openclaw
diff --git a/‎.github/workflows/ci-build-artifacts-testbox.yml‎
Lines changed: 6 additions & 3 deletions b/‎.github/workflows/ci-build-artifacts-testbox.yml‎
Lines changed: 6 additions & 3 deletions
diff --git a/‎.github/workflows/ci.yml‎
Lines changed: 16 additions & 4 deletions b/‎.github/workflows/ci.yml‎
Lines changed: 16 additions & 4 deletions
diff --git a/‎.github/workflows/openclaw-npm-release.yml‎
Lines changed: 57 additions & 9 deletions b/‎.github/workflows/openclaw-npm-release.yml‎
Lines changed: 57 additions & 9 deletions
diff --git a/‎.github/workflows/openclaw-performance.yml‎
Lines changed: 17 additions & 0 deletions b/‎.github/workflows/openclaw-performance.yml‎
Lines changed: 17 additions & 0 deletions
diff --git a/‎CHANGELOG.md‎
Lines changed: 6 additions & 1 deletion b/‎CHANGELOG.md‎
Lines changed: 6 additions & 1 deletion
@@ -98,7 +98,7 @@ jobs:
         run: |
           set -euo pipefail
 
-          cache_prefix="${RUNNER_OS}-dist-build-"
+          cache_prefix="${RUNNER_OS}-dist-build-v2-"
           declare -A seen=()
 
           resolve_tag_sha() {
@@ -150,7 +150,8 @@ jobs:
             .artifacts/build-all-cache/
             dist/
             dist-runtime/
-          key: ${{ runner.os }}-dist-build-${{ github.sha }}
+            packages/*/dist/
+          key: ${{ runner.os }}-dist-build-v2-${{ github.sha }}
           restore-keys: ${{ steps.dist-cache-seeds.outputs.restore-keys }}
 
       - name: Build dist on cache miss
@@ -170,6 +171,7 @@ jobs:
 
           test -d dist
           test -d dist-runtime
+          test -f packages/ai/dist/internal/runtime.mjs
           if [[ ! -f dist/index.js && ! -f dist/index.mjs ]]; then
             echo "Missing dist/index.js or dist/index.mjs" >&2
             exit 1
@@ -185,7 +187,8 @@ jobs:
             .artifacts/build-all-cache/
             dist/
             dist-runtime/
-          key: ${{ runner.os }}-dist-build-${{ github.sha }}
+            packages/*/dist/
+          key: ${{ runner.os }}-dist-build-v2-${{ github.sha }}
 
       - name: Prepare Testbox shell
         shell: bash
 
@@ -344,6 +344,9 @@ jobs:
                 requires_dist: shard.requiresDist,
                 runner: shard.runner,
                 timeout_minutes: shard.timeoutMinutes,
+                requires_go:
+                  shard.shardName === "core-tooling" ||
+                  shard.groups?.some((group) => group.shard_name === "core-tooling"),
               }))
             : [];
           const nodeTestNonDistShards = nodeTestShards.filter((shard) => !shard.requires_dist);
@@ -669,9 +672,10 @@ jobs:
           path: |
             dist/
             dist-runtime/
+            packages/*/dist/
             extensions/*/src/host/**/.bundle.hash
             extensions/*/src/host/**/*.bundle.js
-          key: ${{ runner.os }}-dist-build-${{ needs.preflight.outputs.checkout_revision }}
+          key: ${{ runner.os }}-dist-build-v2-${{ needs.preflight.outputs.checkout_revision }}
 
       - name: Build dist
         if: steps.dist_build_cache.outputs.cache-hit != 'true'
@@ -684,7 +688,7 @@ jobs:
         run: pnpm ui:i18n:check
 
       - name: Pack built runtime artifacts
-        run: tar --posix -cf dist-runtime-build.tar.zst --use-compress-program zstdmt dist dist-runtime
+        run: tar --posix -cf dist-runtime-build.tar.zst --use-compress-program zstdmt dist dist-runtime packages/*/dist
 
