61416e1254
fix(feishu): honor disabled default tool accounts ( #126412 )
2026-08-19 13:47:23 -07:00
3378e07d50
refactor(plugin-sdk): promote shared runtime primitives ( #126193 )
...
* refactor(plugin-sdk): promote shared runtime primitives
* test(codex): keep one attempt tools owner
2026-08-19 01:10:18 -07:00
0684f50136
fix(gateway): harden hook admission and shutdown ( #125893 )
...
* fix(gateway): harden hook admission and shutdown
Flush structured 413 and 408 hook responses before closing oversized or timed-out request sockets, and reject deferred wake requests that target an explicit session.
Direct Gateway close now marks startup and readiness as draining immediately and attempts every HTTP listener shutdown before reporting an incomplete close.
* test(gateway): model request destruction in fuzzing
Give the HTTP request fuzz double the IncomingMessage destroy contract exercised after 413 and 408 responses finish.
* fix(gateway): preserve response and shutdown bounds
Route installed webhook body-limit failures through the shared response-first close owner and require complete Feishu 413/408 responses before terminal connection closure.
Retain the current-main grace bound for agent-harness disposal so one stuck harness cannot block listener teardown.
* test(telegram): model response-close request cleanup
Keep the slow-body request alive through response finish, then assert cleanup when the mock response transport closes.
2026-08-18 10:39:56 -07:00
eb38d5e486
fix(reply): report settled delivery outcomes once ( #124773 )
...
* refactor(reply): publish settled dispatch receipts
* refactor(reply): isolate dispatch outcome accounting
* refactor(discord): infer settled dispatch result
* test(reply): model settled dispatch receipts
* test(reply): type settled receipt fixtures
* test(telegram): declare settled final receipt
* test(telegram): adapt legacy dispatch fixtures
* fix(reply): complete settled receipt compatibility
* test(channels): keep delivery suite within lint budget
* test(channels): reuse settled count fixture
* test(channels): consolidate receipt assertions
* test(channels): extract delivery receipt fixtures
* fix(qa): recover stopped clients after config restart
* fix(reply): settle deferred delivery receipts
* test(channels): share delivery turn fixtures
* fix(channels): preserve non-visible reconciliation
* fix(reply): preserve settled receipt compatibility
* refactor(reply): make settled receipts canonical
* refactor(reply): absorb settlement at dispatcher boundary
* test(matrix): prove settled receipt precedence
* refactor(sessions): extract prompt snapshot types
* fix(reply): restore queued admission counts
2026-08-17 06:38:16 -07:00
5ebfbbf8d7
fix(plugins): honor per-agent runtime config ( #124978 )
...
* fix(plugins): resolve per-agent config through SDK
* test(codex): preserve agent runtime exports
* test(telegram): make default owner explicit
* refactor(plugins): use lightweight agent scope runtime
* fix(codex): preserve multi-agent execution ownership
* chore(plugin-sdk): record approved agent scope exports
* fix(codex): keep scoped sandbox ownership authoritative
* fix(codex): preserve agent scope in native side actions
* fix(ci): avoid counting node check as environment variable
2026-08-17 01:53:08 -07:00
fcb499a4ce
refactor(channels): move read-gate policy to channel plugins ( #125136 )
...
* refactor(channels): move read-gate policy to plugins
* test(channels): declare bundled Discord read gates
2026-08-17 01:38:30 -07:00
f9b1ccc4fa
refactor(plugin-sdk): discriminate delivery and exec results ( #124979 )
...
* refactor(plugin-sdk): discriminate delivery and exec results
* test(plugin-sdk): update delivery target expectations
* fix(outbound): preserve canonical delivery targets
* fix(irc): normalize message delivery target
2026-08-16 22:55:41 -07:00
568b920b21
feat(lint): enforce import ordering and deduplication ( #124730 )
...
* refactor(imports): dedupe and hoist imports
* feat(lint): enforce import/no-duplicates and import/first
2026-08-16 11:44:52 -07:00
ffa0929c7f
fix(agents): stop advertising unavailable tools ( #124716 )
...
* fix(agents): gate tool description cross-references
* test(gateway): include metadata copier in invoke mock
2026-08-16 11:20:45 -07:00
63401b730b
fix: keep doctor security conditions as single findings ( #124666 )
...
* fix(doctor): record security finding severity
* refactor(security): keep audit severity internal
* fix(security): preserve channel finding severity
2026-08-16 10:24:40 -07:00
6aa27d6ecd
refactor: retire August compat windows (embedding API, pi aliases, target parser, spawning hook, setup exports, WhatsApp inbound aliases) ( #124416 )
...
