Skip to content

Sync/upstream 2026 03 14#107

Merged
linfangw merged 942 commits into
mainfrom
sync/upstream-2026-03-14
Mar 15, 2026
Merged

Sync/upstream 2026 03 14#107
linfangw merged 942 commits into
mainfrom
sync/upstream-2026-03-14

Conversation

@linfangw

Copy link
Copy Markdown
Member

No description provided.

steipete and others added 30 commits March 13, 2026 23:35
…claw#45518)

* test: preserve wrapper behavior for targeted runs

* test: tighten targeted wrapper routing
obviyus and others added 27 commits March 14, 2026 09:25
…claw#45622)

* Gateway: treat scope-limited probe RPC as degraded

* Docs: clarify gateway probe degraded scope output

* test: fix CI type regressions in gateway and outbound suites

* Tests: fix Node24 diffs theme loading and Windows assertions

* Tests: fix extension typing after main rebase

* Tests: fix Windows CI regressions after rebase

* Tests: normalize executable path assertions on Windows

* Tests: remove duplicate gateway daemon result alias

* Tests: stabilize Windows approval path assertions

* Tests: fix Discord rate-limit startup fixture typing

* Tests: use Windows-friendly relative exec fixtures

---------

Co-authored-by: Mainframe <mainframe@MainfraacStudio.localdomain>
* fix(gateway): bound unanswered client requests

* fix(gateway): skip default timeout for expectFinal requests

* fix(gateway): preserve gateway call timeouts

* fix(gateway): localize request timeout policy

* fix(gateway): clamp explicit request timeouts

* fix(gateway): clamp default request timeout
* 'main' of https://github.com/openclaw/openclaw: (640 commits)
  ci: add npm token fallback for npm releases
  build: prepare 2026.3.13-beta.1
  docs: reorder unreleased changelog by impact
  fix: keep windows onboarding logs ascii-safe
  test: harden parallels all-os smoke harness
  chore: bump pi to 0.58.0
  fix(browser): prefer user profile over chrome relay
  build: upload Android native debug symbols
  Gateway: treat scope-limited probe RPC as degraded reachability (openclaw#45622)
  build: shrink Android app release bundle
  fix: keep exec summaries inline
  docs: fix changelog formatting
  test(discord): align rate limit error mock with carbon
  build(android): strip unused dnsjava resolver service before R8
  build(android): add auto-bump signed aab release script
  fix(browser): add browser session selection
  fix(models): apply Gemini model-id normalization to google-vertex provider (openclaw#42435)
  fix(feishu): add early event-level dedup to prevent duplicate replies (openclaw#43762)
  fix: unblock discord startup on deploy rate limits
  fix: default Android TLS setup codes to port 443
  ...

# Conflicts:
#	src/browser/pw-tools-core.interactions.batch.test.ts
#	src/browser/pw-tools-core.interactions.ts
* origin/main:
  fix(gateway): bound unanswered client requests (openclaw#45689)
…on (openclaw#16511)

feat(cron): support persistent session targets for cron jobs (openclaw#9765)

Add support for `sessionTarget: "current"` and `session:<id>` so cron jobs can
bind to the creating session or a persistent named session instead of only
`main` or ephemeral `isolated` sessions.

Also:
- preserve custom session targets across reloads and restarts
- update gateway validation and normalization for the new target forms
- add cron coverage for current/custom session targets and fallback behavior
- fix merged CI regressions in Discord and diffs tests
- add a changelog entry for the new cron session behavior

Co-authored-by: kkhomej33-netizen <kkhomej33-netizen@users.noreply.github.com>
Co-authored-by: ImLukeF <92253590+ImLukeF@users.noreply.github.com>
@linfangw
linfangw merged commit bed349b into main Mar 15, 2026
2 of 10 checks passed
@gemini-code-assist

Copy link
Copy Markdown

Summary of Changes

Hello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request synchronizes the repository with upstream changes, focusing on upgrading dependencies, enhancing security, improving the Android app, and adding detailed testing playbooks. It includes updates to Dockerfiles, GitHub Actions, documentation, and various bug fixes across different platforms and channels.