       - name: Upload built runtime artifacts
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
@@ -830,6 +834,7 @@ jobs:
           path: |
             dist/
             dist-runtime/
+            packages/*/dist/
             extensions/*/src/host/**/.bundle.hash
             extensions/*/src/host/**/*.bundle.js
           key: ${{ steps.dist_build_cache.outputs.cache-primary-key }}
@@ -922,7 +927,7 @@ jobs:
       contents: read
     name: QA Smoke CI (${{ matrix.name }})
     needs: [preflight]
-    if: needs.preflight.outputs.run_checks_fast == 'true'
+    if: ${{ false }} # Temporarily disabled while QA smoke sharding is repaired.
     runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && 'blacksmith-16vcpu-ubuntu-2404' || 'ubuntu-24.04') }}
     timeout-minutes: 60
     strategy:
@@ -1009,7 +1014,7 @@ jobs:
       contents: read
     name: QA Smoke CI
     needs: [preflight, qa-smoke-ci-shard]
-    if: always() && needs.preflight.outputs.run_checks_fast == 'true'
+    if: ${{ false }} # Temporarily disabled while QA smoke sharding is repaired.
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
@@ -1149,6 +1154,13 @@ jobs:
           node-version: "${{ matrix.node_version || '24.x' }}"
           install-bun: "false"
 
+      - name: Setup Go for docs i18n
+        if: matrix.requires_go == true
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+        with:
+          go-version-file: scripts/docs-i18n/go.mod
+          cache-dependency-path: scripts/docs-i18n/go.sum
+
       - name: Configure Node test resources
         run: echo "OPENCLAW_VITEST_MAX_WORKERS=2" >> "$GITHUB_ENV"
 
 
@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
     inputs:
       tag:
-        description: Release tag to publish, or a full 40-character workflow-branch commit SHA for validation-only preflight (for example v2026.3.22 or 0123456789abcdef0123456789abcdef01234567)
+        description: Release tag to publish, or any full 40-character commit SHA for validation-only preflight (for example v2026.3.22 or 0123456789abcdef0123456789abcdef01234567)
         required: true
         type: string
       preflight_only:
@@ -133,6 +133,7 @@ jobs:
       - name: Validate npm release request
         env:
           BYPASS_EXTENDED_STABLE_GUARD: ${{ inputs.bypass_extended_stable_guard }}
+          PREFLIGHT_ONLY: ${{ inputs.preflight_only }}
           RELEASE_NPM_DIST_TAG: ${{ inputs.npm_dist_tag }}
           RELEASE_TAG: ${{ inputs.tag }}
           NPM_WORKFLOW_REF: ${{ github.ref }}
@@ -207,19 +208,16 @@ jobs:
           RELEASE_SHA=$(git rev-parse HEAD)
           RELEASE_BRANCH_REF="refs/remotes/origin/${WORKFLOW_REF_NAME}"
           export RELEASE_SHA RELEASE_BRANCH_REF
-          # Fetch the workflow branch so merge-base ancestry checks keep working
-          # for older tagged commits contained in a release branch.
-          git fetch --no-tags origin "+refs/heads/${WORKFLOW_REF_NAME}:refs/remotes/origin/${WORKFLOW_REF_NAME}"
           if [[ "${RELEASE_REF}" =~ ^[0-9a-fA-F]{40}$ ]]; then
-            BRANCH_SHA="$(git rev-parse "${RELEASE_BRANCH_REF}")"
-            if [[ "${RELEASE_SHA}" != "${BRANCH_SHA}" ]]; then
-              echo "Validation-only SHA mode only supports the current ${WORKFLOW_REF_NAME} HEAD." >&2
-              exit 1
-            fi
             RELEASE_TAG="v$(node -p "require('./package.json').version")"
             export RELEASE_TAG
+            RELEASE_BRANCH_REF="${RELEASE_SHA}"
+            export RELEASE_BRANCH_REF
             echo "Validation-only SHA mode: using synthetic release tag ${RELEASE_TAG} for package metadata checks."
           else
+            # Tagged release validation still proves the commit is contained in
+            # the workflow branch selected by the operator.
+            git fetch --no-tags origin "+refs/heads/${WORKFLOW_REF_NAME}:refs/remotes/origin/${WORKFLOW_REF_NAME}"
             RELEASE_TAG="${RELEASE_REF}"
             export RELEASE_TAG
           fi
@@ -231,8 +229,58 @@ jobs:
       # IF A CHECK CAN TAKE A LONG TIME, NEEDS LIVE CREDENTIALS, OR IS KNOWN TO BE FLAKY,
       # IT BELONGS IN openclaw-release-checks.yml INSTEAD OF BLOCKING npm PUBLISH.
       - name: Verify release contents
+        env:
+          OPENCLAW_RELEASE_CHECK_LOCAL_PACKAGE_TARBALL_DIR: ${{ steps.ai_runtime_tarballs.outputs.dir }}
         run: pnpm release:check
 
