Skip to content

Commit a19a5b5

Browse files
PhymathPhymath
authored
Merge branch 'main' into fix/qqbot-data-dir
2 parents 4815526 + 89a15fd commit a19a5b5

244 files changed

Lines changed: 4540 additions & 793 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/plugin-clawhub-release.yml‎

Lines changed: 84 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ env:
3232
CLAWHUB_REGISTRY: "https://clawhub.ai"
3333
CLAWHUB_REPOSITORY: "openclaw/clawhub"
3434
# Pinned to a reviewed ClawHub commit so release behavior stays reproducible.
35-
CLAWHUB_REF: "199e6a0cdf32471702e0503e9899e8d24f06a527"
35+
CLAWHUB_REF: "facf20ceb6cc459e2872d941e71335a784bbc55c"
3636

3737
jobs:
3838
preview_plugins_clawhub:
@@ -50,7 +50,7 @@ jobs:
5050
uses: actions/checkout@v6
5151
with:
5252
persist-credentials: false
53-
ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || github.sha }}
53+
ref: ${{ github.ref }}
5454
fetch-depth: 0
5555

5656
- name: Setup Node environment
@@ -62,14 +62,29 @@ jobs:
6262

6363
- name: Resolve checked-out ref
6464
id: ref
65-
run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
66-
67-
- name: Validate ref is on main or a release branch
65+
env:
66+
TARGET_REF: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || '' }}
6867
run: |
6968
set -euo pipefail
7069
git fetch --no-tags origin \
7170
+refs/heads/main:refs/remotes/origin/main \
7271
'+refs/heads/release/*:refs/remotes/origin/release/*'
72+
if [[ -n "${TARGET_REF}" ]]; then
73+
if git rev-parse --verify --quiet "${TARGET_REF}^{commit}" >/dev/null; then
74+
target_sha="$(git rev-parse "${TARGET_REF}^{commit}")"
75+
elif git rev-parse --verify --quiet "origin/${TARGET_REF}^{commit}" >/dev/null; then
76+
target_sha="$(git rev-parse "origin/${TARGET_REF}^{commit}")"
77+
else
78+
echo "Unable to resolve requested publish ref: ${TARGET_REF}" >&2
79+
exit 1
80+
fi
81+
git checkout --detach "${target_sha}"
82+
fi
83+
echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
84+
85+
- name: Validate ref is on main or a release branch
86+
run: |
87+
set -euo pipefail
7388
if git merge-base --is-ancestor HEAD origin/main; then
7489
exit 0
7590
fi
@@ -153,6 +168,12 @@ jobs:
153168
echo "::error::One or more selected plugin versions already exist on ClawHub. Bump the version before running a real publish."
154169
exit 1
155170
171+
- name: Verify OpenClaw ClawHub package ownership
172+
if: steps.plan.outputs.has_candidates == 'true'
173+
env:
174+
CLAWHUB_REGISTRY: ${{ env.CLAWHUB_REGISTRY }}
175+
run: node --import tsx scripts/plugin-clawhub-owner-preflight.ts .local/plugin-clawhub-release-plan.json
176+
156177
preview_plugin_pack:
157178
needs: preview_plugins_clawhub
158179
if: needs.preview_plugins_clawhub.outputs.has_candidates == 'true'
@@ -161,16 +182,26 @@ jobs:
161182
contents: read
162183
strategy:
163184
fail-fast: false
164-
max-parallel: 1
185+
max-parallel: 6
165186
matrix:
166187
plugin: ${{ fromJson(needs.preview_plugins_clawhub.outputs.matrix) }}
167188
steps:
168189
- name: Checkout
169190
uses: actions/checkout@v6
170191
with:
171192
persist-credentials: false
172-
ref: ${{ needs.preview_plugins_clawhub.outputs.ref_revision }}
173-
fetch-depth: 1
193+
ref: ${{ github.ref }}
194+
fetch-depth: 0
195+
196+
- name: Checkout target revision
197+
env:
198+
TARGET_SHA: ${{ needs.preview_plugins_clawhub.outputs.ref_revision }}
199+
run: |
200+
set -euo pipefail
201+
git fetch --no-tags origin \
202+
+refs/heads/main:refs/remotes/origin/main \
203+
'+refs/heads/release/*:refs/remotes/origin/release/*'
204+
git checkout --detach "${TARGET_SHA}"
174205
175206
- name: Setup Node environment
176207
uses: ./.github/actions/setup-node-env
@@ -185,9 +216,15 @@ jobs:
185216
with:
186217
persist-credentials: false
187218
repository: ${{ env.CLAWHUB_REPOSITORY }}
188-
ref: ${{ env.CLAWHUB_REF }}
219+
ref: main
189220
path: clawhub-source
190-
fetch-depth: 1
221+
fetch-depth: 0
222+
223+
- name: Checkout pinned ClawHub CLI revision
224+
working-directory: clawhub-source
225+
env:
226+
CLAWHUB_REF: ${{ env.CLAWHUB_REF }}
227+
run: git checkout --detach "${CLAWHUB_REF}"
191228

