df2cc8f259
fix(onboard): honor secret-input-mode ref for the generated gateway token ( #126877 )
...
* fix(onboard): honor secret-input-mode ref for the generated gateway token
`openclaw onboard --secret-input-mode ref` was silently ignored for
`gateway.auth.token`: onboarding generated the token and wrote it into
`openclaw.json` as a plaintext string, so `openclaw doctor` warned about
`gateway.auth.token` on the install it had just created. The flag was
honored for provider credentials, so an operator who explicitly opted into
references still ended up with a plaintext secret and a remediation
(`openclaw secrets configure`) that cannot migrate a self-generated value,
because it validates a ref by resolving one that already exists.
Setup mints this token itself, so reference mode now provisions it:
- an ambient OPENCLAW_GATEWAY_TOKEN keeps an `env` ref to that variable, so a
later rotation stays authoritative instead of being pinned by a stale copy
- anything else (freshly generated, or an existing plaintext token being
migrated) goes into the shared SQLite secret store as a write-only `secret`
entry, with config holding only `{source:"store",...}`
An existing store entry wins over a freshly generated one, so reruns never
rotate a token already paired with clients. The store write precedes the
config write: a ref persisted without its value would leave the gateway
unauthenticatable, while an orphaned entry is reused by the next run.
The interactive wizard had the same dead end and is fixed the same way.
Default (plaintext) onboarding is unchanged.
User impact: `--secret-input-mode ref` now keeps the gateway token out of
openclaw.json, and a fresh install no longer self-reports a plaintext-secret
warning.
* test(onboard): split gateway onboarding suite under the max-lines gate
The added gateway auth-token tests pushed
onboard-non-interactive.gateway.test.ts to 1014 lines, over the max-lines
limit (check-lint-core-3). Repo policy is to split, never suppress.
Extract the shared vi.mock/harness preamble into
onboard-non-interactive.gateway.test-mocks.ts, following the existing
agent-command.test-mocks.ts pattern, and move the four gateway auth-token
storage tests into their own suite. The reachability mock becomes a holder
object so both suites can swap it across the module boundary, and hoisted
mocks are re-exported in a separate export clause because Vitest rejects
exporting a vi.hoisted binding at its declaration.
Test set is unchanged: the it-declaration multiset matches the pre-split
file exactly, with no duplication across the two suites.
* test(onboard): give the shared gateway onboarding mocks unique export names
check-export-name-collisions flagged `runtime` and `readConfigFileSnapshotMock`
as colliding with program.test-mocks.ts and plugins-cli-test-helpers.ts once the
gateway onboarding preamble became a shared module. Rename the exports to
gatewayOnboardRuntime / gatewayOnboardConfigSnapshotMock per the repo's
unique-export-name rule; suites alias them locally so the assertions read the
same as before.
* test(tooling): route the new gateway auth-token suite from its test helper
test-projects asserts which suites a change to
onboard-non-interactive.test-helpers.ts should run. The new
onboard-non-interactive.gateway-auth-token.test.ts imports that helper, so it
belongs in the expected routing plan.
2026-08-20 17:46:59 -07:00
0d14434d0e
feat(secrets): add explicit protected and agent-readable access ( #126088 )
...
* feat(secrets): add explicit agent access modes
Distinguish protected write-only secrets from agent-readable Gateway environment values, expose policy-bound Gateway exec aliases to Codex, and activate Node environment proxy support for destination-bound egress.\n\nCloses #125975
* fix(gateway): bind lifecycle dispatch to owning instance
* test(ui): preserve mock gateway recovery state
* fix(codex): avoid unavailable gateway process guidance
* fix(harness): keep run correlation host-owned
* fix(gateway): bind restart delivery to instance
* test(codex): construct tools through test host capability
2026-08-18 22:51:15 -07:00
c0930de5de
fix(secrets): scope egress sentinels to Gateway and survive client tunnel resets ( #123527 )
...
* fix(secrets): scope exec egress proxy to gateway
* fix(secrets): keep a client reset from crashing the egress proxy host
2026-08-14 01:56:29 -07:00
b9c6789560
feat(secrets): authenticated egress substitution proxy with destination binding ( #123216 )
...
* feat(secrets): add authenticated egress substitution proxy
* feat(secrets): bind egress substitution to hosts
* ci(codeql): classify egress proxy bypass tunnel in network boundary query
* refactor(proxy-capture): use the canonical IP parser instead of node:net
* fix(secrets): compare proxy tokens with a process-keyed MAC
2026-08-13 20:49:31 -07:00
85230cf76c
test(secrets): cover Code Mode exec store env and document the harness boundary ( #122405 )
...
* test(secrets): cover code-mode nested exec store env; document harness boundary
* docs(secrets): warn that store env does not reach external agent harnesses
2026-08-12 07:06:40 -07:00
b067a4dce3
fix(secrets): reject empty secret values and classify oversized input as validation ( #121947 )
2026-08-11 02:30:04 -07:00
ea06d72e85
feat(secrets): manage team secrets in Control UI ( #121724 )
...
