Commit Graph

1073 Commits

Author SHA1 Message Date
美電球 4ccea5eb93 fix(identity): prevent allowlist ID entries from matching usernames (#1406) 2026-03-13 15:41:18 +08:00
iMil 516f7103b0 add NetBSD to the list of released platforms (#434)
* add NetBSD to the list of released platforms

* ignore platforms s390x mips64 and arm for NetBSD

* add NetBSD to the build-all target
2026-03-13 15:19:37 +08:00
Cytown 9676e51e89 make gateway aware of config.json change (#1187)
* make gateway aware of config.json change

* fix according to code review

* fix lint

* fix review comment

* fix for review

* refactor to fix review

* fix for review

* fix for review
2026-03-13 14:27:46 +08:00
Cytown dfa36f39cb add model command to set default model (#1250)
* add model command to set default model

* fix for ci

* fix test for model

* fix active agent not recognized

* implement test for model command

* fix local-model can not set as default issue

* fix review comment

* fix for comment
2026-03-13 14:10:11 +08:00
Zane Tung 9fed4ec136 feat: add anthropic-messages protocol for native Anthropic Messages API support Fixes #269 (#1284)
* feat: add anthropic-messages protocol support

Add native Anthropic Messages API format support to enable
compatibility with custom endpoints that only support Anthropic's
native message format (not OpenAI-compatible format).

Changes:
- Add new pkg/providers/anthropic_messages package with HTTP-based provider
- Implement Anthropic Messages API request/response format conversion
- Add anthropic-messages protocol support in factory_provider.go
- Include comprehensive unit tests (64.2% coverage)

Features:
- Support for system, user, assistant, and tool messages
- Support for tool calls (tool_use blocks)
- Proper header handling (x-api-key, anthropic-version)
- Configurable max_tokens and temperature
- Automatic base URL normalization

Configuration example:
  model: "anthropic-messages/claude-opus-4-6"
  api_base: "https://api.anthropic.com"
  api_key: "sk-..."

Tested with actual API endpoint, verified compatibility
with Anthropic Messages API specification.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* docs: add anthropic-messages protocol examples to README and config

Add configuration examples and documentation for the new
anthropic-messages protocol:

- config.example.json: Add claude-opus-4.6 example with anthropic-messages
- README.md: Add "Anthropic Messages API (native format)" section
- README.zh.md: Add Chinese version of the documentation

This helps users understand when to use anthropic-messages vs
anthropic protocol and fixes issue #269.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix: format code with gofmt -s

- Align constant definitions in provider.go
- Align struct fields in test cases
- Fix gofmt formatting issues reported in review

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix: address linter errors

- Fix HTTP header canonical form: "x-api-key" → "X-API-Key"
- Fix HTTP header canonical form: "anthropic-version" → "Anthropic-Version"
- Format imports with gci (standard, default, localmodule order)
- Format code with golines (max line length 120)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix: resolve golangci-lint errors in anthropic-messages provider

- add nolint comment for canonicalheader rule on X-API-Key header (Anthropic API requires exact casing)
- fix golines formatting issues in provider_test.go (split long lines under 120 chars)
- fix long comment line in factory_provider.go (split into two lines)

Resolves CI linter failures for the anthropic-messages protocol implementation.

* fix(providers): address review comments in anthropic-messages provider

- fix normalizeBaseURL edge case that incorrectly appends /v1 to URLs already containing /v1 path (e.g., https://api.example.com/v1/proxy)
- remove dead code for apiBase empty check as normalizeBaseURL() always provides a default value
- update test to use proper constructor instead of direct struct initialization
- add detailed comments explaining the URL normalization logic

Resolves review comments on PR #1284

* fix(providers): remove hardcoded max_tokens in anthropic-messages provider

- remove hardcoded max_tokens value (4096) from buildRequestBody
- read max_tokens directly from options parameter
- add error handling when max_tokens is missing from options
- update test cases to include max_tokens in options

This fix ensures the provider respects the config default value (32768)
or system fallback (8192) instead of always using the hardcoded 4096.

