Commit Graph

8120 Commits

Author SHA1 Message Date
Shadow
260f6e2c00 Docs: fix /scripts redirect loop 2026-01-26 19:57:49 -06:00
Glucksberg
481bd333eb fix(gateway): gracefully handle AbortError and transient network errors (#2451)
* fix(tts): generate audio when block streaming drops final reply

When block streaming succeeds, final replies are dropped but TTS was only
applied to final replies. Fix by accumulating block text during streaming
and generating TTS-only audio after streaming completes.

Also:
- Change truncate vs skip behavior when summary OFF (now truncates)
- Align TTS limits with Telegram max (4096 chars)
- Improve /tts command help messages with examples
- Add newline separator between accumulated blocks

* fix(tts): add error handling for accumulated block TTS

* feat(tts): add descriptive inline menu with action descriptions

- Add value/label support for command arg choices
- TTS menu now shows descriptive title listing each action
- Capitalize button labels (On, Off, Status, etc.)
- Update Telegram, Discord, and Slack handlers to use labels

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix(gateway): gracefully handle AbortError and transient network errors

Addresses issues #1851, #1997, and #2034.

During config reload (SIGUSR1), in-flight requests are aborted, causing
AbortError exceptions. Similarly, transient network errors (fetch failed,
ECONNRESET, ETIMEDOUT, etc.) can crash the gateway unnecessarily.

This change:
- Adds isAbortError() to detect intentional cancellations
- Adds isTransientNetworkError() to detect temporary connectivity issues
- Logs these errors appropriately instead of crashing
- Handles nested cause chains and AggregateError

AbortError is logged as a warning (expected during shutdown).
Network errors are logged as non-fatal errors (will resolve on their own).

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix(test): update commands-registry test expectations

Update test expectations to match new ResolvedCommandArgChoice format
(choices now return {label, value} objects instead of plain strings).

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix: harden unhandled rejection handling and tts menus (#2451) (thanks @Glucksberg)

---------

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Shadow <hi@shadowing.dev>
2026-01-26 19:51:53 -06:00
Shadow
d8e5dd91ba fix: clean up session locks on exit (#2483) (thanks @janeexai) 2026-01-26 19:48:46 -06:00
Jane
14f8acdecb fix(agents): release session locks on process termination
Adds process exit handlers to release all held session locks on:
- Normal process.exit() calls
- SIGTERM / SIGINT signals

This ensures locks are cleaned up even when the process terminates
unexpectedly, preventing the 'session file locked' error.
2026-01-26 19:46:04 -06:00
Yuan Chen
27174f5d82 bugfix:The Mintlify navbar (logo + search bar with ⌘K) scrolls away w… (#2445)
* bugfix:The Mintlify navbar (logo + search bar with ⌘K) scrolls away when scrolling down the documentation, so it disappears from view.

* fix(docs): keep navbar visible on scroll (#2445) (thanks @chenyuan99)

---------

Co-authored-by: vignesh07 <vigneshnatarajan92@gmail.com>
2026-01-26 17:39:10 -08:00
Gustavo Madeira Santana
2f7fff8dcd CLI: add changelog for versioned node argv (#2490) (thanks @David-Marsh-Photo) 2026-01-26 20:29:47 -05:00
Gustavo Madeira Santana
566c9982b3 CLI: expand versioned node argv handling 2026-01-26 20:29:47 -05:00
David Marsh
c95072fc26 fix: support versioned node binaries (e.g., node-22)
Fedora and some other distros install Node.js with a version suffix
(e.g., /usr/bin/node-22) and create a symlink from /usr/bin/node.
When Node resolves process.execPath, it returns the real binary path,
not the symlink, causing buildParseArgv to fail the looksLikeNode check.

This adds executable.startsWith('node-') to handle versioned binaries.

Fixes #2442
2026-01-26 20:23:19 -05:00
Shadow
58b96ca0c0 CI: sync labels on PR updates 2026-01-26 19:21:31 -06:00
Shadow
e0dc49f287 line: centralize webhook signature validation 2026-01-26 19:21:26 -06:00
Luka Zhang
3b8792ee29 Security: fix timing attack vulnerability in LINE webhook signature validation 2026-01-26 19:21:26 -06:00
Shadow
1e7cb23f00 Fix: avoid plugin registration on global help/version (#2212) (thanks @dial481) 2026-01-26 19:14:09 -06:00
Peter Steinberger
1506d493ea fix: switch Matrix plugin SDK 2026-01-27 01:00:23 +00:00
Gustavo Madeira Santana
0c855bd36a Infra: fix recoverable error formatting 2026-01-26 19:59:25 -05:00
Gustavo Madeira Santana
b861a0bd73 Telegram: harden network retries and config
Co-authored-by: techboss <techboss@users.noreply.github.com>
2026-01-26 19:36:43 -05:00
techboss
e43f4c0628 fix(telegram): handle network errors gracefully
- Add bot.catch() to prevent unhandled rejections from middleware
- Add isRecoverableNetworkError() to retry on transient failures
- Add maxRetryTime and exponential backoff to grammY runner
- Global unhandled rejection handler now logs recoverable errors
  instead of crashing (fetch failures, timeouts, connection resets)

