76c7cd7308
test(ci): trim duplicate SQLite lifecycle tours ( #122308 )
...
* test(ci): accelerate SQLite flip proof
* test(sessions): replace duplicate archive stress tour
* test(sessions): preserve SQLite lifecycle contracts
* test(sessions): drop duplicate archive assertions
---------
Co-authored-by: Amp <amp@ampcode.com >
2026-08-11 16:51:28 -07:00
23d1eca455
refactor(sessions): enforce transcript writer fence in sqlite sync ops ( #121316 )
...
Fold the writer-claim fence into the four sync write ops at their
definition sites, collapse the logical-layer fence wrappers to plain
re-exports, delete the session-accessor.sqlite middle barrel (the only
unfenced escape hatch), and retarget its 26 importers to the focused
defining modules. replaceSessionEntrySync intentionally stays unfenced:
its two production callers own their freshness guards and its return
carries no rebound signal. Net -106 production LOC, behavior-neutral.
Part 1 of the session-accessor dual-layer collapse.
2026-08-09 23:16:57 -07:00
73bdb4b924
feat(agents): record run-end worktree cleanup outcome; prove Workboard dirty retention ( #120434 )
...
* feat(agents): record run-end worktree cleanup outcome
Persist removed, retained, and failed run-end cleanup outcomes on managed worktree records. Operators and QA can inspect the durable fact through worktrees.list and openclaw worktrees list --json.
Release note: Managed worktree run-end cleanup now records why a checkout was removed or retained in worktree list JSON.
* test(qa): prove dirty worktree retention outcome
* chore(protocol): regenerate swift gateway models
* fix(agents): harden worktree cleanup recovery
Register run_end_cleanup_json as a lazy compatible column so same-version v6 index repair and read-only doctor migration can recover databases created before the column existed.
Type removal contention at the registry boundary; unexpected claim failures now best-effort record a bounded failed outcome and rethrow the original error.
* fix(ci): clear repo-wide lint debt blocking merge gates
The red-main landing rule requires this PR to repair repository-wide merge-gate debt instead of bypassing it. Apply the current lint contracts mechanically and split turn-transition coverage into a concept-named sibling with per-file-safe test state.
Exact line delta: +676/-574 (net +102) across 44 test/support files.
* fix(ci): preserve cached health refresh proof
Require the public refresh call to exist before accepting that sensitive fields were omitted, so the boundary proof cannot pass on a missing call.
* fix(ci): correct test typing left by the lint sweep
Literal-widened totalTokensVersion fixtures, a WebSocket RawData overload
mismatch, and the protocol schema document cast broke check-test-types
after the repo-wide lint repair. Aligns the fixtures with SessionEntry,
narrows Buffer handling per RawData, and keeps the JSON-shaped undefined
omission under structuredClone.
* test(agents): reuse upstream resource-loader test support
The session-loop split and #120463 's helper extraction landed the same
createResourceLoader/createCompactionHandlers twice; the rebase kept both,
orphaning main's agent-session-loop-resource-loader.test-support.ts and
failing the dead-code gate. Import the upstream helpers and delete the
duplicates.
* fix(agents): reject finalized rows at the worktree removal claim
Address the accepted ClawSweeper late-claim finding by rereading and rejecting missing or finalized worktree rows inside the synchronous removal-claim transaction.
Preserve the authoritative cleanup invariant: finalized contenders record nothing, while retained-busy is written only while the row remains live.
* refactor(agents): reuse registry update for busy outcomes
Keep the live-row conditional write in the canonical registry update path so the finalized-claim repair stays below the registry max-lines ratchet without weakening the authoritative-outcome invariant.
* test(agents): drop session test duplicates after rebase
Keep current main as the canonical owner of next-turn lifecycle coverage and correctness test support after replaying the older lint-debt split.
