mirror of
https://github.com/iamlukethedev/Claw3D.git
synced 2026-08-14 00:58:04 +00:00
main
12
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 jamartineztelecoengineer84-dotcomandJose Antonio Martinez
|
51cd3a1e94 |
fix(gateway+server): improve diagnostics for origin/auth rejection and silent upstream reject (#125)
* fix(gateway): don't surface protocol-mismatch hint when server rejects origin/auth The heuristic that flags INVALID_REQUEST errors mentioning minProtocol or maxProtocol as a possible protocol mismatch can fire on any schema validation error that happens to mention those field names, including rejections whose real cause is origin allowlist, missing device identity, or upstream policy. Prefer the structured details.code when the gateway provides one, and treat known non-protocol codes (CONTROL_UI_ORIGIN_NOT_ALLOWED, CONTROL_UI_DEVICE_IDENTITY_REQUIRED, UPSTREAM_NOT_ALLOWED) as non-mismatches so the UI does not send operators down the wrong diagnostic path. * fix(server): log explicit warning when gateway proxy rejects an upstream Previously isUpstreamAllowed returned false silently when UPSTREAM_ALLOWLIST was empty in production, when the upstream host was not in the allowlist, or when the URL could not be parsed. The caller closes the connection without forwarding anything to the browser, which sees an opaque 'WebSocket closed before the connection is established' and the server logs contain no hint of what happened. Emit a console.warn in each of the three rejection branches with an actionable message that names the missing env var or the rejected hostname, so operators can diagnose the rejection from the server logs without reading the proxy source. * fix(gateway): don't bias the local-timeout hint toward a protocol mismatch formatGatewayError unconditionally appended a hint suggesting the user upgrade OpenClaw or switch to the Hermes adapter whenever the browser reported a generic "timed out connecting to the gateway" Error. That Error is raised by a local Promise.race timeout, so it carries no information about why the upstream did not respond. Common real causes are network reachability, nginx idle timeouts, origin allowlist, missing UPSTREAM_ALLOWLIST in production, or credential mismatches — none of which are addressed by upgrading the gateway. Replace the biased suggestion with a neutral pointer to the likely diagnostic paths so the hint helps in the common cases without misleading away from origin/auth/policy issues. --------- Co-authored-by: Jose Antonio Martinez <257598434+jamartineztelecoengineer84-dotcom@users.noreply.github.com> |
||
|
GordoCursor AgentLuke The DevElias PfefferClaude Sonnet 4.6copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>Greg Clarkiamlukethedev |
4e552967d9 |
[PRIORITY][FEAT] merge runtime profiles, office systems, doctor, and vera lane convergence (#109)
* fix: include kanbanImmersive in immersiveOverlayActive calculation When Kanban board is open, HUD elements (camera preset buttons, edit toolbar, overlays) should be suppressed. The kanbanImmersive flag was defined but not included in the immersiveOverlayActive condition, causing HUD elements to remain visible. This fix adds kanbanImmersive to the immersiveOverlayActive calculation so HUD elements are properly hidden when the Kanban board is open. Co-authored-by: Luke The Dev <iamlukethedev@users.noreply.github.com> * Fix: Hide mini status bar when Kanban immersive overlay is open Wraps the bottom-left mini status bar (showing agent stats, vibe score, and control hints) with !immersiveOverlayActive check to match the behavior of other HUD elements like camera controls and toolbar. This ensures the status bar is properly hidden when the Kanban board or any other immersive overlay is active, maintaining a clean immersive experience. Co-authored-by: Luke The Dev <iamlukethedev@users.noreply.github.com> * chore: drop unrelated package-lock line from branch Co-authored-by: Luke The Dev <iamlukethedev@users.noreply.github.com> * universal-backend-plan * backend-neutral runtime seam * package.json update * feat: add Hermes gateway adapter as alternative to OpenClaw Adds a