The previous commit patched me.id into 13 contexts in one suite. That treated the
symptom: the harness itself never passes botInfo, so resolveBotUserId has no
fallback when a test ctx carries only a username.
Fix the harness instead. Production always builds the bot from getMe(), so
botInfo is present in every real path; supplying telegramBotInfoForTest matches
that and drops the per-context ids.
Also revives bot.media.stickers-and-fragments.e2e.test.ts, which shares the
harness and failed 3/6 for the same reason and was not covered before.
The other ~84 bare me literals across 8 Telegram suites are fine: those tests
supply botInfo through their own harnesses. Verified, 371 pass, so no sweep.
PR #115401 fixed the album split by separating durable claim lifetime from lane
occupancy (deferredLaneOccupancy="release"), and stated the same change repairs
the text/forwarded-message debounce, which defers its spooled participant the
same way. The album path got a durable-drain regression test; the debounce path
did not, because the suite that would cover it fails 10/10 on main.
Restore that suite: its harness supplies me.username without me.id, which
resolveBotUserId has required since #114532. Production grammY populates ctx.me
from getMe(), so this is harness drift, not a runtime gap.
Then extend the durable-ingress regression file to both buffers and rename it
off media-group. Two new tests admit a forwarded burst through the spool and
core drain, live and from a restart backlog, asserting one turn carrying both
notes plus independent tombstones.
Both fail with deferredLaneOccupancy reverted to "hold" (second note lands in a
separate turn), so they pin the lane contract rather than restate it.
* fix(telegram): coalesce durable album ingress
Split durable claim lifetime from lane occupancy so Telegram can admit later album members while every deferred claim remains heartbeated, recoverable, and independently settled.
With deferredLaneOccupancy=release, an unrelated later same-lane Telegram message can reach reply admission before an album that is still inside its 500 ms flush window. That restores the pre-f7786a16 contract, not a new defect; grammY sequentialize still preserves handler-entry order and the reply lane serializes once a turn is admitted.
* fix(telegram): preserve deferred abort semantics
Release deferred claims when their owner aborts before settlement, while preserving adoption when settlement won the race. Supersede every accepted pre-adoption state on released lanes without admitting past a surviving lane owner.
* fix(telegram): separate participant rejection from settlement failure
The detached deferred continuation chained its rejection handler with .catch
after .then, so it observed not only a participant.task rejection but also any
error thrown by onFailed()/onAdopted() and re-drove that infrastructure error
through onFailed().
That applied the wrong disposition when the claim was still pre-adoption, and
silently discarded the error once it was not: onAdopted() sets phase to adopted
before its tombstone write, so a wedged write reached a re-entrant onFailed()
that returned early on the phase guard and never reached the logging handler.
Use the two-argument then form so task rejection and lifecycle settlement
failure stay on separate paths.
* fix(channels): satisfy ingress CI guards
* feat(talk): emit realtime models and voices in talk.catalog and mirror create-time readiness
* feat(ui): add curated Talk settings page with catalog-driven pickers
* docs(talk): correct stale claims and add one-page GPT-Live setup path
* fix(ui): refresh Talk catalog on config-hash advance and neutralize GPT-Live badge
* fix(ui): provider-aware Talk selection, atomic provider switch, focus refresh
* fix(ui): resolve Talk provider fallbacks via catalog and make Default a true reset
* fix(ui): provider-compatible transports and race-free Talk catalog loads
* fix(ui): never resolve an unknown explicit Talk provider to the active one
* docs(talk): note Android relay readiness caveat for browser-only models
* fix(ui): keep the relay transport when switching Talk provider to Auto
* fix(ui): align section-ownership test and drop unused export after rebase
* feat(gateway): share the canonical browser-origin policy with plugins
Export resolveAcceptedBrowserOrigin through openclaw/plugin-sdk/webhook-request-guards
so browser-facing plugin routes reuse the Gateway's real origin contract instead of a
narrow allowedOrigins array check. Private LAN/Tailnet Control UI loads and the
Host-header fallback were previously rejected with 403 by plugin offer routes while the
Control UI itself worked.