* feat(secrets): add gateway store settings
* perf(control-ui): trim secrets startup copy
* perf(control-ui): reduce secrets startup payload
* fix(secrets): harden store mutation refresh
* perf(control-ui): meet secrets startup budget
* test(control-ui): update secrets navigation copy
* fix(ui): pluralize secret-detection count and drop duplicated dialog hint
* chore(protocol): regenerate gateway clients and SDK baseline after rebase
* fix(gateway): merge secrets store methods after project RPCs in advertised order
* chore: leave changelog to release generation
* test(gateway): retain desktop launch train coverage
2026-08-11 07:20:38 +00:00
768f53d345
fix(secrets): resolve default aliases by source ( #121630 )
2026-08-10 21:05:26 -07:00
52e3149ed7
feat(secrets): inject store env into agent exec ( #121773 )
2026-08-10 18:59:32 -07:00
f4bac99a81
feat(secrets): add SQLite-backed secret store ( #121559 )
2026-08-10 07:08:40 -07:00
fd1662f49c
fix(cli): retire invalid secret flags and prove doctor recovery ( #118926 )
...
* test(qa): add doctor CLI recovery coverage
* test(qa): secure doctor exec SecretRef proof
* test(qa): gate doctor systemd recovery proof
* test(qa): normalize doctor terminal output
* test(qa): close doctor probe sockets
* test(qa): classify doctor probe as foreign
* test(qa): track doctor probe sockets
* test(qa): retain doctor instance narrowing
* test(qa): preserve observed doctor recovery proof
* test(qa): keep doctor recovery on stable dist
* test(qa): honor Windows exec ACL blocking
* test(qa): use canonical home for systemd recovery
* test(qa): follow bounded gateway recovery
* test(qa): accept lifecycle service label
* test(qa): align doctor recovery contract
Punchcard-Session: crisp-lantern-orchard-nv
* docs(secrets): remove retired provider bypasses
Punchcard-Session: crisp-lantern-orchard-nv
* test(qa): isolate doctor recovery target
Punchcard-Session: crisp-lantern-orchard-nv
* fix(cli): retire invalid secret provider flags
Punchcard-Session: crisp-lantern-orchard-nv
* test(qa): isolate doctor supervisor mode
Punchcard-Session: crisp-lantern-orchard-nv
* fix(plugins): remove dead secret path bypass
Punchcard-Session: crisp-lantern-orchard-nv
* chore: drop release-owned changelog entry
Punchcard-Session: crisp-lantern-orchard-nv
* test(qa): isolate doctor sudo scope
Punchcard-Session: crisp-lantern-orchard-nv
* fix(secrets): remove dead path bypass
Punchcard-Session: crisp-lantern-orchard-nv
* test(qa): isolate systemd user bus
Punchcard-Session: crisp-lantern-orchard-nv
2026-08-05 11:20:23 +08:00
9dbfeb7e61
fix(channels): keep healthy accounts' message actions when one credential SecretRef fails ( #110329 )
...
* fix(channels): isolate unavailable account discovery
Co-authored-by: wangmiao0668000666 <wang.miao86@xydigit.com >
* refactor(channels): remove stale discovery exports
* test(pr): provide ripgrep fixture command
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-28 01:50:51 -04:00
fd6e042d87
fix(gateway): keep configured local auth authoritative ( #114462 )
...
* fix(gateway): align configured local credentials
* test(gateway): align local credential coverage
* chore(gateway): leave release note to release process
2026-07-27 05:43:31 -04:00
19a98c873c
refactor(auth): finish SQLite-only auth profile cutover ( #114033 )
...
* refactor(auth): finish SQLite-only profile cutover
* test(auth): isolate SQLite shadow fixtures
* test(auth): satisfy OAuth refresh lint
* test(auth): infer legacy sidecar fixtures
* fix(auth): fail closed on unreadable stores
* fix(auth): recheck migration readiness on lookup
* fix(auth): preserve compatibility owner checks
* fix(auth): align SQLite cutover proof
* style(qa): format SQLite auth helpers
* fix(auth): recover interrupted SQLite migrations
* fix(auth): bind materialized SQLite refs
* style(auth): clarify receipt hash value
* fix(auth): preserve state-only OAuth routing
* fix(auth): snapshot receipted migration sources
* fix(auth): fail closed across recovery races
* fix(auth): close legacy recovery gaps
* fix(auth): serialize SQLite refresh recovery
2026-07-26 07:27:54 -04:00
f045f33a62
feat(onepassword): add managed SecretRef integration
2026-07-25 06:03:30 -05:00
edecdbd05e
refactor(config): config-surface reduction tranche 3 — product consolidations (review request) ( #111527 )
...
