Inbound image, audio, and video attachments could vanish with no recorded outcome and no model-visible explanation: attachments dropped by first-only selection, disabled or unconfigured capabilities, stage failures, URL-only images, and ACP-undelivered images all left the model unaware the media existed. Fixes#122044; completes the outcome custody started for documents in #122025.
Media capabilities now record one closed disposition per pre-truncation candidate at the decision site that owns the reason, with a memoized lazy native-vision probe (fires only when a marker could render; failure yields unknown and never alters outcomes; explicit image models never pay a catalog lookup). One late reader renders bounded, actionable markers from recorded facts only: native-vision and ACP-delivered images suppress per verified index, recorded failures always render, and document plus media markers share one five-marker budget with a reason-neutral overflow summary. The shipped SDK decision type stays additive (optional dispositions map).
Proof: 906 + 103 focused tests including nine adversarial-review regressions, ClawSweeper local review clean (round 9, zero findings, security cleared), live Telegram image drive showing ref preservation with no false marker.
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
* fix(ui): hide unusable models from picker
* refactor(ui): remove stale model availability helper
* refactor(ui): simplify catalog state guards
* style: format provider catalog imports
* chore: refresh plugin SDK API baseline
* refactor(core): break provider catalog type cycle
* chore(protocol): refresh models list Swift output
* chore: refresh plugin SDK API baseline after rebase
* fix(gateway): preserve full catalog preload semantics
* fix(ui): keep model status within startup budget
* fix(ui): preserve provider status within startup budget
* fix(models): scope live catalog outcomes
* test(ui): expect agent-scoped model refresh
* test(ui): align model refresh e2e fixtures
Schema versions are global v6 and agent v17 (src/state/openclaw-state-db-contract.ts:6; src/state/openclaw-agent-db-contract.ts:22). State v5/v6 provenance comes from 7a7d6bb and 509a5f0, matching the current contract comments at src/state/openclaw-state-db-contract.ts:4.
QMD is retired and Doctor migrates its paths to builtin memory (src/commands/doctor/shared/legacy-config-migrations.runtime.retired-memory-qmd.ts:94). Device auth is SQLite-backed in TypeScript and Swift while Android remains SecurePrefs-backed (src/infra/device-auth-store.ts:115; apps/shared/OpenClawKit/Sources/OpenClawKit/DeviceAuthStore.swift:26; apps/android/app/src/main/java/ai/openclaw/app/gateway/DeviceAuthStore.kt:55).
Opt-in cache, payload, raw-stream, timeline, and macOS diagnostics remain JSONL artifacts (src/agents/cache-trace.ts:93; src/agents/anthropic-payload-log.ts:46; src/agents/embedded-agent-subscribe.raw-stream.ts:16; src/infra/diagnostics-timeline.ts:96; apps/macos/Sources/OpenClaw/DiagnosticsFileLog.swift:3).
The canonical agent schema currently has cache_entries but no VFS/tool/run artifact tables, and subagent attachments materialize in child workspaces (src/state/openclaw-agent-schema.sql:398; src/agents/subagents/spawn/subagent-attachments.ts:308). Current Doctor/session owners replace deleted prototype paths (src/infra/state-migrations.doctor.ts:66; src/config/sessions/session-accessor.sqlite-entry.ts:165; src/config/sessions/paths.ts:320).
Close the barrel gap (SessionEntryListScope), migrate the 14 production
type-bypass imports and the sessions-rewind raw-op imports through the
accessor barrel, and document session-accessor.sqlite-scope as the
sanctioned low-level entry point for doctor/migrations/infra. Net +8
production LOC: the barrel gains its missing surface. Part 3 (final) of
the session-accessor dual-layer collapse (#121316, #121536).
