5f6de37e20
fix(secrets): preserve authored env shorthand provenance ( #127685 )
...
* fix(secrets): preserve authored env shorthand provenance
Fixes #127684
* fix(gateway): keep provenance scope narrow
* fix(gateway): carry provenance through auth reads
2026-08-21 17:25:46 -07:00
3d00611793
fix(config): keep missing env references unavailable without rejecting literals ( #125455 )
...
* fix(config): record unresolved env references as facts
Preserve missing-substitution provenance through config snapshots and runtime activation so unresolved credentials remain unavailable without misclassifying intentional literal placeholder text.
* fix(gateway): preserve config facts across credential clones
2026-08-17 19:05:29 -07:00
1ca60fbc3a
refactor(agents): make multi-agent ownership explicit (H2-1 core) ( #114388 )
...
* refactor(agents): make roster ownership explicit
* feat(config): materialize legacy agent roles
* fix(cron): migrate legacy owners at startup
* feat(gateway): expose agent selection contracts
* fix(gateway): enforce agent-scoped authorization
* docs(config): document explicit agent ownership
* fix(config): pin retained owner workspace
* fix(gateway): target hook wakes at effective agent
* fix(sessions): preserve fixed-store ownership
* fix: preserve retained agent ownership
* fix: preserve legacy agent ownership across runtime surfaces
* fix: fail closed on ambiguous session ownership
* fix: preserve compatibility owners across dispatch and writes
* fix: preserve retained agent projections
* fix: preserve agent ownership compatibility
* fix: preserve per-agent heartbeat guidance
* fix: preserve compatibility owners in generic paths
* fix: enforce configured ownership in session paths
* fix: defer remote roster selection
* fix: preserve ownership across session and config writes
* fix: fail closed on ambiguous restored ownership
* fix: preserve explicit ACP and legacy ownership
* fix: honor durable fixed-store ownership
* fix: enforce fixed-store owner authority
* fix: preserve ownership evidence boundaries
* fix: honor resolved session ownership
* fix: align compatibility ownership paths
* fix: persist legacy main store ownership
* fix: close ownership fallback gaps
* fix(agents): close retained owner compatibility gaps
* fix(agents): enforce session owner resolution
* fix(agents): complete session owner resolution sweep
* fix(agents): preserve durable session ownership
* fix: complete persisted session owner routing
* fix: thread prepared session owners
* fix: preserve stable session ownership
* fix: enforce session ownership boundaries
* fix: close session ownership delta gaps
* fix: reconcile session ownership after rebase
* fix: reconcile ownership with current main
* fix: align session store path imports
* fix: align session store config path import
* fix: reconcile explicit ownership CI
* fix: reconcile ownership rebase checks
* fix: align ownership ci contracts
* fix: align ownership rebase checks
* fix: preserve compatibility owner during setup
* fix(doctor): migrate ownerless heartbeat monitors
* fix(gateway): preserve explicit session ownership
* test: align ownership fixtures after rebase
* test: complete plugin manifest fixture
* test: align runtime context mocks
* fix(gateway): preserve alias routing for existing sessions
* style: format agent routing update
* fix(gateway): preserve selected owner during alias routing
* style: normalize rebased ownership files
* fix(gateway): preserve owner through global alias routing
* fix(gateway): preserve explicit ownership at HTTP boundaries
* fix(gateway): validate compatibility model ownership
* fix(agents): reconcile strict session ownership
* fix(agents): contain media yield callback failures
* fix(agents): avoid eager bare-key owner resolution
* chore: refresh rebased ownership baselines
* chore: align hosted plugin SDK baseline
* chore: refresh ownership baselines after main sync
* chore: refresh ownership baselines after main sync
* test: align routed event owner fixtures
* chore: retrigger CI after runner startup failure
* chore: refresh ownership SDK budgets after main sync
* fix(tasks): require agent identity for bare owners
* chore: align Linux plugin SDK baseline
* chore: remove release-owned changelog entry
2026-08-12 15:55:16 -07:00
db73b59c04
refactor: burn wrapper shadowing baseline entries ( #122040 )
...
* refactor: burn wrapper shadowing entries
* chore: refresh wrapper shadowing baselines
* test: update secrets runtime state mocks
* fix(ci): absorb Control UI build identity variance
2026-08-11 08:24:03 -07:00
ea06d72e85
feat(secrets): manage team secrets in Control UI ( #121724 )
...
* feat(secrets): add gateway store settings
* perf(control-ui): trim secrets startup copy
* perf(control-ui): reduce secrets startup payload
* fix(secrets): harden store mutation refresh
* perf(control-ui): meet secrets startup budget
* test(control-ui): update secrets navigation copy
* fix(ui): pluralize secret-detection count and drop duplicated dialog hint
* chore(protocol): regenerate gateway clients and SDK baseline after rebase
* fix(gateway): merge secrets store methods after project RPCs in advertised order
* chore: leave changelog to release generation
* test(gateway): retain desktop launch train coverage
2026-08-11 07:20:38 +00:00
19a98c873c
refactor(auth): finish SQLite-only auth profile cutover ( #114033 )
...
