v2.6.0: address 14 OpenClaw audit findings - #21
Merged
Conversation
added 3 commits
April 21, 2026 00:01
Captures the style used for v2.5.1: release title is the version number alone, body is one or two sentences plus a link to the matching CHANGELOG section rather than a duplicated dump. Example included.
Response to the external v2.5.1 smoke-test report. Fourteen findings grouped into three severity tiers — all in one minor bump. P0 (correctness): - param-validator covers setBrightness (int 1-100), setColor (rgb/hex/ named), and Curtain setPosition single-value form (B-1). - unknown deviceId in 'devices command' exits 2 by default with a candidate list; --allow-unknown-device restores pass-through (B-3). - capabilities.subcommands[] leaves carry per-command meta, and a flat commandMeta path-lookup is published at the top level (B-4). - 'devices commands <type...>' is truly variadic now — 'Bot Curtain' prints both sections, multi-word unquoted form still works (B-7). - setColor accepts R:G:B, R,G,B, #RRGGBB, #RGB, and 16 CSS named colors; all normalize to R:G:B before hitting the API (B-12). P1 (usability): - '--filter key!=value' (neq) across list/batch/events tail. Substring by default; exact for 'category' (B-5). - getFlagValue recognizes '--flag=value' everywhere (was silently dropped for --format/--timeout/--config/--fields/…) (B-6). - catalog list alias for show; catalog search <keyword> fuzzy match (B-8). - capabilities --used filters per-type summary to locally-cached devices (B-9). - 'scenes describe <unknown>' plaintext branch renders 'Did you mean: …?' candidates (JSON branch already did) (B-10). P2 (robustness): - --retry-on-5xx <n> (default 2) transparently retries 502/503/504 and request timeouts on idempotent GETs. Mutating calls never auto-retry (B-11). - All terminal error paths route through emitJsonError/handleError so --format=json failures are always parseable (B-14). - Ambiguous --name hint names both --name-strategy=fuzzy and =first (B-15). - Empty results under --table-style markdown render as _(empty)_ rather than a header-only skeleton (B-16). Soft-breaking (flagged in CHANGELOG): - Invalid setBrightness/setColor/setPosition now exit 2 before the network call. --skip-param-validation is the narrow escape hatch. - Unknown deviceId exits 2 by default. --allow-unknown-device restores pass-through. Rejected / deferred: - B-2 (MCP error envelope) and B-13 (expand scope) are reviewer errors — current behavior is correct; README / plan note the rationale. - B-17 / B-18 / B-19 / B-21 are v3.x track (roadmap in README). - B-20 full rollout deferred; this minor only seeds humanHint in the two validators it touches.
- package.json / package-lock.json: 2.5.1 → 2.6.0. - CHANGELOG: v2.6.0 entry — Added/Fixed/Changed, with the two soft-breaking defaults (stricter param validation, unknown-deviceId gate) called out under Changed. - README: != operator row in the per-command filter table; updated parameter-validation paragraph to cover setBrightness / setColor / setPosition and the new escape hatches; catalog list/search; capabilities --used; devices expand scope clarification; Roadmap section for the v3.x track (B-17/18/19/21 parked there).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Response to the external v2.5.1 smoke-test report (OpenClaw, 1016 cases,
96.8% pass). 14 of the 21 findings fixed in one minor bump; 2 reviewer
errors declined with rationale; 4 P3 items (daemon, standalone
npxMCP package,
self-test, record/replay) parked on the v3.x roadmap.setBrightness/setColor/ CurtainsetPosition(B-1); unknowndeviceIdexits 2by default with
--allow-unknown-deviceescape hatch (B-3);capabilitiessubcommand leaves carrycommandMetaand a flatpath-lookup is published at the top (B-4);
devices commands <type...>is truly variadic (B-7);
setColoraccepts rgb/hex/named colors (B-12).--filter key!=value(B-5);--flag=valueequals form recognized everywhere (B-6);
catalog list/catalog search(B-8);capabilities --used(B-9);scenes describeplaintextrenders candidates (B-10).
--retry-on-5xx <n>for idempotent GETs (B-11);every terminal error routes through
emitJsonError/handleErrorso--format=jsonfailures stay parseable (B-14); ambiguous--namehintnames both strategies (B-15);
--table-style markdownempty rowsrender as
_(empty)_(B-16).Two soft-breaking defaults — invalid params now exit 2 pre-network, and
unknown
deviceIdno longer passes through silently — are called outin the
### Changedsection of the CHANGELOG along with their escapehatches (
--skip-param-validation,--allow-unknown-device).Full details: CHANGELOG entry for 2.6.0.
Test plan
npm run build:prod— cleannpm test— 985/985 pass (up from 959)bash tmp/canary/par.sh— 50-concurrent real-API smoke (needs live token; run before tag)--dry-run setBrightness 101→ rc=2--dry-run setColor "#FF0000"→ rc=0, normalized255:0:0--dry-run turnOn ZZZZ000000ZZ→ rc=2 + candidates… ZZZZ000000ZZ turnOn --allow-unknown-device→ rc=0--filter "type!=Meter" --format=json--format=json devices listdevices commands Bot Curtain→ two sectionscatalog list/catalog search Hubcapabilities --used --format=jsonscenes describe ZZZ→ plaintextDid you mean: …