Highlights

  • Node.js Version Upgrade: Upgraded the default Node.js version in Dockerfiles and GitHub Actions from 22.x to 24.x, ensuring the project uses the latest stable version.
  • Dependency Updates: Updated various dependencies, including @pierre/diffs, @mariozechner/pi-* packages, and useblacksmith/stickydisk, to incorporate new features and bug fixes.
  • Security Enhancements: Implemented several security measures, such as making bootstrap setup codes single-use and stripping zero-width characters from external content markers.
  • Android App Improvements: Enhanced the Android app with a redesigned chat settings sheet, Google Code Scanner for QR scanning, and improved gateway connection handling.
  • Parallels Smoke Playbooks: Added detailed playbooks for Parallels macOS, Windows, and Linux smoke tests, improving testing and debugging processes.
  • iMessage/BlueBubbles Self-Chat Deduplication: Implemented a new mechanism to prevent self-chat loops in iMessage and BlueBubbles by dropping reflected duplicate copies based on chat, body, and timestamp.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Changelog
  • .dockerignore
    • Added .env* to .dockerignore to prevent sensitive files from being included in the build context.
  • .github/actions/setup-node-env/action.yml
    • Updated default Node.js version to 24.x and added cache-key-suffix input.
    • Updated actions/setup-node to v6 and oven-sh/setup-bun to v2.1.3.
  • .github/actions/setup-pnpm-store-cache/action.yml
    • Updated default cache-key-suffix to node24 and modified sticky disk usage for pull_request events.
  • .gitignore
    • Added docker-compose.override.yml and several test-related files to .gitignore.
  • .jscpd.json
    • Added .jscpd.json to configure duplicate code detection.
  • .npmignore
    • Added .npmignore to exclude node_modules from npm packages.
  • .secrets.baseline
    • Updated line numbers in .secrets.baseline for i18n files.
  • AGENTS.md
    • Added American English spelling guideline and detailed Parallels smoke test playbooks.
  • CHANGELOG.md
    • Updated CHANGELOG.md with detailed release notes for versions 2026.3.13 and 2026.3.12, including changes, fixes, and security enhancements.
  • CONTRIBUTING.md
    • Updated Ayaan Zaidi's affiliation to Android app and added American English spelling guideline.
  • Dockerfile
    • Updated base images to Node 24 and added retry logic for Bun installation.
    • Updated labels to reflect Node 24 and added DEBIAN_FRONTEND=noninteractive apt-get upgrade.
  • Dockerfile.sandbox
    • Added apt-get upgrade to Dockerfile.sandbox.
  • Dockerfile.sandbox-browser
    • Added apt-get upgrade to Dockerfile.sandbox-browser.
  • Dockerfile.sandbox-common
    • Added apt-get upgrade to Dockerfile.sandbox-common.
  • SECURITY.md
    • Added more details about reporting security vulnerabilities.
  • Swabble/Sources/SwabbleKit/WakeWordGate.swift
    • Refactored commandText function in WakeWordGate to handle foreign range indices.
  • Swabble/Tests/SwabbleKitTests/WakeWordGateTests.swift
    • Added commandTextHandlesForeignRangeIndices test case.
  • apps/android/README.md
    • Added documentation for the android:bundle:release command.
  • apps/android/app/build.gradle.kts
    • Updated versionCode and versionName, added debugSymbolLevel, and excluded certain files from packaging.
  • apps/android/app/src/main/java/ai/openclaw/app/MainViewModel.kt
    • Added setGatewayBootstrapToken function and refreshHomeCanvasOverviewIfConnected function.
  • apps/android/app/src/main/java/ai/openclaw/app/NodeRuntime.kt
    • Added gateway bootstrap token support and updated home canvas state management.
    • Added logic to mount pnpm store sticky disk only when not a pull request.
  • apps/android/app/src/main/java/ai/openclaw/app/SecurePrefs.kt
    • Added gateway bootstrap token persistence.
  • apps/android/app/src/main/java/ai/openclaw/app/gateway/DeviceAuthStore.kt
    • Added clearToken function to DeviceAuthStore.
  • apps/android/app/src/main/java/ai/openclaw/app/gateway/GatewaySession.kt
    • Added bootstrap token support and improved error handling for gateway connections.
  • apps/android/app/src/main/java/ai/openclaw/app/node/CanvasController.kt
    • Added updateHomeCanvasState function to manage home canvas content.
  • apps/android/app/src/main/java/ai/openclaw/app/ui/ConnectTabScreen.kt
    • Refactored UI for gateway connection and added disconnect button.
  • apps/android/app/src/main/java/ai/openclaw/app/ui/GatewayConfigResolver.kt
    • Added bootstrap token support to gateway configuration resolution.
  • apps/android/app/src/main/java/ai/openclaw/app/ui/OnboardingFlow.kt
    • Refactored onboarding flow with welcome pager and Google Code Scanner integration.
  • apps/android/scripts/build-release-aab.ts
    • Added script to auto-bump Android versionName/versionCode and build a signed release .aab.
  • apps/ios/ActivityWidget/OpenClawLiveActivity.swift
    • Added horizontal padding to the OpenClawLiveActivity widget.
  • apps/ios/Config/Version.xcconfig