* refactor(auth): finish SQLite-only profile cutover
* test(auth): isolate SQLite shadow fixtures
* test(auth): satisfy OAuth refresh lint
* test(auth): infer legacy sidecar fixtures
* fix(auth): fail closed on unreadable stores
* fix(auth): recheck migration readiness on lookup
* fix(auth): preserve compatibility owner checks
* fix(auth): align SQLite cutover proof
* style(qa): format SQLite auth helpers
* fix(auth): recover interrupted SQLite migrations
* fix(auth): bind materialized SQLite refs
* style(auth): clarify receipt hash value
* fix(auth): preserve state-only OAuth routing
* fix(auth): snapshot receipted migration sources
* fix(auth): fail closed across recovery races
* fix(auth): close legacy recovery gaps
* fix(auth): serialize SQLite refresh recovery
2026-07-26 07:27:54 -04:00
82d1a03f25
refactor(agents): move implicit-main fallback into load-time roster injection ( #112678 )
...
* refactor(agents): require explicit roster defaults
* feat(onboard): create named first roster agent
* refactor(agents): remove runtime main fallbacks
* style(agents): apply roster refactor formatting
* refactor(agents): finish roster-only runtime sweep
* fix(doctor): migrate legacy main session sqlite
* fix(doctor): harden roster session migrations
* fix(onboard): commit first agent atomically
* fix(config): support empty-roster analysis
* fix(agents): preserve legacy main state during creation
* fix(setup): materialize baseline agent roster
* fix(agents): harden legacy default transfer recovery
* fix(agents): simplify roster-only legacy compatibility
* fix(agents): preserve staged first-agent entries
* fix(config): migrate persisted implicit-main rosters
* fix(config): preserve staged empty rosters
* fix(agents): finalize roster-only upgrade paths
* fix(sessions): close legacy main migration outcomes
* fix(config): migrate legacy roster markers at load
* fix(sessions): preserve roster upgrade history
* refactor(sessions): restore lean legacy main compatibility
* fix(setup): prepare first-agent credentials before publish
* fix(config): stabilize roster snapshot migration
* refactor(sessions): shrink legacy main compatibility
* fix(agents): restore roster compatibility fidelity
* fix(sessions): preserve divergent legacy history
* refactor(agents): narrow roster-only scope
* fix(config): isolate roster migration
* test(agents): align roster-only fixtures
* fix(agents): keep main agent undeletable
* fix(agents): harden roster migration invariants
* fix(agents): close setup and audit scope gaps
* fix(cron): scope session reaper throttles by agent
* fix(agents): preserve scoped owner precedence
* fix(config): preserve authored config ownership
* fix(setup): keep default workspace and roster in sync
* fix(setup): preserve default entry workspace on bare runs
* fix(agents): adapt roster rebase to keyed entries
* fix(agents): honor both roster representations
* fix(agents): route roster reads through shared helpers
* fix(config): preserve canonical roster writes
* fix(cron): resolve dynamic default for session reaper
* fix(agents): close dynamic default migration gaps
* fix(agents): align scoped session ownership
* fix(sessions): preserve legacy main directory casing
* fix(agents): align cron and legacy auth ownership
* fix(setup): provision the committed default workspace
* fix(cron): align scoped ownership and reaping
* fix(cron): treat blank agent ids as absent
* fix(cron): retain configured session-store owners
* fix(agents): repair roster-aware CI boundaries
* fix(cron): preserve scoped ownership resolution
* fix(agents): preserve rosterless maintenance paths
* fix(agents): propagate roster ownership through runtime boundaries
* fix(agents): preserve roster ownership across runtime paths
* fix(agents): harden roster diagnostics and legacy routing
* fix(agents): remove redundant diagnostic import
* test(agents): type CLI policy fixture explicitly
* fix(config): preserve canonical roster mutation identity
* fix(doctor): read canonical agent rosters consistently
* fix(config): resolve compound roster unsets safely
* fix(config): finalize main-session reconciliation
* fix(doctor): read canonical session state safely
* fix(sessions): preserve current visibility alias
* fix(config): track roster include provenance
* test(config): type roster provenance cases
* fix(config): refine roster include ownership
* fix(agents): preserve staged roster invariants
* test(config): align fixtures with explicit roster ownership
* test(node-host): preserve optional plan typing
* fix(config): preserve authored roster projections
* test(config): keep raw roster fixtures explicit
* test(config): normalize rosters at runtime fixtures
* fix(config): protect authored roster ownership
* fix(agents): require explicit session ownership
* fix(agents): enforce scoped roster ownership
* fix(sessions): merge fixed-store agent partitions
* fix(agents): harden roster ownership boundaries
* fix(config): reject ambiguous roster projections
* fix(sessions): preserve persisted store ownership
* fix(sessions): keep collision diagnostics additive
