8790c54635
fix(android): use scheme default port for gateway setup URLs ( #43540 )
...
* fix(android): use scheme default port for gateway setup URLs
* test(android): cover gateway endpoint default ports
* fix(android): preserve direct gateway default port
* fix(android): preserve explicit cleartext port display
* fix: preserve Android gateway setup URL ports (#43540 ) (thanks @fmercurio)
---------
Co-authored-by: clawdia <clawdia@fmercurio.tech >
Co-authored-by: Ayaan Zaidi <hi@obviy.us >
2026-03-22 10:21:38 +05:30
e7e4c68caf
Android: update status bar appearance in OpenClawTheme ( #51098 )
...
* Android: update status bar appearance in OpenClawTheme
* fix: update Android status bar appearance (#51098 ) (thanks @goweii)
---------
Co-authored-by: Ayaan Zaidi <hi@obviy.us >
2026-03-22 09:33:24 +05:30
1e98dbcad3
Android: fix Bitmap memory leaks in PhotosHandler ( #41888 )
...
* Android: fix Bitmap memory leaks in PhotosHandler
Bitmaps created by decodeScaledBitmap and intermediate scaled copies
inside encodeJpegUnderBudget were never recycled, leaking native memory
on every photos.latest invocation (up to 20 bitmaps per call).
- latest(): wrap bitmap usage in try/finally to guarantee recycle
- decodeScaledBitmap(): recycle the decoded bitmap after scaling
- encodeJpegUnderBudget(): use try/finally to recycle intermediate
scaled bitmaps on all exit paths (success, compress failure, and
cannot-shrink-further early returns)
Made-with: Cursor
* Android: guard decodeScaledBitmap against scale() exceptions
* fix: note Android photos bitmap cleanup (#41888 ) (thanks @Kaneki-x)
---------
Co-authored-by: Ayaan Zaidi <hi@obviy.us >
2026-03-22 08:53:26 +05:30
2909d8cd12
Android: fix Bitmap memory leaks in CanvasController snapshots ( #41889 )
...
* Android: fix Bitmap memory leaks in CanvasController snapshots
snapshotPngBase64() and snapshotBase64() create bitmaps via
captureBitmap() and scaleForMaxWidth() but never recycle them,
leaking native memory on every canvas snapshot invocation.
Wrap both methods in nested try/finally blocks:
- outer: always recycles the captured bitmap
- inner: recycles the scaled bitmap only when it differs from the
captured one (scaleForMaxWidth returns `this` when no scaling needed)
Made-with: Cursor
* fix: note Android canvas snapshot bitmap leak in changelog (#41889 ) (thanks @Kaneki-x)
---------
Co-authored-by: Ayaan Zaidi <hi@obviy.us >
2026-03-22 08:50:42 +05:30
88da51d91b
Android: fix temp file leak in CameraHandler.handleClip ( #41890 )
...
* Android: fix temp file leak in CameraHandler.handleClip
When readBytes() throws (IOException, OOM, etc.), the recorded clip
file was never deleted because delete() only ran on the success path.
Move file.delete() into a finally block so the temp file is cleaned up
regardless of whether readBytes() succeeds or fails.
Made-with: Cursor
* fix: Android camera clip cleanup (#41890 ) (thanks @Kaneki-x)
---------
Co-authored-by: Ayaan Zaidi <hi@obviy.us >
2026-03-22 08:49:50 +05:30
f7866c1c15
Android: escape SQL LIKE wildcards in contacts search query
...
The contacts search passed user input directly into a LIKE pattern
without escaping % and _ characters, causing them to act as SQL
wildcards and return incorrect results.
Add an escapeLikePattern() helper that escapes \, %, and _ with a
backslash, and add ESCAPE '\' to the selection clause so SQLite
treats them as literal characters.
Made-with: Cursor
2026-03-22 08:48:29 +05:30
d38561acbe
Android: fix Bitmap memory leaks in CameraCaptureManager.snap
2026-03-22 08:44:06 +05:30
d6346aaf63
Android: fix sensor callback race condition in MotionHandler ( #43781 )
...
