* fix(workboard): recover interrupted worker launches
Persist prepared, accepted, and failed launch phases so Gateway restart reconciliation cannot leave cards permanently running between launch preparation and worker acceptance.
* fix(workboard): require durable terminal evidence
Do not synthesize terminal-session acceptance timing during restart reconciliation; stale same-key terminal rows without updatedAt now fail the prepared launch instead of being adopted.
* fix(workboard): make ownership updates atomic
Persist launch intent before worker acceptance, reconcile accepted identities,
fence cross-host card mutations, and deduplicate session capture in SQLite.
Closes#125932
* test(workboard): keep race fixtures plugin-local
Use a plugin-local synchronization helper and update the sessions-page capture
expectation for the new store-owned RPC.
* fix(workboard): fence lifecycle and restore races
Apply terminal lifecycle state only while the matched association is current,
and converge concurrent archived session restores on the active winner.
* feat(workboard): reference the automation job that owns a board's prompt
Boards can now record automationJobId, linking a board to the cron
automation whose prompt/model/schedule categorize its cards. The cron
job remains the single owner of that configuration; workboard stores
only the reference. The board toolbar shows an Automation chip linking
to the cron page when set. Deleting a board never deletes the job.
Proof: pnpm test extensions/workboard packages/workboard-contract
ui/src/pages/workboard ui/src/lib/workboard (9,492 passed), autoreview
clean (codex/gpt-5.6-sol). check:changed blocked by remote capacity
(Blacksmith down, Daytona lease cap); local fallback lanes green except
a parent-branch lint finding fixed on that branch.
* fix(ui): describe workboard automation destination
ClawSweeper flagged that the prior matrix at line 31-48 tested
labels/title/notes by manually invoking normalizeBoundedString, even
though those fields use the independent normalizeTitle, normalizeNotes,
and normalizeLabels functions (each with its own generic message).
A regression that drops the (got N) suffix from normalizeBoundedString
would not be caught for those three surfaces — operators would still
see the old opaque error.
This commit narrows the matrix to only the consumers of the shared
helper (comment body, link title, link target, link URL, card id) and
restores the exact labels gateway assertion that should match the
unchanged normalizeLabels error.
Verification: 9/9 inline Node 18 AST harness (node /tmp/verify-pr-118888-v77.mjs);
parent-commit proof-gate (pre-PR helper without the got suffix) fails
4/9 of the post-fix expected messages.
Closes ClawSweeper review on PR #118888 (P2 + P3).
The shared normalizeBoundedString helper in extensions/workboard/src
threw an opaque error like 'comment body must be 2000 characters or
fewer.' whenever an oversize string hit any bounded field. Agents that
posted a long run summary or oversized link URL had no way to tell
how far over the limit they were, so they could not retry with a
trimmed payload.
Include the actual length in the error so the message tells the agent
exactly what to do next:
comment body must be 2000 characters or fewer (got 3502).
The format applies uniformly to every bounded field routed through
this helper (labels, link URL, link title, link target, comment
body, title, notes, worker log message, session key, run id,
protocol violation detail, etc.) since the helper is the single
canonical owner of the message.
Cover the new format with a focused unit test that pins the regex
for the comment-body repro from #118845 and exercises the six other
bounded fields listed in the issue. Update the existing
gateway.test.ts assertion to allow both the old and new format so
the format change is a forward-compatible improvement.
* refactor: consolidate coercion ownership
Centralize four canonical coercion helpers, migrate exact core and plugin duplicates through narrow Plugin SDK facades, and enforce declaration and plugin-normalization ownership boundaries.
The sweep adds eight focused SDK exports while deleting more production and tooling code than it adds. User-visible behavior is unchanged except for safer equivalent object and UI parsing at existing boundaries.
* fix: guard integer option ownership
Register resolveIntegerOption with the canonical function owner and extend the declaration-guard fixture so future local duplicates fail validation.
* fix: keep integer helpers on numeric facade
Remove the unshipped duplicate string-coerce exports and route every affected plugin consumer through the existing number-runtime contract.
* fix: point numeric coercion to number runtime
Make boundary and declaration diagnostics recommend the canonical numeric facade, with failing-before coverage for both guidance paths.
* fix(workboard): diagnose archived cards still in an active status
An archived card with an active status (ready/running/blocked/etc.) was
silently excluded from dispatch with no signal on any surface —
workboard show rendered it normally, dispatch returned count:0 with empty
startFailures, and computeCardDiagnostics returned [] for archived cards.
Operators could only find it by reading the database directly.
Add an archived_but_active diagnostic kind to WORKBOARD_DIAGNOSTIC_KINDS
and an unarchive action. In computeCardDiagnostics, when a card has
archivedAt set but status is not done, emit the warning so workboard show
and store.diagnostics report it. Done+archived cards stay silent (no
diagnostic) as before. The diagnostic is transient — refreshDiagnostics
still skips archived cards, so their stored metadata is not rewritten.