* refactor(config): consolidate media model lists
* refactor(config): unify memory configuration
* refactor(config): consolidate TTS ownership
* refactor(config): move typing policy to agents
* refactor(config): retire product-level config surfaces
* refactor(config): share scoped tool policy type
* chore(config): refresh generated baselines
* fix(config): honor agent typing overrides
* fix(config): migrate sibling config consumers
* refactor(infra): keep base64url decoder private
* fix(config): strip invalid legacy TTS values
* chore(config): refresh rebased baseline hash
* fix(doctor): route legacy messages.tts.realtime voice to talk during tts move
* refactor(config): polish final layout names
* refactor(config): freeze retired tuning defaults
* feat(config): add fast mode default symmetry
* refactor(config): key agent entries by id
* docs(config): update final layout reference
* test(config): cover final layout migrations
* chore(config): refresh final layout baselines
* fix(config): align final layout runtime readers
* fix(config): align remaining readers
* fix(config): stabilize final layout migrations
* fix(config): finalize config projection proof
* fix(config): address final layout review
* docs(release): preserve historical config names
* fix(config): complete keyed agent migration
* fix(config): close final migration gaps
* fix(config): finish full-branch review
* fix(config): complete runtime secret detection
* fix(config): close final review findings
* fix(config): finish canonical docs and heartbeat migration
* fix(config): integrate latest main after rebase
* refactor(env): isolate test-only controls
* refactor(env): isolate build and development controls
* refactor(env): collapse process identity indirection
* refactor(env): remove duplicate config and temp aliases
* docs(env): define the operator-facing allowlist
* ci(env): ratchet production variable count
* fix(env): remove stale provider helper import
* fix(env): make ratchet sorting explicit
* test(env): keep test seam in dead-code audit
* test(env): cover ratchet growth and boundary; document surface budgets
* docs(config): document tier-eval consolidations
* docs(config): clarify speech preference ownership
* test(memory): align retired tuning fixtures
* refactor(memory): freeze engine heuristics
* refactor(config): apply tier-eval tranche
* refactor(tts): move persona shaping to providers
* refactor(compaction): move prompt policy to providers
* test(config): align hookified prompt fixtures
* chore(deadcode): classify test-only exports
* chore(github): remove unused spawn helper
* chore(deadcode): classify queue diagnostics
* chore(deadcode): remove unused lane snapshot export
* chore(plugin-sdk): ratchet consolidated surface
* fix(config): integrate latest main after rebase
2026-07-21 20:28:43 -07:00
783a5d21cf
refactor(config): purge numeric tuning knobs behind built-in defaults ( #111382 )
2026-07-19 07:35:45 -07:00
5590d7c280
docs: align SecretRef degradation semantics ( #111021 )
2026-07-19 00:18:01 +01:00
7a551bff0c
fix(vault): aggregate provider outage diagnostics ( #110908 )
...
* fix(vault): aggregate provider outage diagnostics
* fix(vault): classify revoked token outages
* fix(vault): preserve scoped ACL failures
* fix(vault): keep token probes advisory
* test(vault): satisfy gateway proof gates
* fix(secrets): attribute web provider outages
* test(secrets): prove web outage fan-out in owner suite
* fix(vault): scope malformed responses per secret
* test(secrets): harden exec fanout fixtures
2026-07-18 22:44:06 +01:00
8a5c8690e1
fix(secrets): keep unaffected owners live during reload failures ( #110779 )
...
* fix(secrets): isolate reload failures per owner
* refactor(secrets): split runtime activation helpers
* fix(secrets): export web warning type
* fix(secrets): reject unsafe degraded config writes
* fix(secrets): derive reload defaults type
* fix(secrets): defer reload state publication
* fix(secrets): preserve partial refresh state
* fix(secrets): retry superseded reload preflight
* fix(secrets): bind stale credentials to owner contracts
* fix(secrets): scope degraded credential contracts
* fix(secrets): restore source ownership guards
* fix(secrets): recover provider-only degradation
* fix(secrets): enforce degraded reload contracts
* fix(secrets): preserve scoped reload state
* fix(secrets): reconcile deferred descendant state
* fix(secrets): commit reload state atomically
* fix(secrets): preserve source transaction lineage
* test(secrets): use non-secret lineage marker
* chore(plugin-sdk): refresh API baseline
* fix(secrets): canonicalize web owner contracts
* fix(plugin-sdk): preserve legacy secret owner contracts
* fix(secrets): satisfy startup activation types
* test(secrets): align reload fixtures with owner contracts
* refactor(secrets): move source recovery scope helper
* fix(secrets): preserve owner contracts on web failures
* fix(secrets): bind legacy web resolution contract
* fix(secrets): retry stale auth publication
2026-07-18 18:29:24 +01:00
347ee45895
fix(secrets): surface degradation in logs and doctor ( #109792 )
...
* fix(secrets): surface degraded owners safely
* fix(secrets): preserve degradation ownership across reloads
* fix(secrets): require cold ownership for source recovery
* refactor(secrets): keep assignment provenance internal
* test(secrets): use provider error contract
* fix(secrets): attribute provider failures to active co-owners
* test(secrets): clarify provider failure fixture
* fix(secrets): redact doctor degradation reasons
* test(secrets): align reload harness with runtime state
* test(secrets): cover atomic source publication
* fix(secrets): preserve web owner degradation context
* fix(secrets): retain active web degradation co-owners
* fix(secrets): keep web provider error internal
* refactor(secrets): unify reload degradation state
* refactor(config): remove obsolete source snapshot setter
2026-07-18 11:46:53 +01:00
8539640abc
fix(config,secrets): emit JSON errors and cover dotenv roots ( #104340 )
...
* fix(secrets): use resolveStateDir for .env path to cover legacy .clawdbot dir
* fix(secrets): replace override-based legacy .env test with true automatic fallback, add apply-path coverage
* fix(config-cli): emit JSON error on config get --json for missing paths
When is used with a nonexistent
path, the command emits no JSON on stdout, only a text error on stderr.
This breaks automated consumers that expect machine-readable errors.
Fix: output JSON to stdout before exit(1) when
opts.json is set. This matches the existing JSON error output pattern
already used by runConfigValidate and handleConfigMutationError.
