Skip to content

Commit a253548

Browse files
pgondhi987pgondhi987
committed
Merge remote-tracking branch 'origin/main' into fix/fix-700
# Conflicts: # extensions/msteams/src/attachments/shared.test.ts # extensions/msteams/src/attachments/shared.ts
2 parents a7744ed + f3cfd75 commit a253548

2,154 files changed

Lines changed: 111887 additions & 25990 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.agents/skills/clawdtributor/SKILL.md‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,7 @@ Do not close from title alone. If closing as done on main or nonsensical, prove
9898

9999
When asked for `5 new`, exclude refs already surfaced in the session and refill from the archive until there are 5 live-open candidates. If fewer than 5 remain open, list all open ones and say how many short.
100100

101-
When asked to `update`, `refresh`, `recheck`, `check again`, or similar, return an updated live-open candidate list. Do not fill the main list with items that merely merged/closed since the last pass; put those numbers in a short bottom line.
101+
When asked to `update`, `refresh`, `recheck`, `check again`, or similar, return an updated live-open candidate list. Sort by maintainer importance, not recency: high-impact ready fixes first, then useful-but-review-first, then open/not-ready items. Do not include a "changed since last pass" section or bottom-line merged/closed summary unless the user explicitly asks for churn.
102102

103103
Prefer:
104104

@@ -142,18 +142,20 @@ No Markdown tables. Compact bullets. Use color/risk markers:
142142
Required line shape:
143143

144144
```markdown
145-
- **PR #81244** `@whatsskill.` `+118/-1` `bug` 🟢 verifiable: yes. This prevents chat action buttons from overlapping short assistant replies. Blast: web chat rendering, low.
146-
- **Issue #81245** `@alice` `LOC n/a` `bug` 🟡 verifiable: partial. This reports duplicate Telegram replies when reconnecting after gateway restart. Blast: Telegram channel runtime, medium.
145+
- **PR #81244** `@whatsskill.` `+118/-1` `bug` 🟢 https://github.com/openclaw/openclaw/pull/81244 - Prevents chat action buttons from overlapping short assistant replies. Verifiable: yes. Blast: web chat rendering, low.
146+
- **Issue #81245** `@alice` `LOC n/a` `bug` 🟡 https://github.com/openclaw/openclaw/issues/81245 - Reports duplicate Telegram replies when reconnecting after gateway restart. Verifiable: partial. Blast: Telegram channel runtime, medium.
147147
```
148148

149149
Rules:
150150

151151
- Bold the `PR #n` or `Issue #n` marker.
152152
- Use `@handle`, not author bio text.
153+
- Always include the full GitHub URL.
154+
- Include a one-line description after the URL, separated with `-`.
153155
- PR LOC is `+additions/-deletions`; issue LOC is `LOC n/a`.
154156
- Type: `bug`, `feature`, `perf`, `security`, `docs`, `test`, `chore`, or `refactor`.
155157
- Write a full sentence for what it does.
156158
- Always include blast radius in one phrase.
157159
- Always include `verifiable: yes|partial|no` plus the shortest proof hint when helpful.
158160
- If status is not open, still show it only when the user asked for all surfaced refs; use ✅ or ⚪ and state merged/closed.
159-
- For refresh-style asks, bottom line: `Merged/closed since last pass: #81016 merged, #81026 closed.` Omit if none.
161+
- For refresh-style asks, prefer section order: `Best Open Now`, `Useful But Review First`, `Still Open / Not Ready`. Omit merged/closed churn by default.

