Commit Graph

8077 Commits

Author SHA1 Message Date
Shakker
ff382f6b68 Merge pull request #1742 from clawdbot/feat/tools-alsoAllow
feat(config): tools.alsoAllow additive allowlist
2026-01-26 20:44:48 +00:00
Shakker
bc8c31eeed Merge branch 'main' into feat/tools-alsoAllow 2026-01-26 20:39:09 +00:00
Shadow
bdea265704 CI: run auto-response on pull_request_target 2026-01-26 14:37:39 -06:00
Shadow
ec75e0b3dc CI: use app token for auto-response 2026-01-26 14:36:29 -06:00
Paul Pamment
9e6b45faab fix(discord): honor threadId for thread-reply 2026-01-26 14:28:28 -06:00
Peter Steinberger
8e051a418f test: stub windows ACL for include perms audit 2026-01-26 20:28:20 +00:00
Peter Steinberger
a5b99349c9 style: format workspace bootstrap signature 2026-01-26 20:28:20 +00:00
Peter Steinberger
1371e95e57 docs: clarify onboarding + credentials 2026-01-26 20:26:30 +00:00
Peter Steinberger
320b45c051 docs: note sandbox opt-in in gateway security 2026-01-26 20:13:10 +00:00
Peter Steinberger
97248a2885 feat: surface security audit + docs 2026-01-26 19:58:59 +00:00
jaydenfyi
f5c90f0e5c feat: Twitch Plugin (#1612)
* wip

* copy polugin files

* wip type changes

* refactor: improve Twitch plugin code quality and fix all tests

- Extract client manager registry for centralized lifecycle management
- Refactor to use early returns and reduce mutations
- Fix status check logic for clientId detection
- Add comprehensive test coverage for new modules
- Remove tests for unimplemented features (index.test.ts, resolver.test.ts)
- Fix mock setup issues in test suite (149 tests now passing)
- Improve error handling with errorResponse helper in actions.ts
- Normalize token handling to eliminate duplication

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* use accountId

* delete md file

* delte tsconfig

* adjust log level

* fix probe logic

* format

* fix monitor

* code review fixes

* format

* no mutation

* less mutation

* chain debug log

* await authProvider setup

* use uuid

* use spread

* fix tests

* update docs and remove bot channel fallback

* more readme fixes

* remove comments + fromat

* fix tests

* adjust access control logic

* format

* install

* simplify config object

* remove duplicate log tags + log received messages

* update docs

* update tests

* format

* strip markdown in monitor

* remove strip markdown config, enabled by default

* default requireMention to true

* fix store path arg

* fix multi account id + add unit test

* fix multi account id + add unit test

* make channel required and update docs

* remove whisper functionality

* remove duplicate connect log

* update docs with convert twitch link

* make twitch message processing non blocking

* schema consistent casing

* remove noisy ignore log

* use coreLogger

---------

Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-26 13:48:10 -06:00
Peter Steinberger
c5ffc11df5 chore(repo): remove stray .DS_Store 2026-01-26 19:41:25 +00:00
Shadow
1a947a21d6 fix: support memory.md in bootstrap files (#2318) (thanks @czekaj) 2026-01-26 13:36:26 -06:00
Lucas Czekaj
2cbc991bfe feat(agents): add MEMORY.md to bootstrap files (#2318)
MEMORY.md is now loaded into context at session start, ensuring the
agent has access to curated long-term memory without requiring
embedding-based semantic search.

Previously, MEMORY.md was only accessible via the memory_search tool,
which requires an embedding provider (OpenAI/Gemini API key or local
model). When no embedding provider was configured, the agent would
claim memories were empty even though MEMORY.md existed and contained
data.

This change:
- Adds DEFAULT_MEMORY_FILENAME constant
- Includes MEMORY.md in WorkspaceBootstrapFileName type
- Loads MEMORY.md in loadWorkspaceBootstrapFiles()
- Does NOT add MEMORY.md to subagent allowlist (keeps user data private)
- Does NOT auto-create MEMORY.md template (user creates as needed)

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-26 13:30:43 -06:00
Frank Harris
10d5ea5de6 docs: Add Oracle Cloud (OCI) platform guide (#2333)
* docs: Add Oracle Cloud (OCI) platform guide

- Add comprehensive guide for Oracle Cloud Always Free tier (ARM)
- Cover VCN security, Tailscale Serve setup, and why traditional hardening is unnecessary
- Update vps.md to list Oracle as top provider option
- Update digitalocean.md to link to official Oracle guide instead of community gist

