Mason Huang 83d7ab0d36 fix(changelog): reject bot/app handles as Thanks attribution and require explicit human credit (#81357) ...

Summary:
- The PR expands forbidden changelog `Thanks` attribution rules for bot/app handles, shares the Node predicate ... ngelog gate, requires explicit human credit for bot/app-authored changelog entries, and adds focused tests.
- Reproducibility: yes. Current main source shows bot/app changelog authors can skip human attribution and bot/app `Thanks` handles are not all rejected; I did not execute tests because this review was read-only.

Automerge notes:
- PR branch already contained follow-up commit before automerge: fix: simplify bot changelog credit guard
- PR branch already contained follow-up commit before automerge: fix: share changelog credit attribution rule
- PR branch already contained follow-up commit before automerge: fix: tighten changelog attribution scanning
- PR branch already contained follow-up commit before automerge: test: cover legacy changelog credit exclusions
- PR branch already contained follow-up commit before automerge: fix: express changelog credit exclusions as union sets
- PR branch already contained follow-up commit before automerge: fix: avoid substring changelog credit exclusions

Validation:
- ClawSweeper review passed for head 1e6d0f53ec.
- Required merge gates passed before the squash merge.

Prepared head SHA: 1e6d0f53ec
Review: https://github.com/openclaw/openclaw/pull/81357#issuecomment-4439359411

Co-authored-by: Mason Huang <masonxhuang@tencent.com>
Co-authored-by: clawsweeper <274271284+clawsweeper[bot]@users.noreply.github.com>

2026-05-14 15:04:43 +00:00

..

clawdock

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00

dev

feat: add realtime voice OAuth controls

2026-05-10 00:13:23 -04:00

docker

fix(docker): pin setup cli container paths

2026-05-13 14:13:57 +01:00

docs-i18n

fix(release): stabilize Codex live validation

2026-05-09 23:25:26 +01:00

e2e

fix(channels): preserve Telegram ordering without blocking follow-ups

2026-05-14 12:19:02 +08:00

github

perf(gateway): cache session list resolver lookups

2026-05-13 23:20:40 -05:00

k8s

…

lib

Remove codex-cli backend and migrate to Codex runtime

2026-05-14 10:07:18 +01:00

mantis

ci(mantis): render proof media responsively

2026-05-11 20:08:02 +05:30

perf

perf: cache pi model discovery

2026-05-14 00:13:29 +01:00

podman

…

pr-lib

fix(changelog): reject bot/app handles as Thanks attribution and require explicit human credit (#81357)

2026-05-14 15:04:43 +00:00

pre-commit

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00

repro

…

systemd

…

test-planner

…

AGENTS.md

…

analyze-plugin-sdk-usage.ts

…

anthropic-prompt-probe.ts

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00

audit-seams.mjs

…

auth-monitor.sh

…

bench-cli-startup.ts

perf(cli): route plugin list json directly

2026-05-14 16:29:21 +08:00

bench-gateway-startup.ts

…

bench-model.ts

build: refresh deps and route testbox through crabbox

2026-05-11 03:41:00 +01:00

bench-test-changed.mjs

…

build_icon.sh

…

build-all.mjs

Fix Node 26 build deprecation warnings

2026-05-11 18:44:29 +01:00

build-and-run-mac.sh

…

build-docs-list.mjs

…

build-stamp.d.mts

…

build-stamp.mjs

…

bundle-a2ui.mjs

refactor: move canvas to plugin surfaces

2026-05-07 09:07:18 +01:00

bundle-a2ui.sh

…

bundled-plugin-assets.mjs

refactor: move canvas to plugin surfaces

2026-05-07 09:07:18 +01:00

changed-lanes.mjs

…

changelog-add-unreleased.ts

…

changelog-to-html.sh

…

check-architecture-smells.mjs

build: enable additional oxlint rules

2026-05-11 03:56:34 +01:00

check-changed.mjs

ci: block new package patches

2026-05-14 07:57:59 +01:00

check-changelog-attributions.mjs

fix(changelog): reject bot/app handles as Thanks attribution and require explicit human credit (#81357)

2026-05-14 15:04:43 +00:00

check-channel-agnostic-boundaries.mjs

chore(channels): remove bluebubbles bundled surface

2026-05-07 12:52:48 -07:00

check-cli-bootstrap-imports.mjs

…

check-cli-startup-memory.mjs

…

check-codex-app-server-protocol.ts

fix codex harness service tiers (#79152)