+      - name: Exercise all extended-stable plugin npm packages
+        id: plugin_npm_preflight
+        if: ${{ inputs.npm_dist_tag == 'extended-stable' }}
+        env:
+          OPENCLAW_PLUGIN_NPM_PUBLISH_TAG: extended-stable
+        run: |
+          set -euo pipefail
+          plan="$RUNNER_TEMP/plugin-npm-extended-stable-preflight.json"
+          artifact_dir="$RUNNER_TEMP/openclaw-plugin-npm-preflight"
+          rm -rf "$artifact_dir"
+          mkdir -p "$artifact_dir"
+          node --import tsx scripts/plugin-npm-release-plan.ts \
+            --selection-mode all-publishable \
+            --npm-dist-tag extended-stable > "$plan"
+          cp "$plan" "$artifact_dir/plugin-npm-release-plan.json"
+
+          mapfile -t package_dirs < <(jq -r '.all[].packageDir' "$plan")
+          if [[ "${#package_dirs[@]}" == "0" ]]; then
+            echo "Extended-stable plugin preflight resolved no publishable packages." >&2
+            exit 1
+          fi
+
+          runtime_args=()
+          for package_dir in "${package_dirs[@]}"; do
+            runtime_args+=(--package "$package_dir")
+          done
+          node scripts/check-plugin-npm-runtime-builds.mjs "${runtime_args[@]}"
+
+          for package_dir in "${package_dirs[@]}"; do
+            OPENCLAW_PLUGIN_NPM_RUNTIME_BUILD=0 \
+              OPENCLAW_PLUGIN_NPM_PACK_OUTPUT_DIR="$artifact_dir" \
+              bash scripts/plugin-npm-publish.sh --pack "$package_dir" >/dev/null
+          done
+
+          (cd "$artifact_dir" && sha256sum ./*.tgz > SHA256SUMS)
+          package_count="$(jq -r '.all | length' "$plan")"
+          echo "dir=$artifact_dir" >> "$GITHUB_OUTPUT"
+          echo "Extended-stable plugin preflight exercised ${package_count} publishable packages."
+          echo "- Extended-stable plugin packages exercised: ${package_count}" >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Upload extended-stable plugin npm packages
+        if: ${{ inputs.npm_dist_tag == 'extended-stable' }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: openclaw-plugin-npm-preflight-${{ inputs.tag }}
+          path: ${{ steps.plugin_npm_preflight.outputs.dir }}
+          if-no-files-found: error
+
       - name: Generate dependency release evidence
         id: dependency_evidence
         env:
 
@@ -246,6 +246,23 @@ jobs:
           chmod 0755 "$HOME/.local/bin/kova"
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
 
+      - name: Configure OCM local workspace dependencies
+        if: steps.lane.outputs.run == 'true'
+        shell: bash
+        run: |
+          set -euo pipefail
+          npm_wrapper="$PERFORMANCE_HELPER_DIR/scripts/ocm-npm-workspace-deps.mjs"
+          workspace_dependency_dirs=""
+          if [[ -f "${GITHUB_WORKSPACE}/packages/ai/package.json" ]]; then
+            workspace_dependency_dirs="${GITHUB_WORKSPACE}/packages/ai"
+          fi
+          chmod 0755 "$npm_wrapper"
+          {
+            echo "OCM_INTERNAL_NPM_BIN=$npm_wrapper"
+            echo "OPENCLAW_OCM_REAL_NPM_BIN=$(command -v npm)"
+            echo "OPENCLAW_OCM_WORKSPACE_DEPENDENCY_DIRS=$workspace_dependency_dirs"
+          } >> "$GITHUB_ENV"
+
       - name: Pin Kova OpenAI model to GPT 5.5
         if: steps.lane.outputs.run == 'true'
         shell: bash
 