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Keep community gist link, remove unzip

* Fix step order: lock down VCN after Tailscale is running

* Move VCN lockdown to final step (after verifying everything works)

* docs: make Oracle/Tailscale guide safer + tone down DO copy

* docs: fix Oracle guide step numbering

* docs: tone down VPS hub Oracle blurb

* docs: add Oracle Cloud guide (#2333) (thanks @hirefrank)

---------

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Pocket Clawd <pocket@Pockets-Mac-mini.local>
2026-01-26 11:23:11 -08:00
Shakker
34b3494246 Merge branch 'main' into feat/tools-alsoAllow 2026-01-26 19:15:39 +00:00
Peter Steinberger
fba7afaa12 chore(scripts): update claude auth status hints 2026-01-26 19:05:00 +00:00
Peter Steinberger
000d5508aa docs(auth): remove external CLI OAuth reuse 2026-01-26 19:05:00 +00:00
Peter Steinberger
aa2a1a17e3 test(auth): update auth profile coverage 2026-01-26 19:05:00 +00:00
Peter Steinberger
526303d9a2 refactor(auth)!: remove external CLI OAuth reuse 2026-01-26 19:05:00 +00:00
alexstyl
39d219da59 Add FUNDING.yml 2026-01-26 19:00:46 +00:00
Pocket Clawd
f625303d13 test(config): enforce allow+alsoAllow mutual exclusion 2026-01-26 10:42:03 -08:00
Peter Steinberger
3314b3996e fix: harden gateway auth defaults 2026-01-26 18:24:26 +00:00
Peter Steinberger
ab73aceb27 fix: use Windows ACLs for security audit 2026-01-26 18:19:58 +00:00
Pocket Clawd
42d039998d feat(config): forbid allow+alsoAllow in same scope; auto-merge 2026-01-26 10:17:50 -08:00
Vignesh Natarajan
3497be2963 docs: recommend tools.alsoAllow for optional plugin tools 2026-01-26 10:05:31 -08:00
Vignesh Natarajan
d62b7c0d1e fix: treat tools.alsoAllow as implicit allow-all when no allowlist 2026-01-26 10:05:31 -08:00
Vignesh Natarajan
2ad3508a33 feat(config): add tools.alsoAllow additive allowlist 2026-01-26 10:05:31 -08:00
Peter Steinberger
b9098f3401 fix: remove unsupported gateway auth off option 2026-01-26 17:44:23 +00:00
Peter Steinberger
e6bdffe568 feat: add control ui device auth bypass 2026-01-26 17:40:28 +00:00
Peter Steinberger
a486940781 fix: honor tools.exec.safeBins config 2026-01-26 17:22:40 +00:00
Shadow
2a4ccb624a Docs: update clawtributors 2026-01-26 11:02:59 -06:00
Shadow
e0b8661eee Docs: credit LINE channel guide contributor 2026-01-26 11:02:59 -06:00
Peter Steinberger
bfe9bb8a23 docs(changelog): note slack redirect fix
Co-authored-by: Glucksberg <markuscontasul@gmail.com>
2026-01-26 17:01:22 +00:00
Peter Steinberger
287ab84060 fix(slack): handle file redirects
Co-authored-by: Glucksberg <markuscontasul@gmail.com>
2026-01-26 17:01:22 +00:00
Peter Steinberger
b06fc50e25 docs: clarify onboarding security warning 2026-01-26 16:58:55 +00:00
Ayaan Zaidi
94ead83ba4 fix: telegram sendPayload and plugin auth (#1917) (thanks @JoshuaLelon) 2026-01-26 22:28:14 +05:30
Joshua Mitchell
db2395744b fix(telegram): extract and send buttons from channelData
Plugin commands can return buttons in channelData.telegram.buttons,
but deliverReplies() was ignoring them. Now we:

1. Extract buttons from reply.channelData?.telegram?.buttons
2. Build inline keyboard using buildInlineKeyboard()
3. Pass reply_markup to sendMessage()

Buttons are attached to the first text chunk when text is chunked.
2026-01-26 22:28:14 +05:30
Joshua Mitchell
b8e6f0b135 fix(telegram): register bot.command handlers for plugin commands
Plugin commands were added to setMyCommands menu but didn't have
bot.command() handlers registered. This meant /flow-start and other
plugin commands would fall through to the general message handler
instead of being dispatched to the plugin command executor.

