100 Commits
Author SHA1 Message Date
George Pickett 732b994120 Harden agent id validation, session keys, agent-state rollback, and gateway/auth reliability
Centralize OpenClaw agent id validation in a new module
(src/lib/agents/agentIds.ts) and route every gateway, cron, ssh, and
intent path through it. Tighten the safe-id regex to match the gateway's
64-char normalization and reserve "main" from UI creation.

Add symlink-aware boundary checks and move rollback to
trash/restoreAgentStateLocally and the SSH equivalent so a failed move
never leaves the filesystem half-migrated, and restore refuses symlinks
that escape stateDir.

Validate session keys (hasMalformedAgentSessionKey,
sessionKeyBelongsToAgent) and cron job fields before trusting gateway
output, and compare cron agent ids case-insensitively.

Refactor applyGatewayConfigPatch and exec-approvals retry to fetch the
snapshot inside the retry callback, eliminating a stale-baseHash race.

Harden the control-plane adapter: stop() now waits on in-flight start,
times out hung sockets, and ignores stale ws event handlers via a
connection epoch.

Close a WebSocket upgrade auth bypass in server/index.js by routing
upgrades through accessGate.allowUpgrade, make access-gate cookie values
URL-safe and stop reconstructing redirect URLs from Host headers, and
apply the access gate to all non-token requests rather than only /api/.

Read media via realpath + boundary re-check, enforce MAX_MEDIA_BYTES on
remote SSH responses, and whitelist response MIME types. Clean up SSE
streams on client abort.

Normalize localhost gateway URLs in studio-settings so token hints only
apply when the draft URL matches, and write settings atomically.

Make the Playwright port configurable (PLAYWRIGHT_PORT, default 3100)
to avoid colliding with the running dev server, and ignore .worktrees
in eslint.

Add unit tests for the new agentIds module, gateway connect profile,
disconnect-like errors, local gateway, and studio settings store, and
extend existing tests to cover the new validation, rollback, retry, and
normalization paths.
2026-06-22 10:06:22 -07:00
George Pickett 49bb80f1a0 refactor: hide media line parsing policy
Cycle: 2/5

Work item: .agent/work/2026-05-08-2100-media-line-parser

Validation: media markdown tests and typecheck passed
2026-05-08 21:02:54 -07:00
George Pickett b2dd992244 refactor: centralize thinking tag parsing
Cycle: 1/5

Work item: .agent/work/2026-05-08-2054-text-message-boundaries

Validation: targeted runtime text tests and typecheck passed
2026-05-08 20:59:34 -07:00
George Pickett 7dee5ec52b Add dependency release cooldown 2026-03-31 10:38:14 -07:00
George Pickett b7209d5220 Fix localhost gateway handshake for Studio (#97) 2026-03-18 19:04:53 -07:00
George Pickett daa0a7dca4 Update Discord invite link 2026-03-18 18:36:28 -07:00
George Pickett 2843a43984 Fix gateway connect dead-end on insecure remote ws 2026-03-14 17:37:41 -07:00
George Pickett 607e934a05 Fix chat scroll jumping 2026-03-10 12:49:56 -07:00
George Pickett 455e33a2fa better connection reliability 2026-03-09 10:50:27 -07:00
George Pickett 367fa18cd2 feat: warn when openclaw-studio CLI is outdated 2026-03-05 17:28:01 -08:00
George Pickett d2c10958bc Improve Studio install onboarding for local and cloud setups
Make first-run connection setup explain how users open Studio separately from how Studio reaches OpenClaw, so remote and same-host cloud installs are less confusing for beginners.