    • Updated OPENCLAW_GATEWAY_VERSION, OPENCLAW_MARKETING_VERSION, and OPENCLAW_BUILD_VERSION.
  • apps/ios/README.md
    • Added details about beta release behavior and required environment variables.
  • apps/ios/ShareExtension/ShareViewController.swift
    • Added bootstrap token support to gateway connection in ShareViewController.
  • apps/ios/Sources/Chat/IOSGatewayChatTransport.swift
    • Added resetSession function to IOSGatewayChatTransport.
  • apps/ios/Sources/Gateway/GatewayConnectConfig.swift
    • Added bootstrapToken property to GatewayConnectConfig.
  • apps/ios/Sources/Gateway/GatewayConnectionController.swift
    • Added bootstrap token support to gateway connection and session management.
  • apps/ios/Sources/Gateway/GatewaySettingsStore.swift
    • Added gateway bootstrap token persistence.
  • apps/ios/Sources/Info.plist
    • Added push notification settings to Info.plist.
  • apps/ios/Sources/Model/NodeAppModel.swift
    • Added push registration management and updated gateway connection handling.
  • apps/ios/Sources/Onboarding/GatewayOnboardingView.swift
    • Added bootstrap token support to gateway onboarding.
  • apps/ios/Sources/Onboarding/OnboardingStateStore.swift
    • Added first run intro state and reset function.
  • apps/ios/Sources/OpenClawApp.swift
    • Added logic to refresh APNs registration after notification permission grant.
  • apps/ios/Tests/DeepLinkParserTests.swift
    • Added bootstrap token support to deep link parsing.
  • apps/ios/Tests/IOSGatewayChatTransportTests.swift
    • Added test case for resetSession function.
  • apps/macos/Sources/OpenClaw/ControlChannel.swift
    • Added bootstrap token auth source.
  • apps/macos/Sources/OpenClaw/CronJobEditor+Helpers.swift
    • Added support for current and session-based cron jobs.
  • apps/macos/Sources/OpenClaw/ExecApprovalEvaluation.swift
    • Added logic to bind macOS skill auto-allow trust to both executable name and resolved path.
  • apps/macos/Sources/OpenClaw/ExecCommandResolution.swift
    • Added logic to unwrap env dispatch wrappers inside shell-segment allowlist resolution on macOS.
  • apps/macos/Sources/OpenClaw/NodeMode/MacNodeModeCoordinator.swift
    • Added bootstrap token support to gateway connection.
  • apps/macos/Sources/OpenClaw/OnboardingView+Pages.swift
    • Added support for bootstrap tokens in gateway onboarding.
  • apps/macos/Sources/OpenClawApp.swift
    • Added logic to refresh APNs registration after notification permission grant.
  • apps/macos/Tests/OpenClawIPCTests/ExecAllowlistTests.swift
    • Added test cases for line-continued command substitution and env dispatch wrappers.
  • apps/macos/Tests/OpenClawIPCTests/ExecSkillBinTrustTests.swift
    • Added test cases for skill bin trust and auto-allow.
  • apps/macos/Tests/OpenClawIPCTests/OnboardingRemoteAuthPromptTests.swift
    • Added test case for setup code expiration.
  • apps/macos/Tests/OpenClawIPCTests/RuntimeLocatorTests.swift
    • Added test case for Node version validation.
  • apps/macos/Tests/OpenClawIPCTests/VoiceWakeRuntimeTests.swift
    • Added test case for gate command text handling of foreign string ranges.
  • apps/shared/OpenClawKit/Sources/OpenClawChatUI/ChatSessions.swift
    • Added mainSessionKey to OpenClawChatSessionsDefaults.
  • apps/shared/OpenClawKit/Sources/OpenClawChatUI/ChatTransport.swift
    • Added resetSession function to OpenClawChatTransport protocol.
  • apps/shared/OpenClawKit/Sources/OpenClawKit/DeepLinks.swift
    • Added bootstrapToken property to GatewayConnectDeepLink.
  • apps/shared/OpenClawKit/Sources/OpenClawKit/GatewayChannel.swift
    • Added bootstrap token support to gateway connections.
  • apps/shared/OpenClawKit/Sources/OpenClawProtocol/GatewayModels.swift
    • Removed spawnedby and workspacedir from AgentParams and added details for session status.
  • test/config-form.analyze.telegram.test.ts
    • Added test case for secret ref in signal groups.
  • ui/src/ui/theme-variants.browser.test.ts
    • Added test case for theme variants.
Ignored Files
  • Ignored by pattern: .github/workflows/** (10)
    • .github/workflows/auto-response.yml
    • .github/workflows/ci.yml
    • .github/workflows/codeql.yml
    • .github/workflows/docker-release.yml
    • .github/workflows/install-smoke.yml
    • .github/workflows/labeler.yml
    • .github/workflows/openclaw-npm-release.yml
    • .github/workflows/sandbox-common-smoke.yml
    • .github/workflows/stale.yml
    • .github/workflows/workflow-sanity.yml
Activity
  • Upgraded Node.js version to 24.x in Dockerfiles and GitHub Actions.
  • Updated dependencies including @pierre/diffs, @mariozechner/pi-* packages, and useblacksmith/stickydisk.
  • Implemented security measures such as single-use bootstrap setup codes and external content sanitization.
  • Enhanced Android app with redesigned chat settings and Google Code Scanner.
  • Added detailed playbooks for Parallels smoke tests.
  • Implemented self-chat loop prevention in iMessage and BlueBubbles.
Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution.