Fixes crash loop when Telegram API is temporarily unreachable.
2026-01-26 19:36:43 -05:00
Dominic
a8ad242f88 fix(security): properly test Windows ACL audit for config includes (#2403)
* fix(security): properly test Windows ACL audit for config includes

The test expected fs.config_include.perms_writable on Windows but
chmod 0o644 has no effect on Windows ACLs. Use icacls to grant
Everyone write access, which properly triggers the security check.

Also stubs execIcacls to return proper ACL output so the audit
can parse permissions without running actual icacls on the system.

Adds cleanup via try/finally to remove temp directory containing
world-writable test file.

Fixes checks-windows CI failure.

* test: isolate heartbeat runner tests from user workspace

* docs: update changelog for #2403

---------

Co-authored-by: Tyler Yust <TYTYYUST@YAHOO.COM>
2026-01-26 16:27:53 -08:00
vignesh07
343882d45c feat(telegram): add edit message action (#2394) (thanks @marcelomar21) 2026-01-26 15:34:47 -08:00
Shadow
5c35b62a5c fix: refresh history key order for LRU eviction 2026-01-26 17:22:18 -06:00
Robby (AI-assisted)
af9606de36 fix(history): add LRU eviction for groupHistories to prevent memory leak
Add evictOldHistoryKeys() function that removes oldest keys when the
history map exceeds MAX_HISTORY_KEYS (1000). Called automatically in
appendHistoryEntry() to bound memory growth.

The map previously grew unbounded as users interacted with more groups
over time. Growth is O(unique groups) not O(messages), but still causes
slow memory accumulation on long-running instances.

Fixes #2384
2026-01-26 17:22:18 -06:00
Robby (AI-assisted)
5aa02cf3f7 fix(gateway): sanitize error responses to prevent information disclosure
Replace raw error messages with generic 'Internal Server Error' to prevent
leaking internal error details to unauthenticated HTTP clients.

Fixes #2383
2026-01-26 17:22:13 -06:00
Shadow
91d5ea6e33 Fix: allow cron heartbeat payloads through filters (#2219) (thanks @dwfinkelstein)
# Conflicts:
#	CHANGELOG.md
2026-01-26 17:22:08 -06:00
Dave Lauer
82746973d4 fix(heartbeat): remove unhandled rejection crash in wake handler
The async setTimeout callback re-threw errors without a .catch() handler,
causing unhandled promise rejections that crashed the gateway. The error
is already logged by the heartbeat runner and a retry is scheduled, so
the re-throw served no purpose.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-26 17:19:48 -06:00
vignesh07
cd7be58b8e docs: add Northflank deploy guide to changelog (#2167) (thanks @AdeboyeDN) 2026-01-26 15:11:02 -08:00
Clawdbot Maintainers
107f07ad69 docs: add Northflank page to nav + polish copy 2026-01-26 15:11:02 -08:00
adeboyedn
99ce47e86a minor update 2026-01-26 15:11:02 -08:00
adeboyedn
2a709385f8 cleanup 2026-01-26 15:11:02 -08:00
adeboyedn
0aa48a26d1 docs: add Northflank deployment guide for Clawdbot 2026-01-26 15:11:02 -08:00
Peter Steinberger
6cbdd767af fix: pin tar override for npm installs 2026-01-26 22:58:14 +00:00
Dave Lauer
2807f5afbc feat: add heartbeat visibility filtering for webchat
- Add isHeartbeat to AgentRunContext to track heartbeat runs
- Pass isHeartbeat flag through agent runner execution
- Suppress webchat broadcast (deltas + final) for heartbeat runs when showOk is false
- Webchat uses channels.defaults.heartbeat settings (no per-channel config)
- Default behavior: hide HEARTBEAT_OK from webchat (matches other channels)