WebSocket adapter that lets Claw3D connect to a Hermes AI agent runtime without any changes to the frontend. The adapter implements the full Claw3D gateway protocol and bridges it to the Hermes HTTP API. Changes: - server/hermes-gateway-adapter.js: WebSocket bridge implementing the Claw3D gateway protocol against the Hermes HTTP API. Supports all core methods (agents, sessions, chat streaming, cron, config, files, approvals) and multi-agent orchestration via spawn_agent/delegate_task tools. Persists conversation history to ~/.hermes/clawd3d-history.json. - scripts/clawd3d-start.sh: All-in-one startup script that launches Hermes, the adapter, and the Next.js dev server with auto port conflict resolution. Alias as `claw3d` for convenience. - src/features/office/hooks/useCronAgents.ts: Hook that polls the gateway for cron-scheduled agents and surfaces them in the 3D office. - package.json: adds `hermes-adapter` npm script - .env.example: documents Hermes config vars - docs/hermes-gateway.md: setup guide and protocol reference Usage: npm run hermes-adapter # start adapter (connect to http://localhost:8642) npm run dev # start Claw3D, point browser at localhost:3000 # or: bash scripts/clawd3d-start.sh (starts everything automatically) Both OpenClaw and Hermes are supported simultaneously — the gateway URL in NEXT_PUBLIC_GATEWAY_URL determines which backend Claw3D connects to. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: add read_agent_context tool for cross-agent coordination Agents can now read each other's conversation history via the read_agent_context tool, enabling the orchestrator to check what a sub-agent has done before re-delegating work. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: wire Hermes office UX and role-aware runtime updates * feature update - demomode & hermes adapter * fix lint blockers * lintfix #2 * fix: stabilize retro office camera preset callbacks * Initial plan * fix: stabilize retro office overview preset hooks Agent-Logs-Url: https://github.com/gsknnft/Claw3D/sessions/9cc71555-591e-44cf-aec4-25affbdcb405 Co-authored-by: gsknnft <123185582+gsknnft@users.noreply.github.com> * feat: add truthful backend selection, Hermes adapter hardening, and demo gateway mode * fix: address bugbot review and finalize backend selection * fixed - onboarding and hermes calls * office systems roadmap * feat specs in docs * specs ready * feat: continue custom runtime seam and gateway alignment * custom lane wired * feat: add custom runtime provider path and office runtime alignment * office_sys prep * tighten multi-floor runtime spec * multi-floor v1 implementation * moved floor nav * runtime architecture specs * claw3doctor specs * feat: add first pass claw3doctor diagnostics * docs: align roadmap with runtime profiles and office systems priorities * feat: expand claw3doctor provider diagnostics and json output * feat: improve claw3doctor formatting and multi-runtime diagnostics * feat: formalize runtime profile resolution * feat: expand claw3doctor profile health diagnostics * feat: polish claw3doctor output and tunnel remediation * feat: add claw3doctor profile scoping and failure classification * docs: define claw3doctor v1 boundary and v2 backlog * test: fix stale claw3doctor branch expectations * test: fix stale expectations on claw3doctor branch * fix(claw3doctor): scope provider-specific checks to --profile / --all-profiles flags PR #101 finding: - Medium: --profile <adapter> and --all-profiles only scoped the profile health probe loop; OpenClaw/Hermes/Demo/Custom check blocks still ran based on the selected adapter type in runtimeContext, making CLI output misleading. Fix: introduce adapterInScope(adapterType, defaultBehavior) helper in main(). - --profile <adapter> -> only that adapter's checks run - --all-profiles -> all adapter checks run - no flag -> falls back to existing shouldRun* predicate (unchanged) Also: - Export parseDoctorArgs from claw3doctor-core.mjs (removed duplicate in script) - Add test suites: parseDoctorArgs flag parsing (6 cases) and adapterInScope scoping semantics (4 cases) — 10 new tests, all green * fix(office): persist per-floor