2026-05-08 12:10:41 +09:00

check-composite-action-input-interpolation.py

…

check-deadcode-unused-files.mjs

…

check-dependency-pins.mjs

fix(ci): read sparse package manifests from index

2026-05-14 13:11:42 +08:00

check-deprecated-api-usage.mjs

refactor: consolidate message delivery API

2026-05-09 07:04:04 +01:00

check-deprecated-jsdoc.mjs

…

check-docker-e2e-boundaries.mjs

fix(gateway): preserve batched client tool calls

2026-05-11 13:06:05 +01:00

check-docs-i18n-glossary.mjs

…

check-docs-mdx.mjs

…

check-duplicates.mjs

…

check-dynamic-import-warts.mjs

…

check-extension-package-tsc-boundary.mjs

…

check-extension-plugin-sdk-boundary.mjs

build: enable additional oxlint rules

2026-05-11 03:56:34 +01:00

check-extension-wildcard-reexports.mjs

…

check-file-utils.ts

…

check-gateway-cpu-scenarios.mjs

…

check-gateway-watch-regression.mjs

…

check-import-cycles.ts

…

check-ingress-agent-owner-context.mjs

…

check-live-cache.ts

ci: exit live cache release smoke cleanly

2026-05-11 02:08:58 +01:00

check-madge-import-cycles.ts

…

check-media-download-helper-roundtrip.mjs

refactor(media): centralize bounded remote downloads

2026-05-13 15:04:49 +01:00

check-no-conflict-markers.mjs

…

check-no-deprecated-channel-access.ts

refactor: centralize channel ingress access

2026-05-10 00:18:36 -04:00

check-no-extension-src-imports.ts

…

check-no-extension-test-core-imports.ts

…

check-no-monolithic-plugin-sdk-entry-imports.ts

…

check-no-pairing-store-group-auth.mjs

refactor: centralize channel ingress access

2026-05-10 00:18:36 -04:00

check-no-random-messaging-tmp.mjs

…

check-no-raw-channel-fetch.mjs

chore(channels): remove bluebubbles bundled surface

2026-05-07 12:52:48 -07:00

check-no-raw-http2-imports.mjs

…

check-no-raw-window-open.mjs

…

check-no-register-http-handler.mjs

…

check-no-runtime-action-load-config.mjs

…

check-openclaw-package-tarball.mjs

…

check-package-dist-imports.mjs

…

check-package-patches.mjs

ci: block new package patches

2026-05-14 07:57:59 +01:00

check-pairing-account-scope.mjs

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00

check-plugin-extension-import-boundary.mjs

build: enable additional oxlint rules

2026-05-11 03:56:34 +01:00

check-plugin-gateway-gauntlet.mjs

…

check-plugin-npm-runtime-builds.mjs

…

check-plugin-sdk-exports.mjs

…

check-plugin-sdk-subpath-exports.mjs

…

check-plugin-sdk-wildcard-reexports.mjs

…

check-release-metadata-only.mjs

…

check-runtime-sidecar-loaders.mjs

…

check-sdk-package-extension-import-boundary.mjs

…

check-src-extension-import-boundary.mjs

…

check-temp-path-guardrails.ts

…

check-test-helper-extension-import-boundary.mjs

…

check-timed.mjs

…

check-ts-max-loc.ts

…

check-tsgo-core-boundary.mjs

…

check-web-fetch-provider-boundaries.mjs

build: enable additional oxlint rules

2026-05-11 03:56:34 +01:00

check-web-search-provider-boundaries.mjs

build: enable additional oxlint rules

2026-05-11 03:56:34 +01:00

check-webhook-auth-body-order.mjs

chore(channels): remove bluebubbles bundled surface

2026-05-07 12:52:48 -07:00

check-workflows.mjs

…

check.mjs

ci: block new package patches

2026-05-14 07:57:59 +01:00

ci-changed-scope.d.mts

…

ci-changed-scope.mjs

chore(installer): remove legacy cmd installer

