,value \
17+
--jq 'map(select(.name|test("^CLOWNFISH_"))) | sort_by(.name) | .[] | {name,value}'
18+
```
19+
20+
Keep merge gated unless Peter explicitly opens it. Execute/fix gates are closed
21+
unless the repo variables are literally `1`; normal fix-PR work needs an
22+
intentional execution window:
23+
24+
```bash
25+
gh variable set CLOWNFISH_ALLOW_EXECUTE --repo openclaw/clownfish --body 1
26+
gh variable set CLOWNFISH_ALLOW_FIX_PR --repo openclaw/clownfish --body 1
27+
gh variable set CLOWNFISH_ALLOW_MERGE --repo openclaw/clownfish --body 0
28+
gh variable set CLOWNFISH_ALLOW_AUTOMERGE --repo openclaw/clownfish --body 0
29+
```
30+
31+
Reset `CLOWNFISH_ALLOW_EXECUTE=0` and `CLOWNFISH_ALLOW_FIX_PR=0` after the
32+
window. If those vars are absent or not `1`, execute/autonomous workflow runs
33+
stay plan-only/no-mutation.
34+
35+
## Create One Job
36+
37+
From refs and a custom prompt:
38+
39+
```bash
1640
npm run create-job -- \
1741
--repo openclaw/openclaw \
1842
--refs 123,456 \
@@ -28,7 +52,28 @@ npm run create-job -- \
2852

2953
The script checks for an existing open PR/body match and remote branch named
3054
`clownfish/<cluster-id>` before writing a duplicate job. Use `--dry-run` to
31-
inspect the exact job body.
55+
inspect the exact job body and `--force` only after deciding the duplicate check
56+
is stale.
57+
58+
## Ask For A Replacement PR
59+
60+
The skill can trigger replacement PR writing through the normal `create-job`
61+
and `dispatch` path. Put the maintainer decision in the prompt:
62+
63+
```md
64+
Treat #123 as useful source work. If the source branch cannot be safely updated
65+
because it is uneditable, stale, draft-only, unmergeable, or unsafe, create a
66+
narrow Clownfish replacement PR instead of waiting. Preserve the source PR
67+
author as co-author, credit the source PR in the replacement PR body, and close
68+
only that source PR after the replacement PR is opened.
69+
```
70+
71+
The worker should emit `repair_strategy=replace_uneditable_branch` and list the
72+
source PR URL in `source_prs`. The deterministic executor opens or updates
73+
`clownfish/<cluster-id>`, adds non-bot source PR authors as `Co-authored-by`
74+
trailers, and closes the superseded source PR only after the replacement PR
75+
exists. New replacement PRs are blocked when the touched area already has
76+
`CLOWNFISH_MAX_ACTIVE_PRS_PER_AREA` open Clownfish PRs.
3277

