Expose opt-in replyToMode off while retaining threaded replies by default. Keep incoming thread/session identity and explicit tool or CLI targets intact. Resolves#120339. Thanks to @Alfridus1 for the report.
* feat(reef): operator-configurable sharing rules for the guard
Adds channels.reef.guard.rules with capped outbound/inbound free-text
policy. Rules ride the trusted instruction side of the guard call only,
may tighten decisions or explicitly allow otherwise-review cases, and can
never override the deny floor or deterministic checks. The rules text is
hashed into the effective policy version so audit rows and pending review
approvals bind to the exact policy in force.
* fix(reef): full rules digest in policy identity; align blank-rule validation
ClawSweeper review fixes: use the untruncated sha256 rules digest in the
effective policy version so approvalDigest stays collision-resistant, and
express identical non-blank (\S) rule validation in the zod schema, the
manifest JSON Schemas, and the generated channel metadata instead of a
trim-transform mismatch.
* refactor(imap): consume the core identifier-authentication scale
Use the SDK type and canonical strength comparator instead of the private
SenderStrength vocabulary and index ordering. Bind config values to the SDK
union with a compile-time exhaustiveness check, preserving all config keys.
Classify unproven From ownership, including no-evidence and DMARC temperror
results, as unverified. Only an explicit unverified minimum gains admission;
the default verified floor and asserted minimum keep their behavior. Keep
existing token admission and thrown-authenticator retries unchanged.
Document the remaining mutable token/early-rejection paths and expose only
the canonical comparator through the SDK, with packaged-consumer coverage.
The IMAP introduction has no stable release contract.
* docs(security): record landed sender-auth mitigations in the threat atlas
Record the graded exact-pair identifier-authentication gate and inert mutable
allowFrom audit findings. Mark R-008 implemented in core while retaining
per-channel verified adoption and downstream mappers as remaining work.
Keep the existing atlas structure and Medium residual risk.
* fix(twitch): retain native sender identity in execution audits
Forward the registered channel runtime and actual account identity, keeping native participants distinct from role authorization. Normalize the all role at the Twitch policy producer and preserve unknown and disabled-collection paths.
Cover actual registered-plugin ingress and native reply delivery, and drain asynchronous monitor test work before cleanup. Related to #122863; no shared authorization or storage change.
* test(twitch): track the registered context builder in inventory
* test(twitch): honor host and plugin contract boundaries
Replace the drain waiter array + release loop with one lazily created
shared idle deferred (same semantics: concurrent waiters share it, it
resolves on the first all-trackers-zero publish), and fold the tracker
update into publishInboundPendingWork.
Collapse expectInboxPairingReplyText into expectPairingPromptSent: the
mocked pairing upsert always issues PAIRCODE, so the regex code
extraction and code-override parameter were dead generality. Net -20
lines of test-support code, no behavior change.
Declare the provider-supported efforts and reuse the canonical minimal-to-low mapping for static GPT-5.4 mini resolution. Preserve xhigh and keep max unavailable.
Declare the Gemini Chat Completions transport and request compatibility in the owning model manifest. Remove the private metadata decoration loop so static catalog selection and forward-compatible synthesis use the same declared contract.
* fix(openshell): unregister sandbox backend on plugin stop
Bind the explicit backend disposer to the plugin service lifetime so disabling or reloading OpenShell retires its factory, manager, and workdir hooks together. Preserve the core registry's stale and repeated disposer semantics.
* fix(sandbox): retire plugin backends with registry lifecycle
Introduce on admitted bot joins using the existing sealed no-tools turn and durable room dedupe. Matrix uses room metadata and readable history; LINE uses group names and explicitly unavailable history.
Mark Matrix bridge membership provenance without changing existing event delivery, invite handling, or auto-join. Exclude startup snapshots and already-joined profile updates, including startup connection recovery.
Simplify snapshot budget accounting while preserving prompt bytes, metadata order, and oldest-first message dropping. Add channel config, docs, and regression coverage.
* fix(openshell): preserve nested host symlinks during mirror sync
Reconcile mirror entries recursively so trusted host symlinks and their ancestors survive remote edits and deletions. Preserve unlink-before-copy hardlink safety and drain pending filesystem work before returning an error. Cover the repair with unit regressions and the real OpenShell E2E flow.
Fixes#131111
* chore(openshell): satisfy mirror callback lint rules
* feat(security): warn on inert mutable allowFrom entries
Report configured entries that cannot authorize with name matching disabled,
and preview lockout counts before disabling mutable matching. Distinguish
mutable aliases from exact identifiers with unproven ownership in audit text.