2026-05-10 06:59:33 +01:00

ci-docker-pull-retry.sh

…

ci-hydrate-live-auth.sh

…

ci-hydrate-testbox-env.sh

…

ci-live-command-retry.sh

…

ci-run-timings.mjs

refactor: move canvas to plugin surfaces

2026-05-07 09:07:18 +01:00

claude-auth-status.sh

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00

CLAUDE.md

…

clawlog.sh

…

clawtributors-map.json

…

close-duplicate-prs-after-merge.mjs

…

codesign-mac-app.sh

…

codespell-dictionary.txt

…

codespell-ignore.txt

…

committer

…

control-ui-i18n-report.ts

fix(ui): avoid noisy i18n report locale warnings

2026-05-14 10:27:12 +01:00

control-ui-i18n.ts

fix(ci): skip locale refresh on invalid provider auth

2026-05-14 14:13:39 +08:00

copy-bundled-plugin-metadata.d.mts

…

copy-bundled-plugin-metadata.mjs

fix: skip metadata for build-excluded bundled plugins

2026-05-12 07:51:11 +01:00

copy-export-html-templates.ts

…

copy-hook-metadata.ts

…

copy-plugin-sdk-root-alias.mjs

…

crabbox-wrapper.mjs

…

create-dmg.sh

…

cron_usage_report.ts

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00

deadcode-unused-files.allowlist.mjs

fix(ci): refresh stale metadata ownership

2026-05-13 14:59:47 +01:00

debug-claude-usage.ts

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00

dependency-changes-report.mjs

Add dependency release safety evidence and PR awareness (#81325)

2026-05-13 03:05:09 -05:00

dependency-ownership-surface-report.mjs

Add dependency release safety evidence and PR awareness (#81325)

2026-05-13 03:05:09 -05:00

dependency-vulnerability-gate.mjs

Add dependency release safety evidence and PR awareness (#81325)

2026-05-13 03:05:09 -05:00

docker-e2e-rerun.mjs

…

docker-e2e-timings.mjs

…

docker-e2e.mjs

…

docs-link-audit.d.mts

…

docs-link-audit.mjs

docs: add dedicated ClawHub docs tab (#79159)

2026-05-07 18:55:08 -07:00

docs-list.js

…

docs-spellcheck.sh

…

docs-sync-publish.mjs

docs: keep qa broker notes internal

2026-05-08 06:01:23 +01:00

embedded-run-abort-leak.ts

…

firecrawl-compare.ts

…

format-docs.mjs

refactor: centralize channel ingress access

2026-05-10 00:18:36 -04:00

full-release-validation-at-sha.mjs

…

gateway-watch-tmux.d.mts

…

gateway-watch-tmux.mjs

…

generate-base-config-schema.ts

fix: use pathToFileURL for Windows path comparison in generate-base-config-schema

2026-05-11 00:09:35 -05:00

generate-bundled-channel-config-metadata.ts

…

generate-bundled-provider-auth-env-vars.d.mts

…

generate-config-doc-baseline.ts

…

generate-dependency-release-evidence.mjs

Add dependency release safety evidence and PR awareness (#81325)

2026-05-13 03:05:09 -05:00

generate-host-env-security-policy-swift.mjs

…

generate-plugin-inventory-doc.mjs

docs: consolidate plugin install docs (#81167)

2026-05-13 13:17:39 -07:00

generate-plugin-sdk-api-baseline.ts

…

generate-prompt-snapshots.ts

…

generate-runtime-sidecar-paths-baseline.ts

…

generate-secretref-credential-matrix.ts

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00

gh-read

…

gh-read.ts

…

ghsa-patch.mjs

…

install-cli.sh

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00

install-discord-native-opus.mjs

fix(discord): make native opus opt-in

2026-05-10 08:17:00 +01:00

install.ps1

fix(install): don't abort install.ps1 when git writes to stderr (#80834)