* fix(security): scan malformed roster workspaces
* test(config): align snapshot fixtures after rebase
* test(agents): use explicit roster fixtures
* fix(config): harden roster diagnostic boundaries
* fix(sessions): isolate fixed-store agent databases
* test(agents): type malformed default markers
* refactor(sessions): extract store collision resolution
* test(system-agent): split oversized setup coverage
* style(system-agent): format split setup suite
* fix(sessions): preserve promoted store ownership
* fix(sessions): derive scoped owner before target
* fix(sessions): preserve explicit sqlite ownership
* fix(agents): restore roster compatibility across CI
* fix(agents): enforce roster-owned runtime boundaries
* fix(agents): satisfy default lookup lint
* test(sessions): split known-owner coverage
* fix(state): satisfy path identity lint
* fix(agents): preserve malformed roster safety boundaries
* fix(agents): restore roster compatibility at runtime boundaries
* fix(config): satisfy roster boundary type checks
* fix(agents): preserve roster ownership across runtime probes
Setup inference probes now execute as the configured roster owner. Malformed agent-prefixed session rows are intentionally omitted by the fail-closed visibility contract rather than normalized by tests.
* fix(agents): satisfy session list owner lint
* fix(agents): preserve roster-owned runtime boundaries
Restore shared logical rows for exact SQLite session locators while keeping their physical database owner separate. The ownership regression test now constructs an explicit sole-owner database directly instead of relying on first-touch capture, matching the intentional shared-store contract.
* fix(sessions): preserve multiply owned exact stores
* fix(sessions): restore runtime owner boundaries
Keep incognito sentinels agent-owned, fold default-agent approvals into the global snapshot, and preserve the configless legacy-main CLI policy fallback. Also repair the existing CLI watchdog test lifecycle so the compact shard observes its timeout without an unawaited assertion or async timer stall; product behavior is unchanged by that test-only fix.
* test(ci): align owner-scoped fixtures
These assertions are unchanged. The fixtures now declare the intended non-default runner, expose the session-key constant imported by production status code, and select the main approvals bucket explicitly on Windows.
* fix(agents): close final roster ownership gaps
2026-07-24 22:38:09 -07:00
8a5c8690e1
fix(secrets): keep unaffected owners live during reload failures ( #110779 )
...
* fix(secrets): isolate reload failures per owner
* refactor(secrets): split runtime activation helpers
* fix(secrets): export web warning type
* fix(secrets): reject unsafe degraded config writes
* fix(secrets): derive reload defaults type
* fix(secrets): defer reload state publication
* fix(secrets): preserve partial refresh state
* fix(secrets): retry superseded reload preflight
* fix(secrets): bind stale credentials to owner contracts
* fix(secrets): scope degraded credential contracts
* fix(secrets): restore source ownership guards
* fix(secrets): recover provider-only degradation
* fix(secrets): enforce degraded reload contracts
* fix(secrets): preserve scoped reload state
* fix(secrets): reconcile deferred descendant state
* fix(secrets): commit reload state atomically
* fix(secrets): preserve source transaction lineage
* test(secrets): use non-secret lineage marker
* chore(plugin-sdk): refresh API baseline
* fix(secrets): canonicalize web owner contracts
* fix(plugin-sdk): preserve legacy secret owner contracts
* fix(secrets): satisfy startup activation types
* test(secrets): align reload fixtures with owner contracts
* refactor(secrets): move source recovery scope helper
* fix(secrets): preserve owner contracts on web failures
* fix(secrets): bind legacy web resolution contract
* fix(secrets): retry stale auth publication
2026-07-18 18:29:24 +01:00
347ee45895
fix(secrets): surface degradation in logs and doctor ( #109792 )
...
* fix(secrets): surface degraded owners safely
* fix(secrets): preserve degradation ownership across reloads
* fix(secrets): require cold ownership for source recovery
* refactor(secrets): keep assignment provenance internal
* test(secrets): use provider error contract
* fix(secrets): attribute provider failures to active co-owners
* test(secrets): clarify provider failure fixture
* fix(secrets): redact doctor degradation reasons
* test(secrets): align reload harness with runtime state
* test(secrets): cover atomic source publication
* fix(secrets): preserve web owner degradation context
* fix(secrets): retain active web degradation co-owners
* fix(secrets): keep web provider error internal
* refactor(secrets): unify reload degradation state
* refactor(config): remove obsolete source snapshot setter
2026-07-18 11:46:53 +01:00
d4ae2bb01f
fix(agent): materialize local auth profile refs
2026-07-17 21:55:27 +01:00
0097363c69
fix(secrets): keep gateway alive when web provider refs fail ( #109687 )
...