Reuse channel ingress declarations through one SDK classifier without changing
admission policy. Keep Discord audit findings redacted and exclude symbolic
access-group references from mutable-identifier warnings.
Refs #131099.
* test(security): keep entry-authentication audit coverage in its lanes
* fix(canvas): retire the legacy document root only after migration completes
* fix(canvas): preserve older migration roots and canonical aliases
Read both historical host locations with shipped plugin precedence.
Select legacy config owners from existing manifest metadata for doctor,
without broadening session-store ownership. Recognize realpath aliases
of canonical storage and cover persisted partial repairs and retries.
* fix: honor scenario drivers in generated QA commands
Carry declared driver requirements through coverage search, grouping and quoted command output. Preserve unconstrained defaults and validate generated arguments through real CLI parsing and canonical lane selection. Closes#131088.
* test: capture generated QA commands through the shell
* fix(browser): close the created tab when opened-tab discovery is aborted
* fix(browser): complete cancelled tab creation cleanup
Close newly created CDP targets on their creating socket when cancellation prevents returning the target ID. Preserve the original error even when close fails.
Capture cleanup policy and timeout before asynchronous work so runtime shutdown cannot fence compensation or mask the open error. Extend the existing cancellation tests through the real profile lifecycle.
* test(whatsapp): give pairing-prompt waits the saturation budget
The monitor-inbox.policy pairing test waited on vi.waitFor's 1s default
while sibling pairing tests use the suite-standard 5s/5ms saturation
budget. Under full-project no-isolate runs the worker can stall ~1.5s
mid-flow (sync module fetches against the saturated shared transform
queue), starving waitFor's interval timers so the prompt lands just
after the deadline. Probes showed every mock firing correctly on the
right sock — not the shared-worker mock-defeat class.
Centralize waitForPairingPromptSent in the monitor-inbox harness, use
it at all three call sites (dropping the duplicated inline waits), and
align inbound.media's 2s delivery wait to the same 5s budget.
* test(whatsapp): event-driven inbound drain for pairing waits
Replace the wall-clock pairing wait with waitForInboundWorkDrained: the
harness now tracks each listener's onPendingWorkChanged signal and
resolves when pending inbound work returns to zero, so no saturation
stall can outlast a deadline. settleInboundWork keeps its yield-ticks
semantics for tests that observe intermediate states (held handlers,
parked debounce batches).
Route the policy and media-and-session monitor helpers through the
harness startInboxMonitor so their listeners are drain-tracked, collapse
media-and-session's bespoke pending-work machinery into the shared
helper, upgrade the policy negative assertions to drain-backed (non-
vacuous), and drop the now-unused getMonitorWebInbox export.
* fix(device-pair): verify retained subscribers before archiving the migration source
Precheck remaining namespace capacity before importing legacy subscribers. Verify source and pre-existing destination keys in the shared JSON importer before reporting completion or archiving, preserving the source and warning when retention falls short. Keep runtime caps, eviction policy, and registration semantics unchanged.
Prepared for draft PR maintainer review. Review-required: persistent-state retention semantics.
* fix(device-pair): omit absent subscriber migration fields
Keep absent account and thread fields out of normalized legacy subscribers so the strict plugin-state JSON serializer accepts ordinary subscriptions. Preserve numeric zero thread IDs and exercise all optional target combinations through the real migration contract.
* fix(network): release captured streams without waiting on their cleanup
End best-effort reader ownership before guarded request cleanup, while preserving explicit cancellation failures after cleanup. Simplify llama download reader ownership without changing transport abort policy.
Co-authored-by: zhang-guiping <zhang.guiping@xydigit.com>
* fix(network): preserve caller-owned response cleanup
Preserve cancellation for partially consumed media responses, type the captured response handoff, and clarify beta stream cleanup ownership.
* fix(tts): settle stream cancellation with request cleanup
Own binary-stream cleanup in the shared helper and remove duplicate provider release wrappers. Preserve explicit cancellation settlement and errors while allowing cleanup to abort retained capture branches.
Co-authored-by: zhang-guiping <zhang.guiping@xydigit.com>
* test(tts): preserve cancellation result tuple types
Keep both cancellation/release call orders while passing an explicit two-result tuple to Promise.allSettled. Preserve the existing outcome and error-identity assertions without casts or non-null assertions.
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
Doctor now distinguishes missing, blocked, incomplete, and unhealthy local embedding providers. It keeps the canonical install action only for a missing plugin and preserves provider-owned setup or Gateway recovery guidance otherwise.
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
Share bounded, complete error-body redaction across message sends, reactions, and bot preflight. Preserve status fallbacks, request deadlines, UTF-16 display bounds, and accepted-send receipts. Consolidate duplicate receipt and feature-mask fixtures while adding real HTTP reflection, truncation, and idle-deadline regressions.