‎.agents/skills/openclaw-ghsa-maintainer/SKILL.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
name: openclaw-ghsa-maintainer
3-
description: Inspect, patch, validate, publish, or confirm OpenClaw GHSA security advisories and private-fork state.
3+
description: "Inspect, patch, validate, publish, or confirm OpenClaw GHSA security advisories and private-fork state."
44
---
55

66
# OpenClaw GHSA Maintainer
@@ -85,3 +85,4 @@ jq -r .description < /tmp/ghsa.refetch.json | rg '\\\\n'
8585
- Publishing fails with HTTP 422 if required fields are missing or the private fork still has open PRs.
8686
- A payload that looks correct in shell can still be wrong if Markdown was assembled with escaped newline strings.
8787
- Advisory PATCH sequencing matters; separate field updates when GHSA API constraints require it.
88+
- Public hardening/no-publish comments and draft text should avoid raw commit hashes, PR titles/numbers, and fix-mechanism summaries. Prefer patched-version fields or release-only wording; keep SHAs, PRs, and implementation notes in internal evidence.

‎.agents/skills/openclaw-testing/SKILL.md‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -213,7 +213,7 @@ workflow only spends setup and queue time on that suite.
213213
### Release Evidence
214214

215215
After release-candidate validation or before a release decision, record the
216-
important run ids in the private `openclaw/releases-private` evidence ledger.
216+
important run ids in the public `openclaw/releases` evidence ledger.
217217
Use the manual `OpenClaw Release Evidence`
218218
(`openclaw-release-evidence.yml`) workflow there. It writes durable summaries
219219
under `evidence/<release-id>/` and commits:
@@ -236,13 +236,13 @@ short release-manager notes there. Do not store raw logs, provider
236236
prompts/responses, channel transcripts, signing material, or secret-bearing
237237
config in git; raw logs stay in Actions artifacts.
238238

239-
When `Full Release Validation` completes and
240-
`OPENCLAW_RELEASES_PRIVATE_DISPATCH_TOKEN` is configured in the public repo, it
241-
requests the private `OpenClaw Release Evidence From Full Validation` workflow.
242-
That private workflow reads the parent full-validation run, extracts the child
243-
CI/release-checks/Telegram run ids from the parent logs, and opens the evidence
244-
PR automatically. If the token is absent or the run predates this wiring, trigger
245-
that private workflow manually with the full-validation run id.
239+
When `Full Release Validation` completes and `OPENCLAW_RELEASES_DISPATCH_TOKEN`
240+
is configured in the source repo, it requests the public
241+
`OpenClaw Release Evidence From Full Validation` workflow. That workflow reads
242+
the parent full-validation run, extracts the child CI/release-checks/Telegram
243+
run ids from the parent logs, and opens the evidence PR automatically. If the
244+
token is absent or the run predates this wiring, trigger that workflow manually
245+
with the full-validation run id.
246246