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request appears to be a large synchronization and dependency update, touching many parts of the codebase including CI workflows, Android and iOS apps, macOS app, and various extensions. Key changes include upgrading to Node.js 24, significant refactoring of authentication and push notification logic for mobile apps, UI improvements, and security hardenings in command execution and webhook handling. My review found a couple of critical issues in the GitHub Actions workflow files that will cause CI to fail.


- name: Setup Node.js
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
uses: actions/setup-node@v6

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

The action actions/setup-node is being updated to @v6, but this version does not exist. The latest major version is v4. This will cause the workflow to fail. Please use a valid version, for example @v4.

      uses: actions/setup-node@v4

uses: actions/cache@v4
# PRs that request sticky disks still need a safe cache restore path.
if: inputs.use-actions-cache == 'true' && (inputs.use-sticky-disk != 'true' || github.event_name == 'pull_request') && inputs.use-restore-keys != 'true'
uses: actions/cache@v5

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

The action actions/cache is being updated to @v5, but this version does not exist. The latest major version is v4. This will cause the workflow to fail. Please use a valid version, for example @v4.

      uses: actions/cache@v4

if: inputs.use-actions-cache == 'true' && inputs.use-sticky-disk != 'true' && inputs.use-restore-keys == 'true'
uses: actions/cache@v4
if: inputs.use-actions-cache == 'true' && (inputs.use-sticky-disk != 'true' || github.event_name == 'pull_request') && inputs.use-restore-keys == 'true'
uses: actions/cache@v5

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

The action actions/cache is being updated to @v5, but this version does not exist. The latest major version is v4. This will cause the workflow to fail. Please use a valid version, for example @v4.

      uses: actions/cache@v4

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.