Preserve structured provider catalogs beyond the lifecycle log capture limit so the cloud machine picker shows CPU/RAM and all available classes again. Keep lifecycle output limits and machine selection unchanged.
Fixes#130660.
Keep raw recovery keys in explicitly opted-in JSON output. Add a safe text
hint in the CLI-owned result renderer, remove duplicated stored-key output,
and cover normal, verbose, missing-key and JSON command behavior.
Thanks @hartmark for the original fix and real-account reproduction.
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(github-copilot): preserve catalog thinking efforts in requests
Unify discovered and bundled capability mapping with the provider thinking policy. Preserve supported xhigh/max Responses efforts and map minimal to the supported low minimum, while respecting explicit account opt-outs and transport limits.
Fixes#107792
Co-authored-by: Pluviobyte <Pluviobyte@users.noreply.github.com>
* fix(github-copilot): resolve nullable thinking policy transport
Accept the public policy API context and resolve missing transports before enforcing Claude and Gemini effort restrictions. Cover undefined and null API values without changing explicit Responses routes.
* refactor(github-copilot): normalize manifest models as one catalog
Use the canonical batch model provider builder after the single-row helper was removed on main. Preserve model transport and compatibility decoration without a legacy API shim.
* refactor(github-copilot): decorate owned catalog rows in place
Keep the normalized manifest batch as the sole owner of runtime rows and apply transport metadata directly, avoiding redundant row copies.
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
Co-authored-by: Pluviobyte <Pluviobyte@users.noreply.github.com>
* feat(channels): introduce bots when they join group rooms
* feat(channels): add Discord and Telegram join introductions
* fix(channels): isolate untrusted evidence and select allowed join targets
* refactor(channels): scope joinIntro to implementing channels
* fix(channels): keep a delivered join introduction settled when its durable commit fails
* feat(channels): read more room history and document join introductions in detail
* chore(config): regenerate bundled channel metadata after rebase
* fix(codex): reclaim binding ownership when sessions are deleted
Prepare harness deletion outside the SQLite writer and compare-delete exact companion ownership at the session removal edge, with compensation before commit and native subscription release afterward. Preserve live siblings and upstream native history. Repair proven orphan bindings through the existing Doctor planner under maintenance ownership.
* fix(codex): reuse prepared auth for resumed thread ownership
* docs(plugins): clarify shared migration and auth contracts
* test(codex): use the canonical config type facade
* fix(codex): preserve native threads during manual resume
Record pending attachment intent and validate the immutable native tool catalog
before applying configuration to the selected thread. Require uninterrupted
physical-client ownership through native unsubscribe, resume, and binding commit.
Keep the thread intact on unsupported policy, competing work, or failed proof.
Reuse canonical retained-owner cleanup and preserve unsafe-client retirement.
Cover the real command producer, cold and loaded resumes, competing leases,
lazy-store commit fencing, and the Gateway competing-owner path.
* test: isolate Codex auth and session completion fixtures
* fix(memory): isolate sqlite-vec KNN in subprocess
* fix(memory): satisfy KNN subprocess CI guards
* test(release): include memory KNN child artifact
* test(memory): update KNN subprocess fixtures
* fix(memory): bound KNN child row payloads
* fix(memory): preserve published readers during cancellable KNN
Keep shadow reindex database, vector readiness, FTS and metadata state in
an owned async context. Public operations retain the published connection,
and escaped shadow continuations cannot write to it after rebuild closes.
Terminate the one-shot query child through its owned handle and retain
admission until close. Remove process-tree/PID probing and test-only hooks.
Cover publication overlap, callback reads, cancellation and recovery.
Co-authored-by: OpenClaw Assistant <assistant@openclaw.local>
* refactor(memory): separate database context ownership
Keep the published reader and shadow writer context in its own owner module. Repair plugin test imports and typed lint findings without changing the verified KNN behavior.
---------
Co-authored-by: OpenClaw Assistant <assistant@openclaw.local>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
Treat LIKE fallback as recall-only so memory search no longer reports false perfect scores. Carry the body-match fact through keyword and hybrid ranking to preserve lexical ordering, including exact path tiers.
Co-authored-by: SunnyShu0925 <shu.zongyu@xydigit.com>
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
Make ask_user use native Telegram controls when one single-select question can be represented directly, while keeping multi-select and batch questions on the text fallback. Add native Other-to-ForceReply input, preserve Gateway-owned option ordering across Telegram, Slack, and Discord, and prevent later progress from overwriting the delivered question.
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
Reuse the existing receipt aggregation owner for Slack action fanout and preserve every accepted message ID across media, presentation segments, and nested text chunks. Retain single-message shape, legacy scalar fields, thread placement, and question-card identity.
Fixes#130604
* feat(buzz): retain bounded passive context for accepted turns
Add opt-in connection-owned room and thread context using the shared history window. Preserve sender admission, current roster filtering, UTF-8 bounds, and snapshot consumption without passive inference, session recording, or typing. Related: #129599.
* docs(config): align baseline with landed Feishu sticker sets
Reuse the canonical settlement owner for boundary helpers, reject truncated verification JSON, and preserve complete live output streams.
Co-authored-by: Peter Steinberger <steipete@gmail.com>
Use the shared per-Gateway bot-pair budget with the latest received signed room roles. Preserve existing sender and mention admission and human traffic. Release note: bound repeated Buzz bot exchanges without adding a channel-specific policy or persistent state.
Keep one-message replacements whole through existing rich-to-plain recovery instead of selecting only the first send page. Preserve send pagination, preview clamping, and visible oversized-edit failures.