Made-with: Cursor
2026-03-05 16:19:54 -08:00
George Pickett ff2dfc4339 remove skills bs 2026-03-05 15:22:47 -08:00
George Pickett fdf4c6e6be faster 2026-03-05 14:47:10 -08:00
George Pickett 701df4cf69 Handle concurrent scope fallback during gateway profile switch 2026-03-05 12:49:24 -08:00
George Pickett 6313eae8dd Add legacy gateway scope fallback for remote compatibility 2026-03-05 12:42:00 -08:00
George Pickett e8187c6277 tiny chnanges 2026-03-05 12:08:26 -08:00
George Pickett 74b3ed6c4e working on improvements 2026-03-05 11:19:24 -08:00
George Pickett 6a711bbf6b Simplify runtime history loading with message-first domain path 2026-03-04 18:20:14 -08:00
George Pickett bc39600613 idk 2026-03-04 09:29:39 -08:00
George Pickett 4411f5a0f6 Persist focused agent selection reliably across refresh 2026-03-03 15:37:49 -08:00
George Pickett fa091d4158 Improve domain history sync reliability and reduce refresh fan-out 2026-03-03 15:16:25 -08:00
George Pickett 7a643225b4 workin 2026-03-03 14:08:32 -08:00
George Pickett e1b78696da big refactor in progress 2026-03-02 17:18:53 -08:00
George Pickett 9c739306a0 chore: remove dead chat send result export 2026-03-02 15:41:17 -08:00
George Pickett 3d7095cb80 Fix fleet runtime server/client import boundary 2026-03-02 13:08:16 -08:00
George Pickett aab2579675 Harden control-plane startup, domain WS behavior, and runtime route reliability 2026-03-02 12:52:39 -08:00
George Pickett adb41eabdb fix(runtime-fleet): degrade bootstrap when gateway is unavailable 2026-03-02 00:46:14 -08:00
George Pickett 9fb2e2759d fix(domain-mode): route agent delete cron cleanup through server intents 2026-03-02 00:36:46 -08:00
George Pickett a902d6cf4b Fix domain-mode exec approval pause status gating 2026-03-02 00:26:29 -08:00
George Pickett a765786579 Fix queued message loss on deferred send failure 2026-03-02 00:16:42 -08:00
George Pickett 57c591eaa0 fix legacy permissions flow partial write on conflict 2026-03-02 00:07:47 -08:00
George Pickett 36206b76f6 fix: disambiguate gateway event dedupe across reconnects 2026-03-01 23:43:48 -08:00
George Pickett 676dd52800 fix: keep history cursor stable while backfill is incomplete 2026-03-01 23:35:17 -08:00
George Pickett 6a81ea651c fix: clamp stream reconnect cursor to current outbox head 2026-03-01 23:26:10 -08:00
George Pickett cb6972ec55 fix: harden runtime stream replay-to-live handoff 2026-03-01 23:18:41 -08:00
George Pickett 0088db5b0a docs: update architecture for runtime stream bootstrap hardening 2026-03-01 23:18:04 -08:00
George Pickett c4d19ff912 Refactor Studio around domain control-plane architecture 2026-02-28 12:09:32 -08:00
George Pickett 9015500ed1 Add robust queued-message UX and focused-filter restore fixes 2026-02-27 15:18:49 -08:00
George Pickett 1c9afdd4e2 Handle WebChat sessions.patch rejection in send/settings flows 2026-02-27 14:52:46 -08:00
George Pickett 226ca5c0ee reliability and skills junk 2026-02-27 13:38:53 -08:00
George Pickett 7786f92d3b Fix gateway reconnect lock after unexpected close 2026-02-26 17:53:34 -08:00
George Pickett d2f96c2177 Merge branch 'codex/skills-delete-action' 2026-02-25 17:04:45 -08:00
George Pickett bee2c44755 Add safe skill deletion flow in Skills settings 2026-02-25 17:04:17 -08:00
George Pickett 38346b89ad fix: prevent assistant thinking stream leaks into visible text 2026-02-25 16:52:35 -08:00