3378
## Validate And Dispatch
3479

@@ -46,13 +91,81 @@ npm run dispatch -- jobs/openclaw/inbox/clawsweeper-openclaw-openclaw-123.md \
4691
```
4792

4893
Do not use `--dispatch` until the job is committed and pushed; the workflow
49-
reads the job path from GitHub. Keep `CLOWNFISH_ALLOW_MERGE=0` unless Peter
50-
explicitly opens the merge gate.
94+
reads the job path from GitHub.
95+
96+
## Maintainer Comment Commands
97+
98+
Clownfish can also be asked from target repo comments, but only by maintainers.
99+
Use `/clownfish ...` or `@openclaw-clownfish ...`; do not use `@clownfish`
100+
because that is a separate GitHub user.
101+
102+
Supported commands:
103+
104+
```text
105+
/clownfish status
106+
/clownfish fix ci
107+
/clownfish address review
108+
/clownfish rebase
109+
/clownfish automerge
110+
/clownfish explain
111+
/clownfish stop
112+
@openclaw-clownfish fix ci
113+
```
114+
115+
The router accepts `OWNER`, `MEMBER`, and `COLLABORATOR` comments by default.
116+
Contributor comments are ignored without a reply. Repair commands dispatch
117+
`cluster-worker.yml` only for existing Clownfish PRs with the `clownfish` label
118+
or `clownfish/*` branch.
119+
120+
```bash
121+
npm run comment-router -- --repo openclaw/openclaw --lookback-minutes 180
122+
npm run comment-router -- --repo openclaw/openclaw --execute --wait-for-capacity
123+
```
124+
125+
Scheduled routing stays dry until `CLOWNFISH_COMMENT_ROUTER_EXECUTE=1` is set in
126+
`openclaw/clownfish` repo variables.
127+
128+
## Bounded ClawSweeper-Reviewed Automerge
129+
130+
Use this only for an existing Clownfish PR that maps back to a `clownfish/*`
131+
branch and job file:
132+
133+
```text
134+
/clownfish automerge
135+
```
136+
137+
The router verifies the commenter is a maintainer, adds
138+
`clownfish:automerge`, dispatches ClawSweeper for the current PR head, and
139+
waits for trusted ClawSweeper markers. `needs-changes` / `fix-required`
140+
dispatches the normal repair worker. `pass`, `approved`, or `no-changes` may
141+
merge only when the marker SHA matches the current PR head, checks are green,
142+
GitHub says the PR is mergeable, no `clownfish:human-review` label is present,
143+
and both merge gates are open:
144+
145+
```bash
146+
gh variable set CLOWNFISH_ALLOW_MERGE --repo openclaw/clownfish --body 1
147+
gh variable set CLOWNFISH_ALLOW_AUTOMERGE --repo openclaw/clownfish --body 1
148+
```
149+
150+
The actual merge command is pinned with GitHub's head-match guard, so a branch
151+
push after ClawSweeper reviewed cannot merge an unreviewed head. If either
152+
merge gate is closed when ClawSweeper passes, Clownfish labels the PR
153+
`clownfish:merge-ready` only after readiness checks have passed; failing checks,
154+
stale heads, conflicts, draft state, or human-review labels must not get that
155+
label. Pause with `/clownfish stop`, which adds `clownfish:human-review`.
156+
157+
The repair loop is capped by `CLOWNFISH_CLAWSWEEPER_MAX_REPAIRS_PER_PR`
158+
(default `5`) and `CLOWNFISH_CLAWSWEEPER_MAX_REPAIRS_PER_HEAD` (default `1`).
51159

52160
## Guardrails
53161

54162
- One cluster, one branch, one PR: `clownfish/<cluster-id>`.
55163
- No security-sensitive work.
164+
- New replacement PRs are capped per touched area by
165+
`CLOWNFISH_MAX_ACTIVE_PRS_PER_AREA`.
166+
- Do not merge from Clownfish unless Peter explicitly asks.
167+
- Do not open `CLOWNFISH_ALLOW_AUTOMERGE` unless Peter explicitly asks for an
168+
automerge window.
56169
- Do not close duplicates before the fix PR path exists, lands, or is proven
57170
unnecessary.
58171
- Codex workers do not get GitHub tokens; deterministic scripts own writes.

‎.agents/skills/openclaw-testing/SKILL.md‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -111,7 +111,8 @@ rerun after a focused patch.
111111
the manual "everything before release" umbrella. It resolves a target ref, then
112112
dispatches:
113113

114-
- manual `CI` for the full normal CI graph
114+
- manual `CI` for the full normal CI graph, with release-only plugin prerelease
115+
lanes enabled via `full_release_validation=true`
115116
- `OpenClaw Release Checks` for install smoke, cross-OS release checks, live and
116117
E2E checks, Docker release-path suites, OpenWebUI, QA Lab, fast Matrix, and
117118
Telegram release lanes
@@ -142,6 +143,12 @@ artifact reuse, and sharding instead. The parent verifier job appends
142143
slowest-job tables for child runs; rerun only that verifier after a child rerun
143144
turns green.
144145

146+
Standalone manual `CI` dispatches do not run the plugin prerelease suite, the
147+
extension batch sweep, or the release-only `agentic-plugins` Vitest shard. Those
148+
lanes are intentionally reserved for the Full Release Validation CI child so
149+
PRs, main pushes, and ad hoc broad CI checks do not spend Docker/package time or
150+
all-plugin runtime time on release-only product coverage.
151+
145152
If a full run is already active on a newer `origin/main`, prefer watching that
146153
run over dispatching a duplicate. If you accidentally dispatch a stale duplicate,
147154
cancel it and monitor the current run.
@@ -222,6 +229,13 @@ When `Full Release Validation` dispatches release checks, it passes the requeste
222229
branch/tag plus an `expected_sha` so branch/tag refs resolve through the fast
223230
remote-ref path while the package and QA jobs still validate the exact SHA.
224231

232+
The full-profile native live media shards use the prebuilt
233+
`ghcr.io/openclaw/openclaw-live-media-runner:ubuntu-24.04` container so
234+
`ffmpeg`/`ffprobe` are already present. If those jobs suddenly spend minutes in
235+
dependency setup again, first check the `Live Media Runner Image` workflow and
236+
the `Verify preinstalled live media dependencies` step before assuming the media
237+
tests themselves slowed down.
238+
225239
The release Docker path intentionally shards the plugin/runtime tail. The
226240
workflow uses `plugins-runtime-plugins`, `plugins-runtime-services`, and
227241
`plugins-runtime-install-a` through `plugins-runtime-install-d`; aggregate

‎.github/actionlint.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
self-hosted-runner:
55
labels:
66
# Blacksmith CI runners
7+
- blacksmith-4vcpu-ubuntu-2404
78
- blacksmith-8vcpu-ubuntu-2404
89
- blacksmith-8vcpu-windows-2025
910
- blacksmith-16vcpu-ubuntu-2404

.github/codeql/codeql-javascript-typescript-critical-quality.yml renamed to .github/codeql/codeql-core-auth-secrets-critical-quality.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: openclaw-codeql-javascript-typescript-critical-quality
1+
name: openclaw-codeql-core-auth-secrets-critical-quality
22

33
disable-default-queries: true
44

‎.github/codeql/codeql-ui-control-plane-critical-quality.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
name: openclaw-codeql-ui-control-plane-critical-quality
2+
3+
disable-default-queries: true
4+
5+
queries:
6+
- uses: security-and-quality
7+
8+
query-filters:
9+
- include:
10+
problem.severity:
11+
- error
12+
- exclude:
13+
tags:
14+
- security
15+
16+
paths:
17+
- ui/src/main.ts
18+
- ui/src/local-storage.ts
19+
- ui/src/ui
20+
- src/tasks/task-registry-control*.ts
21+
22+
paths-ignore:
23+
- "**/node_modules"
24+
- "**/coverage"
25+
- "**/*.generated.ts"
26+
- "**/*.bundle.js"
27+
- "**/*-runtime.js"
28+
- "**/*.test.ts"
29+
- "**/*.test.tsx"
30+
- "**/*.e2e.test.ts"
31+
- "**/*.e2e.test.tsx"
32+
- "**/*test-support*"
33+
- "**/*test-helper*"
34+
- "**/*mock*"
35+
- "**/*fixture*"
36+
- "**/*bench*"

0 commit comments

Comments
 (0)