Fixes#130525
* feat(feishu): search configured received stickers by keyword
Bind curated sticker sets to the selected bot app ID and reuse the existing sticker action gate and native sender. Enforce matching scalar bounds in runtime and generated config schemas, with bounded search output and explicit truncation. Completes the configurable-set request in #114578.
* refactor(feishu): keep sticker schemas with config owner
* build(feishu): regenerate catalog metadata after channel schema update
* fix(discord): surface interaction handler failures instead of leaving a spinner
A command handler that threw after deferring left Discord showing a
spinner forever; the failure only reached the Gateway log.
Dispatch now reports a best-effort failure notice before rethrowing, but
only where a spinner is known to exist: responseState 'deferred' with no
follow-up already sent. 'deferred-update' is excluded because the
interaction's original response is the message a component is attached
to, and editing it would overwrite content the user is reading.
'unacknowledged' is excluded because a second initial callback risks
'already acknowledged' and Discord shows its own notice. 'replied' is
excluded because nextReplyAction() would turn the notice into a
contradictory follow-up.
The notice sets allowed_mentions.parse to empty so an exception message
containing @everyone cannot ping the channel.
* fix(discord): report a generic notice instead of the handler exception text
An interaction response is visible to the whole channel, and handler
exceptions routinely carry absolute paths, config keys, and provider
responses. Send fixed text and leave the detail in the Gateway log, which
also removes the mention-injection source rather than only escaping it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix(discord): re-check follow-up delivery inside the response queue
hasSentFollowUp is only set once the follow-up REST call resolves, so a
follow-up still in flight when the handler throws left the reporter
deciding against state that was about to change. Move the guard into a
queued operation that re-reads both the response state and follow-up
delivery, so any in-flight follow-up settles and records itself first.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---------
Co-authored-by: Marvinthebored <peter@lindsey.jp>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* refactor(plugins): derive private config types from schemas
* test(ci): make directory binding proof deterministic
Replace race-prone child-cwd polling with a synchronous fixture retarget after the real chdir, preserving the full worker and security assertions. Shrink the assertion-safety baseline for the three casts removed by the schema cleanup.
* fix(channels): bundled channels reject the documented responsePrefix override
* fix(feishu): pass channel and account to the reply prefix resolver
The ordinary reply dispatcher built the prefix context without channel or
accountId, so channels.feishu.responsePrefix and its account override fell
through to the global value. The comment dispatcher already passed them.
* fix(channels): accept twitch's root responsePrefix and type ClickClack's
Twitch validates as a two-branch union with both branches closed, so
responsePrefix declared only on the account shape left
channels.twitch.responsePrefix rejected whenever accounts is present. Also
declares responsePrefix on ClickClackAccountConfig so typed callers can express
what its schema already accepts.
* fix(clickclack): apply the configured responsePrefix in model mode
Model mode sends the completion straight to ClickClack instead of going through
the agent reply pipeline, so the documented responsePrefix parsed and then did
nothing. Resolve it through the public reply-pipeline seam so template
variables like {model} render from the completion's own provider and model.
* fix(clickclack): do not double the response prefix in model mode
systemPrompt is operator-owned, so a model can be instructed to emit the
configured prefix itself and the unconditional concatenation then sent it
twice. Match the shared reply normalizer's startsWith guard.
* test(clickclack): resolve inbound access through the real resolver
Main now requires access.channelIngress, which the hand-built fixture did not
provide, so the model-mode messages never dispatched. Drop the fixture and let
handleClickClackInbound resolve access from a DM-shaped message, matching the
sibling bot-loop tests.
* test(channels): reject a key missing from any composed branch
A union alternative is a configuration mode an operator can pick, so a key
present in only one mode is unusable in the other even though the union still
validates. Treat any rejecting alternative as a rejection, and walk allOf when
collecting account schemas.
* fix(channels): offer responsePrefix only where the reply path applies it
Applying the prefix to an outbound reply is per-channel wiring, not a shared
step. Buzz, Nostr, QA Channel, Raft, Reef and SMS never read it, so accepting
the key there validated a setting their delivery path ignores. Anchor the
contract to the channels that consume the prefix.
* fix(channels): complete shared response prefix delivery
Co-authored-by: ayaangazali <ayaangazali.work@gmail.com>
* docs(config): refresh response prefix baseline
* test(tlon): use canonical prefix fixture helpers
* test(channels): prove Twitch reply prefix delivery
Exercise schema admission and the real shared reply dispatcher at the Twitch native send boundary, replacing redundant schema-only coverage. Keep Tlon fixtures on canonical imports and recording options.
* docs(channels): clarify explicit message prefix behavior
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(channels): preserve long presentation text
Preserve complete authored titles, body text, and context through shared presentation limits and repeated normalization, including whitespace at split boundaries. Keep Discord and Feishu native rendering lossless and retain original content in Discord component-overflow fallback.
* test(channels): fix presentation regression CI gates
* fix(feishu): retain native presentation outbound hooks
Lease complete mirror file operations through the workspace owner instead of locking only remote transport. Preserve successful writes across exec publication and share serialization across backend handles.
Proven with a real Docker red/green reproduction, 128-workflow mirror/remote stress matrix, exact inventories, failure recovery, 170 focused tests, and updated operator docs. Related: #127441; follow-up to #130031.
Share remote identity across discovery, node inference, and Local-only setup.
Keep affirmative embedding-only models out of inferred chat capabilities,
guided selection, and failed-download fallback while preserving advertised
metadata and existing unknown-capability chat fallback behavior.
Follow up on #130240 with reproduced regressions, 742 Ollama tests, isolated
real-daemon before/after proof, and source-blind public CLI validation.
Co-authored-by: Yigtwxx <yigiterdogan023@gmail.com>
Peter Steinberger