This allows users to control whether heartbeat responses appear in
the webchat UI via channels.defaults.heartbeat.showOk (defaults to false).
2026-01-26 14:52:23 -08:00
Peter Steinberger
b3a60af71c fix: gate ngrok free-tier bypass to loopback 2026-01-26 22:26:26 +00:00
Tyler Yust
fe1f2d971a fix: add multi-image input support to nano-banana-pro skill (#1958) (thanks @tyler6204) 2026-01-26 14:23:06 -08:00
Tyler Yust
3888f1edc6 docs: update SKILL.md and generate_image.py to support multi-image editing and improve input handling 2026-01-26 14:23:06 -08:00
Peter Steinberger
0f8f0fb9d7 docs: clarify command authorization for exec directives 2026-01-26 22:18:41 +00:00
Tyler Yust
9c0c5866db fix: coalesce BlueBubbles link previews (#1981) (thanks @tyler6204) 2026-01-26 14:12:22 -08:00
Tyler Yust
147842fadc refactor(bluebubbles): remove URL balloon message handling and improve error logging
This commit removes the URL balloon message handling logic from the monitor, simplifying the message processing flow. Additionally, it enhances error logging by including the account ID in the error messages for better traceability.
2026-01-26 14:12:22 -08:00
Tyler Yust
420e5299d2 fix(bluebubbles): increase inbound message debounce time for URL previews 2026-01-26 14:12:22 -08:00
Tyler Yust
6d26971051 fix(bluebubbles): add inbound message debouncing to coalesce URL link previews
When users send iMessages containing URLs, BlueBubbles sends separate
webhook events for the text message and the URL balloon/link preview.
This caused Clawdbot to receive them as separate queued messages.

This fix adds inbound debouncing (following the pattern from WhatsApp/MS Teams):

- Uses the existing createInboundDebouncer utility from plugin-sdk
- Adds debounceMs config option to BlueBubblesAccountConfig (default: 500ms)
- Routes inbound messages through debouncer before processing
- Combines messages from same sender/chat within the debounce window
- Handles URLBalloonProvider messages by coalescing with preceding text
- Skips debouncing for messages with attachments or control commands

Config example:
  channels.bluebubbles.debounceMs: 500  # milliseconds (0 to disable)

Fixes inbound URL message splitting issue.
2026-01-26 14:12:22 -08:00
Peter Steinberger
820ab8765a docs: clarify exec defaults 2026-01-26 21:37:56 +00:00
Suksham
20f6a5546f feat(telegram): add silent message option (#2382)
* feat(telegram): add silent message option (disable_notification)

Add support for sending Telegram messages silently without notification
sound via the `silent` parameter on the message tool.

Changes:
- Add `silent` boolean to message tool schema
- Extract and pass `silent` through telegram plugin
- Add `disable_notification: true` to Telegram API calls
- Add `--silent` flag to CLI `message send` command
- Add unit test for silent flag

Closes #2249

AI-assisted (Claude) - fully tested with unit tests + manual Telegram testing

* feat(telegram): add silent send option (#2382) (thanks @Suksham-sharma)

---------

Co-authored-by: Pocket Clawd <pocket@Pockets-Mac-mini.local>
2026-01-26 13:14:13 -08:00
Peter Steinberger
fb14146033 fix: harden ssh target handling 2026-01-26 21:11:48 +00:00
Shadow
d34ae86114 chore: expand labeler coverage 2026-01-26 15:01:11 -06:00
Vignesh
fbc5ac1fde docs(install): add migration guide for moving to a new machine (#2381)
* docs(install): add migration guide for moving to a new machine

* chore(changelog): mention migration guide docs

---------

Co-authored-by: Pocket Clawd <pocket@Pockets-Mac-mini.local>
2026-01-26 12:59:06 -08:00
Shakker
ff382f6b68 Merge pull request #1742 from clawdbot/feat/tools-alsoAllow
feat(config): tools.alsoAllow additive allowlist
2026-01-26 20:44:48 +00:00
Shakker
bc8c31eeed Merge branch 'main' into feat/tools-alsoAllow 2026-01-26 20:39:09 +00:00
Shadow
bdea265704 CI: run auto-response on pull_request_target 2026-01-26 14:37:39 -06:00
Shadow
ec75e0b3dc CI: use app token for auto-response 2026-01-26 14:36:29 -06:00
Paul Pamment
9e6b45faab fix(discord): honor threadId for thread-reply 2026-01-26 14:28:28 -06:00
Peter Steinberger
8e051a418f test: stub windows ACL for include perms audit 2026-01-26 20:28:20 +00:00
Peter Steinberger
a5b99349c9 style: format workspace bootstrap signature 2026-01-26 20:28:20 +00:00