2026-05-12 17:26:30 -07:00

install.sh

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00

ios-asc-keychain-setup.sh

…

ios-beta-archive.sh

…

ios-beta-prepare.sh

…

ios-beta-release.sh

…

ios-configure-signing.sh

…

ios-pin-version.ts

…

ios-sync-versioning.ts

…

ios-team-id.sh

…

ios-version.ts

…

ios-write-version-xcconfig.sh

…

kova-ci-summary.mjs

…

label-open-issues.ts

…

live-docker-normalize-config.ts

…

load-channel-config-surface.ts

…

make_appcast.sh

…

mobile-reauth.sh

…

notarize-mac-artifact.sh

…

npm-runner.mjs

…

openclaw-cross-os-release-checks.ts

ci: speed up release validation reruns

2026-05-11 00:22:19 +01:00

openclaw-npm-postpublish-verify.ts

ci: forward-port release validation fixes

2026-05-10 20:38:36 +01:00

openclaw-npm-publish.sh

…

openclaw-npm-release-check.ts

…

openclaw-performance-source-summary.mjs

…

openclaw-prepack.ts

…

package-mac-app.sh

build: refresh deps and route testbox through crabbox

2026-05-11 03:41:00 +01:00

package-mac-dist.sh

…

package-openclaw-for-docker.mjs

…

plan-targeted-docker-lane-groups.mjs

…

plugin-boundary-report.ts

…

plugin-clawhub-owner-preflight.ts

…

plugin-clawhub-publish.sh

…

plugin-clawhub-release-check.ts

…

plugin-clawhub-release-plan.ts

…

plugin-npm-publish.sh

…

plugin-npm-release-check.ts

…

plugin-npm-release-plan.ts

…

plugin-prerelease-liveish-matrix.mjs

…

plugin-sdk-surface-report.mjs

test: fix plugin sdk deprecation guardrails

2026-05-10 12:37:10 +01:00

pnpm-runner.d.ts

…

pnpm-runner.mjs

…

postinstall-bundled-plugins.mjs

build(deps): refresh workspace dependencies

2026-05-10 14:00:08 +01:00

pr

…

pr-merge

…

pr-prepare

…

pr-review

…

preinstall-package-manager-warning.mjs

…

prepare-codex-ci-auth.ts

…

prepare-codex-ci-config.ts

…

prepare-extension-package-boundary-artifacts.mjs

…

prepush-ci.sh

refactor: move canvas to plugin surfaces

2026-05-07 09:07:18 +01:00

print-cli-backend-live-metadata.ts

Remove codex-cli backend and migrate to Codex runtime

2026-05-14 10:07:18 +01:00

process-warning-filter.mjs

…

profile-extension-memory.mjs

…

profile-tsgo.mjs

…

protocol-gen-swift.ts

feat(plugin-sdk): consolidate session workflow APIs

2026-05-11 03:24:08 +01:00

protocol-gen.ts

…

proxy-install-ca.mjs

…

prune-docker-plugin-dist.d.mts

…

prune-docker-plugin-dist.mjs

…

qa-coverage-report.ts

…

qa-e2e.ts

…

qa-lab-up.ts

…

qa-otel-smoke.ts

…

qa-parity-report.ts

…

readability-basic-compare.ts

…

recover-orphaned-processes.sh

…

release-beta-smoke.ts

…

release-check.ts

fix telegram ingress worker dist entry

2026-05-14 04:55:39 -05:00

release-fast-pretag-check.sh

fix: keep release fast pretag check branch-safe

2026-05-12 06:21:10 +01:00

release-preflight.mjs

ci(release): speed up beta publish path

2026-05-07 15:02:24 +01:00

release-verify-beta.ts

ci: speed up beta release verification

2026-05-12 06:21:09 +01:00

resolve-openclaw-package-candidate.mjs

ci: speed up release validation reruns

2026-05-11 00:22:19 +01:00

resolve-upgrade-survivor-baselines.mjs

…

restart-mac.sh

refactor: move canvas to plugin surfaces

2026-05-07 09:07:18 +01:00

root-dependency-ownership-audit.mjs

…

rtt.ts

…

run-additional-boundary-checks.mjs

lint: replace raw socket guard with codeql

2026-05-08 01:18:04 +10:00

run-bundled-extension-oxlint.mjs

…

run-extension-channel-oxlint.mjs

…

run-node-watch-paths.mjs

refactor: move canvas to plugin surfaces

2026-05-07 09:07:18 +01:00

run-node.d.mts

…

run-node.mjs

fix(gateway): check restored runtime overlays

2026-05-09 19:31:51 -04:00

run-openclaw-podman.sh

…

run-opengrep.sh

ci: skip symlinks in opengrep changed scan (#79930)

2026-05-10 01:40:56 -04:00

run-oxlint-shards.mjs

…

run-oxlint.mjs

…

run-tsgo.mjs

…

run-vitest-profile.mjs

…

run-vitest.mjs

…

runtime-postbuild-shared.mjs

…

runtime-postbuild-stamp.mjs

…

runtime-postbuild.mjs

fix: keep legacy lazy chunks importable after updates (#80478)