* refactor(plugin-sdk): retire embedded Pi aliases
* refactor(channels): retire explicit target compatibility
* refactor(plugins): retire subagent spawning hook
* refactor(plugin-sdk): retire shipped channel setup exports
* refactor(whatsapp): retire inbound callback aliases
Proof: focused build and WhatsApp E2E green; broad WhatsApp suite 188/189 files green. extensions/whatsapp/src/monitor-inbox.policy.test.ts flakes only in the parallel batch and passes isolated (10/10).
* refactor(plugin-sdk): retire memory embedding registrar
Migrate every bundled provider and manifest to registerEmbeddingProvider and contracts.embeddingProviders. Preserve memory-specific batching, local-service acquisition, index identity, and auto-selection through the canonical generic registry adapter, then remove the parallel registrar, registry, diagnostics, contracts, tests, and docs.
* chore(plugin-sdk): tighten retired surface budgets
Pin the post-retirement public SDK surface to 144 entrypoints, 4,312 exports, 2,564 callable exports, and 1,133 deprecated exports; agent-harness-runtime now permits exactly nine deprecated exports.
2026-08-15 22:43:47 -07:00
37763e4d7e
refactor(feishu): remove thread-binding test reset ( #124276 )
2026-08-15 13:38:04 -07:00
97a53a9b35
feat: audit admitted channel participant identity ( #122863 )
...
* feat: audit admitted channel participant identity
* fix: preserve Telegram identity through thread recovery
* fix: signal held gateway process groups
* fix: keep audit evidence passive in collect routing
* fix: validate copied channel participant evidence
* fix: bind channel participant evidence to host ingress
* fix: honor Telegram proof credential roles
* fix: restart held Telegram proof through gateway
* fix: repair channel identity CI regressions
* test(matrix): bind thread routing owner
* fix: preserve direct DM SDK compatibility
* fix: bind channel provenance at host runtime
* test(feishu): provide channel context builder
* fix: defer record-bound channel runtime resolution
* fix: keep channel admission evidence core-private
* fix(audit): bind channel admission to plugin lifecycle
* fix(audit): bind ingress provenance to final context
* refactor(audit): split admission scope keys
* test(queue): cover combined metadata carriers
* refactor(audit): keep lifecycle helpers private
* fix(queue): preserve combined turn authority
* test(channels): provide ingress context builders
* test(channels): align integrated CI fixtures
* test(clickclack): resolve model-loop ingress
* docs: preserve channel participant evidence invariant
2026-08-14 08:57:01 -05:00
249a38d29f
fix: keep background work scoped to its selected agent ( #123257 )
...
* fix: preserve explicit agent ownership
Scoped route, session, and job owners now survive hooks, cron, process exits, global delivery, bindings, and media cleanup. Truly ownerless operations remain explicit errors.
* test: provide session memory hook owner
* test(ui): close failed-module page explicitly
* test(matrix): align ownership and replacement proof
2026-08-13 11:29:31 -07:00
59c382b717
fix(tests): respect plugin helper boundary
2026-08-13 01:34:05 -05:00
13750feff3
fix(plugin-sdk): preserve cancellation receivers
2026-08-13 01:34:05 -05:00
5af3d49621
fix(plugin-sdk): make ingress cancellation fan-in safe
2026-08-13 01:34:05 -05:00
40af3646d7
test(extensions): remove shared helper replays ( #122773 )
2026-08-12 12:19:38 -07:00
c23d66e3b5
refactor: consolidate coercion ownership ( #122692 )
...
* refactor: consolidate coercion ownership
* test: align shard check with weighted planning
* chore: refresh plugin SDK API baseline
2026-08-12 09:25:28 -07:00
40cb6f0e3b
feat(ui): keep Where picker destinations live ( #122531 )
...
* feat(gateway): enrich environment summaries
* chore(sdk): refresh plugin API surface
surface drift approved: additive EnvironmentSummary enrichment (runners plan rev 2, milestone 4)
* feat(ui): keep where picker destinations live
* docs: link picker liveness milestone PR
* fix(ui): deduplicate picker locale keys
* test(ui): update picker section expectations
* fix(ssrf): narrow lookup resolver contract
* fix(gateway): publish authoritative environment facts
2026-08-12 05:11:46 -07:00
b080dd1e76
refactor: consolidate coercion contracts ( #122458 )
...