* Android: fix sensor callback race in MotionHandler using tryResume
* call completeResume before unregisterListener to avoid coroutine leak
* replace internal tryResume/completeResume with AtomicBoolean guard
* use CancellableContinuation.resume(value, onCancellation) for cancellation safety
* use non-deprecated resume overload for kotlinx.coroutines 1.10+
* fix: simplify Android motion continuation resume
---------
Co-authored-by: Ayaan Zaidi <hi@obviy.us >
2026-03-22 08:41:02 +05:30
e7814f7ba0
Android: fix incomplete JS string escaping in A2UI action status ( #43784 )
...
* Android: fix incomplete JS string escaping in A2UI action status
* escape U+2028/U+2029 Unicode line terminators in JS strings
* refactor(android): serialize A2UI action status strings
* fix: serialize Android A2UI action status strings (#43784 ) (thanks @Kaneki-x)
---------
Co-authored-by: Ayaan Zaidi <hi@obviy.us >
2026-03-22 08:39:53 +05:30
b67baae1f6
fix: make permission rationale completion single-shot
2026-03-22 08:34:02 +05:30
6db72746fb
Android: keep permission dialog cleanup on the main thread
2026-03-22 08:34:02 +05:30
518d2dd6a9
Android: harden permission dialogs across activity teardown
2026-03-22 08:34:02 +05:30
2fd372836e
iOS: improve QR pairing flow ( #51359 )
...
CI / docs-scope (push) Has been cancelled
CI / changed-scope (push) Has been cancelled
CI / changed-extensions (push) Has been cancelled
CI / build-artifacts (push) Has been cancelled
CI / release-check (push) Has been cancelled
CI / checks (node22, pnpm build
pnpm test
node scripts/stage-bundled-plugin-runtime-deps.mjs
node --import tsx scripts/release-check.ts
, 22.x, node, compat-node22) (push) Has been cancelled
CI / checks (pnpm canvas:a2ui:bundle && bunx vitest run --config vitest.unit.config.ts, bun, test) (push) Has been cancelled
CI / checks (pnpm canvas:a2ui:bundle && pnpm test, node, 2, 1, test) (push) Has been cancelled
CI / checks (pnpm canvas:a2ui:bundle && pnpm test, node, 2, 2, test) (push) Has been cancelled
CI / checks (pnpm protocol:check, node, protocol) (push) Has been cancelled
CI / checks (pnpm test:channels, node, channels) (push) Has been cancelled
CI / checks (pnpm test:contracts, node, contracts) (push) Has been cancelled
CI / checks (pnpm test:extensions, node, extensions) (push) Has been cancelled
CI / extension-fast (push) Has been cancelled
CI / check (push) Has been cancelled
CI / check-additional (push) Has been cancelled
CI / build-smoke (push) Has been cancelled
CI / check-docs (push) Has been cancelled
CI / skills-python (push) Has been cancelled
CI / secrets (push) Has been cancelled
CI / checks-windows (pnpm test, node, 6, 1, test) (push) Has been cancelled
CI / checks-windows (pnpm test, node, 6, 2, test) (push) Has been cancelled
CI / checks-windows (pnpm test, node, 6, 3, test) (push) Has been cancelled
CI / checks-windows (pnpm test, node, 6, 4, test) (push) Has been cancelled
CI / checks-windows (pnpm test, node, 6, 5, test) (push) Has been cancelled
CI / checks-windows (pnpm test, node, 6, 6, test) (push) Has been cancelled
CI / macos (push) Has been cancelled
CI / ios (push) Has been cancelled
CI / android (./gradlew --no-daemon :app:assemblePlayDebug, build-play) (push) Has been cancelled
CI / android (./gradlew --no-daemon :app:assembleThirdPartyDebug, build-third-party) (push) Has been cancelled
CI / android (./gradlew --no-daemon :app:testPlayDebugUnitTest, test-play) (push) Has been cancelled
CI / android (./gradlew --no-daemon :app:testThirdPartyDebugUnitTest, test-third-party) (push) Has been cancelled
Docker Release / validate_manual_backfill (push) Has been cancelled
Docker Release / approve_manual_backfill (push) Has been cancelled
Docker Release / build-amd64 (push) Has been cancelled
Docker Release / build-arm64 (push) Has been cancelled
Docker Release / create-manifest (push) Has been cancelled
Install Smoke / docs-scope (push) Has been cancelled
Install Smoke / install-smoke (push) Has been cancelled
Plugin NPM Release / preview_plugins_npm (push) Has been cancelled
Plugin NPM Release / preview_plugin_pack (push) Has been cancelled
Plugin NPM Release / publish_plugins_npm (push) Has been cancelled
Workflow Sanity / no-tabs (push) Has been cancelled
Workflow Sanity / actionlint (push) Has been cancelled
Workflow Sanity / config-docs-drift (push) Has been cancelled
Stale / stale (push) Has been cancelled
Stale / lock-closed-issues (push) Has been cancelled
- improve QR pairing UX and bootstrap token handling
- preserve repeated optimistic user messages during refresh
- add regression coverage for refresh reconciliation
Thanks @ImLukeF
2026-03-21 01:10:29 -05:00
7abfff756d
Exec: harden host env override handling across gateway and node ( #51207 )
...