Now we register bot.command() handlers for each plugin command,
with full authorization checks and proper result delivery.
2026-01-26 22:28:14 +05:30
Joshua Mitchell
0e3340d1fc feat(plugins): sync plugin commands to Telegram menu and export gateway types
- Add plugin command specs to Telegram setMyCommands for autocomplete
- Export GatewayRequestHandler types in plugin-sdk for plugin authors
- Enables plugins to register gateway methods and appear in command menus
2026-01-26 22:28:14 +05:30
Joshua Mitchell
ce60c6db1b feat(telegram): implement sendPayload for channelData support
Add sendPayload handler to Telegram outbound adapter to support
channel-specific data via the channelData pattern. This enables
features like inline keyboard buttons without custom ReplyPayload fields.

Implementation:
- Extract telegram.buttons from payload.channelData
- Pass buttons to sendMessageTelegram (already supports this)
- Follows existing sendText/sendMedia patterns
- Completes optional ChannelOutboundAdapter.sendPayload interface

This enables plugins to send Telegram-specific features (buttons, etc.)
using the standard channelData envelope pattern instead of custom fields.

Related: delivery system in src/infra/outbound/deliver.ts:324 already
checks for sendPayload handler and routes accordingly.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-26 22:28:14 +05:30
Peter Steinberger
c01cc61f9a docs: note fly private deployment fixups (#2289) (thanks @dguido) 2026-01-26 16:58:09 +00:00
Peter Steinberger
5b6a211583 docs: tighten fly private deployment steps 2026-01-26 16:58:09 +00:00
Dan Guido
b9643ad60e docs(fly): add private/hardened deployment guide
- Add fly.private.toml template for deployments with no public IP
- Add "Private Deployment (Hardened)" section to Fly docs
- Document how to convert existing deployment to private-only
- Add security notes recommending env vars over config file for secrets

This addresses security concerns about Clawdbot gateways being
discoverable on internet scanners (Shodan, Censys). Private deployments
are accessible only via fly proxy, WireGuard, or SSH.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-26 16:52:55 +00:00
Shadow
07e34e3423 Discord: add presence cache tests (#2266) (thanks @kentaro) 2026-01-26 10:43:23 -06:00
Kentaro Kuribayashi
3e07bd8b48 feat(discord): add configurable privileged Gateway Intents (GuildPresences, GuildMembers) (#2266)
* feat(discord): add configurable privileged Gateway Intents (GuildPresences, GuildMembers)

Add support for optionally enabling Discord privileged Gateway Intents
via config, starting with GuildPresences and GuildMembers.

When `channels.discord.intents.presence` is set to true:
- GatewayIntents.GuildPresences is added to the gateway connection
- A PresenceUpdateListener caches user presence data in memory
- The member-info action includes user status and activities
  (e.g. Spotify listening activity) from the cache

This enables use cases like:
- Seeing what music a user is currently listening to
- Checking user online/offline/idle/dnd status
- Tracking user activities through the bot API

Both intents require Portal opt-in (Discord Developer Portal →
Privileged Gateway Intents) before they can be used.

Changes:
- config: add `channels.discord.intents.{presence,guildMembers}`
- provider: compute intents dynamically from config
- listeners: add DiscordPresenceListener (extends PresenceUpdateListener)
- presence-cache: simple in-memory Map<userId, GatewayPresenceUpdate>
- discord-actions-guild: include cached presence in member-info response
- schema: add labels and descriptions for new config fields

* fix(test): add PresenceUpdateListener to @buape/carbon mock

* Discord: scope presence cache by account

---------

Co-authored-by: kugutsushi <kugutsushi@clawd>
Co-authored-by: Shadow <hi@shadowing.dev>
2026-01-26 10:39:54 -06:00
Peter Steinberger
97200984f8 fix: secure twilio webhook verification 2026-01-26 16:18:37 +00:00
Peter Steinberger
b623557a2e fix: harden url fetch dns pinning 2026-01-26 16:05:29 +00:00
Alex Alaniz
8b68cdd9bc fix: harden doctor gateway exposure warnings (#2016) (thanks @Alex-Alaniz) (#2016)
Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-01-26 15:44:17 +00:00
Shadow
403c397ff5 Docs: add cli/security labels 2026-01-26 09:36:58 -06:00