* refactor: consolidate coercion contracts
Centralize exact string, record, numeric, date, Boolean, argument, and structured-error coercions while preserving call-site semantics.
Migrate canonical-name collisions and deprecated internal SDK bypasses, deleting 55 net production/tooling lines. Expand declaration ownership enforcement to 101 allowed helpers and add a narrow export-completeness audit.
* fix: preserve standalone script coercions
Keep copied Control UI tooling self-contained and retain the trusted release harness module-relative source seam when the harness runs against an old target cwd.
2026-08-11 23:26:37 -07:00
964c8c84c1
refactor: consolidate coercion ownership ( #122299 )
...
* refactor: consolidate coercion ownership
Centralize four canonical coercion helpers, migrate exact core and plugin duplicates through narrow Plugin SDK facades, and enforce declaration and plugin-normalization ownership boundaries.
The sweep adds eight focused SDK exports while deleting more production and tooling code than it adds. User-visible behavior is unchanged except for safer equivalent object and UI parsing at existing boundaries.
* fix: guard integer option ownership
Register resolveIntegerOption with the canonical function owner and extend the declaration-guard fixture so future local duplicates fail validation.
* fix: keep integer helpers on numeric facade
Remove the unshipped duplicate string-coerce exports and route every affected plugin consumer through the existing number-runtime contract.
* fix: point numeric coercion to number runtime
Make boundary and declaration diagnostics recommend the canonical numeric facade, with failing-before coverage for both guidance paths.
2026-08-11 17:14:53 -07:00
cad77fb39c
refactor: consolidate remaining coercion helpers ( #122020 )
2026-08-11 10:22:01 -07:00
2c8ed54ddb
feat(heartbeat): default delivery to the configured owner, never groups ( #121988 )
...
Unset heartbeat.target now resolves "owner": elected heartbeat notifications deliver to the operator's DM resolved from commands.ownerAllowFrom or the channel allowFrom (first concrete entry; wildcards and channel-scoped wildcards excluded; configured owners exhausted across channels before any channel-local fallback). Delivery requires the channel's own classifier to positively prove a direct destination — every bundled messaging plugin now ships an inferTargetChatType contract — and unproven or group-shaped destinations fail closed to the visible no-route state. The first implicitly-routed delivery carries a one-line self-explanation naming the target: "none" opt-out. Explicit target "last" remains as the follow-the-conversation opt-in. Refines the unreleased #121892 default before it ships; refs #121880 .
Co-authored-by: Ayaan Zaidi <hi@obviy.us >
Co-authored-by: Claude Fable 5 <noreply@anthropic.com >
2026-08-11 13:18:22 +00:00
77fc82c9d3
test(feishu): opt into raw commandText in raw-detail card test
...
The raw-command-detail streaming card test shipped in #121826 asserting
raw exec text under the default commandText mode, but the same commit
made "status" (tool label only) the documented default with raw as an
explicit opt-in. The test has failed since introduction; change-classified
CI never selected the feishu lane on main pushes. Opt the test into
streaming.progress.commandText: "raw" so it proves the documented path.
2026-08-11 09:30:23 +02:00
fa03d9b913
refactor: consolidate coercion helpers ( #121366 )
...
* refactor: consolidate coercion helpers
* fix: remove duplicate coercion imports
* fix: preserve serialized coercion guard
* chore: ratchet coercion helper carve-outs
* fix(test): keep gauntlet subprocess startup lean
* fix: preserve imported session timestamp semantics
* fix: preserve catalog timestamp string semantics
* chore: align plugin SDK surface ratchet
* fix: preserve trajectory and SDK string contracts
* fix(test): preserve QA record assertion semantics
* fix: complete standalone record guard rename
* refactor(cron): use canonical string coercion
* fix(acpx): preserve Pi timestamp parsing
* test(channels): adapt custody test harnesses
* test(telegram): classify media harness as test support
* test(acpx): split timestamp contract coverage
* test(channels): support generated custody contracts
* chore: ban the full coercion helper name set
Extends the declaration guard to all eleven consolidated helper names and
renames the cron schedule-identity readNumber wrapper to readScheduleInteger
so the banned generic name cannot regrow.
* fix(scripts): repair release-validation guard drift and lint cause
Restores the renamed isJsonRecord guard in assertTrustedWorkflowHarness after
main added isRecord call sites in parallel, and attaches the caught YAML error
as the thrown error cause (preserve-caught-error was red on main).