247247
### Release Checks
248248

‎.agents/skills/release-openclaw-announcement/SKILL.md‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
---
2+
name: release-openclaw-announcement
3+
description: "Draft or post OpenClaw beta/stable Discord release announcements from changelog, GitHub release, registry, and validation evidence. Use when announcing a beta, stable release, release candidate, or asking what users should test after an OpenClaw release."
4+
---
5+
6+
# OpenClaw Release Announcement
7+
8+
Use with `release-openclaw-maintainer` after a beta or stable release is live.
9+
Use with `openclaw-discord` when actually posting to Discord.
10+
11+
## Evidence First
12+
13+
Before drafting focus areas, read real release evidence:
14+
15+
1. Current GitHub release body for the tag.
16+
2. `CHANGELOG.md` section for the released base version.
17+
3. Commits since the previous shipped version or the operator-specified base.
18+
4. Registry/package metadata for the exact version and current dist-tag.
19+
5. Validation status that is relevant to user confidence.
20+
21+
Do not claim a full changelog audit unless you did it. If you only read the
22+
generated release notes or top changelog section, say that and either audit
23+
properly or draft with that limitation.
24+
25+
For beta focus areas, prioritize user-observable changes over internal test or
26+
CI mechanics:
27+
28+
- install/update paths
29+
- OS/platform-specific behavior
30+
- Gateway startup/restart, config, and runtime behavior
31+
- provider/model/runtime routing
32+
- plugin loading and local plugin development
33+
- channels and media paths
34+
- security/data-loss/user-impact fixes
35+
36+
Do not let late release-branch fixes automatically dominate the announcement.
37+
If the version includes a large delta from the previous shipped version, rank
38+
focus areas by the whole release delta and expected user impact; mention late
39+
fixes in their natural category.
40+
41+
## Required Copy
42+
43+
Every beta announcement must make beta status explicit and include:
44+
45+
- exact version, e.g. `OpenClaw 2026.5.25-beta.1`
46+
- one-sentence risk framing: beta, useful for testing, not stable promotion
47+
- focused test areas derived from evidence, not guesswork
48+
- update command promoted near the top:
49+
```sh
50+
openclaw update --channel beta --yes
51+
openclaw --version
52+
```
53+
- fresh install path:
54+
`Install from https://openclaw.ai`
55+
- GitHub release link
56+
- concise validation note, without making CI the headline
57+
58+
Do not suggest npm install commands in beta announcements unless the operator
59+
explicitly asks for npm-specific copy or troubleshooting text. It is fine to use
60+
registry metadata as evidence; do not turn that into public install guidance.
61+
62+
For stable announcements, use the stable channel wording:
63+
64+
```sh
65+
openclaw update --channel stable --yes
66+
openclaw --version
67+
```
68+
69+
Fresh installs still point to `https://openclaw.ai`.
70+
71+
## Style
72+
73+
- Discord Markdown, no tables.
74+
- Keep it skimmable: short intro, bullets, commands, links.
75+
- Lead with what users can feel or test, not proof plumbing.
76+
- Mention validation only after install/update instructions.
77+
- Be specific about where feedback is useful.
78+
- Do not mention private local proof paths in public announcements.
79+
- Do not overstate unverified platforms, channels, or provider behavior.
80+
81+
## Posting
82+
83+
When asked to post, use the configured Discord workflow from
84+
`openclaw-discord` or the approved OpenClaw relay. Never print tokens.
85+
For public channels, inspect the final body before sending.

‎.agents/skills/release-openclaw-announcement/agents/openai.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
interface:
2+
display_name: "OpenClaw Release Announcement"
3+
short_description: "Draft Discord beta/stable release announcements from evidence."
4+
default_prompt: "Use this skill to draft an OpenClaw beta or stable Discord announcement from changelog, release notes, npm/GitHub release proof, and validation evidence."

‎.agents/skills/security-triage/SKILL.md‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
name: security-triage
3-
description: Triage OpenClaw security advisories, drafts, and GHSA reports with shipped-tag and trust-model proof.
3+
description: "Triage OpenClaw security advisories, drafts, and GHSA reports with shipped-tag and trust-model proof."
44
---
55

66
# Security Triage
@@ -87,11 +87,19 @@ When preparing a maintainer-ready close reply:
8787
- exact reason for close
8888
- exact code refs
8989
- exact shipped tag / release facts
90-
- exact fix commit or canonical duplicate GHSA when applicable
90+
- fix provenance or canonical duplicate GHSA when applicable
9191
- optional hardening note only if worthwhile and functionality-preserving
9292

9393
Keep tone firm, specific, non-defensive.
9494

95+
## Public Wording Hygiene
96+
97+
- Keep raw commit hashes, PR titles/numbers, and fix-mechanism summaries out of public advisory text. Use the patched release/version field only.
98+
- Keep exact commit SHAs, PRs, and implementation notes in internal notes and verification files.
99+
- For hardening/no-publish outcomes, do not add exploit-heavy details, "Fixed by" text, or a "Fix Commit(s)" section. Thank reporters, preserve credit, state the `SECURITY.md` boundary, and say clearly that the GHSA will close without publication.
100+
- For published CVE/GHSA text, prefer `### Patched Versions` with the fixed release. Do not explain how the patch works unless Peter explicitly asks for that public detail.
101+
- Keep GHSA ids out of changelog and release-note wording unless Peter explicitly asks.
102+
95103
## Discussion Mode
96104