Also re-throw synthetic exit errors in the catch block so the
--json branch's writeRuntimeJson+exit is not caught and re-emitted
as a text error.
* fix(config-cli): use typed ExitError signal instead of __exit__ string sentinel
* fix(secrets): reuse resolved stateDir for .env path in audit
* fix(secrets): pass resolved stateDir into apply .env scrubbing, add root-switch regression
* test(config-cli): migrate remaining __exit__ sentinel to ExitError
* fix(secrets): cover config and state dotenv roots
* style(secrets): format dotenv path helper
* test(secrets): track temporary directories
* test(config): expect typed exit for missing patch files
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
Co-authored-by: Peter Steinberger <peter@steipete.me >
2026-07-17 23:14:05 -07:00
17c2ce05d8
fix(secrets): keep startup alive when TTS SecretRefs are missing ( #101265 )
...
* fix(secrets): degrade missing TTS SecretRefs at startup
* test(secrets): keep non-activating startup strict
* test(secrets): mark denied key fixture synthetic
* test(secrets): use synthetic TTS key fixture
* test(secrets): use neutral TTS key placeholder
* test(secrets): isolate TTS key placeholder
* test(secrets): shorten TTS ref fixture name
* test(secrets): normalize synthetic credential fixtures
* test(secrets): isolate optional redaction coverage
* fix(secrets): preserve degraded TTS ref ownership
* refactor(secrets): keep optional resolver internal
* test(secrets): cover default provider alias misses
* test(secrets): pin explicit provider ownership
* style(secrets): format optional assignment imports
* refactor(secrets): keep optional metadata private
* style(secrets): restore collector file header
* fix(secrets): isolate unavailable SecretRef owners
Co-authored-by: snowzlmbot <293528334+snowzlmbot@users.noreply.github.com >
* test(secrets): complete provider fixtures
* style(status): avoid degraded path shadowing
* style(secrets): satisfy runtime lint
* refactor(secrets): keep error codes internal
* fix(secrets): keep unowned assignments fail closed
* fix(secrets): preserve provider resolution batching
* fix(secrets): normalize stalled resolution errors
* fix(secrets): reject provider limit violations
---------
Co-authored-by: snowzlmbot <293528334+snowzlmbot@users.noreply.github.com >
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-16 21:07:01 -07:00
333409908d
docs: define SecretRef failure isolation policy ( #109430 )
2026-07-16 17:05:20 -07:00
0cdb13abfc
docs(gateway): dedicated 1Password integration page ( #106109 )
2026-07-12 23:52:33 -07:00
b6c171901e
fix(secrets): harden exec provider diagnostics ( #105082 )
2026-07-12 09:01:33 +01:00
e595a8c0ac
Add Vault SecretRef plugin ( #89255 )
...
* Add Vault SecretRef plugin
Signed-off-by: sallyom <somalley@redhat.com >
* expand Vault setup to registered SecretRef targets
Signed-off-by: sallyom <somalley@redhat.com >
* fix(vault): use sdk secret target seam
* fix(vault): preserve auth profile target paths
* docs(vault): document plugin enable step
* fix(vault): make status provider-alias aware
* fix(vault): reject noncanonical secret ids
* fix(vault): separate resolver timeout deadlines
* fix(vault): forward private CA trust settings
* fix(secrets): preserve plugin policy boundaries
---------
Signed-off-by: sallyom <somalley@redhat.com >
Co-authored-by: joshavant <830519+joshavant@users.noreply.github.com >
2026-07-09 05:30:12 -05:00
4bf70be01a
feat(secrets): egress-time credential injection with process-local sentinels ( #102009 )
...
* feat(secrets): resolve SecretRef model credentials at egress via process-local sentinels
SecretRef-managed model-provider credentials now travel as opaque
oc-sent-v1 sentinels through auth storage, stream options, and SDK
config; the guarded model fetch injects real values into headers and
URLs immediately before the SSRF-guarded send and fails closed on
unknown sentinels. packages/ai adapters converge on the host guarded
fetch where the SDK supports custom fetch and unwrap at construction
where it does not. Resolved values (and their percent-encoded forms)
register for exact-value log redaction. Kill switch:
OPENCLAW_SECRET_SENTINELS=off. Also fixes a pre-existing unhandled
rejection race in capNonOkResponseBodyLazily (pipeThrough writer leak).
* test(plugin-sdk): update public surface budget
2026-07-08 12:56:41 +01:00
f7d7148cf0
docs: rewrite published docs grounded in current source ( #100142 )
...
Source-grounded rewrite of 529 published docs pages with per-unit information-loss verification: 1,713 factual corrections cited to src/**, generated surfaces regenerated, frontmatter titles preserved for i18n, release notes pages untouched. All docs gates green.
Closes #100141
2026-07-05 00:32:47 -04:00
73df6d48af
fix(secrets): explicitly pass BWS_SERVER_URL to resolver for self-hosted instances ( #93929 )
...
Merged via squash after the required `scripts/pr merge-run` workflow falsely flagged a non-overlapping mainline refactor as an overlap.
Prepared head SHA: dc0bba965a80405497+Pandah97@users.noreply.github.com >
Co-authored-by: Vincent Koc <25068+vincentkoc@users.noreply.github.com >
Reviewed-by: @vincentkoc
2026-06-17 22:04:48 +08:00
6037a74660
Add plugin manifest contract for SecretRef provider integrations ( #82326 )
...