* fix(secrets): isolate unavailable web providers
* fix(secrets): keep web result type internal
* fix(secrets): hide unavailable web selections
2026-07-16 23:48:37 -07:00
17c2ce05d8
fix(secrets): keep startup alive when TTS SecretRefs are missing ( #101265 )
...
* fix(secrets): degrade missing TTS SecretRefs at startup
* test(secrets): keep non-activating startup strict
* test(secrets): mark denied key fixture synthetic
* test(secrets): use synthetic TTS key fixture
* test(secrets): use neutral TTS key placeholder
* test(secrets): isolate TTS key placeholder
* test(secrets): shorten TTS ref fixture name
* test(secrets): normalize synthetic credential fixtures
* test(secrets): isolate optional redaction coverage
* fix(secrets): preserve degraded TTS ref ownership
* refactor(secrets): keep optional resolver internal
* test(secrets): cover default provider alias misses
* test(secrets): pin explicit provider ownership
* style(secrets): format optional assignment imports
* refactor(secrets): keep optional metadata private
* style(secrets): restore collector file header
* fix(secrets): isolate unavailable SecretRef owners
Co-authored-by: snowzlmbot <293528334+snowzlmbot@users.noreply.github.com >
* test(secrets): complete provider fixtures
* style(status): avoid degraded path shadowing
* style(secrets): satisfy runtime lint
* refactor(secrets): keep error codes internal
* fix(secrets): keep unowned assignments fail closed
* fix(secrets): preserve provider resolution batching
* fix(secrets): normalize stalled resolution errors
* fix(secrets): reject provider limit violations
---------
Co-authored-by: snowzlmbot <293528334+snowzlmbot@users.noreply.github.com >
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-16 21:07:01 -07:00
3616fba951
fix(gateway): make hot reload transactional ( #105289 )
...
* fix(gateway): make hot reload transactional
Replace partial reload side effects with a deferred transaction that publishes config, secrets, auth, and subsystem state together, and drains in-flight reload work before shutdown.
Co-authored-by: LZY3538 <293718838+LZY3538@users.noreply.github.com >
* fix(auth): preserve state-only credential ownership
Keep derived runtime snapshots in place for main-store state mutations so order refreshes do not look like credential replacement.
* fix(gateway): close reload transaction gaps
* fix(gateway): close merged reload gaps
* chore: move reload note to PR context
* fix(gateway): exclude restart emission root
---------
Co-authored-by: LZY3538 <293718838+LZY3538@users.noreply.github.com >
2026-07-12 18:16:15 -07:00
4bf70be01a
feat(secrets): egress-time credential injection with process-local sentinels ( #102009 )
...
* feat(secrets): resolve SecretRef model credentials at egress via process-local sentinels
SecretRef-managed model-provider credentials now travel as opaque
oc-sent-v1 sentinels through auth storage, stream options, and SDK
config; the guarded model fetch injects real values into headers and
URLs immediately before the SSRF-guarded send and fails closed on
unknown sentinels. packages/ai adapters converge on the host guarded
fetch where the SDK supports custom fetch and unwrap at construction
where it does not. Resolved values (and their percent-encoded forms)
register for exact-value log redaction. Kill switch:
OPENCLAW_SECRET_SENTINELS=off. Also fixes a pre-existing unhandled
rejection race in capNonOkResponseBodyLazily (pipeThrough writer leak).
* test(plugin-sdk): update public surface budget
2026-07-08 12:56:41 +01:00
5fa2082655
refactor(shared): consolidate core leaf lazy loaders ( #99278 )
2026-07-02 18:06:00 -07:00
d28ac4dbdb
docs: document secrets target registry
2026-06-04 05:13:24 -04:00
deb7bc6539
chore(lint): enable readability lint rules
2026-05-31 07:17:57 +01:00
00d8d7ead0
refactor: extract normalization core package
...
Extract shared normalization/coercion helpers into private @openclaw/normalization-core workspace package while preserving existing plugin SDK helper subpaths.\n\nAlso keeps direct normalization-core imports internal, wires UI/build/loader resolution, and replaces the slow PR network CodeQL lane with a fast added-line boundary scan while retaining full CodeQL for scheduled/manual runs.\n\nVerification: local moved tests, plugin SDK boundary tests, extension loader tests, agents-support shard, UI build/test, build artifacts, lint, workflow guards, autoreview, and GitHub CI passed on PR head 963d893715
2026-05-31 01:33:00 +01:00
6037a74660
Add plugin manifest contract for SecretRef provider integrations ( #82326 )
...
