mirror of
https://github.com/openclaw/openclaw.git
synced 2026-08-27 21:07:01 -06:00
codex/buzz-flat-replies
9 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Peter Steinberger
|
1ea2640f54 |
refactor(state): consolidate wide rows, plugin index, workspace attestations, and shared auth singletons at schema v13 (#130466)
* refactor(state): make cron and subagent rows JSON-canonical * refactor(state): make gateway origin device tokens canonical at v13 The lazy ensure predates the table joining the canonical schema; at the v13 bump the schema owns creation, so the feature-local DDL, WeakSet dedupe, and lazy-list entry retire. The legacy-file guard the ensure carried stays at each call site. * test: drop obsolete lazy-ensure coverage for origin device tokens The table is canonical at v13; same-version lazy creation no longer exists to protect. Origin CRUD, isolation, and rotation coverage remains in the surviving cases. * refactor(state): fold installed_plugin_index into config_machine_state The singleton index row becomes one JSON value under plugins.installedIndex with its rollback-fencing revision inside the value; reads, CAS restore, and the lease-held write transactions use direct Kysely on config_machine_state so the state_leases assertion stays in-transaction. The v13 migration imports the row and drops the table; the additive workspace_dir entry folds with it. Doctor guidance, docker staging, and the e2e probes name the machine-state row. * refactor(state): merge workspace_attestations into workspace_setup_state One row per workspace now carries both setup milestones and the attestation clock: nullable setup columns represent attestation-only workspaces (replaceWorkspaceAttestation can precede any setup write) and setupExists derives from a non-null version. The bootstrap-hash FK repoints to the merged table; migration receipts keep the historical workspace_attestations discriminator string. The v13 migration grows and rebuilds the table, merges attestation rows (orphans without a path alias drop — their hashes re-derive at the next bootstrap attestation), and the consolidation kind is renamed state-consolidation-v13 to cover the batch. * test(state): cover the workspace merge and consolidation fallout The v12-to-v13 regression seeds merged, attestation-only, and orphan attestation workspaces; the 13-to-12 downgrade fixture recreates workspace_attestations and installed_plugin_index from the folded data; the fold-in migration gates the additive workspace_dir column for pre-additive rows; the workspace merge now triggers on the setup table's own shape so stable-era databases without an attestations table still reshape; the consolidation applied-message covers the batch. * refactor(state): fold shared auth profile singletons into config_machine_state The shared-state auth_profile_stores/auth_profile_state rows (fixed key 'shared') become authProfiles.store/authProfiles.state machine-state values; the agent-DB tables of the same names are untouched. Git-backup redaction moves from table-drop to the authProfiles. secret prefix with seeded-secret absence proof; migration receipts keep the historical table-name discriminators; the shared-auth relocation and receipt verification project the KV cells back to the receipt-era row shapes so persisted digests stay byte-compatible. mcp_oauth_stores stays a table — its multi-key fold is a named follow-up. * test(state): finish shared-auth fold coverage and annotate boundary casts Auth seeders and assertions across the e2e/scripts/secrets suites target the authProfiles machine-state cells; the v12-to-v13 regression proves payload-byte fidelity, non-shared-row drop, and insert-if-absent precedence; the downgrade fixture recreates and repopulates both v12 tables. Boundary type assertions in the plugin-index store carry SAFETY invariants per the ratchet. * chore: shrink assertion-safety baseline for plugin-index store * refactor(doctor): delete the dead onboarding-recommendations migration Its input — the unscoped 'primary' onboarding row — existed only between |
||
|
Peter Steinberger
|
1fc29beba2 |
refactor(state): fold singleton tables into config_machine_state at schema v12 (#129876)
* refactor(state): fold singleton tables into config_machine_state at schema v11 Eight singleton tables (skill_curator_state, update_check_state, clawhub_promotions_feed_state, model_catalog_remote, voicewake_triggers, voicewake_routing_config, voicewake_routing_routes, onboarding_recommendations) were each one logical JSON value behind a fixed key; their bespoke schemas, lazy ensures, and per-table accessors collapse onto the shared config_machine_state KV under namespaced keys. cron_store_epochs retires outright: it was born write-only in #114388 and no reader ever existed in any language. Durable values (update check state, voicewake triggers and routing, per-workspace onboarding answers) migrate insert-if-absent during the v10->v11 migration; cache class contents rebuild on next use. Deferred with named reasons: exec_approvals_config (macOS direct-SQL contract), installed_plugin_index (same-tx lease fence), node_host_config and web_push_vapid_keys (secret-table git-backup redaction). # Conflicts: # src/skills/workshop/collection-review-state.ts # src/skills/workshop/collection-review.gateway-admission.test.ts * test: register v11 guard carve-outs and suppression pin The v11 migration module joins the raw-SQLite allowlist (migrations are the named guardrail exception), the lint-suppression allowlist records the second type-parameter suppression in config-machine-state, and the identity module keeps only externally consumed exports. * test: surface CLI stderr when migration-diagnostic assertion fails * test: expect migration diagnostics on stderr for models plain commands The #129037 pending-migration cases asserted that aliases/fallbacks lists never open the state database, but config-health observation (observeConfigSnapshot -> readConfigHealthStateFromStore) full-opens it on any config read whose file exists — reproduced identically on clean main with a main-built dist. The protected contract is exact stdout; the diagnostic legitimately lands on stderr for every case. * test: drop unused defaults import from CLI stdout e2e * test: split session path derivation out of oversized session-files suite #130016 pushed session-files.test.ts to 1008 lines, over the 1000-line lint cap and red for every PR's check-lint. The sessionPathForFile describe moves to a self-contained sibling following the existing session-files.*.test.ts split pattern; no assertions change. * refactor(state): fold four more singleton tables into schema v12 tui_last_sessions (cache-class, regenerates on next session switch), sidebar_sections (persistent section order, migrated as one JSON array), node_host_config, and web_push_vapid_keys join the v12 fold-in, taking the retirement to thirteen tables at the same version. The two secret singletons were blocked on table-granular git-backup redaction; backups now exclude config_machine_state rows by secret key prefix (nodeHost.*, webPush.vapidKeys) with a fail-closed row filter and regression proof, so STATE_SECRET_TABLE_NAMES sheds both tables. The sidebar fold also retires its lazy-ensure WeakSet and inline DDL; sidebar edits stay inside the existing session-group write transaction via direct Kysely. * fix(node-host): omit absent Cloudflare Access config like the column reader The KV rewrite returned gateway.cloudflareAccess as an own undefined property where the retired column reader omitted the key; toStrictEqual consumers (state-migrations doctor-repair test) caught the shape drift. Mirror the column reader's conditional spread at both construction sites. * fix(backup): disclose redacted machine-state prefixes after restore The prefix-granular secret redaction recorded omitted key prefixes in the backup manifest but the restore result exposed only excludedTables, so a redacted restore looked complete while nodeHost.* and webPush.vapidKeys configuration were intentionally absent. The restore result and CLI output now disclose the omitted prefixes (JSON mode carries them via the result shape), with restore-side regression coverage. * fix(tui): compare-and-delete retired session pointers Doctor cleanup read matching pointer keys then deleted them unconditionally, so a replacement pointer written between the scan and the delete was erased. The delete now re-checks the stored value inside the write transaction and only removes pointers that still name a retired session; a live replacement survives (regression covered). Also corrects the stale schema-version line in database-first.md. |
||
|
Peter Steinberger
|
4bd8859126 |
fix(skills): record skill usage again and retire dead curator tables (#129769)
* fix(scripts): see SAFETY comments after template substitutions
The assertion ratchet scanned each file with a raw ts.createScanner, which
reads the `}` closing a template-literal substitution as a block close. The
scanner desynced there, so every `// SAFETY:` comment after a file's first
`${...}` was invisible and its annotated assertions were counted as bare.
Track substitution brace depth and rescan the closing brace the way the parser
does. The fix uncovers already-annotated assertions in eight files, so the
baseline shrinks accordingly.
* fix(skills): record skill usage again and retire dead curator tables
Skill lifecycle curation shipped in 2026.7.1 with two producers: a trusted
`skill.used` consumer writing `skill_usage`, and a daily sweep aging skills
into `skill_lifecycle`. The weekly collection review (#121653) replaced that
policy and deleted both producers, but left every reader in place. Since then
`skill_usage` has had no writer, so curator status reported `lastUsedAtMs:
null` and `useCount: 0` forever, and `skill_lifecycle` had no writer either, so
pin/unpin/restore either threw "not found" on fresh installs or, worse,
"succeeded" on upgraded ones while gating nothing at all.
`skill_workshop_proposal_origin_runs` was never read in any revision; proposal
provenance is authoritative in `record_json`.
Restore the usage producer at its owner and retire what has no owner:
- `skill.used` events populate `skill_usage` again, registered with the
collection-review maintenance it belongs beside. Curator status derives
curated skills from applied Workshop create proposals and reports real usage.
- Weekly review receives bounded `useCount` / `lastUsedDaysAgo` evidence, with
prompt text stating usage supports keeping a procedure and never alone
justifies a drop.