* secret-provider-integrations
Signed-off-by: sallyom <somalley@redhat.com >
* feat(secrets): configure plugin provider presets
* secrets: use plugin-managed provider refs
Signed-off-by: sallyom <somalley@redhat.com >
* fix secretref auth profile service env
* test secret provider integration e2e
* fix secretref plugin config service env
* fix secret provider preset schema alignment
* stabilize secret provider service proof
* validate secret provider plugin integrations
* harden secret provider resolver paths
* scope secret provider config validation
* stabilize openai secret provider proof
* fix secret provider metadata proof
* stabilize config baseline proof
* fix secret provider e2e lint
---------
Signed-off-by: sallyom <somalley@redhat.com >
Co-authored-by: joshavant <830519+joshavant@users.noreply.github.com >
2026-05-29 18:20:45 -04:00
675158c896
fix(secrets): allow hash in exec SecretRef ids ( #86072 )
...
Summary:
- The branch widens exec SecretRef id validation/schema/docs/test vectors to allow `#` selector syntax, adds a changelog entry, and includes a small `npm pack` filename helper cleanup.
- Reproducibility: yes. Source inspection on current main shows the shared exec SecretRef validator omits `#`, matching the linked gateway startup failure before resolver execution.
Automerge notes:
- PR branch already contained follow-up commit before automerge: docs(secrets): document hash exec SecretRef ids
- PR branch already contained follow-up commit before automerge: docs(secrets): sync exec SecretRef hash pattern
- PR branch already contained follow-up commit before automerge: fix(secrets): allow hash in exec SecretRef ids
- PR branch already contained follow-up commit before automerge: fix(clawsweeper): address review for automerge-openclaw-openclaw-8073…
Validation:
- ClawSweeper review passed for head 1cf53d95f41cf53d95f4https://github.com/openclaw/openclaw/pull/86072#issuecomment-4528994482
Co-authored-by: Andy Ye <andy@Andys-MacBook-Pro-2.local >
Co-authored-by: Andy Ye <andylye@outlook.com >
Co-authored-by: clawsweeper <274271284+clawsweeper[bot]@users.noreply.github.com>
Co-authored-by: clawsweeper[bot] <274271284+clawsweeper[bot]@users.noreply.github.com>
Approved-by: takhoffman
Co-authored-by: takhoffman <781889+takhoffman@users.noreply.github.com >
2026-05-24 14:56:17 +00:00
64d13c017a
docs: refresh contributor docs
...
Co-authored-by: Quratulain-bilal <umayaimanshah@gmail.com >
Co-authored-by: Mariano Belinky <mbelinky@gmail.com >
Co-authored-by: tao <itaofe@gmail.com >
Co-authored-by: julian <julian@tencent.com >
Co-authored-by: xenouzik <xenouziq@gmail.com >
Co-authored-by: Olamiposi <56056759+posigit@users.noreply.github.com >
Co-authored-by: surlymochan <surlymo@apache.org >
Co-authored-by: Janaka A <contact@janaka.co.uk >
Co-authored-by: choiking <samsamuels1927@gmail.com >
2026-05-22 22:58:27 +01:00
bb5010b89a
docs: absorb docs sweep
...
Co-authored-by: Kai <kai@itskai.dev >
Co-authored-by: Weihang <gwh7078@163.com >
Co-authored-by: Scott Long <longstoryscott@gmail.com >
Co-authored-by: moejaberr <mjaber@uoguelph.ca >
Co-authored-by: huihui0822 <109355071+huihui0822@users.noreply.github.com >
2026-05-22 21:52:01 +01:00
ce5dcb0ab2
docs(secrets): clarify agent-readable plaintext boundary ( #84574 )
...
Co-authored-by: alexgduarte <24414784+alexgduarte@users.noreply.github.com >
2026-05-22 19:20:25 +01:00
6b4d371723
fix(secrets): treat env refs as audit-safe auth values
...
Fix secrets audit env-ref classification and document supported auth SecretRef shorthand.\n\nCo-authored-by: XING <wxinxings@gmail.com >
2026-05-17 00:05:10 +01:00
36e88f5ddd
docs: clarify file-backed secret refs
2026-05-16 23:28:39 +01:00
694ca50e97
Revert "refactor: move runtime state to SQLite"
...
This reverts commit f91de52f0d
2026-05-13 13:33:38 +01:00
f91de52f0d
refactor: move runtime state to SQLite
...