selectedAgentId on focusLocalAgent + wire officeFloors runtime state PR #96 findings: - Medium #1: focusLocalAgent now writes selectedAgentId back to floorRosterCache so handleSelectFloor restores the agent the user last picked on each floor rather than snapping back to the hydration-time suggestion. - Medium #2: Add useEffect that calls settingsCoordinator.schedulePatch with officeFloors[activeFloorId] patch on every status/gatewayUrl change, writing status, gatewayUrl, lastKnownGoodAt, lastErrorCode, and lastErrorMessage so the persisted floor runtime state actually tracks live connection transitions. * fix unkept changes * fix audit findings - cross-floor misattribution & officefloors silent drops * pushed changes * multi-agentic runtime & chat bubble fix * partial parity with office-sys-next * claw3doctor parity * partial parity with v_lane * merged feat/office-systems-next -> merge_sys * parity across PR branches * rm *.orig postmerge * full parity across unmerged PRs & main * fix lukes findings * fix findings - bigger chatbox * real local upload path * fixed file upload, MIME integgration * minor fix * fix lukess findings * deleted *.orig * three bugs fixed - gatewayclient, coord, claw3doctor * address findings * fix lukes findings * fix findings #2 * fix: ignore temporary skill-agent names during identity recovery * fix: preserve stable identity names during temp-name recovery * fix(gateway): correct disconnect race and token-blanking on adapter switch - disconnect() now checks actual connection status rather than selectedAdapterType, which may already reflect the target adapter when the effect fires. Prevents stale WebSocket clients from persisting after switching to local/claw3d/custom backends. - setSelectedAdapterType() falls back to loadedGatewaySettings.current.profiles token when the in-memory adapterProfiles entry has an empty token (sanitized API form). Prevents saved tokens from being cleared when switching between backends. Closes Luke findings: High (stale gateway on floor switch), Medium (token blanking). Authored-By: GSKNNFT * feat(gateway): loopback bypass, control-ui remap, operator.read scope, 75ms connect Cherry-picked clean additions from pr/gsknnft-2 (fix/reduce-gateway-connect-delay): - proxy-url.ts: resolveStudioProxyGatewayUrl() now accepts optional upstreamGatewayUrl; loopback hosts (localhost/127.0.0.1/::1) bypass the Studio proxy and connect directly - gateway-proxy.js: remap unauthenticated openclaw-control-ui connections to webchat-ui client ID so OpenClaw doesn't reject them as unknown clients - GatewayBrowserClient.ts + nodeGatewayClient.ts: add operator.read scope to both browser and Node gateway clients for expanded access control - GatewayBrowserClient.ts: reduce socket open→connect delay from 750ms to 75ms GatewayClient.ts rewrites from that PR were intentionally excluded — they would regress our disconnect-race fix, token-blanking fix, broken-regex fix, local/claw3d adapter support, adapterProfiles type export, and private envelope path. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(floor-nav): show only available floors per active adapter; block hang on unconfigured runtime - floors.ts: add paperclip to FloorProvider; add listAvailableFloorsForAdapter() — lobby always visible, runtime floors only shown when their provider matches the active adapter, so demo-only users only see Lobby - OfficeFloorNav: accept activeAdapterType prop, filter floor list via listAvailableFloorsForAdapter(); fall back displayActiveFloorId to lobby if current floor is no longer in the available set - OfficeScreen: pass selectedAdapterType to OfficeFloorNav; add guard in handleSelectFloor — bail back to lobby immediately when a runtime floor has no gateway URL configured, preventing the connect-hang limbo state Authored-By: GSKNNFT * hardening: drop unsafe-eval in production CSP; add TRUSTED_PROXY IP resolution next.config.ts: - unsafe-eval removed from production script-src (Next.js dev/HMR needs it, but production build does not; React and Three.js make no use of eval) - connect-src intentionally kept broad with note: gateway URLs are user-configured