192229
- name: Install ClawHub CLI dependencies
193230
working-directory: clawhub-source
@@ -203,6 +240,9 @@ jobs:
203240
chmod +x "$RUNNER_TEMP/clawhub"
204241
echo "$RUNNER_TEMP" >> "$GITHUB_PATH"
205242
243+
- name: Verify package-local runtime build
244+
run: pnpm release:plugins:npm:runtime:check --package "${{ matrix.plugin.packageDir }}"
245+
206246
- name: Preview publish command
207247
env:
208248
CLAWHUB_REGISTRY: ${{ env.CLAWHUB_REGISTRY }}
@@ -223,15 +263,26 @@ jobs:
223263
id-token: write
224264
strategy:
225265
fail-fast: false
266+
max-parallel: 6
226267
matrix:
227268
plugin: ${{ fromJson(needs.preview_plugins_clawhub.outputs.matrix) }}
228269
steps:
229270
- name: Checkout
230271
uses: actions/checkout@v6
231272
with:
232273
persist-credentials: false
233-
ref: ${{ needs.preview_plugins_clawhub.outputs.ref_revision }}
234-
fetch-depth: 1
274+
ref: ${{ github.ref }}
275+
fetch-depth: 0
276+
277+
- name: Checkout target revision
278+
env:
279+
TARGET_SHA: ${{ needs.preview_plugins_clawhub.outputs.ref_revision }}
280+
run: |
281+
set -euo pipefail
282+
git fetch --no-tags origin \
283+
+refs/heads/main:refs/remotes/origin/main \
284+
'+refs/heads/release/*:refs/remotes/origin/release/*'
285+
git checkout --detach "${TARGET_SHA}"
235286
236287
- name: Setup Node environment
237288
uses: ./.github/actions/setup-node-env
@@ -246,9 +297,15 @@ jobs:
246297
with:
247298
persist-credentials: false
248299
repository: ${{ env.CLAWHUB_REPOSITORY }}
249-
ref: ${{ env.CLAWHUB_REF }}
300+
ref: main
250301
path: clawhub-source
251-
fetch-depth: 1
302+
fetch-depth: 0
303+
304+
- name: Checkout pinned ClawHub CLI revision
305+
working-directory: clawhub-source
306+
env:
307+
CLAWHUB_REF: ${{ env.CLAWHUB_REF }}
308+
run: git checkout --detach "${CLAWHUB_REF}"
252309

253310
- name: Install ClawHub CLI dependencies
254311
working-directory: clawhub-source
@@ -304,7 +361,19 @@ jobs:
304361
encoded_name="$(node -e 'console.log(encodeURIComponent(process.env.PACKAGE_NAME ?? ""))')"
305362
encoded_version="$(node -e 'console.log(encodeURIComponent(process.env.PACKAGE_VERSION ?? ""))')"
306363
url="${CLAWHUB_REGISTRY%/}/api/v1/packages/${encoded_name}/versions/${encoded_version}"
307-
status="$(curl --silent --show-error --output /dev/null --write-out '%{http_code}' "${url}")"
364+
status=""
365+
for attempt in $(seq 1 8); do
366+
status="$(curl --silent --show-error --output /dev/null --write-out '%{http_code}' "${url}")"
367+
if [[ "${status}" == "404" || "${status}" =~ ^2 ]]; then
368+
break
369+
fi
370+
if [[ "${status}" == "429" || "${status}" =~ ^5 ]]; then
371+
echo "ClawHub availability check returned ${status} for ${PACKAGE_NAME}@${PACKAGE_VERSION}; retrying (${attempt}/8)."
372+
sleep 60
373+
continue
374+
fi
375+
break
376+
done
308377
if [[ "${status}" =~ ^2 ]]; then
309378
echo "${PACKAGE_NAME}@${PACKAGE_VERSION} is already published on ClawHub."
310379
exit 1