* fix(providers): improve error handling and add edge case tests

- fix ToolCalls nil vs empty slice issue to ensure consistent JSON serialization
- add detailed HTTP error handling for common status codes (401, 429, 400, 404, 500, 503)
- add edge case tests for buildRequestBody and parseResponseBody
- clarify anthropic vs anthropic-messages protocol differences in docs

---------

Co-authored-by: Claude <noreply@anthropic.com>
2026-03-13 14:09:40 +08:00
leamon 0fb92b21b6 enhance skill installer (#1252)
* enhance skill installer

* enhance install skills v2

* go file formate

* fix:use proxy download skills;many chunck download;simple code

* add default config to config.example.json, download skill from github use proxy and token

---------

Co-authored-by: FantasticCode2019 <1443996278@qq.com>
2026-03-13 14:04:02 +08:00
dataCenter430 b811e9186c feat(provider): add ModelScope as OpenAI-compatible provider (#1486)
* feat(provider): add ModelScope as OpenAI-compatible provider

* test(provider): add ModelScope provider and migration tests

* docs: add ModelScope to README provider tables and free tier sections

* chore: add ModelScope to example config and env template
2026-03-13 14:02:23 +08:00
Cytown 83e24e8ceb fix 3rd party logger not correct output (#1482) 2026-03-13 11:20:17 +08:00
lxowalle f01eeac300 update volcengine doc (#1481) 2026-03-13 11:15:39 +08:00
Alix-007 d24fccd34f Merge pull request #1385 from Alix-007/fix/issue-1373-restore-last-session
fix(web): restore the last active chat session
2026-03-13 10:34:47 +08:00
wenjie c508d6ffce Merge pull request #1429 from darrenzeng2025/fix/svg-mime-type
fix(web): correct SVG MIME type to image/svg+xml
2026-03-13 09:46:14 +08:00
don 19835b2f60 fix(line): limit webhook request body size to prevent DoS (#1413)
* fix(line): limit webhook request body size to prevent DoS

Add io.LimitReader with 1 MB cap on the LINE webhook handler to prevent
unauthenticated memory exhaustion via oversized POST requests.

Follows the same pattern used in the WeCom channel (io.LimitReader).
Requests exceeding the limit are rejected with 413 Request Entity Too Large.

Fixes #1407

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* refactor(line): hoist body size const, add boundary tests

- Move maxWebhookBodySize to package-level const
- Add TestWebhookAcceptsMaxBodySize (exact limit → 403, not 413)
- Add TestWebhookRejectsOversizedBodyBeforeSignatureCheck
- Use const in test instead of magic number

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-12 23:55:40 +08:00
Horsley Lee 8f49af99f9 fix(matrix): stream inbound media downloads to disk (#1436) 2026-03-12 23:48:26 +08:00
曾文锋0668000834 e4460d3815 fix(web): correct SVG MIME type to image/svg+xml
Go's built-in mime.TypeByExtension returns 'image/svg' for .svg files,
but the correct MIME type per RFC 6838 is 'image/svg+xml'. This fix
registers the correct MIME type when setting up the static file server.

Fixes #1410
2026-03-12 20:39:26 +08:00
wenjie d18a319b0c fix(web): render ansi logs with wrapped lines (#1425) 2026-03-12 19:12:19 +08:00
wenjie 7872bb3f0a Merge pull request #1421 from sipeed/refactor/config-ui
refactor(web): redesign config pages and extract raw JSON editor
2026-03-12 18:15:16 +08:00
Guoguo 6460a0a7c7 fix(nightly): reuse single nightly tag, no per-day tags (#1415)
- Disable goreleaser GitHub release for nightly (Docker still pushed)
- Use GORELEASER_CURRENT_TAG with local-only tag for version/validation
- Force-update single `nightly` git tag instead of creating per-day tags
- Docker tags use only `nightly`/`nightly-launcher`, no per-day versions
- Set --latest=false on nightly release to avoid occupying latest
- Simplify workflow from 3 jobs to 1 job, remove all cleanup steps

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-12 16:16:42 +08:00
Guoguo 1e024321c0 refactor: update model name and add VolcEngine coding plan (#1412)
* docs: swap header logo to webp, move meme logo to bottom

Replace header logo with assets/logo.webp across all 6 README
language variants and move the original meme logo (logo.jpg)
to the bottom of each file.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* docs: update GPT model names to gpt-5.4 and refine provider descriptions

Update all 6 language README variants:
- Correct GPT model references from gpt-5.2/gpt4 to gpt-5.4
- Refine provider descriptions in API Key comparison tables

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* chore: update default model to gpt-5.4, codex to gpt-5.3-codex

