Commit Graph

8100 Commits

Author SHA1 Message Date
Robby (AI-assisted)
5aa02cf3f7 fix(gateway): sanitize error responses to prevent information disclosure
Replace raw error messages with generic 'Internal Server Error' to prevent
leaking internal error details to unauthenticated HTTP clients.

Fixes #2383
2026-01-26 17:22:13 -06:00
Shadow
91d5ea6e33 Fix: allow cron heartbeat payloads through filters (#2219) (thanks @dwfinkelstein)
# Conflicts:
#	CHANGELOG.md
2026-01-26 17:22:08 -06:00
Dave Lauer
82746973d4 fix(heartbeat): remove unhandled rejection crash in wake handler
The async setTimeout callback re-threw errors without a .catch() handler,
causing unhandled promise rejections that crashed the gateway. The error
is already logged by the heartbeat runner and a retry is scheduled, so
the re-throw served no purpose.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-26 17:19:48 -06:00
vignesh07
cd7be58b8e docs: add Northflank deploy guide to changelog (#2167) (thanks @AdeboyeDN) 2026-01-26 15:11:02 -08:00
Clawdbot Maintainers
107f07ad69 docs: add Northflank page to nav + polish copy 2026-01-26 15:11:02 -08:00
adeboyedn
99ce47e86a minor update 2026-01-26 15:11:02 -08:00
adeboyedn
2a709385f8 cleanup 2026-01-26 15:11:02 -08:00
adeboyedn
0aa48a26d1 docs: add Northflank deployment guide for Clawdbot 2026-01-26 15:11:02 -08:00
Peter Steinberger
6cbdd767af fix: pin tar override for npm installs 2026-01-26 22:58:14 +00:00
Dave Lauer
2807f5afbc feat: add heartbeat visibility filtering for webchat
- Add isHeartbeat to AgentRunContext to track heartbeat runs
- Pass isHeartbeat flag through agent runner execution
- Suppress webchat broadcast (deltas + final) for heartbeat runs when showOk is false
- Webchat uses channels.defaults.heartbeat settings (no per-channel config)
- Default behavior: hide HEARTBEAT_OK from webchat (matches other channels)

This allows users to control whether heartbeat responses appear in
the webchat UI via channels.defaults.heartbeat.showOk (defaults to false).
2026-01-26 14:52:23 -08:00
Peter Steinberger
b3a60af71c fix: gate ngrok free-tier bypass to loopback 2026-01-26 22:26:26 +00:00
Tyler Yust
fe1f2d971a fix: add multi-image input support to nano-banana-pro skill (#1958) (thanks @tyler6204) 2026-01-26 14:23:06 -08:00
Tyler Yust
3888f1edc6 docs: update SKILL.md and generate_image.py to support multi-image editing and improve input handling 2026-01-26 14:23:06 -08:00
Peter Steinberger
0f8f0fb9d7 docs: clarify command authorization for exec directives 2026-01-26 22:18:41 +00:00
Tyler Yust
9c0c5866db fix: coalesce BlueBubbles link previews (#1981) (thanks @tyler6204) 2026-01-26 14:12:22 -08:00
Tyler Yust
147842fadc refactor(bluebubbles): remove URL balloon message handling and improve error logging
This commit removes the URL balloon message handling logic from the monitor, simplifying the message processing flow. Additionally, it enhances error logging by including the account ID in the error messages for better traceability.
2026-01-26 14:12:22 -08:00
Tyler Yust
420e5299d2 fix(bluebubbles): increase inbound message debounce time for URL previews 2026-01-26 14:12:22 -08:00
Tyler Yust
6d26971051 fix(bluebubbles): add inbound message debouncing to coalesce URL link previews
When users send iMessages containing URLs, BlueBubbles sends separate
webhook events for the text message and the URL balloon/link preview.
This caused Clawdbot to receive them as separate queued messages.