Inbound document attachments could vanish silently (DOCX and other Office files, read failures, disabled URL sources). File intake now classifies every attachment into a closed outcome union rendered through one exhaustiveness-checked path: unsupported formats, policy-rejected types, unreadable files, and disabled URL sources all produce bounded model-visible markers (max five per message plus one overflow summary), with strict MIME-token and URL-basename sanitization so attachment metadata cannot inject prompt text or leak signed-URL credentials. Media-stage outcome custody is tracked separately in #122044.
Proof: focused media suites (1855 tests), pre-fix regression, exact-head ci-gate green, ClawSweeper local review clean, and a live Telegram E2E showing the DOCX marker in the model payload.
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
Unset heartbeat.target now resolves "owner": elected heartbeat notifications deliver to the operator's DM resolved from commands.ownerAllowFrom or the channel allowFrom (first concrete entry; wildcards and channel-scoped wildcards excluded; configured owners exhausted across channels before any channel-local fallback). Delivery requires the channel's own classifier to positively prove a direct destination — every bundled messaging plugin now ships an inferTargetChatType contract — and unproven or group-shaped destinations fail closed to the visible no-route state. The first implicitly-routed delivery carries a one-line self-explanation naming the target: "none" opt-out. Explicit target "last" remains as the follow-the-conversation opt-in. Refines the unreleased #121892 default before it ships; refs #121880.
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* feat(ui): show a workspace's own project icon in the chat workspace chip
Resolve the conventional project icon inside a session's workspace root once
per Gateway process and serve it over a strictly scoped authenticated route so
the Control UI can render real project identity instead of a folder glyph.
Refs #121723
* test(gateway): keep the workspace icon server teardown out of a promise executor return
* fix(ui): keep flat project icons legible on the workspace chip in every theme
* feat(ui): lead the chat header with the project, then the session title
Reorder the header into an identity trail — project chip, muted slash, session
title — rendered from one segment list so a later parent-session segment
extends it. Drop the project icon halo and record the flat-dark-icon contrast
tradeoff at the style site.
Refs #121723
* fix(ui): type the header identity trail segments without a lit result predicate
* fix(gateway): scope the workspace icon route to visible local sessions
Owner-gate the route so it cannot answer for sessions the caller's own
sessions.list would hide, withhold the workspace root of exec-node sessions so
a remote project never resolves to this host's icon, bound SVG icons before
they reach a renderer, and retry ordered Control UI credentials so a stale
saved token no longer silently drops the icon.
Refs #121723
* fix(ui): render the header project as a flat breadcrumb segment, not a badge
Drop the pill border, fill, and radius from the project name so it reads as a
quiet trail segment inline with the session title: one type size across the
trail, hierarchy carried by colour, hover and focus reusing the sibling title
button's tint so removing the border keeps a visible focus indicator.
Refs #121723
* fix(ui): balance the header trail separator spacing after the title pull-back
* test(ui): migrate the shared avatar loader tests to ordered credential arrays
* fix(ui): center the chat header identity trail
* refactor(ui): reuse workspace icon credentials
* test(ui): scope deleted-session recovery to the visible pane
* fix(ui): cache missing workspace icons across renders
* chore: refresh plugin SDK API baseline
* refactor(sessions): drop the Sqlite infix from session-accessor exports
The storage-neutral seam completed its file->SQLite swap on 2026-07-27;
the Sqlite-infixed export names and their X-as-Y rename blocks were the
fossil of that migration, giving every accessor operation two greppable
names. Rename ~148 exports to their canonical names at the definition
sites, delete the message-cut facade (its conflict->failed mask had one
consumer, which already handles conflict), collapse the remaining pure
delegates, and keep honest SQLite-mechanics names (scope resolution,
canonical repair, in-transaction primitives, storage-row types). The main
barrel's exported surface is byte-identical. Net -203 production LOC.
Part 2 of the session-accessor dual-layer collapse (part 1: #121316).
* fix: repair main-breaking lint/type/test failures blocking PR CI
Three breakages landed on main that push CI's changed-scope never runs:
a caught-error cause missing in the release-validation script and two
type errors in the package-acceptance test (direct commit 1f591bba56),
and a memory-host regression where fs-safe 0.5.4 (#121508) started
throwing FsSafeError("not-file") for extra-path reads whose parent chain
hits a regular file, breaking the missing-file empty-text contract that
rejection unchanged.
