- upgrade Vite, ESLint, React plugin, and related frontend packages to secure versions
- refresh the pnpm lockfile to pull in patched transitive dependencies
- raise the required Node.js version to match the patched toolchain
- update the web README with the new frontend runtime requirement
- delegate root launcher builds to the web Makefile
- add dedicated frontend and dev picoclaw build targets
- document the WebUI architecture, runtime behavior, and build workflow
* docs: document gateway.log_level in all READMEs and i18n configuration docs
Add gateway log level note to Channels section in all 9 READMEs and
add Gateway Log Level section to zh/fr/ja/pt-br/vi configuration docs.
- gateway.log_level (default: fatal) controls log verbosity
- Supported values: debug, info, warn, error, fatal
- Can also be set via PICOCLAW_LOG_LEVEL env var
- English docs/configuration.md already had this section
* fix(docs): correct gateway.log_level default from fatal to warn
DefaultConfig() sets Gateway.LogLevel to "warn", not "fatal".
Update all READMEs and i18n configuration docs to reflect the
actual default value.
---------
Co-authored-by: BeaconCat <BeaconCat@users.noreply.github.com>
The agent path now publishes to outbound bus directly (since #2100),
making the deliver=true direct-to-bus shortcut and the directive type
prompt wrapping redundant. All cron jobs now uniformly route through
the agent. This is an intentional behavior change: old jobs with
deliver=true will execute through the agent instead of bypassing it.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* fix(cron): publish agent response to outbound bus for cron-triggered jobs
When a cron job triggers agent execution via ProcessDirectWithChannel,
the agent response was silently discarded — the code assumed AgentLoop
would auto-publish it, but SendResponse is false on this path.
Delegate to PublishResponseIfNeeded (exported from AgentLoop) so the
response reaches the originating channel (e.g. Telegram) only when the
message tool did not already deliver content in the same round.
Also adds a "directive" message type to CronPayload, allowing cron jobs
to instruct the agent to execute a task rather than echo static text.
* fix(cron): add type validation and directive test coverage
Address reviewer blocking feedback:
1. Server-side whitelist for `type` parameter — the `enum` in
Parameters() is only an LLM schema hint; any string was persisted.
Now `addJob` rejects values other than "message" and "directive".
2. Comprehensive test coverage for the directive code path:
- directive adds prompt prefix to ProcessDirectWithChannel
- deliver=true + directive routes through agent (not direct publish)
- directive prompt content, sessionKey, channel, chatID are correct
- invalid type is rejected; valid types ("", "message", "directive") pass
- deliver=true message type goes directly to bus (regression)
- agent error path does not trigger publish (regression)
Also merge the two UpdateJob calls in addJob into one to avoid
redundant disk I/O (non-blocking suggestion from review).
* fix(cron): remove omitempty from CronPayload.Type for consistent JSON
Empty string and "message" are semantically equivalent defaults;
always serializing the field avoids asymmetric JSON output.
* test(cron): remove redundant test, strengthen error path coverage
- Remove ExecuteJobDirectivePassesCorrectContent: its assertions on
sessionKey/channel/chatID duplicate ExecuteJobPublishesAgentResponse;
its prompt check duplicates DirectiveAddsPromptPrefix.
- Strengthen DirectiveAddsPromptPrefix with exact prompt match and
publish response assertion.
- Fix ReturnsErrorWithoutPublish: set non-empty stub response so the
test verifies the error branch early-return, not the response==""
guard.
* fix(ci): satisfy golines and gosmopolitan in cron code
Add token-based authentication for the Launcher's embedded Web Dashboard.
- Ephemeral token generated in-memory each run (or via PICOCLAW_LAUNCHER_TOKEN env var)
- HMAC-SHA256 session cookie (HttpOnly, SameSite=Lax, Secure when HTTPS)
- Bearer token support for API/script access
- Rate limiting on login (10 attempts/IP/min)
- Referrer-Policy: no-referrer on all responses
- POST-only logout with JSON content-type (CSRF-safe)
- System tray "Copy dashboard token" action
- Login page shows contextual help (console/tray/log file path)
- Path traversal protection via path.Clean
- X-Forwarded-Host/Port/Proto support for reverse proxy deployments
- Full i18n support (English, Chinese)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Unified restart-required detection and notification mechanism so that model, tool, and configuration changes all follow the same signature-based comparison logic.