* secret-provider-integrations
Signed-off-by: sallyom <somalley@redhat.com >
* feat(secrets): configure plugin provider presets
* secrets: use plugin-managed provider refs
Signed-off-by: sallyom <somalley@redhat.com >
* fix secretref auth profile service env
* test secret provider integration e2e
* fix secretref plugin config service env
* fix secret provider preset schema alignment
* stabilize secret provider service proof
* validate secret provider plugin integrations
* harden secret provider resolver paths
* scope secret provider config validation
* stabilize openai secret provider proof
* fix secret provider metadata proof
* stabilize config baseline proof
* fix secret provider e2e lint
---------
Signed-off-by: sallyom <somalley@redhat.com >
Co-authored-by: joshavant <830519+joshavant@users.noreply.github.com >
2026-05-29 18:20:45 -04:00
77d9ac30bb
refactor: reuse shared coercion helpers ( #86419 )
...
* refactor: share talk event metric extraction
* refactor: reuse shared coercion helpers
* refactor: reuse shared primitive guards
* refactor: reuse shared record guard
* refactor: reuse shared primitive helpers
* refactor: reuse shared string guards
* refactor: reuse shared non-empty string guard
* refactor: share plugin primitive coercion helpers
* refactor: reuse plugin coercion helpers
* refactor: reuse plugin coercion helpers in more plugins
* refactor: reuse channel coercion helpers
* refactor: reuse monitor coercion helpers
* refactor: reuse provider coercion helpers
* refactor: reuse core coercion helpers
* refactor: reuse runtime coercion helpers
* refactor: reuse helper coercion in codex paths
* refactor: reuse helper coercion in runtime paths
* refactor: reuse codex app-server coercion helpers
* refactor: reuse codex record helpers
* refactor: reuse migration and qa record helpers
* refactor: reuse feishu and core helper guards
* refactor: reuse browser and policy coercion helpers
* refactor: reuse memory wiki record helper
* refactor: share boolean coercion helpers
* refactor: reuse finite number coercion
* refactor: reuse trimmed string list helpers
* refactor: reuse string list normalization
* refactor: reuse remaining string list helpers
* refactor: reuse string entry normalizer
* refactor: share sorted string helpers
* refactor: share string list normalization
* test: preserve command registry browser imports
* refactor: reuse trimmed list helpers
* refactor: reuse string dedupe helpers
* refactor: reuse local dedupe helpers
* refactor: reuse more string dedupe helpers
* refactor: reuse command string dedupe helpers
* refactor: dedupe memory path lists with helper
* refactor: expose string dedupe helpers to plugins
* refactor: reuse core string dedupe helpers
* refactor: reuse shared unique value helpers
* refactor: reuse unique helpers in agent utilities
* refactor: reuse unique helpers in config plumbing
* refactor: reuse unique helpers in extensions
* refactor: reuse unique helpers in core utilities
* refactor: reuse unique helpers in qa plugins
* refactor: reuse unique helpers in memory plugins
* refactor: reuse unique helpers in channel plugins
* refactor: reuse unique helpers in core tails
* refactor: reuse unique helper in comfy workflow
* refactor: reuse unique helpers in test utilities
* refactor: expose unique value helper to plugins
* refactor: reuse unique helpers for numeric lists
* refactor: replace index dedupe filters
* refactor: reuse string entry normalization
* refactor: reuse string normalization in plugin helpers
* refactor: reuse string normalization in extension helpers
* refactor: reuse string normalization in channel parsers
* refactor: reuse string normalization in memory search
* refactor: reuse string normalization in provider parsers
* refactor: reuse string normalization in qa helpers
* refactor: reuse string normalization in infra parsers
* refactor: reuse string normalization in messaging parsers
* refactor: reuse string normalization in core parsers
* refactor: reuse string normalization in extension parsers
* refactor: reuse string normalization in remaining parsers
* refactor: reuse string normalization in final parser spots
* refactor: reuse string normalization in qa media helpers
* refactor: reuse normalization in provider and media lists
* refactor: reuse normalization for remaining set filters
* refactor: reuse normalization in policy allowlists
* refactor: reuse normalization in session and owner lists
* refactor: centralize primitive string lists
* refactor: reuse lowercase entry helpers
* refactor: reuse sorted string helpers
* refactor: reuse unique trimmed helpers
* refactor: reuse string normalization helpers
* refactor: reuse catalog string helpers
* refactor: reuse remaining string helpers
* refactor: simplify remaining list normalization
* refactor: reuse codex auth order normalization
* chore: refresh plugin sdk api baseline
* fix: make shared string sorting deterministic
* chore: refresh plugin sdk api baseline
* fix: align host env security ordering
2026-05-25 21:20:41 +01:00
31145e0dd9
[Fix] Preflight runtime SecretRefs before config writes ( #84454 )
...