* fix: preserve Claude timestamp string semantics
* fix: preserve persisted timestamp string semantics
* fix: preserve date-first timestamp contracts
* fix(openai): harden delegation failure formatting
* chore: close coercion helper guard gaps
* test(openai): model non-error delegation rejection
* chore: refresh plugin SDK API contract
* fix(tasks): use canonical string field reader
* fix(ai): use canonical provider error field coercion
* fix(browser): migrate native bootstrap coercion
* docs(plugin-sdk): clarify text record export compatibility
* fix(gateway): normalize approval execution identity
* test(outbound): isolate message action poll harness
2026-08-11 00:02:18 -07:00
2e6c2bba19
fix(feishu): restore forwarded interactive card content ( #115136 )
2026-08-09 07:07:03 -07:00
8616c0c374
refactor: finish shared test helper migrations ( #120996 )
...
* test: finish shared helper migrations
* test: fix helper migration CI
* style: fix test import ordering
* test(acpx): restore deferred void types
* test: fix helper migrations after rebase
2026-08-09 06:00:06 -07:00
8cb53c7b55
perf(doctor): keep bundled doctor contract closures dependency-light ( #120698 )
...
* perf(doctor): keep bundled doctor contract closures dependency-light
Doctor contract enumeration cold-loads each plugin's doctor-contract-api
closure via jiti, so a static value import of openclaw/plugin-sdk/runtime-doctor
pulled the state-db/kysely graph (~4.3s per closure) into
listPluginDoctorLegacyConfigRules / listPluginDoctorStateMigrationEntries.
- migrate all light doctor-contract closures (66 files) to the
dependency-light openclaw/plugin-sdk/runtime-doctor-migrations subpath
- voice-call: load detect/repairOpenClawStateDatabaseSchema* lazily inside
the migration bodies; keep only a type-only static runtime-doctor import
- matrix: split pure credential record shapes/normalizers into
credentials-state.ts so the doctor closure no longer imports the sync
plugin-state store through credentials-read
- guard: doctor-contract-closure-guard.test.ts now forbids static value
imports of runtime-doctor in closures alongside agent-runtime
* fix(matrix): keep credential revocation record type module-local
Knip production scan flags the export as consumer-less; the type is only
referenced by the exported union and revocation guard signature.
2026-08-08 17:51:31 -07:00
c691f2e41c
fix(progress): preserve callback acceptance results ( #120171 )
...
* fix(progress): preserve callback acceptance results
* fix(progress): require transport acknowledgements
* fix(progress): preserve direct acceptance outcomes
2026-08-07 14:40:33 -05:00
b4a26783f7
refactor(test): consolidate duplicated requireRecord and provider HTTP mock helpers ( #119982 )
...
* refactor(test): consolidate duplicated test helpers
* test: remove stale record guard import
* fix(test): remove orphaned record guards
* refactor(test): keep record requirement messages exhaustively typed
* fix(test): keep packages/ai record guard package-local
2026-08-06 14:48:01 -07:00
528c5e0817
fix(feishu): honor cross-context limits for message mutations [AI] ( #119845 )
...
* fix(feishu): guard native mutation targets
* fix(outbound): preserve direct resource actions
2026-08-06 14:38:24 +05:30
ab7b3ffd1f
fix: retry delivery when outbound adapter is unavailable ( #119371 )
...
* fix(outbound): preserve pre-dispatch retryability
* test(outbound): assert lazy runtime sender
* fix(feishu): preflight direct message runtime
* test(gateway): preserve scoped registry fixture
2026-08-04 21:22:07 -06:00
e79f358b02
fix(feishu): report bot identity retry failures ( #102185 )
...
Co-authored-by: Vincent Koc <vincentkoc@ieee.org >
Co-authored-by: zhangLei99586 <294081397+zhangLei99586@users.noreply.github.com >
2026-08-04 22:45:28 +08:00
14fe739ee9
fix(feishu): enforce exact signed webhook request boundaries ( #118758 )
...
* fix(feishu): enforce exact signed webhook request targets
* fix(feishu): preserve explicitly configured signed webhook query targets
* fix(feishu): preserve shipped relative webhook paths
* fix(feishu): normalize and migrate legacy webhook callback paths
* fix(feishu): preserve transformed webhook schema defaults
* fix(feishu): require canonical webhook paths before runtime startup
* docs(feishu): document canonical webhook routes and doctor recovery
2026-08-03 14:52:58 -07:00
f9d9d1225a
refactor(channels): own the lifecycle status contract in SDK patch factories ( #118795 )
...