Migrate Azure OpenAI provider from legacy Chat Completions API to the OpenAI Responses API.
- Switch API endpoint from `/openai/deployments/{deployment}/chat/completions` to `/openai/v1/responses`
- Change auth header from `Api-Key` to `Authorization: Bearer`
- Use `responses.ResponseNewParams` SDK types for request construction
- Extract shared Responses API utilities into `openai_responses_common` package
- Deduplicate 178 lines from codex_provider.go by reusing shared package
- Add 593 lines of comprehensive test coverage for the shared package
Closes#2111
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- loop_test.go: replace undefined WithSecurity/SecurityConfig/ModelSecurityEntry
with direct APIKeys field using SimpleSecureStrings()
- dingtalk_test.go: use ClientSecret.String() and ClientSecret.Set()
instead of non-existent ClientSecret() and SetClientSecret() methods
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Add README.my.md (full Malay translation from English, including
macOS guide, MiMo provider, unified WeCom row, all sections)
- Add docs/my/ (chat-apps, configuration, debug, docker, spawn-tasks,
troubleshooting) from upstream PR #1770
- Add [Malay](README.my.md) language link to all 8 existing READMEs
- Add v0.2.4 news entry to all 9 READMEs (en/zh/fr/ja/pt-br/vi/id/it/my)
- Move 2026-02-26 20K Stars entry into Earlier news in all READMEs
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(dingtalk): honor @mention flag in mention-only groups
* fix(dingtalk): strip leading mentions in group payloads
---------
Co-authored-by: Alix-007 <267018309+Alix-007@users.noreply.github.com>
- Rewrite docs/channels/wecom/README.md and README.zh.md with unified
3-option setup guide (Web UI QR / CLI QR / manual config), full config
table with defaults and env vars, runtime behavior details, and
migration notes from legacy wecom_bot/wecom_app/wecom_aibot
- Add assets/wecom-qr-binding.jpg screenshot for Web UI QR binding flow
- Remove obsolete docs/channels/wecom/wecom_bot/, wecom_app/, wecom_aibot/
subdirectories (18 files, all language variants)
- Update Channels table in all 8 READMEs: replace 3 legacy WeCom rows
with single unified WeCom row; zh README links to README.zh.md,
others link to README.md
- Add Xiaomi MiMo (mimo/) to Providers table in all 8 READMEs
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Add comprehensive documentation for PicoClaw configuration, chat applications, debugging, Docker setup, async tasks, and troubleshooting on MY language:
- Introduced a new document on MY language for chat applications configuration detailing setup for Telegram, Discord, WhatsApp, and others.
- Created a configuration guide on MY language outlining environment variables, workspace structure, and security settings.
- Added a debugging section to assist users in troubleshooting and understanding agent interactions on MY language.
- Provided a Docker guide on MY language for easy deployment using Docker Compose.
- Documented the use of spawn on MY language for asynchronous tasks and how to configure heartbeat settings.
- Included a troubleshooting section on MY language for common model-related errors.
* docs: add Malay language support to documentation
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Add a collapsible macOS security warning guide under the WebUI Launcher
section in all 8 README languages (en/zh/fr/ja/pt-br/vi/id/it).
- New assets: macos-gatekeeper-warning.jpg, macos-gatekeeper-allow.jpg
- Updated asset: launcher-tui.jpg
- Two-step guide: shows Gatekeeper warning screenshot, then
Privacy & Security → Open Anyway flow
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* docs: update WeChat QR code and TUI launcher screenshot
* docs: convert launcher-tui.jpg from PNG to proper JPEG format
---------
Co-authored-by: BeaconCat <BeaconCat@users.noreply.github.com>
## Summary
- Add zai-coding to Providers table
- Add Z.AI Coding Plan to All Supported Vendors table
- Add Z.AI Coding Plan configuration example with troubleshooting note