* refactor: remove stale file-backed shims
* fix: harden sqlite state ci boundaries
* refactor: store matrix idb snapshots in sqlite
* fix: satisfy rebased CI guardrails
* refactor: store current conversation bindings in sqlite table
* refactor: store tui last sessions in sqlite table
* refactor: reset sqlite schema history
* refactor: drop unshipped sqlite table migration
* refactor: remove plugin index file rollback
* refactor: drop unshipped sqlite sidecar migrations
* refactor: remove runtime commitments kv migration
* refactor: preserve kysely sync result types
* refactor: drop unshipped sqlite schema migration table
* test: keep session usage coverage sqlite-backed
* refactor: keep sqlite migration doctor-only
* refactor: isolate device legacy imports
* refactor: isolate push voicewake legacy imports
* refactor: isolate remaining runtime legacy imports
* refactor: tighten sqlite migration guardrails
* test: cover sqlite persisted enum parsing
* refactor: isolate legacy update and tui imports
* refactor: tighten sqlite state ownership
* refactor: move legacy imports behind doctor
* refactor: remove legacy session row lookup
* refactor: canonicalize memory transcript locators
* refactor: drop transcript path scope fallbacks
* refactor: drop runtime legacy session delivery pruning
* refactor: store tts prefs only in sqlite
* refactor: remove cron store path runtime
* refactor: use cron sqlite store keys
* refactor: rename telegram message cache scope
* refactor: read memory dreaming status from sqlite
* refactor: rename cron status store key
* refactor: stop remembering transcript file paths
* test: use sqlite locators in agent fixtures
* refactor: remove file-shaped commitments and cron store surfaces
* refactor: keep compaction transcript handles out of session rows
* refactor: derive transcript handles from session identity
* refactor: derive runtime transcript handles
* refactor: remove gateway session locator reads
* refactor: remove transcript locator from session rows
* refactor: store raw stream diagnostics in sqlite
* refactor: remove file-shaped transcript rotation
* refactor: hide legacy trajectory paths from runtime
* refactor: remove runtime transcript file bridges
* refactor: repair database-first rebase fallout
* refactor: align tests with database-first state
* refactor: remove transcript file handoffs
* refactor: sync post-compaction memory by transcript scope
* refactor: run codex app-server sessions by id
* refactor: bind codex runtime state by session id
* refactor: pass memory transcripts by sqlite scope
* refactor: remove transcript locator cleanup leftovers
* test: remove stale transcript file fixtures
* refactor: remove transcript locator test helper
* test: make cron sqlite keys explicit
* test: remove cron runtime store paths
* test: remove stale session file fixtures
* test: use sqlite cron keys in diagnostics
* refactor: remove runtime delivery queue backfill
* test: drop fake export session file mocks
* refactor: rename acp session read failure flag
* refactor: rename acp row session key
* refactor: remove session store test seams
* refactor: move legacy session parser tests to doctor
* refactor: reindex managed memory in place
* refactor: drop stale session store wording
* refactor: rename session row helpers
* refactor: rename sqlite session entry modules
* refactor: remove transcript locator leftovers
* refactor: trim file-era audit wording
* refactor: clean managed media through sqlite
* fix: prefer explicit agent for exports
* fix: use prepared agent for session resets
* fix: canonicalize legacy codex binding import
* test: rename state cleanup helper
* docs: align backup docs with sqlite state
* refactor: drop legacy Pi usage auth fallback
* refactor: move legacy auth profile imports to doctor
* refactor: keep Pi model discovery auth in memory
* refactor: remove MSTeams legacy learning key fallback
* refactor: store model catalog config in sqlite
* refactor: use sqlite model catalog at runtime
* refactor: remove model json compatibility aliases
* refactor: store auth profiles in sqlite
* refactor: seed copied auth profiles in sqlite
* refactor: make auth profile runtime sqlite-addressed
* refactor: migrate hermes secrets into sqlite auth store
* refactor: move plugin install config migration to doctor
* refactor: rename plugin index audit checks
* test: drop auth file assumptions
* test: remove legacy transcript file assertions
* refactor: drop legacy cli session aliases
* refactor: store skill uploads in sqlite
* refactor: keep subagent attachments in sqlite vfs
* refactor: drop subagent attachment cleanup state
* refactor: move legacy session aliases to doctor
* refactor: require node 24 for sqlite state runtime
* refactor: move provider caches into sqlite state
* fix: harden virtual agent filesystem
* refactor: enforce database-first runtime state
* refactor: rename compaction transcript rotation setting
* test: clean sqlite refactor test types
* refactor: consolidate sqlite runtime state
* refactor: model session conversations in sqlite
* refactor: stop deriving cron delivery from session keys
* refactor: stop classifying sessions from key shape
* refactor: hydrate announce targets from typed delivery
* refactor: route heartbeat delivery from typed sqlite context
* refactor: tighten typed sqlite session routing
* refactor: remove session origin routing shadow
* refactor: drop session origin shadow fixtures
* perf: query sqlite vfs paths by prefix
* refactor: use typed conversation metadata for sessions
* refactor: prefer typed session routing metadata
* refactor: require typed session routing metadata
* refactor: resolve group tool policy from typed sessions
* refactor: delete dead session thread info bridge