* fix(agents): guard post-abort cleanup outcomes against finalization
After abortWorktreeRemoval releases a stale remover's claim, its retained or
failed write raced a finalizing remover and could overwrite the authoritative
removed-lossless fact. Route every retained/failed write through the live-row
condition; only the finalizing remover's own removed-lossless write stays
unconditional.
* fix(agents): persist the removal outcome atomically with finalization
A delayed removed-lossless write after remove() finalized could race a
restore plus newer cleanup and overwrite the newer operator-visible fact.
The run-end outcome now rides remove()'s finalization update; every other
cleanup write stays live-row conditional, so no post-finalize write path
remains.
* test(qa): restore strict cached-health contract assertions
The lint sweep's Boolean() coercions let truthy non-booleans satisfy the
wire-typed cached-meta contract. Assert the literal boolean for unknown-typed
fields and use nullish-coalesced strict equivalents for boolean chains.
* fix(agents): clear the stale cleanup outcome when restoring a worktree
A restored checkout begins a new lifecycle; leaving the removed-lossless
fact on the live row showed operators a stale result until the next
cleanup. Restore clears the recorded outcome and the regression asserts
the cleared state before the next cleanup records fresh truth.
* fix(agents): scope stale cleanup outcomes to their observed lifecycle
A stale remover's retained/failed write raced a concurrent remove-plus-
restore: the revived row is live again, so the live-row condition alone
could stamp a prior-lifecycle outcome. Condition those writes on the
activity stamp the remover observed; restore bumps lastActiveAt, making
any prior-lifecycle write a no-op.
* fix(agents): advance the restore activity stamp within one millisecond
Stale cleanup writes fence on the activity stamp they observed; a restore
completing in the same millisecond could revive the row with an identical
stamp and let the fence match. Restore now always advances past the
stored value, and the ABA regression pins the clock to prove the
same-millisecond case.
2026-08-08 20:32:11 -07:00
9bfe292c86
fix(sessions): keep gateway responsive while large transcript archives are built ( #112424 )
...
* fix(sessions): keep gateway responsive during transcript archiving
* test(sessions): strengthen archive worker coverage
* fix(sessions): bound archive worker concurrency
* test(sessions): normalize rollback paths on Windows
* fix(sessions): load source archive worker on node 22
* fix(sessions): align archive fencing with session windows
* test(sessions): adapt cleanup race to archive worker
* fix(sessions): harden archive worker lifecycle
* style(sessions): format archive lifecycle tests
* fix(sessions): release writer lane during archive work
---------
Co-authored-by: Josh Lehman <josh@martian.engineering >
2026-08-04 14:40:59 -07:00
607cf8fb6f
test: consolidate SQLite flip proof helpers ( #118502 )
2026-08-02 22:34:58 -07:00
523da82e71
test(sqlite): align flip-proof request budgets ( #117878 )
2026-08-02 01:56:05 -05:00
0d508879d1
test(gateway): align e2e handshake timeout ( #117791 )
2026-08-01 23:49:04 -05:00
d5567ed61e
fix: prevent duplicate agent turns and slow Codex harness runs ( #115474 )
...
* fix(agents): deduplicate turns and speed up Codex harnesses
* test(agents): keep keyed transcript fixtures type-safe
* fix(codex): simplify linear native skill traversal
* fix(agents): preserve admitted SQLite turns during orphan repair
* test: split session user idempotency regressions
2026-07-28 22:56:12 -04:00
4273ca9dbd
refactor(sessions): remove file-era transcript runtime ( #113233 )
...