George Pickett 08a2f17dfc Improve skills panel status clarity and setup actions 2026-02-25 16:40:03 -08:00
George Pickett 090fed169b Update AgentInspectPanels styles for skill eligibility indicators
- Adjusted styles for the skill eligibility indicator to enhance visibility and consistency.
- Changed font size and added border styles for eligible and blocked states.
- Implemented conditional styling for blocked skills to improve user experience.
2026-02-25 15:53:15 -08:00
George Pickett c4b0973881 Add per-agent skills settings management and harden reliability 2026-02-25 15:43:26 -08:00
George Pickett 358521c76e Add handling for aborted assistant messages in history processing
- Implemented `resolveAssistantTerminalLine` to generate appropriate terminal messages for aborted or errored assistant runs.
- Updated `buildHistoryLines` to include terminal messages when assistant content is empty.
- Added unit tests to verify behavior for handling aborted messages and clearing stale running states in history sync operations.
2026-02-25 11:07:59 -08:00
George Pickett c64ef28b6e Fix localhost loopback binding across IPv4 and IPv6 2026-02-25 10:45:16 -08:00
George Pickett 20084b8831 Merge branch 'codex/public-bind-access-token-guard' 2026-02-25 10:18:56 -08:00
George Pickett fe56e2b0e6 Fix delete-agent cron rollback data-loss path 2026-02-25 10:17:15 -08:00
George Pickett 3e27e6c86e Enforce Studio access token for public binds 2026-02-25 10:15:27 -08:00
George Pickett 12ffaf7976 Harden proxy browser auth passthrough detection 2026-02-25 10:14:58 -08:00
George Pickett 7aa55183e0 Refactor UI components and styles for improved layout and consistency. Update HeaderBar and GatewayConnectScreen for better responsiveness. Adjust theme toggle button size and icon dimensions. Enhance ui-topbar styling with new color mixes and shadow properties. 2026-02-25 09:59:58 -08:00
George Pickett a6dd89ab9a Merge branch 'codex/fix-proxy-token-pass-through' 2026-02-25 09:42:47 -08:00
George Pickett 2f3842b921 Rebuild config.set retries from fresh snapshots 2026-02-25 09:39:16 -08:00
George Pickett a7cb00b8c8 Drop stale history responses on revision drift 2026-02-25 09:30:05 -08:00
George Pickett 87c1ebd075 Handle non-streaming chat.send success responses 2026-02-25 09:19:47 -08:00
George Pickett c4246766ce Fix gateway proxy auth passthrough gating 2026-02-25 09:10:50 -08:00
George Pickett 0eb340a0c3 Merge pull request #77 from grp06/big-one
Big one
2026-02-24 13:15:04 -08:00
George Pickett a80eef48a9 Merge codex/approvals-tab-tooltip-fix into big-one 2026-02-24 12:18:43 -08:00
George Pickett 5cac295e84 Replace Idle filter with Approvals and close model tooltip on select 2026-02-24 12:18:39 -08:00
George Pickett f642f9ca87 Improve config toggle UX 2026-02-24 12:16:02 -08:00
George Pickett 8a645a2295 Apply pending big-one workspace updates 2026-02-24 11:57:47 -08:00
George PickettandCursor 43c4dbaa98 Update Discord link in README
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-24 10:33:49 -08:00
George Pickett acbe44d344 Improve ExecPlan accuracy 2026-02-24 10:23:46 -08:00
George Pickett 9266a4a75e Refactor settings into dedicated route with route-safe guards 2026-02-21 16:28:01 -08:00
George Pickett 9875e514e9 Refine behavior editor and agent header UX 2026-02-21 15:19:41 -08:00
George Pickett ccc7f6156b Merge pull request #72 from grp06/codex/remove-labels-from-personality-tab