at runtime, cannot be enumerated at build time server/access-gate.js: - Add resolveClientIp() helper: when TRUSTED_PROXY=1 env var is set, prefer the first value of X-Forwarded-For for rate-limiter keying (correct behavior behind nginx/Caddy/Vercel edge). Without the flag, remoteAddress is used (safe default for direct exposure — prevents X-Forwarded-For spoofing by untrusted clients). Authored-By: GSKNNFT * fix(security): remove upstream tokens from browser API; propagate abort to custom runtime HIGH — /api/studio: strip gatewayPrivate and localGatewayDefaultsPrivate from GET and PUT responses. Upstream tokens must not cross the browser API boundary. The Studio proxy (server/gateway-proxy.js) already injects the server-side token into connect frames when the browser sends an empty token, so the browser never needed raw tokens. GatewayClient.ts and OfficeScreen.tsx updated to work from sanitized public settings only. MEDIUM — /api/runtime/custom route: pass request.signal to the upstream fetch() call. Client abort (e.g. hitting Stop) now cancels the upstream runtime request instead of leaving it running after the browser fetch resolves. Authored By: GSKNNFT * fix(security): preserve stored token through empty-token UI state; handle non-JSON health responses GatewayClient.ts — autosave effects no longer overwrite persisted gateway tokens with empty strings. When the in-memory token is empty (proxy handles auth server-side), the patch omits the token field (undefined) so mergeGatewaySettings/mergeGatewayProfiles treats it as "leave unchanged". adapterProfiles updater also preserves the existing stored token when the new token is empty, preventing floor-switch from erasing tokens. runtime/custom/http.ts — requestCustomRuntime() checks the response Content-Type before calling response.json(). Non-JSON responses (e.g. plain-text /health "OK") are returned as-is instead of throwing a JSON parse error, making the custom/local/claw3d health probe path reliable for runtimes that return plain text. Authored By: GSKNNFT * fix(bug): avoid overwriting stored tokens with an empty UI value GatewayClient.ts:944 → token: "" || undefined = undefined → omitted from patch mergeGatewayConnectionState: patch.token === undefined → patchedToken = undefined → nextToken = undefined || current?.token ?? "" = "abc123" ✓ scenarionn- user explicitly clears token (empty string patch): mergeGatewayConnectionState: patchedToken = "" → nextToken = "" || current?.token ?? "" = falls back to existing stored token Authored By: GSKNNFT * fix ongoing findings issue * test: update gateway connection persistence expectations Co-authored-by: Luke The Dev <iamlukethedev@users.noreply.github.com> * fix: tighten ts.net hostname matching in doctor Co-authored-by: Luke The Dev <iamlukethedev@users.noreply.github.com> * chore(release): prepare v0.1.4 Pin in-repo app version to 0.1.4 to match the planned GitHub release tag, and document the convergence release in CHANGELOG.md with verified 0.1.3 and 0.1.4 entries covering runtime profiles, multi-floor offices, remote messaging/handoffs, file uploads, security hardening, and the claw3doctor diagnostics CLI. Made-with: Cursor --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Luke The Dev <iamlukethedev@users.noreply.github.com> Co-authored-by: Elias Pfeffer <eliaspfeffer@gmail.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Greg Clark <greg.clark@gmail.com> Co-authored-by: iamlukethedev <lucas.guilherme@smartwayslfl.com> |
||
|
Luke The Devandiamlukethedev
|
b573646f2d |
fix(gateway): tolerate reconnect bursts without dropping sessions (#100)
Relax the proxy frame limiter to allow normal startup traffic while preserving abuse protection, and slow reconnect retries after policy-violation disconnects so remote gateways can recover cleanly. Made-with: Cursor Co-authored-by: iamlukethedev <lucas.guilherme@smartwayslfl.com> |
||
|
gsknnft
|
a18c8c630c |
fix: surface upstream gateway timeout for remote OpenClaw/Tailscale connections (#94)