This fix adds inbound debouncing (following the pattern from WhatsApp/MS Teams):

- Uses the existing createInboundDebouncer utility from plugin-sdk
- Adds debounceMs config option to BlueBubblesAccountConfig (default: 500ms)
- Routes inbound messages through debouncer before processing
- Combines messages from same sender/chat within the debounce window
- Handles URLBalloonProvider messages by coalescing with preceding text
- Skips debouncing for messages with attachments or control commands

Config example:
  channels.bluebubbles.debounceMs: 500  # milliseconds (0 to disable)

Fixes inbound URL message splitting issue.
2026-01-26 14:12:22 -08:00
Peter Steinberger
820ab8765a docs: clarify exec defaults 2026-01-26 21:37:56 +00:00
Suksham
20f6a5546f feat(telegram): add silent message option (#2382)
* feat(telegram): add silent message option (disable_notification)

Add support for sending Telegram messages silently without notification
sound via the `silent` parameter on the message tool.

Changes:
- Add `silent` boolean to message tool schema
- Extract and pass `silent` through telegram plugin
- Add `disable_notification: true` to Telegram API calls
- Add `--silent` flag to CLI `message send` command
- Add unit test for silent flag

Closes #2249

AI-assisted (Claude) - fully tested with unit tests + manual Telegram testing

* feat(telegram): add silent send option (#2382) (thanks @Suksham-sharma)

---------

Co-authored-by: Pocket Clawd <pocket@Pockets-Mac-mini.local>
2026-01-26 13:14:13 -08:00
Peter Steinberger
fb14146033 fix: harden ssh target handling 2026-01-26 21:11:48 +00:00
Shadow
d34ae86114 chore: expand labeler coverage 2026-01-26 15:01:11 -06:00
Vignesh
fbc5ac1fde docs(install): add migration guide for moving to a new machine (#2381)
* docs(install): add migration guide for moving to a new machine

* chore(changelog): mention migration guide docs

---------

Co-authored-by: Pocket Clawd <pocket@Pockets-Mac-mini.local>
2026-01-26 12:59:06 -08:00
Shakker
ff382f6b68 Merge pull request #1742 from clawdbot/feat/tools-alsoAllow
feat(config): tools.alsoAllow additive allowlist
2026-01-26 20:44:48 +00:00
Shakker
bc8c31eeed Merge branch 'main' into feat/tools-alsoAllow 2026-01-26 20:39:09 +00:00
Shadow
bdea265704 CI: run auto-response on pull_request_target 2026-01-26 14:37:39 -06:00
Shadow
ec75e0b3dc CI: use app token for auto-response 2026-01-26 14:36:29 -06:00
Paul Pamment
9e6b45faab fix(discord): honor threadId for thread-reply 2026-01-26 14:28:28 -06:00
Peter Steinberger
8e051a418f test: stub windows ACL for include perms audit 2026-01-26 20:28:20 +00:00
Peter Steinberger
a5b99349c9 style: format workspace bootstrap signature 2026-01-26 20:28:20 +00:00
Peter Steinberger
1371e95e57 docs: clarify onboarding + credentials 2026-01-26 20:26:30 +00:00
Peter Steinberger
320b45c051 docs: note sandbox opt-in in gateway security 2026-01-26 20:13:10 +00:00
Peter Steinberger
97248a2885 feat: surface security audit + docs 2026-01-26 19:58:59 +00:00
jaydenfyi
f5c90f0e5c feat: Twitch Plugin (#1612)
* wip

* copy polugin files

* wip type changes

* refactor: improve Twitch plugin code quality and fix all tests

- Extract client manager registry for centralized lifecycle management
- Refactor to use early returns and reduce mutations
- Fix status check logic for clientId detection
- Add comprehensive test coverage for new modules
- Remove tests for unimplemented features (index.test.ts, resolver.test.ts)
- Fix mock setup issues in test suite (149 tests now passing)
- Improve error handling with errorResponse helper in actions.ts
- Normalize token handling to eliminate duplication