Moves the loopback/forwarded-header helpers to net.ts (re-exported from auth.ts) so the
guard can delegate without importing gateway auth, and migrates the Codex realtime
broker onto the shared seam.
* feat(talk): let providers own agent delegation for realtime voice
Adds an optional runAgentConsult callback to the browser-session create request and
injects the existing embedded consult runtime from talk-client, bound to the same agent
and session key the GA tool path uses. Providers whose realtime protocol delegates work
through their own control channel (rather than GA function calls) can now reach the
OpenClaw agent without a client round-trip.
Threads the effective per-session model into browser-session capability resolution so a
request-level model override selects the right capability set, and propagates a caller
abort signal into consultRealtimeVoiceAgent so a superseded delegation stops its run.
* feat(openai): support GPT-Live realtime voice over ChatGPT OAuth
Implements OpenAI's quicksilver/frameless session natively for Talk browser sessions.
The Gateway creates the WebRTC call (multipart sdp+session to https://api.openai.com/v1/live)
and owns the sideband control socket, so the browser never holds upstream credentials;
delegation.created events run through the OpenClaw agent and stream back as speakable
context appends.
Verified end-to-end on 2026-07-28 against a ChatGPT Pro OAuth profile: call create 201
with an rtc_* id and answer SDP, sideband session.started, session.close teardown.
ChatGPT OAuth is preferred over a Platform API key because /v1/live access for platform
keys is waitlist-gated; the legacy chatgpt.com backend route returns 403 for every model
and protocol version and is not used.
Accepted models are gpt-live-1-codex and gpt-live-1-boulder-alpha; the voice allowlist is
the ten values the route actually accepts, since an invalid voice is rejected at call
creation and cannot be repaired afterwards (session.update reports immutable_field_update).
* docs: document GPT-Live Talk support and its route gotchas
Records the working route and auth, the accepted models and voices, the browser-only
scope, and the two traps that cost the most time: the chatgpt.com backend route returns
403 Voice session access denied for every model, and that same 403 is also what an
invalid voice returns, so it must not be read as an account entitlement block.
* fix(openai): resolve GPT-Live CI failures
* refactor(openai): own zod runtime dependency
* fix(openai): satisfy lint and live-shard gates for GPT-Live
Types the retry-delay finish callback as Error so the rejection reason is provably an
Error at the call site; the abort path already normalized a non-Error AbortSignal reason,
but the unknown parameter type hid that from static analysis.
Registers the new GPT-Live live test in the native-live-extensions-openai shard
expectation. The shard selector already picked the file up from the real tree; only the
hardcoded list in the tooling test lagged.
* fix(openai): clean up post-rebase capability resolver
* fix(openai): preserve GPT-Live delegation fragments
* fix(openai): close GPT-Live sideband handoff race
* fix(openai): accept UUID GPT-Live call ids
* style: apply oxfmt to GPT-Live sources and Talk docs
* style: format Talk docs after rebase
* fix(openai): keep GPT-Live transcript context across ignored delegations
* fix(slack): cap chat.update edit text at the 4000-char limit, not the 8000 send limit
updateMessageSlack truncated the edit text to SLACK_TEXT_LIMIT (8000), but Slack chat.update
rejects text longer than 4000 characters with msg_too_long (documented in limits.ts). Every
other edit path (actions.ts, edit-text.ts, message-action-dispatch.ts, preview-finalize.ts)
uses SLACK_EDIT_TEXT_LIMIT (4000); updateMessageSlack was the lone outlier, so a long
question-delivery status edit failed instead of landing. Use the edit limit.
* fix(slack): enforce edit text byte limits
Co-authored-by: MatthewSynthia <matthewsynthia@users.noreply.github.com>
* fix(slack): preserve prepared edit text within limits
Co-authored-by: MatthewSynthia <matthewsynthia@users.noreply.github.com>
---------
Co-authored-by: MatthewSynthia <matthewsynthia@users.noreply.github.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
Shakker