Co-authored-by: Peter Steinberger <steipete@gmail.com>
Project channel-originated embedded run identity and bounded progress through Gateway history so Control UI keeps the original timer, safe recent activity, and exact Stop ownership after reload.
Co-authored-by: SunnyShu0925 <shu.zongyu@xydigit.com>
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
* docs(mxc): correct timeout default
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d7253887-71c9-4083-a591-91979c981e39
* docs(mxc): preserve existing agents in setup
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d7253887-71c9-4083-a591-91979c981e39
* docs(mxc): make cleanup non-destructive
The Cleanup section replaced the entire agents.list with a single default main entry, which would silently drop any other agents a user had configured. Mirror the non-destructive approach now used in Test setup: 'openclaw agents delete mxc-test --force' plus a plugin-only config patch.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d7253887-71c9-4083-a591-91979c981e39
* docs(mxc): restore effective timeoutSeconds default
An unset timeoutSeconds resolves to the 300s sandbox baseline, not the
internal 120 value, since timeoutSecondsConfigured stays unset.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* docs(mxc): keep test setup and cleanup isolated
Use a uniquely owned test agent and freshly reserved workspace, stop after failed native commands, and leave installation-wide MXC configuration and policy untouched. Preserve the effective unset timeout and existing SDK transport wording.
Co-authored-by: Paul Campbell <paulcam@microsoft.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
Copilot-Session: d7253887-71c9-4083-a591-91979c981e39
Reuse accepted server transcripts in the Feishu audio transcript and attachment marker flow so core media understanding does not transcribe the same audio again. Preserve local preflight transcription and transcript text with the unavailable-attachment notice when downloads fail.
Allow low-memory local-memory setups to install only the verified managed server and embedding model while preserving every configured chat route.
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
* fix(browser): resolve unnamed role refs and initialize AX markers
Keep explicit raw ARIA empty names distinct from omitted serializer names and share one dependency-faithful role lookup. Bind the DOM document in the marker-owning CDP session without adding a round trip.
Related: #130879. The separate snapshot membership and ordering failures remain open.
* chore(browser): shrink ref assertion safety baseline
Record the five type assertions removed by the ref-name repair. Tighten the canonical per-file allowance from seven to two; runtime and browser-test bytes are unchanged.
* test(plugins): align Slack configured-state metadata
* fix(openshell): exclude test support from package
* test(release): record Daytona security finding
* feat(channels): add identifier authentication kernel
* fix(channels): preserve exact identity provenance
* fix(channels): fail strict dynamic groups closed
* fix(channels): bind plugin allowlists to exact identity fields
Move the Twitch role normalizers into the kernel branch and keep Discord
name and tag entries on their corresponding identity fields. Repair the
same mismatch for Slack name slugs and IRC nick@host entries.
Add regressions at the channel authorization boundaries.
Related: #123782
Co-authored-by: Omar Shahine <10343873+omarshahine@users.noreply.github.com>
* refactor(channels): resolve identifier authentication at intake
Keep raw SDK inputs optional and carry required authentication through
normalized kernel subjects, entries, and state. Resolve static claims at
intake and floor omitted fields in a supplied per-message map to unverified.
Remove the deprecated internal policy wrapper, downstream strength
fallbacks, and unused type exports. Cover the partial-map floor, static
claims, and mutable alias behavior, and document the map contract.
Related: #123782
* fix(channels): retain affected admission contributions
Preserve an authentication effect when other admission contributions were
not evaluated. Prefer any affected result, then any evaluated result,
before checking for uniformly unevaluated contributions.
Cover the mixed case through the existing redacted receipt flow.
Related: #123782
* test(twitch): await monitor delivery before resetting mocks
Make the ingress fixture drain accepted deliveries on stop, matching the
real monitor lifecycle. Await those deliveries directly so prefix and
reply assertions cannot race or leak completions into the next case.
Related: #123782
* fix(feishu): match ambiguous allow entries under both id fields
---------
Co-authored-by: Omar Shahine <10343873+omarshahine@users.noreply.github.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix: preserve native session ownership during cleanup and attachment
Prepare permitted harness owners for offline session deletion. Reject direct
attachment of parent-controlled Codex children before displacing ownership.
Keep deadline and client authority through binding publication, and release
accepted subscriptions when publication fails without a remaining owner.
Unify conversation create/attach and preserve observational child monitoring.
Verified 950 focused/sibling tests, production and test types, independent
Codex review, and the real built offline CLI capacity reproduction.
* test: avoid shadowing the native binding row
Peter Steinberger