* Exec: harden host env override enforcement and fail closed
* Node host: enforce env override diagnostics before shell filtering
* Env overrides: align Windows key handling and mac node rejection
2026-03-20 15:44:15 -05:00
4c60956d8e
build(android): update Gradle tooling
2026-03-20 17:12:10 +05:30
3bda64f75c
perf(android): reduce tab-switch CPU churn
2026-03-20 17:10:18 +05:30
0c2e6fe97f
ci(android): use explicit flavor debug tasks
2026-03-20 12:55:52 +05:30
f09f98532c
feat(android): hide restricted capabilities in play builds
CI / docs-scope (push) Has been cancelled
CI / changed-scope (push) Has been cancelled
CI / changed-extensions (push) Has been cancelled
CI / build-artifacts (push) Has been cancelled
CI / release-check (push) Has been cancelled
CI / checks (pnpm canvas:a2ui:bundle && bunx vitest run --config vitest.unit.config.ts, bun, test) (push) Has been cancelled
CI / checks (pnpm canvas:a2ui:bundle && pnpm test, node, 2, 1, test) (push) Has been cancelled
CI / checks (pnpm canvas:a2ui:bundle && pnpm test, node, 2, 2, test) (push) Has been cancelled
CI / checks (pnpm protocol:check, node, protocol) (push) Has been cancelled
CI / checks (pnpm test:channels, node, channels) (push) Has been cancelled
CI / checks (pnpm test:contracts, node, contracts) (push) Has been cancelled
CI / checks (pnpm test:extensions, node, extensions) (push) Has been cancelled
CI / extension-fast (${{ matrix.extension }}) (push) Has been cancelled
CI / check (push) Has been cancelled
CI / plugin-extension-boundary (push) Has been cancelled
CI / web-search-provider-boundary (push) Has been cancelled
CI / extension-src-outside-plugin-sdk-boundary (push) Has been cancelled
CI / extension-plugin-sdk-internal-boundary (push) Has been cancelled
CI / build-smoke (push) Has been cancelled
CI / gateway-watch-regression (push) Has been cancelled
CI / check-docs (push) Has been cancelled
CI / compat-node22 (push) Has been cancelled
CI / skills-python (push) Has been cancelled
CI / secrets (push) Has been cancelled
CI / checks-windows (pnpm test, node, 6, 1, test) (push) Has been cancelled
CI / checks-windows (pnpm test, node, 6, 2, test) (push) Has been cancelled
CI / checks-windows (pnpm test, node, 6, 3, test) (push) Has been cancelled
CI / checks-windows (pnpm test, node, 6, 4, test) (push) Has been cancelled
CI / checks-windows (pnpm test, node, 6, 5, test) (push) Has been cancelled
CI / checks-windows (pnpm test, node, 6, 6, test) (push) Has been cancelled
CI / macos (push) Has been cancelled
CI / ios (push) Has been cancelled
CI / android (./gradlew --no-daemon :app:assembleDebug, build) (push) Has been cancelled
CI / android (./gradlew --no-daemon :app:testDebugUnitTest, test) (push) Has been cancelled
Docker Release / validate_manual_backfill (push) Has been cancelled
Docker Release / approve_manual_backfill (push) Has been cancelled
Docker Release / build-amd64 (push) Has been cancelled
Docker Release / build-arm64 (push) Has been cancelled
Docker Release / create-manifest (push) Has been cancelled
Install Smoke / docs-scope (push) Has been cancelled
Install Smoke / install-smoke (push) Has been cancelled
Plugin NPM Release / preview_plugins_npm (push) Has been cancelled