- State schema 10 drops `skill_lifecycle` and
`skill_workshop_proposal_origin_runs`. Previously archived skills return to
the active collection, where review judges them by content; the migration
logs how many. Reconcile now clears usage only for skills it actually drops.
- `skills.curator.pin`/`unpin`/`restore` stay registered for existing clients
but fail with an explicit retirement message instead of silently doing
nothing.
Retirement code moves to openclaw-state-db-table-retirements.ts to keep the
schema-repair module under max-lines; that split is a pure relocation.
Production delta is +23 raw: about -46 for the change itself, +44 for the file
split, +25 for the ratchet fix in the previous commit.
|
||
|
Peter Steinberger
|
6a246f70d1 |
refactor(state): retire six dead shared-state tables at schema v10 (#129626)
* refactor(state): retire six dead shared-state tables at schema v10 agent_model_catalogs, android_notification_recent_packages, command_log_entries, diagnostic_stability_bundles, media_blobs, and model_capability_cache landed with the database-first squash but their runtime writers never reached main; every stable since v2026.6.10 created them empty (agent_model_catalogs held only rebuildable catalog cache rows until #111173 removed its writer). State schema 10 drops all six tables and seven indexes through both the runtime-open and doctor migration paths, records the retirements, bumps the native reader ceiling, and corrects stale database-first doc claims that still named these tables as canonical stores. * test: move cross-lane schema-version pins to v10 The v10 retirement missed current-version pins outside src/state: the native guard vitest wrapper, placement-move and node-worker-launch same-version assertions, and the audit outbound-progress tripwire. The pinned pre-C04 audit reader is a v9-era build that now refuses v10 databases by the version contract, so the test projects the file back to the exact v9 shape with the documented 10-to-9 downgrade fixture before the reader proof; the shared fixture also seeds the v10 retirement regression. * test: keep only the used downgrade fixture export |
||
|
Peter Steinberger
|
4bc37cd597 |
fix(state): copy-safe agent database registry via state-relative paths (schema v9) (#124728)
* fix(state): store in-root agent database registry paths relative to the state dir (schema v9) Copied state directories retained stale absolute agent database registry rows. The combined gateway store then merged old and new copies, causing every sessions.list request to fail with SessionCanonicalKeyMigrationRequiredError. Schema v9 stores in-root registry paths relative to the state directory; migration rewrites eligible rows, deletes stale duplicates, and preserves external paths. * fix(voice-call): describe state-relative registry migration * fix(state): preserve registry locator traversal * test(macos): move PortGuardian schema-version boundary to v9 The store opens any state database up to maximumSupportedSchemaVersion, which the schema v9 bump moved from 8 to 9. Shift the supported/newer partition in the boundary test accordingly. * fix(state): re-anchor copied default-layout registry rows instead of deleting them Resolve the ClawSweeper P1 by preserving genuine external default-layout registrations, re-anchoring copied rows when an in-root counterpart exists, and deleting only dual default-layout conflicts. |
||
|
Peter Steinberger
|
0a6b95a3df |
feat: cloud workers for the codex runtime (remote-exec placements) (#123743)
* feat(gateway): add remote-exec cloud placements * feat(codex): run cloud turns through remote exec * fix(sandbox): quote ssh_config path directives containing whitespace Crabbox lease keys default to ~/Library/Application Support/... on macOS; unquoted IdentityFile/UserKnownHostsFile/CertificateFile arguments tokenize on the space and fail as 'extra arguments'. Found via live remote-exec cloud-worker proof. * test: consolidate gateway maintenance schedule coverage * fix(ci): invalidate plugin sdk declarations on state changes |
||
|
Peter Steinberger
|
b6548e509a |
refactor(state): retire commitments schema (#122176)
* refactor(state): retire commitments schema * fix(state): complete commitments retirement safeguards * test(state): expect doctor retirement report * test(state): prove doctor v7 markers atomically * fix(state): align schema support metadata * fix(state): report actual commitments retirement * fix(state): validate retired commitments schema * fix(state): preserve early commitments upgrades * fix(state): require exact commitments index set * fix(state): reject non-exact retired schemas * fix(state): recognize supported retirement layouts * fix(state): expose commitments retirement to doctor * fix(voice-call): describe commitments retirement * test(state): align v7 rebase proof * fix(state): protect commitments retirement dependencies * fix(state): accept partial commitments layouts * chore(docs): refresh v7 api baselines |
||
|
Vincent Koc
|
509a5f0373 |
fix(sqlite): reject schema data loss during upgrades (#113473)
* fix(sqlite): reject schema data loss during upgrades * test(macos): align native state schema boundary |
||
|
Peter Steinberger
|
28ce6b8116 | fix(macos): accept current native state schema (#111032) |