Remove personality label and toggle sidebar from cog
2026-02-21 14:33:42 -08:00
George Pickett a0ba4623ad Update personality sidebar layout 2026-02-21 14:33:26 -08:00
George Pickett 0bd5093922 Merge pull request #71 from grp06/codex/simplify-personality-rename-flow
Move agent rename control to chat header
2026-02-21 14:28:09 -08:00
George Pickett 9668857f79 Simplify agent rename UX 2026-02-21 14:27:56 -08:00
George Pickett fd8f30ec6d Merge pull request #70 from grp06/codex/simplify-gateway-disconnect-screen
Simplify gateway disconnect screen UI
2026-02-21 14:27:30 -08:00
George Pickett 2bf33cdca1 Simplify gateway disconnect screen 2026-02-21 14:27:15 -08:00
George Pickett 4acdd4d851 Merge pull request #69 from grp06/codex/fix-transparent-plug-icon-background
Fix plug icon popover background
2026-02-21 14:25:46 -08:00
George Pickett a112d9e5f1 Fix gateway menu transparency 2026-02-21 14:25:34 -08:00
George Pickett 1300b966a2 Polish agent inspect UX and approval resume behavior 2026-02-20 20:35:50 -08:00
George Pickett 8fe6fef8c8 chore: ignore claude local directory 2026-02-20 15:17:41 -08:00
George Pickett 0d73eae9b9 chore: stop tracking claude worktree artifacts 2026-02-20 15:17:34 -08:00
George Pickett c8058b0a22 chore: checkpoint current studio changes 2026-02-20 15:16:03 -08:00
George Pickett b915762d52 refactor: consolidate mutation lifecycle and delete operations 2026-02-20 13:47:10 -08:00
George Pickett 65dc0da24d chore: ignore markdown files under .agent/done 2026-02-20 13:45:54 -08:00
George Pickett 2f5c569367 big ui updates 2026-02-20 11:58:10 -08:00
George Pickett 94ee909d3a Refine agent studio UI styling and permissions UX 2026-02-19 15:38:11 -08:00
George Pickett dd01d56859 Merge pull request #67 from grp06/codex/fix-next-16-1-6
chore: upgrade next to 16.1.6
2026-02-19 12:11:34 -08:00
George Pickett 27ffe04951 chore: upgrade next to 16.1.6 2026-02-19 11:36:56 -08:00
George Pickett c5dffa0a0f Merge origin/main into local snapshot 2026-02-19 11:34:08 -08:00
George Pickett 81ab1224ec Local snapshot before linking remote 2026-02-19 11:33:47 -08:00
George Pickett c5d6a0f99e Simplify dev startup output 2026-02-18 17:58:03 -08:00
George Pickett e487f3fd16 Fix chat input lag 2026-02-18 15:16:22 -08:00
George Pickett 89155f538b Merge pull request #65 from grp06/codex/simplify-agent-creation-flow
Refine agent creation onboarding and lifecycle handling
2026-02-17 16:48:55 -08:00
George Pickett d2df8476ec Review execplan revisions 2026-02-17 16:40:27 -08:00
George Pickett 621dd9ba03 Merge pull request #64 from grp06/codex/investigate-double-messages
Strip timestamp envelopes to collapse duplicate user messages
2026-02-17 15:47:20 -08:00
George Pickett 250a703cba Prevent duplicate messages 2026-02-17 15:47:06 -08:00
George Pickett 538e899c69 Improve approval resume UX and simplify thinking indicator 2026-02-17 14:09:24 -08:00
George Pickett 8035b32dd8 Merge pull request #63 from grp06/codex/investigate-duplicate-chat-response
Prevent duplicate live assistant cards during reruns
2026-02-17 14:07:27 -08:00
George Pickett 145ffd462e Fix duplicated assistant response 2026-02-17 14:07:12 -08:00
George Pickett 247ff445dc Align exec approval UI behavior 2026-02-17 13:22:58 -08:00
George Pickett 04f035cc07 Show thinking tool calls inline 2026-02-17 12:13:51 -08:00
George Pickett 19c1bec9dc Disable sandboxing for agent create 2026-02-17 12:01:22 -08:00