* refactor(sessions): keep helper transcripts in memory
* refactor(sessions): remove file-era transcript storage
* test(sessions): use SQLite identity in attempt persistence
* test(codex): isolate legacy transcript fixtures
* fix(sessions): preserve SQLite transcript identity
* fix(sessions): harden transcript lifecycle invariants
* fix(sessions): validate transcript identities
* fix(sessions): close identity compatibility gaps
* fix(sessions): preserve leaf and plugin identities
* fix(sessions): retain dispatch transcript targets
* fix(sessions): preserve active transcript context
* fix(sessions): isolate artifact accounting
* fix(sessions): bound SQLite usage accounting
* fix(sessions): retain bounded latest usage
* fix(sessions): align rebased transcript targets
* test(sessions): align accessor scope fixture
* fix(telegram): derive SQLite transcript identity
* refactor(sessions): remove file-era compaction residue
* chore(sessions): lower max-lines baseline
* fix(sessions): preserve structured transcript identity
* test(sessions): align doctor identity assertions
* fix(sessions): isolate default SDK database
* refactor(sessions): remove dead file-era exports
* fix(sessions): reconcile SQLite transcript identity
* fix(sessions): pass checkpoint identity explicitly
* test(sessions): make entry field probe explicit
* test(sessions): satisfy transcript cleanup lint
* test(sessions): align diagnostics identity proof
* fix(sessions): finish transcript runtime teardown
* fix(sessions): preserve transcript identity invariants
* fix(sessions): harden transcript compatibility edges
* fix(sessions): preserve checkpoint transcript anchors
* fix(sessions): preserve SQLite lifecycle invariants
* fix(sessions): retarget compaction successors
* test(sessions): preserve transcript fixture semantics
* feat(plugin-sdk): add command transcript targets
* fix(sessions): serialize transcript rewrites
* fix(sessions): validate legacy successor identity
* fix(sessions): normalize compaction ownership
* fix(sessions): validate successor identity before adoption
* fix(sessions): preserve plugin transcript ownership
* fix(sessions): carry transcript identity through commands
* fix(sessions): import legacy checkpoint artifacts into SQLite
* fix(sessions): preserve successor transcript ownership
* fix(sessions): align transcript consumers with target identity
* fix(sessions): scope transcript token estimates
* fix(sessions): retain agent identity across lifecycle hooks
* fix(sessions): resolve scoped SQLite targets
* fix(sessions): isolate lifecycle transcript targets
* fix(sessions): validate compaction agent ownership
* fix(sessions): preserve reset and cleanup lifecycle
* fix(sessions): serialize prompt cleanup lifecycle
* fix(sessions): remove stale lock import
* fix(sessions): preserve reset target context
* fix(sessions): fence prompt reload takeover
* fix(sessions): unblock abort and default lifecycle reads
* fix(sessions): validate legacy successor scope
* fix(sessions): reject metadata-only runtime rows
* fix(sessions): propagate custom transcript stores
* fix(sessions): preserve adopted retry targets
* fix(sessions): allow unkeyed usage reads
* fix(sessions): harden runtime target boundaries
* fix(sessions): serialize retry transcript writes
* fix(sessions): bound prompt reload disposal
* fix(sessions): complete retry marker identity
* fix(sessions): keep legacy marker identity minimal
* test(sessions): tighten teardown fixture types
* fix(sessions): preserve compatibility target identity
* test(sessions): persist post-checkpoint boundary turn
* test(sessions): align runtime store mock contracts
* style(sessions): simplify persisted identity guard
* fix(sessions): prefer complete typed targets
* fix(sessions): recover legacy marker targets
* test(sessions): align marker lookup fixture scope
* fix(sessions): validate partial transcript targets
* fix(sessions): reconcile partial transcript identities
* fix(sessions): canonicalize compatibility identities
* test(sessions): cover compatibility aliases
* fix(sessions): adopt legacy successor identity
* fix(sessions): preserve usage read identity
* fix(sessions): preserve partial marker compatibility
* fix(sessions): validate legacy successor mappings
* fix(sessions): reconcile marker store mappings
* fix(sessions): preserve legacy fallback identity
* fix(sessions): harden marker alias resolution
* fix(sessions): prefer verified successor aliases
* fix(sessions): resolve preferred marker aliases
* fix(sessions): serialize cleanup admission
* fix(sessions): align marker lookup scopes
* fix(codex): type marker alias summaries
* style(sessions): satisfy changed lint