* Show Codex subscription reset times in channel errors (#80456 )
* feat(plugin-sdk): consolidate session workflow APIs
* fix(agents): allow read-only agent mount reads
* [codex] refresh plugin regression fixtures
* fix(agents): restore compaction gateway logs
* test: tighten gateway startup assertions
* Redact persisted secret-shaped payloads [AI] (#79006 )
* test: tighten device pair notify assertions
* test: tighten hermes secret assertions
* test: assert matrix client error shapes
* test: assert config compat warnings
* fix(heartbeat): remap cron-run exec events to session keys (#80214 )
* fix(codex): route btw through native side threads
* fix(auth): accept friendly OpenAI order for Codex profiles
* fix(codex): rotate auth profiles inside harness
* fix: keep browser status page probe within timeout
* test: assert agents add outputs
* test: pin cron read status
* fix(agents): avoid Pi resource discovery stalls
Co-authored-by: dataCenter430 <titan032000@gmail.com >
* fix: retire timed-out codex app-server clients
* test: tighten qa lab runtime assertions
* test: check security fix outputs
* test: verify extension runtime messages
* feat(wake): expose typed sessionKey on wake protocol + system event CLI
* fix(gateway): await session_end during shutdown drain and track channel + compaction lifecycle paths (#57790 )
* test: guard talk consult call helper
* fix(codex): scale context engine projection (#80761 )
* fix(codex): scale context engine projection
* fix: document Codex context projection scaling
* fix: document Codex context projection scaling
* fix: document Codex context projection scaling
* fix: document Codex context projection scaling
* chore: align Codex projection changelog
* chore: realign Codex projection changelog
* fix: isolate Codex projection patch
---------
Co-authored-by: Eva (agent) <eva+agent-78055@100yen.org >
Co-authored-by: Josh Lehman <josh@martian.engineering >
* refactor: move agent runtime state toward piless
* refactor: remove cron session reaper
* refactor: move session management to sqlite
* refactor: finish database-first state migration
* chore: refresh generated sqlite db types
* refactor: remove stale file-backed shims
* test: harden kysely type coverage
# Conflicts:
# .agents/skills/kysely-database-access/SKILL.md
# src/infra/kysely-sync.types.test.ts
# src/proxy-capture/store.sqlite.test.ts
# src/state/openclaw-agent-db.test.ts
# src/state/openclaw-state-db.test.ts
* refactor: remove cron store path runtime
* refactor: keep compaction transcript handles out of session rows
* refactor: derive embedded transcripts from sqlite identity
* refactor: remove embedded transcript locator handoff
* refactor: remove runtime transcript file bridges
* refactor: remove transcript file handoffs
* refactor: remove MSTeams legacy learning key fallback
* refactor: store model catalog config in sqlite
* refactor: use sqlite model catalog at runtime
# Conflicts:
# docs/cli/secrets.md
# docs/gateway/authentication.md
# docs/gateway/secrets.md
* fix: keep oauth sibling sync sqlite-local
# Conflicts:
# src/commands/onboard-auth.test.ts
* refactor: remove task session store maintenance
# Conflicts:
# src/commands/tasks.ts
* refactor: keep diagnostics in state sqlite
* refactor: enforce database-first runtime state
* refactor: consolidate sqlite runtime state
* Show Codex subscription reset times in channel errors (#80456 )
* fix(codex): refresh subscription limit resets
* fix(codex): format reset times for channels
* Update CHANGELOG with latest changes and fixes
Updated CHANGELOG with recent fixes and improvements.
* fix(codex): keep command load failures on codex surface
* fix(codex): format account rate limits as rows
* fix(codex): summarize account limits as usage status
* fix(codex): simplify account limit status
* test: tighten subagent announce queue assertion
* test: tighten session delete lifecycle assertions
* test: tighten cron ops assertions
* fix: track cron execution milestones
* test: tighten hermes secret assertions
* test: assert matrix sync store payloads
* test: assert config compat warnings
* fix(codex): align btw side thread semantics
* fix(codex): honor codex fallback blocking
* fix(agents): avoid Pi resource discovery stalls
* test: tighten codex event assertions
* test: tighten cron assertions
* Fix Codex app-server OAuth harness auth
* refactor: move agent runtime state toward piless
* refactor: move device and push state to sqlite
* refactor: move runtime json state imports to doctor
* refactor: finish database-first state migration
* chore: refresh generated sqlite db types
* refactor: clarify cron sqlite store keys
* refactor: remove stale file-backed shims
* refactor: bind codex runtime state by session id
* test: expect sqlite trajectory branch export
* refactor: rename session row helpers
* fix: keep legacy device identity import in doctor
* refactor: enforce database-first runtime state
* refactor: consolidate sqlite runtime state
* build: align pi contract wrappers
* chore: repair database-first rebase
* refactor: remove session file test contracts
* test: update gateway session expectations
* refactor: stop routing from session compatibility shadows
* refactor: stop persisting session route shadows
* refactor: use typed delivery context in clients
* refactor: stop echoing session route shadows
* refactor: repair embedded runner rebase imports
# Conflicts:
# src/agents/pi-embedded-runner/run/attempt.tool-call-argument-repair.ts
* refactor: align pi contract imports
* refactor: satisfy kysely sync helper guard
* refactor: remove file transcript bridge remnants
* refactor: remove session locator compatibility
* refactor: remove session file test contracts
* refactor: keep rebase database-first clean
