* fix(macos): make the whole AI candidate row clickable and clear stale exhausted verdicts
Live-testing pick-during-testing on 2026-08-11 showed clicks on a candidate
row's blank stretch (between the title/subtitle texts or over the spacer)
silently doing nothing: plain-style buttons only hit-test opaque label
pixels. A user trying to pick Claude Code while Codex auto-tests can click
the visually highlighted row and get no outcome. .contentShape(Rectangle())
makes the full row hit-test.
Also, after auto-candidates exhaust, a user-picked retest left the stale
"None of the found options worked" card up while the new test visibly ran;
userSelect now clears exhaustedAutoCandidates when a fresh attempt begins.
* test(tooling): drop stateless poll tests from stateful-helper fixtures
Main went red when #121923 rewrote the outbound poll tests to be
order-independent and removed their stateful helper import/file; this
lane-config test hardcoded both as stateful-helper classification
fixtures. Folded into this PR per red-main landing policy.
* fix(mac): scope managed CLI install and detection to the active app profile
Under an active OPENCLAW_PROFILE the onboarding ready page detected the
host-global managed CLI (~/.openclaw/bin/openclaw) and its update/install
flow rewrote the operator's real managed copy. The managed install prefix
now follows the profile state directory (~/.openclaw-<name>), preferred
paths exclude other profiles' managed trees (including stale validated
executables and inherited shell PATH entries), and external CLIs stay
detectable read-only. Default-profile behavior is unchanged.
* chore(mac): refresh native i18n inventory for shifted source lines
* fix(macos): let AI setup proceed when the login keychain is unavailable
A missing/locked login keychain made GatewayActivationBindingKeyStore
unable to mint the activation binding key, and onboarding refused every
candidate and manual-key activation with 'Secure storage is unavailable'.
The fingerprint only protects the crash/relaunch resume receipt, so
degrade instead of refusing: write an ownerless pending record (still
matched exactly, never as a wildcard), keep the full activation-ambiguity
window, and skip only restart reconciliation, which needs fingerprint
proof by design. A relaunch then repeats activation rather than trusting
the receipt.
Reported by Peter Steinberger.
* fix(macos): render proper provider brand icons in onboarding AI setup
Nearly every provider icon URL the gateway sends is a simpleicons.org
SVG, which AsyncImage cannot decode, so the Connect your AI page fell
back to generic symbols for every tool and provider; the two GitHub
avatar PNGs that did render clashed as full-color rasters.
Bundle nine monochrome template marks (Simple Icons CC0; xAI from
LobeHub icons, MIT) and resolve them local-first by brand id/kind,
including composed choice ids like xai-oauth. Remote icons now load via
NSImage(data:), which decodes SVG, with vector payloads tinted as
templates so plugin-supplied icons blend too. Every glyph sits in a
uniform rounded well; install cards show host-only links, hover states,
and a softer translucent surface shared by all setup sections instead
of controlBackgroundColor.
Requested by Peter Steinberger.
* fix(macos): use failable UTF-8 decode in icon vector sniffing (swiftlint)
* fix(macos): address ClawSweeper review of onboarding icon/keychain changes
- Refuse relaunch handoff from ownerless (keychain-unavailable) completed
receipts at the reconciliation trust boundary; such receipts can belong
to replaced credentials, so setup repeats a fresh activation instead.
- Decode and pass the canonical brandId the gateway sends for candidates,
auth options, and manual providers so bundled marks resolve for opaque
choice ids.
- Scan the bounded XML prolog (comments, declarations, doctype) when
sniffing remote SVG payloads; comment-prefixed vectors now tint as
templates.
* refactor(macos): move setup error enum to support file (swiftlint file length)
* chore(i18n): refresh native source inventory
* fix(macos): give keychain-unavailable activations attempt-specific unbound leases
A nil owner made concurrent unbound attempts indistinguishable: a stale
attempt's delayed response could complete or clear a newer attempt's
record. Unbound attempts now mint a random per-attempt lease id with a
sentinel fingerprint — live matching stays attempt-exact, restart
reconciliation's fingerprint guard rejects them, and relaunch
verification refuses unbound receipts before any handoff.
* chore(macos): ship third-party artwork notices with provider icons
Simple Icons (CC0) attribution and the LobeHub Icons MIT license text
for the xAI mark now travel inside the bundled ProviderIcons directory.