@@ -23,6 +23,10 @@ Docs: https://docs.openclaw.ai
 
 ### Fixes
 
+- **Browser actions on Node 24:** keep browser request cancellation bound to the client and response lifetime instead of Node 24.16+'s prematurely aborted body-stream signal, preventing valid POST actions from failing after JSON parsing. Thanks @obviyus and @vincentkoc.
+- **SecretRef model credentials:** keep resolved provider secrets behind process-local sentinels through auth storage, stream setup, SDK configuration, and managed local-provider probing, then inject plaintext only at the final network or provider-plugin boundary while retaining exact-value log redaction. (#102008, #102009)
+- **Lean local model shell access:** keep `exec` directly visible beside the default structured Tool Search controls so coding-tuned local models can use their shell fallback instead of searching for missing domain tools. (#87587) Thanks @vincentkoc.
+- **OAuth refresh contention diagnostics:** keep local lock paths out of user-facing refresh failures and avoid duplicate failure prefixes while preserving structured provider and profile classification. (#83383) Thanks @vincentkoc.
 - **Exec approval prompts:** keep background-disabled fallback warnings out of pending gateway/node approvals and show them only after a command actually runs in the foreground. (#78184) Thanks @vincentkoc.
 - **Direct poll delivery:** route direct and hybrid channel polls through the owning outbound adapter while preserving gateway-mode routing and channel option checks. (#99950) Thanks @NianJiuZst.
 - **Agent wait hard-timeout snapshots:** preserve canonical hard-timeout phase and timestamps when the outer `agent.wait` timer wins the retry-grace race, while leaving queue, draining, and restart-cancelled waits correctable. (#89367) Thanks @Pick-cat.
@@ -43,12 +47,13 @@ Docs: https://docs.openclaw.ai
 - **Microsoft Teams attachment metadata:** bound Bot Framework `attachmentInfo` JSON reads and cancel oversized streams before they can exhaust Gateway memory. (#99125) Thanks @ly85206559.
 - **Agent auth copy order:** preserve the source agent's portable auth-profile precedence when copying credentials to a new agent while excluding skipped profiles and transient auth state. (#100833) Thanks @machine3at.
 - **Memory session repair:** keep daily dreaming ingestion bookkeeping outside session-corpus audit and repair so `memory status --fix` preserves healthy daily state. (#93389) Thanks @Alix-007 and @vincentkoc.
-- **Remote browser CDP policy:** allow the configured CDP control host through an existing hostname allowlist without widening page navigation policy. (#100986, #100819) Thanks @NianJiuZst.
+- **Remote browser CDP policy:** allow the configured CDP control host through an existing hostname allowlist without widening page navigation policy, while keeping strict-policy discovery bound to the configured control authority. (#100986, #100819) Thanks @NianJiuZst.
 - **Config unset diagnostics:** explain when an inherited or default configuration value cannot be unset instead of reporting a misleading successful deletion. (#96557) Thanks @moeghashim.
 - **Crestodian command probes:** contain stdout and stderr stream failures while keeping child-process close and spawn errors authoritative, preventing unhandled probe crashes. (#100741) Thanks @lsr911.
 - **Feishu mention forwarding:** fail closed when the bot Open ID is unavailable so group messages cannot be misclassified as explicit bot mentions. (#100891) Thanks @zhangguiping-xydt.
 - **Cron edit delivery:** preserve each job's implicit delivery mode when applying partial delivery updates, so disabling best-effort delivery no longer turns detached job announcements off. (#100846) Thanks @machine3at.
 - **Control UI session creation:** keep newly created sessions at the front of the stable sidebar order after selecting another session. Thanks @shakkernerd.
+- **Control UI file previews:** keep large Skill Workshop files responsive with cached, offscreen-contained text chunks while preserving wrapped content, stable file switching, full-file copy, and clean focus behavior. (#101319) Thanks @xianshishan and @shakkernerd.
 - **FTS-only memory startup:** skip plugin capability discovery when `memorySearch.provider` is explicitly `none`, avoiding an unnecessary cold-start scan.
 - **Control UI agent model labels:** show each selected agent's effective model in the Default picker option instead of the global model. (#100719, #77690, #77440) Thanks @hyspacex.
 - **Control UI inbound image previews:** render canonical inbound media references through the authenticated ticket route after chat-history reloads. (#100725, #90172, #89591) Thanks @sweetcornna.