* test(sessions): align structured target assertions
* fix(sessions): reconcile latest identity contracts
* fix(sessions): validate transcript identity boundaries
* docs(sessions): explain stable registry keys
* fix(sessions): harden compatibility target round trips
* fix(sessions): port usage identity to split modules
* test(sessions): align subagent transcript identity
* fix(sessions): finish transcript identity migration
* fix(agents): route subagent completion capture through transcript targets
* fix(agents): settle SQLite prompt handoff during cleanup
* chore: shrink max-lines baseline after teardown
* fix(sessions): port teardown across split runtime owners
* fix(sessions): carry transcript targets through split owners
* test(agents): use SQLite compaction target in abort coverage
* chore: retain unrelated max-lines suppressions
* chore: shrink max-lines baseline after main splits
* style(agents): const compaction checkpoint locals
* fix(sessions): harden SQLite teardown boundaries
* test(sessions): use typed metadata in predicate isolation fixture
* test(agents): cover malformed settlement rejections lint-safely
* fix(sessions): close remaining SQLite identity races
* fix(agents): fail closed on incomplete successor targets
* fix(sessions): preserve transcript identity fallbacks
* fix(agents): preserve session-key abort admission
* fix(trajectory): validate incomplete export targets
* test(sessions): drop retired pricing cache imports
* fix(sessions): validate partial transcript identities
* fix(sessions): close transcript identity edge cases
* fix(plugins): reserve retired transcript locator slot
* fix(sessions): scope transcript locks by target
* style(sessions): simplify SDK initialization error
* fix(sessions): preserve initialized transcript state
* fix(codex): verify mirrored history session keys
* fix(sessions): reject stale transcript ownership
* fix(sessions): anchor asynchronous transcript ownership
* fix(sessions): measure active transcript state
* fix(sessions): preserve scoped transcript compaction
* fix(sessions): harden transcript identity and lifecycle
* fix(sessions): resolve scoped command transcript stores
* fix(sessions): make transcript appends failure-atomic
* fix(sessions): enforce scoped transcript ownership
* fix(sessions): reject cross-owner transcript handoffs
* fix(sessions): fence cleanup transcript ownership
* fix(sessions): retire stale write ownership contexts
* fix(sessions): preserve pending session migration state
* fix(sessions): validate migrated transcript ownership
* fix(sessions): validate usage transcript targets
* fix(sessions): clear predecessor transcript metadata
* fix(sessions): align durable session event targets
* fix(sessions): fence late prompt handoffs
* fix(sessions): fence lifecycle transcript fallbacks
* fix(sessions): bound zero-length memory capture
* fix(sessions): preserve transcript teardown ownership
* fix(sessions): reject duplicate cleanup ownership
* fix(sessions): serialize runtime writes with sqlite leases
* fix(sessions): close sqlite teardown concurrency gaps
* fix(sessions): preserve nested lifecycle failures
* fix(sessions): canonicalize sqlite transcript ownership
* fix(sessions): settle disposed prompt handoffs
* fix(sessions): resolve canonical attempt lock targets
* test(sessions): align canonical target fixtures
* test(sessions): retire redundant jsonl parser coverage
* refactor(sessions): split active transcript cursors
* test(memory): retire legacy marker fixture
* fix(sessions): preserve canonical transcript access after rebase
* fix(sessions): fence prompt lease and return transcript targets
* fix(sessions): colocate transcript leases with target store
* fix(sessions): canonicalize transcript lease and worker targets
* fix(sessions): preserve plugin and fork identity markers
* fix(sessions): complete sqlite transcript target migration
* fix(sessions): integrate canonical followup identity
* fix(sessions): preserve bounded transcript topology
* fix(sessions): validate transcript identity boundaries
* fix(context): separate caller and successor targets
* test(sessions): split persistence compatibility coverage
* test(sessions): preserve fixture topology efficiently
* chore(sdk): refresh plugin api baseline
* test(agents): align compaction lock target mocks
* test(sessions): seed malformed transcript fixtures directly
* fix(agents): canonicalize transcript compatibility inputs
* fix(agents): type optional tool result ids
* test(ci): stabilize loaded process timing
* test(tui): wait for collect queue admission
2026-07-27 22:33:24 -04:00
82d1a03f25
refactor(agents): move implicit-main fallback into load-time roster injection ( #112678 )
...