* fix(config): preflight runtime secret refs before writes
* fix(config): restore include rollback env
* docs(changelog): note SecretRef config preflight
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-05-24 03:40:15 +01:00
2bb448908d
fix: keep config writes independent of auth profile refs
2026-05-18 13:34:49 +01:00
0177a4b6c9
fix(gateway): speed up secrets startup
...
Summary:
- Split the lightweight secrets runtime state and auth-store cache from the full secrets runtime.
- Use the startup fast path whenever gateway startup has no SecretRef values, while preserving cleanup and refresh semantics.
- Add regression coverage for startup-only empty auth-store snapshots and update affected gateway/tool tests.
Verification:
- pnpm test src/secrets/runtime.fast-path.test.ts src/secrets/runtime-state.test.ts src/gateway/server-startup-config.secrets.test.ts src/gateway/server-import-boundary.test.ts src/gateway/server-aux-handlers.test.ts src/gateway/server-methods/config.shared-auth.test.ts src/agents/tools/web-tools.enabled-defaults.test.ts src/agents/tools/web-tool-runtime-context.test.ts -- --reporter=verbose
- pnpm build
- pnpm format:check -- src/agents/tools/web-tools.enabled-defaults.test.ts src/secrets/runtime-command-secrets.ts src/secrets/runtime-fast-path.ts src/secrets/runtime.fast-path.test.ts src/agents/auth-profiles/store.ts src/agents/auth-profiles/store-cache.ts src/secrets/runtime-state.ts src/secrets/runtime-state.test.ts src/gateway/server-startup-config.ts
- codex-review --mode branch
- isolated gateway token-auth smoke: openclaw gateway run + openclaw gateway health returned ok: true
- GitHub CI on PR #83031 green; newer Real behavior proof run passed on current SHA f27ed3f7cesamzong.lu@gmail.com >
2026-05-17 10:55:41 +01:00
9e67f53b91
fix(cli): resolve web command SecretRefs
...
Fix CLI web search/fetch command SecretRef resolution for provider-scoped plugin credentials.
- Carry command provider overrides through gateway and local secret resolution.
- Mark the selected web provider targets active and unrelated plugin refs inactive.
- Cover Tavily, DuckDuckGo, legacy Firecrawl fetch, protocol overrides, and runtime command-secret behavior.
- Add public plugin-sdk test mock exports needed by existing plugin tests after CI boundary enforcement.
Fixes #82621 .
Replacement for #82699 .
Co-authored-by: 吴杨帆 <39647285+leno23@users.noreply.github.com >
2026-05-17 03:00:39 +01:00
64b94daf92
Fix gateway auth logout aborting active runs ( #82346 )
...
* fix gateway auth logout aborts active runs
* docs changelog for auth logout abort fix
* test fix auth logout typecheck
* test fix auth profile mock shape
2026-05-15 18:36:49 -05:00
35da7d2c99
refactor: remove legacy agent dir resolver
2026-05-05 20:07:49 +01:00
b1f8172867
fix(secretrefs): resolve external channel contracts ( #76449 )
2026-05-02 23:48:11 -05:00
71da5af164
refactor: reuse plugin metadata snapshots
2026-05-02 07:13:17 +01:00
afb17eade9
fix(secrets): skip optional web fetch discovery before bind
2026-04-30 14:45:55 +01:00
e27fe55aa8
refactor: simplify plugin cache boundaries
2026-04-29 04:33:15 +01:00
10763781fd
fix(config): resolve plugin contracts cold
2026-04-25 19:33:56 -07:00
f3e6eeb643
perf(gateway): fast path startup secrets
2026-04-20 21:30:06 +01:00
74e7b8d47b
fix(cycles): bulk extract leaf type surfaces
2026-04-11 13:26:50 +01:00
5ae27dfb5a
perf(secrets): skip idle plugin origin discovery
2026-04-07 10:27:02 +01:00
73485c2300
perf(secrets): trim runtime import walls
2026-04-06 07:32:12 +01:00
b432dc5af9
perf(test): trim secrets runtime coverage
2026-04-06 06:45:05 +01:00
97878b853a
refactor: move legacy config migration behind doctor
2026-04-05 16:12:45 +01:00
7343d1b2ad
fix(runtime): guard import-time side effects
2026-04-05 13:20:06 +01:00
3872a866a1
fix(xai): make x_search auth plugin-owned ( #59691 )
...
* fix(xai): make x_search auth plugin-owned
* fix(xai): restore x_search runtime migration fallback
* fix(xai): narrow legacy x_search auth migration
* fix(secrets): drop legacy x_search target registry entry
* fix(xai): no-op knob-only x_search migration fallback
2026-04-02 23:54:07 +09:00
3e4de956c0
!refactor(xai): move x_search config behind plugin boundary ( #59674 )
...