Plugin NPM Release / preview_plugin_pack (push) Has been cancelled
Plugin NPM Release / publish_plugins_npm (push) Has been cancelled
Workflow Sanity / no-tabs (push) Has been cancelled
Workflow Sanity / actionlint (push) Has been cancelled
Workflow Sanity / config-docs-drift (push) Has been cancelled
Stale / stale (push) Has been cancelled
Stale / lock-closed-issues (push) Has been cancelled
2026-03-20 12:45:25 +05:30
ecec0d5b2c
build(android): add play and third-party release flavors
2026-03-20 12:45:25 +05:30
a73e517ae3
build(protocol): regenerate swift talk models
2026-03-20 11:12:53 +05:30
2afd65741c
fix: preserve talk provider and speaking state
2026-03-20 11:08:21 +05:30
47e412bd0b
fix(review): preserve talk directive overrides
2026-03-20 11:01:24 +05:30
4a0341ed03
fix(review): address talk cleanup feedback
2026-03-20 11:01:24 +05:30
4386a0ace8
refactor(android): remove legacy elevenlabs talk stack
2026-03-20 11:01:24 +05:30
e3afaca1a6
refactor(android): route talk playback through gateway
2026-03-20 11:01:24 +05:30
f7fe75a68b
refactor(android): simplify talk config parsing
2026-03-20 11:01:24 +05:30
bfe979dd5b
refactor: add Android LocationHandler test seam ( #50027 ) (thanks @xu-baolin)
2026-03-19 20:57:43 +05:30
c4a4050ce4
fix(macos): align exec command parity ( #50386 )
...
* fix(macos): align exec command parity
* fix(macos): address exec review follow-ups
2026-03-19 13:51:17 +02:00
040c43ae21
feat(android): benchmark script
2026-03-19 13:13:14 +05:30
0443ee82be
fix(android): auto-connect gateway on app open
2026-03-19 12:49:18 +05:30
608b9a9af2
fix(android): show copyable gateway diagnostics
2026-03-19 10:47:12 +05:30
19126033dd
build: regenerate protocol swift models
2026-03-19 03:38:35 +00:00
c86de678f3
feat(android): support android node sms.search ( #48299 )
...
* feat(android): support android node sms.search
* feat(android): support android node sms.search
* fix(android): split sms search permissions
* fix: document android sms.search landing (#48299 ) (thanks @lixuankai)
---------
Co-authored-by: lixuankai <lixuankai@oppo.com >
Co-authored-by: Ayaan Zaidi <hi@obviy.us >
2026-03-19 08:52:15 +05:30
089a43f5e8
fix(security): block build-tool and glibc env injection vectors in host exec sandbox ( #49702 )
...
Add GLIBC_TUNABLES, MAVEN_OPTS, SBT_OPTS, GRADLE_OPTS, ANT_OPTS,
DOTNET_ADDITIONAL_DEPS to blockedKeys and GRADLE_USER_HOME to
blockedOverrideKeys in the host exec security policy.
Closes #22681
2026-03-18 13:11:01 +01:00
ab1da26f4d
fix(macos): show sessions after controls in tray menu ( #38079 )
...
* fix(macos): show sessions after controls in tray menu
When many sessions are active, the injected session rows push the
toggles, action buttons, and settings items off-screen, requiring
a scroll to reach them.
Change findInsertIndex and findNodesInsertIndex to anchor just before
the separator above 'Settings…' instead of before 'Send Heartbeats'.
This ensures the controls section is always immediately visible on
menu open, with sessions appearing below.
* refactor: extract findAnchoredInsertIndex to eliminate duplication
findInsertIndex and findNodesInsertIndex shared identical logic.
Extract into a single private helper so any future anchor change
(e.g. Settings item title) only needs one edit.