* fix(ci): refresh plugin-sdk API manifest for private-type hashing
#120975 changed the baseline generator to hash private types but landed
without regenerating the manifest; the check-plugin-sdk-api-baseline
lane was gated off on that PR and first failed here. Regenerated via
pnpm plugin-sdk:api:gen with no SDK surface change in this branch.
Make timeout paths cancel or release every pending test continuation before cleanup, so failures cannot poison the remaining Swift suite. Inject the retry sleeper to preserve invalidation-before-backoff ordering without real-time polling.
Fresh Dev installs now preflight disk space and stream honest stages, while Codex activation probes the refreshed request-scoped registry.
Closes#120779Closes#120780
* feat(macos): add native camera PTZ controls
Add physical UVC pan, tilt, and zoom through the signed Mac app, with camera.ptz.control kept behind dangerous-command approval. Verified against real Insta360 Link 2 Pro hardware.
* refactor(agents): split message tool display config
* fix(mac): harden camera PTZ contracts
BoundedCommandTests and BoundedProcessTests failed nondeterministically:
4/20 runs idle, 7/8 under CPU saturation. Three separate causes.
1. #require inside a retry loop. waitForPID polled through readPID with
`try?`, but #require records an issue even when its error is swallowed,
so the first read of a created-but-not-yet-written pid file failed the
test outright. Added a non-recording pollPID for the polling path and
kept the recording read as the authoritative final attempt. The two
single-read call sites now poll too - echo $$ > file creates and writes
in two steps, so any single read can see a missing or empty file.
2. A 0.1s deadline racing process spawn. BoundedCommand starts its timeout
concurrently with the spawn, so the deadline also bounded /bin/sh
starting and publishing its pid; under load the child was killed before
it ever wrote the file. Wait for the pid while the run is in flight and
give the child a deadline well clear of spawn cost.
3. A 1s per-process budget on the concurrent fan-outs. Instrumenting the
deadline showed a stalled run observed all 64 exits at ~3.1s, clustered
within 100ms of each other - a global stall, not a straggler. Those
tests assert that no exit is lost during monitor registration, not
latency, so the timeout should not double as a performance assertion.
A missed exit still fails: the 50ms pollUntilExit fallback would never
complete.
Also widened waitUntilGone, since reaping is asynchronous.
No production code changed. Proof: 30/30 idle and 20/20 under full 32-core
saturation, against 16/20 and 1/8 before.
* refactor(macos): remove the custom menu bar hover card
The status item showed two hover affordances at once: the native AppKit
tooltip and a custom SwiftUI panel rendering an "Idle / No recent activity"
card. Keep the native tooltip and drop the custom HUD.
The HUD was the only consumer of the status item's hover tracking, so the
NSTrackingArea and onHoverChanged plumbing in StatusItemMouseRouter goes
with it; click routing is unchanged. WorkActivityStore.lastToolLabel had no
other reader either.
* chore(i18n): refresh native i18n inventory after hover card removal
Deleting HoverHUD.swift shifted the MenuBar.swift line numbers that
apps/.i18n/native-source.json records. Regenerated with
`pnpm native:i18n:baseline`; only line numbers change, no strings added
or removed.
* refactor(macos): drop the orphaned anchored chat panel
Removing the hover card left WebChatManager.togglePanel() without a caller,
and it was the only thing that created the menu-bar-anchored chat popover.
Delete that presentation path: togglePanel/panelHidden, the panel controller
state, WebChatPresentation, WebChatPanel, presentAnchored and its dismiss
monitor, and WindowPlacement.anchoredBelowFrame.
Chat is unaffected as a window - WebChatManager.show() still backs the Dock
menu, --chat and deep links. The status item highlight that tracked chat
window visibility is preserved, renamed to onChatWindowVisibilityChanged
now that no panel exists to confuse it with.
Periphery reports no unused code.
* chore: drop CHANGELOG edit from this PR
AGENTS.md: CHANGELOG.md is release-only and release generation derives it
from merged PRs. Release-note context lives in the PR body instead.
* chore: restore CHANGELOG to the branch base
Correct the previous commit, which restored CHANGELOG.md from current
origin/main and so pulled in an unrelated entry added after this branch
forked. Reset to the merge-base content: this PR now touches no changelog.
Pavan Kumar Gondhi