* refactor(xai): move x_search config behind plugin boundary
* chore(changelog): note x_search config migration
* fix(xai): include x_search migration helpers
2026-04-02 22:08:59 +09:00
81b777c768
fix(config): harden SecretRef round-trip handling in Control UI and RPC writes ( #58044 )
...
* Config: harden SecretRef round-trip handling
* Gateway: test SecretRef preflight on config writes
* Agents: align skill loader with upstream Skill type
* Docs: align SecretRef write semantics with Control UI and RPC behavior
* Config: add UI and gateway regression evidence for SecretRef hardening
* Config: add token SecretRef restore regression and skill sourceInfo compat
* UI: scope structured-value lockout to SecretRef fields
* Agents: remove out-of-scope skill loader compat edits
* UI: reduce app-render churn to rawAvailable-only changes
* Gateway: scope SecretRef preflight to submitted config
* Docs: clarify config write SecretRef preflight scope
* changelog
Signed-off-by: joshavant <830519+joshavant@users.noreply.github.com >
---------
Signed-off-by: joshavant <830519+joshavant@users.noreply.github.com >
2026-03-30 23:55:03 -05:00
694bc082a8
fix: resolve acpx MCP secret inputs
2026-03-30 05:30:32 +09:00
01bcbcf8d5
refactor: require legacy config migration on read
2026-03-26 23:23:47 +00:00
6b9915a106
refactor!: drop legacy CLAWDBOT env compatibility
2026-03-22 22:13:39 -07:00
24b9baebab
fix: preserve runtime path env in secrets snapshots
2026-03-22 15:25:58 -07:00
467dae53cf
Secrets: honor caller env during runtime validation
2026-03-16 12:31:44 +00:00
f0eb67923c
fix(secrets): resolve web tool SecretRefs atomically at runtime
2026-03-09 22:57:03 -05:00
4ff4ed7ec9
fix(config): refresh runtime snapshot from disk after write. Fixes #37175 ( #37313 )
...
Merged via squash.
Prepared head SHA: 69e1861abf122739024+bbblending@users.noreply.github.com >
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com >
Reviewed-by: @gumadeiras
2026-03-08 19:49:15 -04:00
806803b7ef
feat(secrets): expand SecretRef coverage across user-supplied credentials ( #29580 )
...
* feat(secrets): expand secret target coverage and gateway tooling
* docs(secrets): align gateway and CLI secret docs
* chore(protocol): regenerate swift gateway models for secrets methods
* fix(config): restore talk apiKey fallback and stabilize runner test
* ci(windows): reduce test worker count for shard stability
* ci(windows): raise node heap for test shard stability
* test(feishu): make proxy env precedence assertion windows-safe
* fix(gateway): resolve auth password SecretInput refs for clients
* fix(gateway): resolve remote SecretInput credentials for clients
* fix(secrets): skip inactive refs in command snapshot assignments
* fix(secrets): scope gateway.remote refs to effective auth surfaces
* fix(secrets): ignore memory defaults when enabled agents disable search
* fix(secrets): honor Google Chat serviceAccountRef inheritance
* fix(secrets): address tsgo errors in command and gateway collectors
* fix(secrets): avoid auth-store load in providers-only configure
* fix(gateway): defer local password ref resolution by precedence
* fix(secrets): gate telegram webhook secret refs by webhook mode
* fix(secrets): gate slack signing secret refs to http mode
* fix(secrets): skip telegram botToken refs when tokenFile is set
* fix(secrets): gate discord pluralkit refs by enabled flag
* fix(secrets): gate discord voice tts refs by voice enabled
* test(secrets): make runtime fixture modes explicit
* fix(cli): resolve local qr password secret refs
* fix(cli): fail when gateway leaves command refs unresolved
* fix(gateway): fail when local password SecretRef is unresolved
* fix(gateway): fail when required remote SecretRefs are unresolved
* fix(gateway): resolve local password refs only when password can win
* fix(cli): skip local password SecretRef resolution on qr token override
* test(gateway): cast SecretRef fixtures to OpenClawConfig
* test(secrets): activate mode-gated targets in runtime coverage fixture
* fix(cron): support SecretInput webhook tokens safely
* fix(bluebubbles): support SecretInput passwords across config paths
* fix(msteams): make appPassword SecretInput-safe in onboarding/token paths
* fix(bluebubbles): align SecretInput schema helper typing
* fix(cli): clarify secrets.resolve version-skew errors
* refactor(secrets): return structured inactive paths from secrets.resolve
* refactor(gateway): type onboarding secret writes as SecretInput
* chore(protocol): regenerate swift models for secrets.resolve
* feat(secrets): expand extension credential secretref support
* fix(secrets): gate web-search refs by active provider
* fix(onboarding): detect SecretRef credentials in extension status
* fix(onboarding): allow keeping existing ref in secret prompt
* fix(onboarding): resolve gateway password SecretRefs for probe and tui