* refactor: remove session file assumptions from e2e
* docs: clarify database-first goal state
* test: remove legacy store markers from sqlite runtime tests
* refactor: remove legacy store assumptions from runtime seams
* refactor: align sqlite runtime helper seams
* test: update memory recall sqlite audit mock
* refactor: align database-first runtime type seams
* test: clarify doctor cron legacy store names
* fix: preserve sqlite session route projections
* test: fix copilot token cache test syntax
* docs: update database-first proof status
* test: align database-first test fixtures
* docs: update database-first proof status
* refactor: clean extension database-first drift
* test: align agent session route proof
* test: clarify doctor legacy path fixtures
* chore: clean database-first changed checks
* chore: repair database-first rebase markers
* build: allow baileys git subdependency
* chore: repair exp-vfs rebase drift
* chore: finish exp-vfs rebase cleanup
* chore: satisfy rebase lint drift
* chore: fix qqbot rebase type seam
* chore: fix rebase drift leftovers
* fix: keep auth profile oauth secrets out of sqlite
* fix: repair rebase drift tests
* test: stabilize pairing request ordering
* test: use source manifests in plugin contract checks
* fix: restore gateway session metadata after rebase
* fix: repair database-first rebase drift
* fix: clean up database-first rebase fallout
* test: stabilize line quick reply receipt time
* fix: repair extension rebase drift
* test: keep transcript redaction tests sqlite-backed
* fix: carry injected transcript redaction through sqlite
* chore: clean database branch rebase residue
* fix: repair database branch CI drift
* fix: repair database branch CI guard drift
* fix: stabilize oauth tls preflight test
* test: align database branch fast guards
* test: repair build artifact boundary guards
* chore: clean changelog rebase markers
---------
Co-authored-by: pashpashpash <nik@vault77.ai >
Co-authored-by: Eva <eva@100yen.org >
Co-authored-by: stainlu <stainlu@newtype-ai.org >
Co-authored-by: Jason Zhou <jason.zhou.design@gmail.com >
Co-authored-by: Ruben Cuevas <hi@rubencu.com >
Co-authored-by: Pavan Kumar Gondhi <pavangondhi@gmail.com >
Co-authored-by: Shakker <shakkerdroid@gmail.com >
Co-authored-by: Kaspre <36520309+Kaspre@users.noreply.github.com >
Co-authored-by: dataCenter430 <titan032000@gmail.com >
Co-authored-by: Kaspre <kaspre@gmail.com >
Co-authored-by: pandadev66 <nova.full.stack@outlook.com >
Co-authored-by: Eva <admin@100yen.org >
Co-authored-by: Eva (agent) <eva+agent-78055@100yen.org >
Co-authored-by: Josh Lehman <josh@martian.engineering >
Co-authored-by: jeffjhunter <support@aipersonamethod.com >
2026-05-13 13:15:12 +01:00
78a12706ec
fix(docs): make docs formatter mintlify-safe
2026-04-28 08:13:21 +01:00
9d6e79019f
docs(secrets): rewrite with Tabs for SecretRef sources, AccordionGroup for providers and exec examples, Steps for the audit flow
2026-04-26 00:12:05 -07:00
2777b089b5
docs: normalize frontmatter titles to sentence case
2026-04-23 13:15:17 -07:00
4a2cd533ac
docs: remove duplicate H1 where frontmatter title already sets it
2026-04-23 13:11:14 -07:00
99e45eb3ba
docs: refresh remote bootstrap refs
2026-04-04 14:17:59 +01:00
788f56f30f
Secrets: hard-fail unsupported SecretRef policy and fix gateway restart token drift ( #58141 )
...
* Secrets: enforce C2 SecretRef policy and drift resolution
* Tests: add gateway auth startup/reload SecretRef runtime coverage
* Docs: sync C2 SecretRef policy and coverage matrix
* Config: hard-fail parent SecretRef policy writes
* Secrets: centralize unsupported SecretRef policy metadata
* Daemon: test service-env precedence for token drift refs
* Config: keep per-ref dry-run resolvability errors
* Docs: clarify config-set parent-object policy checks
* Gateway: fix drift fallback and schema-key filtering
* Gateway: align drift fallback with credential planner
* changelog
Signed-off-by: joshavant <830519+joshavant@users.noreply.github.com >
---------
Signed-off-by: joshavant <830519+joshavant@users.noreply.github.com >
2026-03-31 02:37:31 -05:00
81b777c768
fix(config): harden SecretRef round-trip handling in Control UI and RPC writes ( #58044 )
...
* Config: harden SecretRef round-trip handling
* Gateway: test SecretRef preflight on config writes
* Agents: align skill loader with upstream Skill type
* Docs: align SecretRef write semantics with Control UI and RPC behavior
* Config: add UI and gateway regression evidence for SecretRef hardening
* Config: add token SecretRef restore regression and skill sourceInfo compat
* UI: scope structured-value lockout to SecretRef fields
* Agents: remove out-of-scope skill loader compat edits
* UI: reduce app-render churn to rawAvailable-only changes
* Gateway: scope SecretRef preflight to submitted config
* Docs: clarify config write SecretRef preflight scope
* changelog
Signed-off-by: joshavant <830519+joshavant@users.noreply.github.com >
---------
Signed-off-by: joshavant <830519+joshavant@users.noreply.github.com >
2026-03-30 23:55:03 -05:00
168ab94eee
refactor(config): pin runtime snapshot and drop ttl cache
2026-03-29 22:57:31 +01:00
694bc082a8
fix: resolve acpx MCP secret inputs
2026-03-30 05:30:32 +09:00
6b9915a106
refactor!: drop legacy CLAWDBOT env compatibility
2026-03-22 22:13:39 -07:00
0ffcc308f2
Secrets: gate exec dry-run and preflight resolution behind --allow-exec ( #49417 )
...
* Secrets: gate exec dry-run resolution behind --allow-exec
* Secrets: fix dry-run completeness and skipped exec audit semantics
* Secrets: require --allow-exec for exec-containing apply writes
* Docs: align secrets exec consent behavior
* Changelog: note secrets exec consent gating
2026-03-17 23:24:34 -05:00
Peter Steinberger