* macOS: use structural tray menu anchor
---------
Co-authored-by: Brian Ernesto <bernesto@users.noreply.github.com >
Co-authored-by: ImLukeF <92253590+ImLukeF@users.noreply.github.com >
2026-03-18 11:29:11 +11:00
f84a41dcb8
fix(security): block JVM, Python, and .NET env injection vectors in host exec sandbox ( #49025 )
...
Add JAVA_TOOL_OPTIONS, _JAVA_OPTIONS, JDK_JAVA_OPTIONS, PYTHONBREAKPOINT, and
DOTNET_STARTUP_HOOKS to blockedKeys in the host exec security policy.
Closes #22681
2026-03-17 15:37:55 +01:00
1399ca5fcb
fix(plugins): forward plugin subagent overrides ( #48277 )
...
Merged via squash.
Prepared head SHA: ffa45893e0ea72bc21b48d0ea227253ba207eec0
Co-authored-by: jalehman <550978+jalehman@users.noreply.github.com >
Co-authored-by: jalehman <550978+jalehman@users.noreply.github.com >
Reviewed-by: @jalehman
2026-03-17 07:20:27 -07:00
6b6942552d
fix(macos): stop relaunching the app after quit when launch-at-login is enabled ( #40213 )
...
Merged via squash.
Prepared head SHA: c702d98bd63f4de4059df54f8aaea1ff56c01a34
Co-authored-by: stablegenius49 <259448942+stablegenius49@users.noreply.github.com >
Co-authored-by: ImLukeF <92253590+ImLukeF@users.noreply.github.com >
Reviewed-by: @ImLukeF
2026-03-17 20:59:56 +11:00
7303253427
fix: update macOS node service to use current CLI command shape ( closes #43171 ) ( #46843 )
...
Merged via squash.
Prepared head SHA: dbf2edd6f4fdc89aea865bec631f7a289a4dcbd1
Co-authored-by: Br1an67 <29810238+Br1an67@users.noreply.github.com >
Co-authored-by: ImLukeF <92253590+ImLukeF@users.noreply.github.com >
Reviewed-by: @ImLukeF
2026-03-17 20:46:54 +11:00
0d776c87c3
fix(macos): block canvas symlink escapes
2026-03-16 23:56:35 -07:00
be2e6ca0f6
fix(macos): harden exec approval socket auth
2026-03-16 23:00:22 -07:00
64e412e57e
fix(android): lazy-init node runtime after onboarding
2026-03-16 18:54:51 +05:30
3e360ec8cb
fix(android): shrink chat image attachments
2026-03-16 18:47:09 +05:30
a41be2585f
fix(android): preserve chat message identity on refresh
2026-03-16 18:42:25 +05:30
56e23a887f
fix(android): reduce chat recomposition churn
2026-03-16 18:42:20 +05:30
2a85fa7db1
fix(macos): restore debug build helpers ( #48046 )
2026-03-16 10:57:08 +02:00
d7ac16788e
fix(android): support android node calllog.search ( #44073 )
...
* fix(android): support android node `calllog.search`
* fix(android): support android node calllog.search
* fix(android): wire callLog through shared surfaces
* fix: land Android callLog support (#44073 ) (thanks @lxk7280)
---------
Co-authored-by: lixuankai <lixuankai@oppo.com >
Co-authored-by: Ayaan Zaidi <hi@obviy.us >
2026-03-15 14:54:32 +05:30
8e04d1fe15
macOS: restrict canvas agent actions to trusted surfaces ( #46790 )
...
* macOS: restrict canvas agent actions to trusted surfaces
* Changelog: note trusted macOS canvas actions
* macOS: encode allowed canvas schemes as JSON
2026-03-14 23:26:19 -07:00
37c79f84ba
fix(android): theme popup surfaces
2026-03-15 09:48:08 +05:30
db20141993
feat(android): add dark theme ( #46249 )
...
* Android: add mobile dark theme
* Android: fix remaining dark mode card surfaces
* Android: address dark mode review comments
* fix(android): theme onboarding flow
* fix: add Android dark theme coverage (#46249 ) (thanks @sibbl)
---------
Co-authored-by: Ayaan Zaidi <hi@obviy.us >
2026-03-15 08:35:04 +05:30
Felippe Mercurio