Update OpenAI default model references from gpt-5.2 to gpt-5.4
across source code, config examples, tests, and docs. Set Codex
default model to gpt-5.3-codex.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-12 16:10:29 +08:00
Alix-007 b5bd434ddb fix(web): allow horizontal scroll in raw json editor (#1386)
Co-authored-by: XYSK-lilong007 <267018309+XYSK-lilong007@users.noreply.github.com>
Co-authored-by: wenjie <meetwenjie@gmail.com>
2026-03-12 14:51:52 +08:00
wenjie 7273c7fe35 Merge pull request #1377 from Alix-007/fix/issue-1364-firefox-raw-json
fix: keep raw JSON editor full-height in Firefox
2026-03-12 14:43:08 +08:00
Alix-007 3bcbfd99b9 fix(channels): stop stale typing loops on overwrite (#1392)
Co-authored-by: XYSK-lilong007 <267018309+XYSK-lilong007@users.noreply.github.com>
2026-03-12 14:31:00 +08:00
Guoguo b4d00c631d docs: update wechat qrcode (#1394) 2026-03-12 11:01:11 +08:00
Mahendra Teja 8cac29d9bb docs: remove stale TOOLS.md references (#1388)
TOOLS.md was intentionally removed in 21d60f6 and #771, as tools are
now provided to the LLM via JSON schema through ToProviderDefs().
These references were missed during that cleanup.

Suggested by @yinwm in #1355.

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-12 09:47:01 +08:00
Mahendra Teja 6612ca099a fix(openai_compat): improve prompt_cache_key host matching (#1387)
LGTM! The changes improve the robustness of prompt_cache_key host matching and add Azure OpenAI support. Thanks for the contribution!
v0.2.2-nightly.20260312.6612ca09
2026-03-12 03:24:31 +08:00
amagi 49204df678 fix(openai_compat): accept object tool call arguments (#1292) 2026-03-12 02:47:22 +08:00
Cytown d920b78b41 refactor logger to zerolog (#1239)
* refactor logger to zerolog

* modify dingtalk and discord logger

* fix for lint

* fix for review

* fix for file leak

* fix for review
2026-03-12 02:35:37 +08:00
LeaderOnePro 9222351871 feat(providers): add LongCat model provider support (#1317)
* feat(providers): add LongCat model provider support

Add LongCat as an OpenAI-compatible provider with base URL
https://api.longcat.chat/openai and default model LongCat-Flash-Thinking.
Includes provider config, migration, factory routing, example config,
tests, and README entries for all 6 locales.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(providers): address LongCat review feedback

- Add dedicated factory routing test for LongCat provider
- Add longcat to DefaultAPIBase test coverage
- Set default api_base in example config providers section

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* test(providers): add ResolveProviderSelection tests for LongCat

Add two test cases to TestResolveProviderSelection:
- Explicit provider selection with api_base default and proxy wiring
- Fallback inference from model name with api_base default

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-12 02:34:42 +08:00
Darren.Zeng 8431fa3e04 fix(config): support Chinese comma separator in allow_from environment variables (#1301)
Add UnmarshalText method to FlexibleStringSlice to support both English
(,) and Chinese (,) comma separators in environment variables.

Includes comprehensive unit tests covering:
- English commas, Chinese commas, mixed commas
- Single values, whitespace trimming
- Empty strings, edge cases

Fixes #1280
2026-03-12 02:33:33 +08:00
Dimitrij Denissenko 39a451d312 Enable rich-text messages in matrix channel (#1370)
* Enable rich-text messages in matrix channel

* Fix lint
2026-03-12 01:25:28 +08:00
Mahendra Teja 4a80c6f58c fix(openai_compat): only send prompt_cache_key to OpenAI endpoints (#1353)
Non-OpenAI providers (Mistral, DeepSeek, Groq, etc.) reject unknown
request fields with 422 errors. The previous blocklist only excluded
Google/Gemini, but the comment already noted this feature is
OpenAI-only. Flip to an allowlist so only api.openai.com receives
the field.

Fixes #1333
2026-03-12 01:21:54 +08:00
XYSK-lilong007 fcf9545736 fix: use native textarea scrolling for raw config editor 2026-03-12 01:21:44 +08:00
Congregalis 9b0a48ac6d fix(agent): initialize MCP in direct agent mode (#1361) 2026-03-12 01:06:48 +08:00
wenjie 4a8a2e9c23 chore(frontend): update pnpm-lock.yaml (#1368) v0.2.2 2026-03-11 20:23:37 +08:00
wenjie 8949a2575b Add exec allow_remote config support in web settings (#1363)
- default tools.exec.allow_remote to true when omitted in config loading
- preserve allow_remote in OpenClaw config migration and API updates
- expose allow_remote in the web config form with i18n strings
- add backend and config tests covering the new default behavior
2026-03-11 19:57:59 +08:00
wenjie 8c2a9332c6 fix(security): harden unauthenticated tool-exec paths (#1360)
* fix(security): harden unauthenticated tool-exec paths (GHSA-pv8c-p6jf-3fpp)

- Exec tool: channel-based access control (default deny remote)
- Cron tool: command scheduling restricted to internal channels
- Web fetch: SSRF defense-in-depth (pre-flight + dial-time + redirect checks)
- File permissions: session/state dirs 0700, files 0600
- Registry: inject __channel/__chat_id into tool args (replaces racy SetContext)

28 new security regression tests.