‎CHANGELOG.md‎

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,8 @@ Docs: https://docs.openclaw.ai
2222
- Channels/streaming: cap progress-draft tool lines by default so edited progress boxes avoid jumpy reflow from long wrapped lines.
2323
- Agents/verbose: use compact explain-mode tool summaries for `/verbose` and progress drafts by default, with `agents.defaults.toolProgressDetail: "raw"` and per-agent overrides for debugging raw command/detail output.
2424
- Agents/commands: add `/steer <message>` for queue-independent steering of the active current-session run without starting a new turn when the session is idle. (#76934)
25+
- Control UI/chat: add an agent-first filter to the chat session picker, keep chat controls/composer responsive across phone/tablet/desktop widths, keep desktop chat controls on one row, avoid duplicate avatar refreshes during initial chat load, and hide that row while scrolling down the transcript. Thanks @BunsDev.
26+
- Control UI/chat: collapse consecutive duplicate text messages into one bubble with a count so no-op heartbeat acknowledgements stay compact without hiding nearby context.
2527
- Agents/subagents: preserve every grouped child result when direct completion fallback has to bypass the requester-agent announce turn. Thanks @vincentkoc.
2628
- TTS/telephony: honor provider voice/model overrides in telephony synthesis providers so Google Meet agent speech logs match the backend that actually produced the audio. Thanks @vincentkoc.
2729
- Voice Call/realtime: bound the paced Twilio audio queue and close overloaded realtime streams before provider audio can pile up behind the websocket backpressure guard. Thanks @vincentkoc.
@@ -62,14 +64,30 @@ Docs: https://docs.openclaw.ai
6264