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* use accountId

* delete md file

* delte tsconfig

* adjust log level

* fix probe logic

* format

* fix monitor

* code review fixes

* format

* no mutation

* less mutation

* chain debug log

* await authProvider setup

* use uuid

* use spread

* fix tests

* update docs and remove bot channel fallback

* more readme fixes

* remove comments + fromat

* fix tests

* adjust access control logic

* format

* install

* simplify config object

* remove duplicate log tags + log received messages

* update docs

* update tests

* format

* strip markdown in monitor

* remove strip markdown config, enabled by default

* default requireMention to true

* fix store path arg

* fix multi account id + add unit test

* fix multi account id + add unit test

* make channel required and update docs

* remove whisper functionality

* remove duplicate connect log

* update docs with convert twitch link

* make twitch message processing non blocking

* schema consistent casing

* remove noisy ignore log

* use coreLogger

---------

Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-26 13:48:10 -06:00
Peter Steinberger
c5ffc11df5 chore(repo): remove stray .DS_Store 2026-01-26 19:41:25 +00:00
Shadow
1a947a21d6 fix: support memory.md in bootstrap files (#2318) (thanks @czekaj) 2026-01-26 13:36:26 -06:00
Lucas Czekaj
2cbc991bfe feat(agents): add MEMORY.md to bootstrap files (#2318)
MEMORY.md is now loaded into context at session start, ensuring the
agent has access to curated long-term memory without requiring
embedding-based semantic search.

Previously, MEMORY.md was only accessible via the memory_search tool,
which requires an embedding provider (OpenAI/Gemini API key or local
model). When no embedding provider was configured, the agent would
claim memories were empty even though MEMORY.md existed and contained
data.

This change:
- Adds DEFAULT_MEMORY_FILENAME constant
- Includes MEMORY.md in WorkspaceBootstrapFileName type
- Loads MEMORY.md in loadWorkspaceBootstrapFiles()
- Does NOT add MEMORY.md to subagent allowlist (keeps user data private)
- Does NOT auto-create MEMORY.md template (user creates as needed)

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-26 13:30:43 -06:00
Frank Harris
10d5ea5de6 docs: Add Oracle Cloud (OCI) platform guide (#2333)
* docs: Add Oracle Cloud (OCI) platform guide

- Add comprehensive guide for Oracle Cloud Always Free tier (ARM)
- Cover VCN security, Tailscale Serve setup, and why traditional hardening is unnecessary
- Update vps.md to list Oracle as top provider option
- Update digitalocean.md to link to official Oracle guide instead of community gist

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Keep community gist link, remove unzip

* Fix step order: lock down VCN after Tailscale is running

* Move VCN lockdown to final step (after verifying everything works)

* docs: make Oracle/Tailscale guide safer + tone down DO copy

* docs: fix Oracle guide step numbering

* docs: tone down VPS hub Oracle blurb

* docs: add Oracle Cloud guide (#2333) (thanks @hirefrank)

---------

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Pocket Clawd <pocket@Pockets-Mac-mini.local>
2026-01-26 11:23:11 -08:00
Shakker
34b3494246 Merge branch 'main' into feat/tools-alsoAllow 2026-01-26 19:15:39 +00:00
Peter Steinberger
fba7afaa12 chore(scripts): update claude auth status hints 2026-01-26 19:05:00 +00:00
Peter Steinberger
000d5508aa docs(auth): remove external CLI OAuth reuse 2026-01-26 19:05:00 +00:00
Peter Steinberger
aa2a1a17e3 test(auth): update auth profile coverage 2026-01-26 19:05:00 +00:00
Peter Steinberger
526303d9a2 refactor(auth)!: remove external CLI OAuth reuse 2026-01-26 19:05:00 +00:00
alexstyl
39d219da59 Add FUNDING.yml 2026-01-26 19:00:46 +00:00
Pocket Clawd
f625303d13 test(config): enforce allow+alsoAllow mutual exclusion 2026-01-26 10:42:03 -08:00
Peter Steinberger
3314b3996e fix: harden gateway auth defaults 2026-01-26 18:24:26 +00:00
Peter Steinberger
ab73aceb27 fix: use Windows ACLs for security audit 2026-01-26 18:19:58 +00:00
Pocket Clawd
42d039998d feat(config): forbid allow+alsoAllow in same scope; auto-merge 2026-01-26 10:17:50 -08:00
Vignesh Natarajan
3497be2963 docs: recommend tools.alsoAllow for optional plugin tools 2026-01-26 10:05:31 -08:00
Vignesh Natarajan
d62b7c0d1e fix: treat tools.alsoAllow as implicit allow-all when no allowlist 2026-01-26 10:05:31 -08:00