(cherry picked from commit 191446ae19021604d3d5b0d9376b9655ab749105)

* fix(exec): revalidate working_dir before command start

* test(web): allow local oversized payload fixture

---------

Co-authored-by: xj <gh-xj@users.noreply.github.com>
2026-03-11 19:22:20 +08:00
wenjie dea06c391c feat(web): add agent management UI and improve launcher integration (#1358)
* Improve the web launcher and gateway integration across backend and frontend.

- add runtime model availability checks for local and OAuth-backed models
- support launcher-driven gateway host overrides and websocket URL resolution
- add gateway log clearing and keep incremental log sync consistent after resets
- migrate session history APIs to JSONL metadata-backed storage with legacy fallback
- expose session titles and improve chat history loading and error handling
- move shared backend runtime helpers into the web utils package
- avoid blocking web startup when automatic onboard initialization fails
- add backend tests covering gateway readiness, host resolution, models, logs, and sessions

* feat(agent): add skills and tools management APIs and UI

- add backend APIs to list, view, import, and delete skills
- add tool status and toggle endpoints with dependency-aware config updates
- add agent skills/tools pages, routes, sidebar entries, and i18n strings
- add backend tests for the new skills and tools flows

* chore(frontend): upgrade shadcn to 4.0.5 and refresh lockfile

* chore(web): keep backend dist placeholder tracked
2026-03-11 18:37:00 +08:00
nayihz 8a398988d7 refactor skills loader markdown metadata parsing (#1354) 2026-03-11 18:08:00 +08:00
Mauro 30584f04cb Merge pull request #1214 from afjcjsbx/feat/echo-voice-audio-transcription
feat(channel): echo voice audio transcription feedback
2026-03-11 08:45:25 +01:00
wenjie e74820cf69 fix: skip meta json files during session migration (#1340) 2026-03-11 14:29:42 +08:00
Cage d5cbf198b2 fix: resolve gateway binary path, pass --config flag, and clarify empty model error (#1337) 2026-03-11 12:54:08 +08:00
美電球 755fa32336 Merge pull request #1330 from statxc/fix/session-key-sanitize-slash
fix(session): sanitize '/' and '\' in session keys so forum topic key…
2026-03-11 12:18:54 +08:00
afjcjsbx 08cc09e091 resolve conflicts 2026-03-11 00:17:10 +01:00
afjcjsbx 87d458f519 Merge remote-tracking branch 'origin/main' into feat/echo-voice-audio-transcription
# Conflicts:
#	pkg/channels/telegram/telegram.go
#	pkg/config/config.go
#	pkg/config/defaults.go
2026-03-11 00:06:37 +01:00
Mauro 9cd2d21800 Merge pull request #1207 from afjcjsbx/feat/debug-mode-no-truncate
feat: no-truncate param for debug
2026-03-10 17:13:44 +01:00
statxc 2e3e6788ab fix(session): sanitize '/' and '\' in session keys so forum topic keys don't create invalid paths 2026-03-10 16:11:34 +00:00
美電球 54f0680add Merge pull request #1291 from statxc/feat/telegram-forum-topics
feat(telegram): support forum topics with per-topic session isolation
2026-03-10 21:38:40 +08:00
statxc 320fcd1f02 fix: Add IsForum check so only forum topic threads get session isolation, not regular group reply threads 2026-03-10 13:25:14 +00:00
Guoguo 8654ec90d9 feat(docker): add launcher bundle image with all three binaries (#1309)
Add a new Docker image variant tagged as `launcher` that includes
picoclaw, picoclaw-launcher, and picoclaw-launcher-tui. The image
defaults to running picoclaw-launcher (web console) instead of gateway.

Original minimal single-binary image remains unchanged.

New files:
- docker/Dockerfile.goreleaser.launcher: goreleaser Docker with 3 binaries

Updated:
- .goreleaser.yaml: new dockers_v2 entry for launcher tag
2026-03-10 17:42:21 +08:00
lxowalle 680e845d61 feat:Modify the location where version is obtained, and insert version information into the context (#1300)
* feat:migrate version info from internal package to pkg/config

* * fix lint issue
2026-03-10 17:42:05 +08:00
yanhool 95716b106b feat(web_search): add load balance and failover for api keys (#982)
* feat(web_search): add load balance and failover for api keys

* feat(web_search): add load balance and failover for api keys

* lint

* new iter to get api key

* deleted conflicts
2026-03-10 19:34:11 +11:00