6365
### Fixes
6466

67+
- Plugins/commands: scope QQBot framework slash commands to the QQBot channel so `/bot-*` command handlers and native specs do not leak onto unrelated chat surfaces. Thanks @vincentkoc.
68+
- fix: harden backend message action gateway routing [AI]. (#76374) Thanks @pgondhi987.
69+
- Gate QQBot streaming command auth [AI]. (#76375) Thanks @pgondhi987.
70+
- Plugins/discovery: ignore managed npm plugin packages that only expose TypeScript source entries without compiled runtime output, so stale/broken installs cannot hide a working bundled or reinstallable channel plugin during setup.
71+
- CLI/update: treat OpenClaw stable correction versions like `2026.5.3-1` as newer than their base stable release, so package updates no longer ask for downgrade confirmation.
72+
- Plugins/install: suppress dangerous-pattern scanner warnings for trusted official OpenClaw npm installs, so installing `@openclaw/discord` no longer prints credential-harvesting warnings for the official package.
73+
- Plugins/release: make the published npm runtime verifier reject blank `openclaw.runtimeExtensions` entries instead of treating them as absent and passing via inferred outputs. Thanks @vincentkoc.
74+
- Plugins/security: ignore inline and block comments when matching source-rule context in plugin install scans, so comment-only `fetch`/`post` references near environment defaults do not block clean plugins. Thanks @vincentkoc.
75+
- Doctor/plugins: remove stale managed install records for bundled plugins even when the bundled plugin is not explicitly configured, so doctor cleanup cannot leave orphaned install metadata behind. Thanks @vincentkoc.
76+
- Web fetch: scope provider fallback cache entries by the selected fetch provider so config reloads cannot reuse another provider's cached fallback payload. Thanks @vincentkoc.
77+
- Web search: honor late-bound `tools.web.search.enabled: false` during tool execution so config reloads cannot leave an already-created `web_search` tool runnable. Thanks @vincentkoc.
78+
- Plugins/packages: reject inferred built runtime entries that exist but fail package-boundary checks instead of falling back to TypeScript source for installed packages. Thanks @vincentkoc.
79+
- Plugins/loader: do not retry native-loaded JavaScript plugin modules through the source transformer after native evaluation has already reached a missing dependency, avoiding duplicate top-level side effects. Thanks @vincentkoc.
80+
- Plugins/security: stop the install scanner from blocking official bundled plugin packages when `process.env` access and normal API sends only appear in distant parts of the same compiled bundle.
81+
- Plugins/packages: reject blank `openclaw.runtimeExtensions` entries instead of silently ignoring them and falling back to inferred TypeScript runtime entries. Thanks @vincentkoc.
82+
- Doctor/plugins: remove stale managed npm plugin shadow entries from the managed package lock as well as `package.json` and `node_modules`, so future npm operations do not keep referencing repaired bundled-plugin shadows. Thanks @vincentkoc.
6583
- Plugins/runtime state: keep the key being registered when namespace eviction runs in the same millisecond as existing entries, so `register` and `registerIfAbsent` do not report success while evicting their own fresh value. Thanks @vincentkoc.
6684
- Control UI/Talk: make failed Talk startup errors dismissable and clear the stale Talk error state when dismissed, so missing realtime voice provider configuration does not leave a permanent chat banner. Fixes #77071. Thanks @ijoshdavis.
6785
- Control UI/Talk: stop and clear failed realtime Talk sessions when dismissing runtime error banners, so the next Talk click starts a fresh session instead of only stopping the stale one. Thanks @vincentkoc.
6886
- Control UI/Talk: retry from a failed realtime Talk session on the next Talk click instead of requiring a separate stale-session stop click first. Thanks @vincentkoc.
6987
- Canvas host: preserve the Gateway TLS scheme in browser canvas host URLs and startup mount logs, so direct HTTPS gateways do not advertise insecure canvas links. Thanks @vincentkoc.
7088
- WhatsApp/login: route login success and failure messages through the injected runtime, so setup/onboarding surfaces capture all login output instead of only the QR. Thanks @vincentkoc.
7189
- Google Chat: create an isolated Google auth transport per auth client, so google-auth-library interceptor mutations do not accumulate across webhook verification and access-token clients. Thanks @vincentkoc.
72-
- Doctor/plugins: remove orphaned managed npm copies of bundled `@openclaw/*` plugins during `doctor --fix`, so stale package manifests cannot shadow the current bundled plugin config schema.
90+
- Doctor/plugins: remove orphaned or recovered managed npm copies of bundled `@openclaw/*` plugins during `doctor --fix`, so stale package manifests cannot shadow the current bundled plugin config schema.
7391
- Control UI/performance: cap long-task and long-animation-frame diagnostics in the shared event log, so slow-render telemetry does not evict gateway/plugin events from the Debug and Overview views. Thanks @vincentkoc.
7492
- Gateway/startup: log the canvas host mount only after the HTTP server has bound, so startup logs no longer report the canvas host as mounted before it can serve requests.
7593
- Control UI/i18n: render the Sessions active filter tooltip with the configured minute count in every locale and make the i18n check reject placeholder drift. Thanks @BunsDev.
@@ -84,6 +102,7 @@ Docs: https://docs.openclaw.ai
84102
- Google Meet: fork the caller's current agent transcript into agent-mode meeting consultant sessions, so Meet replies inherit the context from the tool call that joined the meeting.
85103
- iOS/mobile pairing: reject non-loopback `ws://` setup URLs before QR/setup-code issuance and let the iOS Gateway settings screen scan QR codes or paste full setup-code messages. Thanks @BunsDev.
86104
- Control UI: keep Gateway Access inputs and locale picker contained inside the card at narrow and tablet widths.
105+
- Agents/trajectory: bound runtime trajectory capture and yield queued sidecar writes so oversized traces stop recording instead of monopolizing Gateway cleanup. Fixes #77124. Thanks @loyur.
87106
- Telegram/streaming: sanitize tool-progress draft preview backticks before shared compaction, so long backtick-heavy progress text still renders inside the safe code-formatted preview instead of collapsing to an ellipsis.
88107
- UI/chat: remove the unsupported `line-clamp` declaration from the chat queue text rule to eliminate Firefox console noise without changing visible truncation behavior. Thanks @ZanderH-code.
89108
- Agents/Pi: suppress persistence for synthetic mid-turn overflow continuation prompts, so transcript-retry recovery does not write the "continue from transcript" prompt as a new user turn. Thanks @vincentkoc.
@@ -109,6 +128,7 @@ Docs: https://docs.openclaw.ai
109128
- Web search: keep first-class assistant `web_search` auto-detect and configured runtime providers visible when active runtime metadata or the active plugin registry is incomplete. Fixes #77073. Thanks @joeykrug.
110129
- Plugins/tools: mark manifest-optional sibling tools as optional even when they come from a shared non-optional factory, so cached/status/MCP metadata keeps opt-in tool policy accurate. Thanks @vincentkoc.
111130
- Matrix: keep `streaming.progress.toolProgress` scoped to progress draft mode, so partial and quiet Matrix previews do not lose tool progress unless `streaming.preview.toolProgress` is disabled. Thanks @vincentkoc.
131+
- Gateway/validation: isolate gateway server validation files, ignore unrelated startup logs in request-trace coverage, and fail fast on stuck shared-auth sockets, reducing false main-branch CI failures for contributors. Thanks @amknight.
112132
- Channels/streaming: keep `streaming.progress.toolProgress` scoped to progress draft mode, so disabling compact progress lines does not silence partial/block preview tool updates. Thanks @vincentkoc.
113133
- Plugins/update: treat OpenClaw stable correction versions like `2026.5.3-1` as stable releases for npm installs, plugin updates, and bundled-version comparisons, so `latest` can advance official plugins without prerelease opt-in. Thanks @vincentkoc.
114134
- Control UI: point the Appearance tweakcn browse action and docs at the live tweakcn editor route instead of the removed `/themes` page. Fixes #77048.