Fixes#116359
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(workboard): expose archived active cards
* ci: re-trigger after sqlite flip-proof e2e flake
Unrelated to workboard diagnostic changes; sqlite session/transcript
flip-proof e2e failed with array mismatch on an untouched path.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: ruel225 <ruel225@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
Archiving is a lifecycle transition owned by archive(), which routes through
updateCard and appends the matching `archived` event. createDirect had no such
guard: it passed input.metadata straight into normalizeMetadata, which treats
archivedAt as an ordinary caller-supplied field.
A card could therefore be created already archived. Archived cards are excluded
from dispatch at every status, so the card was unstartable from the instant it
existed, while its event log contained only `created` - no archive ever
happened, so no `archived` event was ever recorded. The board reported work that
could never start, and the missing event sent operators looking for a rogue
archiver that did not exist.
normalizeMetadata already carries an options bag for rules that are stricter on
create than on update (allowDependencyLinks). Add allowArchivedAt alongside it
and pass false from createDirect, so archivedAt falls back to the create
fallback (undefined) instead of the caller's value. The update path is
unchanged: patches that set archivedAt still archive the card and still emit the
event.
Fixes#116395
* feat(plugins): deliver sessions.changed to plugin services
* docs: regenerate docs map
* refactor(clickclack): split reconcile scheduler and history formatting out of the discussion service
* style: format discussion service
* fix(workboard): record resolved runtime metadata instead of hardcoded codex engine
Workboard executions labeled every dispatched run engine=codex, model=default,
and id suffix :codex even for Claude/other harness agents. The gateway agent
admission phase now returns the resolved {harness, provider, model} for plugin
subagent runs; the dispatcher records it verbatim and omits engine/model when
unresolved. Engine becomes an open runtime identifier in the workboard
contract (built-in launch choices stay a closed list), store/UI normalizers
preserve historical labels as written instead of inventing codex, and new
execution ids use an :agent-session suffix. Fixes#108362
* fix(workboard): accept undefined engine in ui engineModel helper
Adds consistent manual Workboard movement across CLI, slash commands, and agent tools while preserving operator authority and agent claim isolation.
Co-authored-by: Ross I4JU <ross@i4ju.ch>
* fix(workboard): resolve parent dependency status via targeted lookups, not a full-corpus scan
dependencyTargetStatus() called the fully unscoped store.list() (every card,
every board, fully materialized via entries()+readCard()) just to look up the
status of a card's own parent id(s) -- almost always exactly one. dispatch()
calls promoteDependencyReady() once per card in its board-scoped pass, so
every parented card in that pass re-paid for a full-corpus re-scan.
Confirmed via a live CDP CPU profile of a real "openclaw workboard dispatch"
call (--inspect attached to a running gateway, Profiler.start/stop scoped to
the repro, elapsed 161.8s matching a known 160s+ stall): 93.3% of the time
(142s + 8.7s of 162s) was inside native SQLite all()/prepare() bindings, all
funneling through dispatch -> promoteDependencyReady -> dependencyTargetStatus
-> list -> entries -> readCard (readCard issues 4 separate synchronous SQL
statements per card). On a corpus of ~5770 cards, this is O(parented_cards_in_pass
x corpus_size x 4_queries) -- a genuine algorithmic defect, not event-loop
starvation from a concurrent session as originally suspected for this symptom.
Replace the unscoped list()+Map lookup with targeted get(parentId) calls
(already a single indexed-row lookup used everywhere else in this file) --
O(parents.length), normally O(1), instead of O(corpus size). Behavior is
unchanged: parent?.status === "done" on the get() result is exactly what
cards.get(parentId)?.status === "done" computed from the unscoped list().
Adds a regression test asserting the underlying store's entries() is called
at most once while promoting 8 parented cards together in one dispatch pass
(would have been 9 calls before this fix -- 1 outer scoped list() + 1 inner
unscoped list() per parented card).
* fix(workboard): address review feedback on dependency-target-status fastpath
Two findings from the automated PR review, both confirmed real:
- Remove an incomplete, unrelated active-owner fast-path (listActiveOwnerIds()
in store.ts + its cross-board test in store.test.ts) that leaked into this
commit from separate, still-in-progress local work. It imported
WorkboardActiveOwnerQueryable, a type that isn't defined anywhere in this
PR's tree, breaking typecheck and the bundled-extension lint check. Not
part of the dependencyTargetStatus fix this PR is scoped to.
- Replace the comparator-free, mutating .sort() calls in the new dependency
regression test with .toSorted() plus an explicit localeCompare comparator,
per the repo's lint rules.
Re-ran locally against just these two files (the actual PR diff, review WIP
set aside): pnpm lint --threads=8, pnpm format:check, pnpm tsgo:prod, pnpm
check:test-types, pnpm run lint:extensions:bundled all pass; full workboard
extension suite 111/111 (two removed tests belonged to the unrelated
active-owner code, not this fix).
---------
Co-authored-by: ClawBox <clawbox@cayk.ca>
* refactor(extensions): remove dead QA and utility exports
* refactor(extensions): trim Matrix QA internal exports
* chore(deadcode): refresh extension export baseline
* chore(ci): reconcile deadcode and LOC baselines
* chore(deadcode): refresh baseline after main advance
* chore(deadcode): refresh baseline after main advance
* refactor(plugins): keep channel snapshot type private
* fix(ci): align Linux deadcode baseline
Peter Steinberger