97105
When Peter is manually posting GHSA comments, use this flow:

‎.agents/skills/verify-release/SKILL.md‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
---
2+
name: verify-release
3+
description: "Verify an OpenClaw release is fully published across GitHub, npm, plugins, ClawHub, package smoke, and live Gateway agent turns."
4+
---
5+
6+
# Verify Release
7+
8+
Use this when asked whether an OpenClaw release is fully released, published,
9+
promoted, smoke-tested, or live-verified. This is a verification skill, not a
10+
publish skill; use `$release-openclaw-maintainer` before changing release state.
11+
12+
## Rules
13+
14+
- Resolve short suffixes like `.27` to the concrete CalVer version from the
15+
current date/context, then say the resolved version.
16+
- Verify live state. Do not trust local checkout state, release notes, or old
17+
memory as current truth.
18+
- If the checkout is dirty or divergent, use it only for scripts/reference.
19+
For version metadata, fetch from GitHub release/tag or unpack the tag tarball
20+
under `/tmp`.
21+
- Never print secrets. Use inherited live keys only for scoped smoke commands.
22+
- Keep the final terse: `yes/no`, evidence bullets, caveats, cleanup.
23+
24+
## Core Checks
25+
26+
1. GitHub release:
27+
- `gh release view v<VERSION> --repo openclaw/openclaw --json tagName,name,publishedAt,isDraft,isPrerelease,targetCommitish,url,body,assets`
28+
- Confirm stable releases are not draft/prerelease.
29+
- Confirm release body has npm, CI, plugin npm, ClawHub, mac/appcast evidence
30+
links when expected.
31+
- Confirm assets expected for stable mac releases are uploaded: zip, dmg,
32+
dSYM, dependency evidence when present.
33+
2. Root npm:
34+
- `npm view openclaw@<VERSION> version dist-tags.latest dist.tarball dist.integrity time.<VERSION> --json`
35+
- `latest` must equal `<VERSION>` for stable.
36+
- Record tarball, integrity, publish time.
37+
3. Plugin publish set:
38+
- Get exact tag metadata from GitHub, not the local checkout when dirty:
39+
download `https://api.github.com/repos/openclaw/openclaw/tarball/v<VERSION>`
40+
into `/tmp/openclaw-v<VERSION>-src`.
41+
- Count `extensions/*/package.json` with
42+
`openclaw.release.publishToNpm === true` and
43+
`openclaw.release.publishToClawHub === true`.
44+
- Compare expected counts to workflow job counts:
45+
`gh api repos/openclaw/openclaw/actions/runs/<RUN>/jobs --paginate`.
46+
- Each expected npm plugin must have version `<VERSION>` and
47+
`dist-tags.latest === <VERSION>`.
48+
4. ClawHub:
49+
- Check the Plugin ClawHub Release workflow conclusion and publish job count.
50+
- Use OpenClaw itself for live registry proof:
51+
`openclaw plugins search <known-plugin> --json`.
52+
- Install one official plugin from ClawHub in an isolated HOME:
53+
`openclaw plugins install clawhub:@openclaw/matrix --pin`.
54+
Prefer `matrix` unless that plugin is not in the expected set.
55+
5. Release workflows:
56+
- Verify conclusions for release notes evidence links:
57+
Full Release Validation, OpenClaw Release Checks, OpenClaw NPM Release,
58+
Plugin NPM Release, Plugin ClawHub Release, mac preflight/validation/publish
59+
when stable mac assets are expected.
60+
- Summarize only relevant successful/failed jobs; ignore routine skipped
61+
optional lanes unless the release body promised them.
62+
6. Published package smoke:
63+
- In `/tmp`, isolated HOME:
64+
`npm exec --yes --package openclaw@<VERSION> -- openclaw --version`.
65+
- Run at least one harmless command that touches the published CLI surface,
66+
for example `plugins --help` or `gateway --help`.
67+
7. Dev Gateway live model smoke:
68+
- Use temp HOME/workspace, not the user's normal state:
69+
`HOME=/tmp/openclaw-release-smoke/home OPENCLAW_WORKSPACE=/tmp/openclaw-release-smoke/work pnpm openclaw --dev gateway run --auth none --force --verbose`.
70+
- Health check via CLI: `openclaw --dev gateway health --json`.
71+
- Run one Gateway-backed agent turn with inherited `OPENAI_API_KEY`, short
72+
prompt, explicit session key, JSON output, and a known-available model.
73+
- If the configured default model fails as unavailable, record that caveat
74+
and retry with the newest known-good OpenAI model instead of declaring the
75+
release failed.
76+
- Stop the gateway and verify the port is not listening.
77+
78+
## Caveats To Report
79+
80+
- Dist-tag caveat: stable `latest` is release truth; if optional `beta` mirrors
81+
still point at a beta version, report it as a caveat, not a stable-release
82+
blocker, unless the user asked to verify beta promotion.
83+
- Divergent checkout caveat: say when local source SHA differs from release tag
84+
or origin and which live sources were used instead.
85+
- Smoke caveat: distinguish Gateway-backed agent success from local embedded
86+
fallback. A valid Gateway smoke has health OK plus gateway log/run id for the
87+
agent call.