‎apps/android/app/build.gradle.kts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -65,8 +65,8 @@ android {
6565
applicationId = "ai.openclaw.app"
6666
minSdk = 31
6767
targetSdk = 36
68-
versionCode = 2026050300
69-
versionName = "2026.5.3"
68+
versionCode = 2026050400
69+
versionName = "2026.5.4"
7070
ndk {
7171
// Support all major ABIs — native libs are tiny (~47 KB per ABI)
7272
abiFilters += listOf("armeabi-v7a", "arm64-v8a", "x86", "x86_64")

‎apps/ios/Config/Version.xcconfig‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@
22
// Source of truth: apps/ios/version.json
33
// Generated by scripts/ios-sync-versioning.ts.
44

5-
OPENCLAW_IOS_VERSION = 2026.5.3
6-
OPENCLAW_MARKETING_VERSION = 2026.5.3
5+
OPENCLAW_IOS_VERSION = 2026.5.4
6+
OPENCLAW_MARKETING_VERSION = 2026.5.4
77
OPENCLAW_BUILD_VERSION = 1
88

99
#include? "../build/Version.xcconfig"

‎apps/ios/fastlane/metadata/en-US/release_notes.txt‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,3 @@
11
Maintenance update for the current OpenClaw development release.
2+
3+
- Gateway pairing now supports scanning QR codes from Settings and accepts full copied setup-code messages while keeping non-loopback `ws://` setup links blocked.

‎apps/ios/version.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
{
2-
"version": "2026.5.3"
2+
"version": "2026.5.4"
33
}

‎apps/macos/Sources/OpenClaw/Resources/Info.plist‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,9 @@
1515
<key>CFBundlePackageType</key>
1616
<string>APPL</string>
1717
<key>CFBundleShortVersionString</key>
18-
<string>2026.5.3</string>
18+
<string>2026.5.4</string>
1919
<key>CFBundleVersion</key>
20-
<string>2026050300</string>
20+
<string>2026050400</string>
2121
<key>CFBundleIconFile</key>
2222
<string>OpenClaw</string>
2323
<key>CFBundleURLTypes</key>

‎docs/cli/plugins.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -387,7 +387,7 @@ The local plugin registry is OpenClaw's persisted cold read model for installed
387387

388388
Use `plugins registry` to inspect whether the persisted registry is present, current, or stale. Use `--refresh` to rebuild it from the persisted plugin index, config policy, and manifest/package metadata. This is a repair path, not a runtime activation path.
389389

390-
`openclaw doctor --fix` also repairs registry-adjacent managed npm drift: if an orphaned `@openclaw/*` package under the managed plugin npm root shadows a bundled plugin, doctor removes that stale package and rebuilds the registry so startup validates against the bundled manifest.
390+
`openclaw doctor --fix` also repairs registry-adjacent managed npm drift: if an orphaned or recovered `@openclaw/*` package under the managed plugin npm root shadows a bundled plugin, doctor removes that stale package and rebuilds the registry so startup validates against the bundled manifest.
391391

392392
<Warning>
393393
`OPENCLAW_DISABLE_PERSISTED_PLUGIN_REGISTRY=1` is a deprecated break-glass compatibility switch for registry read failures. Prefer `plugins registry --refresh` or `openclaw doctor --fix`; the env fallback is only for emergency startup recovery while the migration rolls out.

0 commit comments

Comments
 (0)