* surface gateway timeout for tailscale * talescale fix #2 - attempt 1 * luke findings fix#1 * add narrow log for clientId * prod safe proxy log * fix log visibility * LAN connection & subagent SOUL|IDENTITY fixes * Initialize missing files for subagent SOUL|IDENTITY * surface missing files in UI * capturing agent - runtime,identity,session * plugin-install fix * fix: recover agent workspace for marketplace installs * fix: recover agent workspace and identity name from file provenance * fix: tolerate webchat session patch blocks during permission updates |
||
|
gsknnft
|
4be98d7080 |
fix: clean up Hermes-visible OpenClaw leftovers (#97)
* cleanup openclaw session leftovers - hermes can breathe now * fix: load hermes adapter env from .env * fix: redact secrets from hermes adapter error output * addressed review findings * address luke findings #2 |
||
|
gsknnft
|
051d0ce469 |
security: harden gateway proxy, custom runtime proxy, and media routes (#95)
* security hardening pass 1 - otel removed * hardening pass #2 * feat security hardening pass * chore: trim unrelated docs from security hardening pr * fix: address security hardening review findings * address findings |
||
|
gsknnftClaude Sonnet 4.6Cursor AgentLuke The DevElias Pfeffercopilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>iamlukethedev |
083c146aac |
feat: add runtime seam, Hermes adapter support, and demo gateway mode (#89)
* fix: include kanbanImmersive in immersiveOverlayActive calculation When Kanban board is open, HUD elements (camera preset buttons, edit toolbar, overlays) should be suppressed. The kanbanImmersive flag was defined but not included in the immersiveOverlayActive condition, causing HUD elements to remain visible. This fix adds kanbanImmersive to the immersiveOverlayActive calculation so HUD elements are properly hidden when the Kanban board is open. Co-authored-by: Luke The Dev <iamlukethedev@users.noreply.github.com> * Fix: Hide mini status bar when Kanban immersive overlay is open Wraps the bottom-left mini status bar (showing agent stats, vibe score, and control hints) with !immersiveOverlayActive check to match the behavior of other HUD elements like camera controls and toolbar. This ensures the status bar is properly hidden when the Kanban board or any other immersive overlay is active, maintaining a clean immersive experience. Co-authored-by: Luke The Dev <iamlukethedev@users.noreply.github.com> * chore: drop unrelated package-lock line from branch Co-authored-by: Luke The Dev <iamlukethedev@users.noreply.github.com> * universal-backend-plan * backend-neutral runtime seam * package.json update * feat: add Hermes gateway adapter as alternative to OpenClaw Adds a WebSocket adapter that lets Claw3D connect to a Hermes AI agent runtime without any changes to the frontend. The adapter implements the full Claw3D gateway protocol and bridges it to the Hermes HTTP API. Changes: - server/hermes-gateway-adapter.js: WebSocket bridge implementing the Claw3D gateway protocol against the Hermes HTTP API. Supports all core methods (agents, sessions, chat streaming, cron, config, files, approvals) and multi-agent orchestration via spawn_agent/delegate_task tools. Persists conversation history to ~/.hermes/clawd3d-history.json. - scripts/clawd3d-start.sh: All-in-one startup script that launches Hermes, the adapter, and the Next.js dev server with auto port conflict resolution. Alias as `claw3d` for convenience. - src/features/office/hooks/useCronAgents.ts: Hook that polls the gateway for cron-scheduled agents and surfaces them in the 3D office. - package.json: adds `hermes-adapter` npm script - .env.example: documents Hermes config vars - docs/hermes-gateway.md: setup guide and protocol reference Usage: npm run hermes-adapter # start adapter (connect to http://localhost:8642) npm run dev # start Claw3D, point browser at localhost:3000 # or: bash scripts/clawd3d-start.sh (starts everything automatically) Both OpenClaw and Hermes are supported simultaneously — the gateway URL in NEXT_PUBLIC_GATEWAY_URL determines which backend Claw3D connects to. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: add read_agent_context tool for cross-agent coordination Agents can now read each other's conversation history via the read_agent_context tool, enabling the orchestrator to check what a sub-agent has done before re-delegating work. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: wire Hermes office UX and role-aware runtime updates * feature update - demomode & hermes adapter * fix lint blockers * lintfix #2 * fix: stabilize retro office camera preset callbacks * Initial plan * fix: stabilize retro office overview preset hooks Agent-Logs-Url: https://github.com/gsknnft/Claw3D/sessions/9cc71555-591e-44cf-aec4-25affbdcb405 Co-authored-by: gsknnft <123185582+gsknnft@users.noreply.github.com> * feat: add truthful backend selection, Hermes adapter hardening, and demo gateway mode * fix: address bugbot review and finalize backend selection * fixed - onboarding and hermes calls * office systems roadmap * feat specs in docs * specs ready * feat: continue custom runtime seam and gateway alignment * custom lane wired * feat: add custom runtime provider path and office runtime alignment * runtime fixes * fix lukes findings * fix lukes findings #2 * stable UI & connect screen page -> overlay * better baseline for connection * stable providers & ui rendering * best launch yet * nearly no gateway on reconnect * auto reconnect last state * fix: preserve selected runtime across reconnects Keep backend selection aligned with the operator's chosen runtime instead of reviving a mismatched last-known-good adapter, and keep custom runtimes prompting for reconnect when Studio cannot auto-connect them. Made-with: Cursor --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Luke The Dev <iamlukethedev@users.noreply.github.com> Co-authored-by: Elias Pfeffer <eliaspfeffer@gmail.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: iamlukethedev <lucas.guilherme@smartwayslfl.com> |
||
|
Luke The Dev
|
3da1694085 |
feat: add SOUNDCLAW jukebox skill integration (#67)
Add the office jukebox flow so Spotify can be controlled from the SOUNDCLAW skill, manual jukebox UI, and local browser auth bridge during development. Made-with: Cursor |
||
|
|
c9789c2148 |
Add office agent management wizard (#56)
* Add agents * Agent * Added agents management * Polish agent wizard and release blockers. Finalize the office agent management flow by aligning the gateway fallback behavior, cleaning up UI semantics, and updating tests so the branch is ready to ship. Made-with: Cursor --------- Co-authored-by: iamlukethedev <iamlukethedev@users.noreply.github.com> Co-authored-by: iamlukethedev <lucas.guilherme@smartwayslfl.com> |
||
|
NixandThankNIXlater
|
533bcd9b3f |
fix(security): enforce access gate on all routes, not just /api/ (#42)
Co-authored-by: ThankNIXlater <267577058+ThankNIXlater@users.noreply.github.com> |
||
|
Tony SimonsandClaude Opus 4.6
|
a5b0895dd8 |
Fix WS auth + gym release directive TypeScript error (#16)
* Fix WS auth: wire accessGate.allowUpgrade via verifyClient The allowWs callback was never actually calling accessGate.allowUpgrade during the WS handshake - the ws library passes (info) not (req), and verifyClient must be set on the WebSocketServer constructor options. Fix: pass verifyClient to WebSocketServer constructor and wrap allowUpgrade to extract info.req. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Fix TypeScript error and add gym release directive support Add "release" value to OfficeGymDirective type for symmetry with OfficeQaDirective ("qa_lab" | "release"). Previously OfficeGymDirective was only "gym" with no release state, making the "!== 'release'" check in eventTriggers.ts dead code that TypeScript flagged as an unintentional comparison. Changes: - deskDirectives.ts: add "release" to OfficeGymDirective type - deskDirectives.ts: add gym release patterns to skill and command directive resolvers (e.g. "leave the gym", "done with skills") - eventTriggers.ts: change !== "release" to === "gym" for clarity and consistency with reduceOfficeGymHoldState pattern This fixes: https://github.com/iamlukethedev/Claw3D/issues/15 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> |
||
|
Luke The Devandiamlukethedev
|
4fa4f13558 |
First Release of Claw3D (#11)
Co-authored-by: iamlukethedev <iamlukethedev@users.noreply.github.com> |