‎.crabbox.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,11 @@ actions:
2929
- openclaw
3030
runnerVersion: latest
3131
ephemeral: true
32+
blacksmith:
33+
org: openclaw
34+
workflow: .github/workflows/ci-check-testbox.yml
35+
job: check
36+
ref: main
3237
aws:
3338
region: eu-west-1
3439
rootGB: 400

‎.github/CODEOWNERS‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,10 @@
1111
/.github/workflows/codeql.yml @openclaw/openclaw-secops
1212
/.github/workflows/codeql-android-critical-security.yml @openclaw/openclaw-secops
1313
/.github/workflows/codeql-critical-quality.yml @openclaw/openclaw-secops
14-
/.github/workflows/dependency-change-awareness.yml @openclaw/openclaw-secops
15-
/test/scripts/dependency-change-awareness-workflow.test.ts @openclaw/openclaw-secops
14+
/.github/workflows/dependency-guard.yml @openclaw/openclaw-secops
15+
/test/scripts/dependency-guard-workflow.test.ts @openclaw/openclaw-secops
16+
/test/scripts/dependency-guard-script.test.ts @openclaw/openclaw-secops
17+
/scripts/github/dependency-guard.mjs @openclaw/openclaw-secops
1618
/package-lock.json @openclaw/openclaw-secops
1719
/npm-shrinkwrap.json @openclaw/openclaw-secops
1820
/extensions/*/package-lock.json @openclaw/openclaw-secops
@@ -29,7 +31,7 @@
2931
/src/gateway/**/*secret*.ts @openclaw/openclaw-secops
3032
/src/gateway/security-path*.ts @openclaw/openclaw-secops
3133
/src/gateway/resolve-configured-secret-input-string*.ts @openclaw/openclaw-secops
32-
/src/gateway/protocol/**/*secret*.ts @openclaw/openclaw-secops
34+
/packages/gateway-protocol/src/**/*secret*.ts @openclaw/openclaw-secops
3335
/src/gateway/server-methods/secrets*.ts @openclaw/openclaw-secops
3436
/src/agents/*auth*.ts @openclaw/openclaw-secops
3537
/src/agents/**/*auth*.ts @openclaw/openclaw-secops

‎.github/actionlint.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,10 @@ self-hosted-runner:
1414
- blacksmith-16vcpu-ubuntu-2404-arm
1515
- blacksmith-6vcpu-macos-latest
1616
- blacksmith-12vcpu-macos-latest
17+
- blacksmith-6vcpu-macos-15
18+
- blacksmith-12vcpu-macos-15
19+
- blacksmith-6vcpu-macos-26
20+
- blacksmith-12vcpu-macos-26
1721

1822
# Ignore patterns for known issues
1923
paths:

0 commit comments

Comments
 (0)