* fix(onboarding): honor secret-input-mode for local gateway auth
* fix(acp): resolve gateway SecretInput credentials
* fix(secrets): gate gateway.remote refs to remote surfaces
* test(secrets): cover pattern matching and inactive array refs
* docs(secrets): clarify secrets.resolve and remote active surfaces
* fix(bluebubbles): keep existing SecretRef during onboarding
* fix(tests): resolve CI type errors in new SecretRef coverage
* fix(extensions): replace raw fetch with SSRF-guarded fetch
* test(secrets): mark gateway remote targets active in runtime coverage
* test(infra): normalize home-prefix expectation across platforms
* fix(cli): only resolve local qr password refs in password mode
* test(cli): cover local qr token mode with unresolved password ref
* docs(cli): clarify local qr password ref resolution behavior
* refactor(extensions): reuse sdk SecretInput helpers
* fix(wizard): resolve onboarding env-template secrets before plaintext
* fix(cli): surface secrets.resolve diagnostics in memory and qr
* test(secrets): repair post-rebase runtime and fixtures
* fix(gateway): skip remote password ref resolution when token wins
* fix(secrets): treat tailscale remote gateway refs as active
* fix(gateway): allow remote password fallback when token ref is unresolved
* fix(gateway): ignore stale local password refs for none and trusted-proxy
* fix(gateway): skip remote secret ref resolution on local call paths
* test(cli): cover qr remote tailscale secret ref resolution
* fix(secrets): align gateway password active-surface with auth inference
* fix(cli): resolve inferred local gateway password refs in qr
* fix(gateway): prefer resolvable remote password over token ref pre-resolution
* test(gateway): cover none and trusted-proxy stale password refs
* docs(secrets): sync qr and gateway active-surface behavior
* fix: restore stability blockers from pre-release audit
* Secrets: fix collector/runtime precedence contradictions
* docs: align secrets and web credential docs
* fix(rebase): resolve integration regressions after main rebase
* fix(node-host): resolve gateway secret refs for auth
* fix(secrets): harden secretinput runtime readers
* gateway: skip inactive auth secretref resolution
* cli: avoid gateway preflight for inactive secret refs
* extensions: allow unresolved refs in onboarding status
* tests: fix qr-cli module mock hoist ordering
* Security: align audit checks with SecretInput resolution
* Gateway: resolve local-mode remote fallback secret refs
* Node host: avoid resolving inactive password secret refs
* Secrets runtime: mark Slack appToken inactive for HTTP mode
* secrets: keep inactive gateway remote refs non-blocking
* cli: include agent memory secret targets in runtime resolution
* docs(secrets): sync docs with active-surface and web search behavior
* fix(secrets): keep telegram top-level token refs active for blank account tokens
* fix(daemon): resolve gateway password secret refs for probe auth
* fix(secrets): skip IRC NickServ ref resolution when NickServ is disabled
* fix(secrets): align token inheritance and exec timeout defaults
* docs(secrets): clarify active-surface notes in cli docs
* cli: require secrets.resolve gateway capability
* gateway: log auth secret surface diagnostics
* secrets: remove dead provider resolver module
* fix(secrets): restore gateway auth precedence and fallback resolution
* fix(tests): align plugin runtime mock typings
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-03-03 02:58:20 +00:00
8a4d8c889c
fix(secrets): normalize inline SecretRef token/key to tokenRef/keyRef in runtime snapshot ( #31047 )
...
* fix(secrets): normalize inline SecretRef token/key to tokenRef/keyRef in runtime snapshot
When auth-profiles.json uses an inline SecretRef as the token or key
value directly (e.g. `"token": {"source":"file",...}`), the resolved
plaintext was written back to disk on every updateAuthProfileStoreWithLock
call, overwriting the SecretRef.
Root cause: collectTokenProfileAssignment and collectApiKeyProfileAssignment
detected inline SecretRefs but did not promote them to the canonical
tokenRef/keyRef fields. saveAuthProfileStore only strips plaintext when
tokenRef/keyRef is set, so the inline case fell through and persisted
plaintext on every save.
Fix: when an inline SecretRef is detected and no explicit tokenRef/keyRef
exists, promote it to the canonical field and delete the inline form.
saveAuthProfileStore then correctly strips the resolved plaintext on write.
Fixes #29108
* fix test: cast inline SecretRef loadAuthStore mocks to AuthProfileStore
* fix(secrets): fix TypeScript type error in runtime test loadAuthStore lambda
* test(secrets): keep explicit keyRef precedence over inline key ref
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-03-02 03:34:23 +00:00
Peter Steinberger