2026-05-11 02:10:19 +01:00

sandbox-browser-entrypoint.sh

Require auth for sandbox browser CDP relay [AI] (#81002)

2026-05-12 19:37:32 +05:30

sandbox-browser-setup.sh

…

sandbox-common-setup.sh

…

sandbox-setup.sh

…

setup-auth-system.sh

…

sparkle-build.ts

…

sqlite-vec-smoke.mjs

…

stage-bundled-plugin-runtime.d.mts

…

stage-bundled-plugin-runtime.mjs

…

sync-codex-app-server-protocol.ts

refactor: move canvas to plugin surfaces

2026-05-07 09:07:18 +01:00

sync-codex-model-prompt-fixture.ts

…

sync-labels.ts

…

sync-moonshot-docs.ts

…

sync-plugin-sdk-exports.mjs

…

sync-plugin-versions.ts

…

termux-auth-widget.sh

…

termux-quick-auth.sh

…

termux-sync-widget.sh

…

test-built-bundled-channel-entry-smoke.mjs

…

test-built-plugin-singleton.mjs

…

test-built-status-message-runtime.mjs

…

test-cleanup-docker.sh

…

test-cli-startup-bench-budget.mjs

test(cli): add response-time contract for CLI surfaces

2026-05-10 23:06:28 +08:00

test-docker-all.mjs

fix(gateway): preserve batched client tool calls

2026-05-11 13:06:05 +01:00

test-docker-all.sh

…

test-extension-batch.mjs

…

test-extension.mjs

…

test-force.ts

…

test-group-report.mjs

…

test-hotspots.mjs

…

test-install-sh-docker.sh

…

test-install-sh-e2e-docker.sh

ci: tighten release publish timeouts

2026-05-10 15:55:24 +01:00

test-live-acp-bind-docker.sh

ci: avoid pnpm prompts in live docker tests

2026-05-13 03:46:33 +01:00

test-live-build-docker.sh

…

test-live-cli-backend-docker.sh

Remove codex-cli backend and migrate to Codex runtime

2026-05-14 10:07:18 +01:00

test-live-codex-harness-docker.sh

ci: avoid pnpm prompts in live docker tests

2026-05-13 03:46:33 +01:00

test-live-gateway-models-docker.sh

ci: avoid pnpm prompts in live docker tests

2026-05-13 03:46:33 +01:00

test-live-media.ts

…

test-live-models-docker.sh

ci: avoid pnpm prompts in live docker tests

2026-05-13 03:46:33 +01:00

test-live-shard.mjs

…

test-live-subagent-announce-docker.sh

test: add docker live subagent announce proof

2026-05-13 15:21:37 +01:00

test-live.mjs

fix: make codex harness live test portable

2026-05-13 08:16:47 +01:00

test-perf-budget.mjs

…

test-projects.mjs

…

test-projects.test-support.d.mts

…

test-projects.test-support.mjs

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00

test-report-utils.mjs

…

test-shell-completion.ts

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00

test-unit-fast-audit.mjs

…

test-update-cli-startup-bench.mjs

…

test-voicecall-closedloop.mjs

…

tool-display.ts

…

tool-search-gateway-e2e.ts

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00

transitive-manifest-risk-report.mjs

Add dependency release safety evidence and PR awareness (#81325)

2026-05-13 03:05:09 -05:00

ts-topology.ts

…

tsconfig.json

…

tsdown-build.mjs

fix(codex): remove dynamic tools profile option

2026-05-09 21:34:33 -07:00

ui.js

fix(scripts): avoid DEP0190 when spawning .cmd files on Windows

2026-05-08 18:45:20 -05:00

update-clawtributors.ts

…

update-clawtributors.types.ts

…

verify-docker-attestations.mjs

fix(release): stabilize final validation checks

2026-05-06 10:45:29 +01:00

verify-plugin-npm-published-runtime.mjs

…

vitest-process-group.mjs

…

watch-node.d.mts

…

watch-node.mjs

fix: keep gateway watch sync tracing opt-in (#79110)

2026-05-07 16:40:35 -07:00

windows-cmd-helpers.mjs

…

write-build-info.ts

…

write-cli-compat.ts

…

write-cli-startup-metadata.ts

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00

write-official-channel-catalog.d.mts

…

write-official-channel-catalog.mjs

…

write-package-dist-inventory.ts

…

write-plugin-sdk-entry-dts.ts

…

zai-fallback-repro.ts

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00