* refactor(sdk): add channel lifecycle patch factories
* refactor(channels): adopt lifecycle patches in a-m
* refactor(channels): adopt lifecycle patches in n-z
* refactor(runtime): lifecycle-own ambient registries
* test(slack): assert lifecycle factory fields
* fix(sdk): preserve lifecycle patch extras types
* test(zalouser): widen lifecycle status sink
* test(irc): avoid shadowed status patch
* fix(zalo): reuse account-agnostic media route
* fix(gateway): accept explicit channel ready recovery
* test(qa): assert terminal Slack block fact
* test(qa): restore Slack blocked lifecycle scenario
* test(gateway): lock explicit lifecycle recovery contract
2026-08-03 12:39:48 -07:00
c1686c9a84
fix(feishu): fence external collaboration tool results ( #118877 )
...
* fix(feishu): fence external collaboration tool results
* test(feishu): narrow bitable result content safely
2026-08-03 12:36:39 -07:00
4c66ed5615
feat(channels): lifecycle wave 2 — fifteen more channels publish recorded lifecycle ( #118298 )
...
* feat(channels): publish lifecycle from existing status sinks
* feat(channels): thread lifecycle through provider monitors
* fix(mattermost): keep lifecycle status helper private
* fix(matrix): preserve terminal lifecycle during startup cleanup
* fix(matrix): reject invalid tokens during startup
* test(mattermost): drop unused vi import
2026-08-02 17:30:56 -07:00
dd97722e3e
test(feishu): consolidate monitor lifecycle fixtures ( #118273 )
2026-08-02 16:13:45 -07:00
8e7a24adb8
refactor(feishu): consolidate chat tool fixtures ( #118234 )
2026-08-02 16:04:17 -07:00
1786a011df
refactor(feishu): consolidate doctor state fixtures ( #118238 )
2026-08-02 16:02:06 -07:00
e7ce514f4e
fix(feishu): deliver approved workspace attachments through plugin owners ( #117778 )
2026-08-01 21:24:04 -07:00
ccee629359
refactor(plugins): delete registry compat scaffolding ( #117749 )
...
* refactor(plugins): delete registry compat scaffolding
* test(plugins): update CLI registry handle mock
* fix(plugins): preserve explicitly initialized hook registries
* test(plugins): update registry ownership fixtures
* fix(channels): restore registry snapshot memo
2026-08-01 21:18:47 -07:00
6c41f37417
fix(feishu): avoid 400s on topic reaction hydration ( #117685 )
...
* fix(feishu): hydrate reaction topics with real ids
Fixes #34528
* fix(feishu): scope topic hydration id for errors
2026-08-01 16:49:42 -07:00
0e45b46889
refactor(feishu): deduplicate drive test fixtures ( #117659 )
2026-08-01 15:27:07 -07:00
1a0d3b5c40
fix(feishu): cancel unread streaming-card error bodies before release ( #117312 )
2026-08-01 12:26:27 -07:00
a1f2fb45bc
fix(feishu): restore custom HTTPS API domains ( #117278 )
...
Co-authored-by: Peter Steinberger <steipete@macos.shared >
2026-08-01 01:00:09 -07:00
f5a8cb02ea
test(release): repair full validation regressions ( #116931 )
...
* test(discord): mock thread delete listener
* test(qa): expect blocked update evidence
* test(telegram): preserve recovered context body
* fix(test): configure kitchen-sink personality
* test(browser): expect canonical staged upload paths
* test(browser): canonicalize macOS download roots
* test(feishu): seed legacy session rows offline
* test(telegram): isolate message context session stores
* test(qqbot): expect canonical media paths
* test(anthropic): match canonical transcript paths
* test(qa): expect canonical session store keys
* test(gateway): isolate rewind media reads
* test(release): review plugin child spawns
* test(plugins): expect process-stable manifest metadata
* test(google): retire usage telemetry contracts
2026-08-01 15:42:50 +08:00
ad3e36ef33
fix(feishu): unify outbound delivery lifecycle ( #117223 )
...
Co-authored-by: Peter Steinberger <steipete@macos.shared >
2026-07-31 23:16:04 -07:00
b521ce626b
fix(feishu): consume implicit reply targets across media delivery ( #117196 )
...
Co-authored-by: Peter Steinberger <steipete@macos.shared >
2026-07-31 21:01:45 -07:00
Josh Avant