Item 4 repairs managed-image action E2E narrowing from bad30d5a74 (#77017).
Item 5's chat-message mock repair was superseded upstream by 750d0dcd9e, whose broader fetch typing and explicit download capture preserve the same contract.
Item 6 restores #121258's cursor token contract after #77017 hard-coded pointer.
Item 7's managed-image thumbnail-path repair was superseded upstream by 750d0dcd9e, which preserves the same contract in main's reorganized URL structure.
Item 8 records #121600's explicit command-bearing lifecycle classification.
Item 9's cron assertion repair was superseded upstream by 3cd034f7a8, whose exact diagnostic rewrite includes the same redacted alert contract.
Item 10 forwards fs-safe 0.5.4 bigint lstat options through the snapshot mock.
Item 11 refreshes release-matrix test ownership after 1f591bba56.
Item 12 awaits f3e1efead48's setup-admission settlement in direct session tests.
Item 13's media FileStore-key repair was superseded upstream by cf432ec871, which fixes the same Windows root cause at the owner boundary.
Item 14 regenerates Swift approval reviewer fields added by 9935ca3b30.
* [AI] fix(context-engine): bound accepted-turn cap to the current turn range
The accepted-turn transcript read applied the 8 MiB / 20k-event cap to
the entire active prefix instead of the admitted turn range, so durable
context engines permanently blocked every later small turn once session
history exceeded the cap. Restrict the cap check to rows at or after the
admission message position while preserving the full messages +
prePromptMessageCount payload contract.
Fixes#121623
Co-Authored-By: Claude <noreply@anthropic.com>
* [AI] test(context-engine): clean up large-prefix regression temp dirs
ClawSweeper P3: the two new accepted-turn regression cases created
multi-megabyte SQLite fixture directories that were never removed.
Track them and delete them in afterEach.
Related to #121623
Co-Authored-By: Claude <noreply@anthropic.com>
* oc-136: make durable turn commits turn-local
* oc-514: use canonical temp-dir cleanup helper
* oc-514.7: version turn-local durable commits
* oc-514.9: preserve legacy durable rows
* oc-514.8: refresh plugin SDK API baseline
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Josh Lehman <550978+jalehman@users.noreply.github.com>
* fix(agents): remove stale media completion reply mechanics
Make generated image, music, and video completion wakes follow the current tool-agnostic visible-reply contract, preserving every structured attachment without NO_REPLY or transport-specific instructions.
Refs #121933.
* test(agents): remove stale media helper
Delete the unused assertion helper left behind by the table-driven generated-media completion coverage.\n\nRefs #121933.
* test(tooling): wait for profiler descendant pid
Require the PID file to contain a valid positive process ID before asserting profiler descendant cleanup, closing the create-before-write CI race.\n\nRefs #121971.
A final reply whose platform send was accepted but whose response was lost
previously ended in silence. Custody that stays unknown after a claimed send
now records durable pendingDeliveryNotice debt; the next same-route turn
delivers one "could not confirm delivery" notice and acknowledges it into the
transcript. Restart recovery completes ambiguous sessions with the same debt
instead of a fire-and-forget notice; the debt survives reset and rollover, and
suppressed notice sends retain it instead of faking delivery. Permanent typed
no-send rejections settle as terminal suppression (no replay, no false
notice); retryable ones restore prepared custody for safe replay. Google Chat
media-only rejections use the typed no-send contract; Telegram native-command
replies join pending-final custody.
Fixes#80362
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
Unset heartbeat.target silently collapsed into the explicit "none" opt-out: heartbeats ran every 30m by default, elected notifications were dropped with only an in-memory event, and health read fine. Unset now resolves to "last" (the most recent conversation); explicit target: "none" keeps its internal-only contract. Polls skip pre-model with reason no-route while no route exists yet, and status/doctor surface the waiting-for-route state. Deliberate maintainer-owned default cutover: existing installs without a configured target start receiving heartbeat alerts in their last conversation after upgrade.
Fixes#121880
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Align copyable onboarding commands with the mandatory risk acknowledgement and an explicit health disposition for config-only automation.\n\nRefs #121951.
* refactor(skills): split workspace loading into concept modules
* refactor(skills): delete dead seams and duplicate helpers
* chore(lint): ratchet max-lines baseline after workspace split
* chore(plugin-sdk): refresh API baseline
* refactor(skills): internalize discovery result type
* test(tooling): drop stale unit-fast fixtures
Re-lands the reverted #121507 on the current custody contracts. The reply dispatcher now owns direct-send pending-final custody: claim before provider I/O, terminal settlement for delivered/suppressed/failed outcomes, proven no-send stays replayable, ambiguous evidence fails closed — so Gateway restarts can no longer duplicate an already-accepted final reply.
Proof: ClawSweeper local review clean, exact-head ci-gate green, live Telegram E2E (one turn, one final, no duplicates).
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
* feat(ui): edit a queued chat message in place
The pencil on a queued row, or a double-click, lifts the message and its
attachments into the composer. The row stays where it is, marked Editing,
so the position the corrected message will take is visible rather than
promised. The composer shows an edit banner with an X to cancel.
Cancelling touches storage not at all, because the row never left the
queue. Sending retires the original and hands its position to the
replacement, which lands in the same slot. While an edit is open the
drain refuses that row, so a reconnect cannot deliver the text the
operator is visibly rewriting; the queue behind it waits, which is the
same contract the held position promises.
* fix(ui): retire an edited queued row only with its replacement
The send retired the source row first and admitted the replacement second,
so a rejected store write left the operator with neither: the original gone,
the replacement never persisted, and the attachments it dropped already
released. Admission now carries the source id and swaps both rows in one
store write, so a rejected write changes nothing and the edit stays open on
the row that is still there, which is what cancelling already promises.
Filtering the source before the cap check also keeps a replacement
admissible on a full queue.
The edit token recorded only the session key, but an outbox is scoped by
session and agent, and a raw global session keeps its key while the selected
agent changes underneath it. The token now carries the agent that owned the
row and every reader validates the whole scope, so a send after a switch
cannot retire a row in the outbox it left behind.
* fix(ui): hold an edited queued row across every pane
Panes share one outbox and one drain lane while composer state stays per
pane, so the hold that keeps a row from being delivered while it is rewritten
was invisible to the pane that drained it: a session event in a second split
pane resumed every stored outbox, saw no edit, and sent the original text.
The hold is now read across every pane subscribed to the outbox, which keeps
one source of truth — each pane's own scope-validated edit — and needs no
lifecycle of its own, so closing a pane or switching agent releases it by
simply no longer being an active edit.
The payloads an edit owns now travel with its token. The write that admits
the replacement retires the source row and tells every pane synchronously, so
by the time the send released the images the replacement had dropped, the row
holding them was already gone and nothing was released. That leaked the
payload and its object URL for the rest of the browser session.
* fix(ui): release attachments from cancelled queue edits
* fix(system-agent): repair setup-chat execution identity, harness fallback, and error surfacing
Always inject the reserved "openclaw" execution entry for off-roster system-agent runs.
Keep implicit harness runtime selection implicit so Codex refusal falls back to the OpenClaw harness, while explicit policy remains fail-closed.
Log openclaw.chat turn failures and surface their underlying causes in the UNAVAILABLE response.
* chore(plugin-sdk): refresh agent harness API baseline
* test(system-agent): align fixtures with optional harness routes
* fix(system-agent): keep execution roster out of TUI catalog lookup
* refactor(system-agent): keep verified state types internal
* fix(system-agent): separate setup policy and execution config
Dallin Romney