* refactor(agents): require explicit roster defaults
* feat(onboard): create named first roster agent
* refactor(agents): remove runtime main fallbacks
* style(agents): apply roster refactor formatting
* refactor(agents): finish roster-only runtime sweep
* fix(doctor): migrate legacy main session sqlite
* fix(doctor): harden roster session migrations
* fix(onboard): commit first agent atomically
* fix(config): support empty-roster analysis
* fix(agents): preserve legacy main state during creation
* fix(setup): materialize baseline agent roster
* fix(agents): harden legacy default transfer recovery
* fix(agents): simplify roster-only legacy compatibility
* fix(agents): preserve staged first-agent entries
* fix(config): migrate persisted implicit-main rosters
* fix(config): preserve staged empty rosters
* fix(agents): finalize roster-only upgrade paths
* fix(sessions): close legacy main migration outcomes
* fix(config): migrate legacy roster markers at load
* fix(sessions): preserve roster upgrade history
* refactor(sessions): restore lean legacy main compatibility
* fix(setup): prepare first-agent credentials before publish
* fix(config): stabilize roster snapshot migration
* refactor(sessions): shrink legacy main compatibility
* fix(agents): restore roster compatibility fidelity
* fix(sessions): preserve divergent legacy history
* refactor(agents): narrow roster-only scope
* fix(config): isolate roster migration
* test(agents): align roster-only fixtures
* fix(agents): keep main agent undeletable
* fix(agents): harden roster migration invariants
* fix(agents): close setup and audit scope gaps
* fix(cron): scope session reaper throttles by agent
* fix(agents): preserve scoped owner precedence
* fix(config): preserve authored config ownership
* fix(setup): keep default workspace and roster in sync
* fix(setup): preserve default entry workspace on bare runs
* fix(agents): adapt roster rebase to keyed entries
* fix(agents): honor both roster representations
* fix(agents): route roster reads through shared helpers
* fix(config): preserve canonical roster writes
* fix(cron): resolve dynamic default for session reaper
* fix(agents): close dynamic default migration gaps
* fix(agents): align scoped session ownership
* fix(sessions): preserve legacy main directory casing
* fix(agents): align cron and legacy auth ownership
* fix(setup): provision the committed default workspace
* fix(cron): align scoped ownership and reaping
* fix(cron): treat blank agent ids as absent
* fix(cron): retain configured session-store owners
* fix(agents): repair roster-aware CI boundaries
* fix(cron): preserve scoped ownership resolution
* fix(agents): preserve rosterless maintenance paths
* fix(agents): propagate roster ownership through runtime boundaries
* fix(agents): preserve roster ownership across runtime paths
* fix(agents): harden roster diagnostics and legacy routing
* fix(agents): remove redundant diagnostic import
* test(agents): type CLI policy fixture explicitly
* fix(config): preserve canonical roster mutation identity
* fix(doctor): read canonical agent rosters consistently
* fix(config): resolve compound roster unsets safely
* fix(config): finalize main-session reconciliation
* fix(doctor): read canonical session state safely
* fix(sessions): preserve current visibility alias
* fix(config): track roster include provenance
* test(config): type roster provenance cases
* fix(config): refine roster include ownership
* fix(agents): preserve staged roster invariants
* test(config): align fixtures with explicit roster ownership
* test(node-host): preserve optional plan typing
* fix(config): preserve authored roster projections
* test(config): keep raw roster fixtures explicit
* test(config): normalize rosters at runtime fixtures
* fix(config): protect authored roster ownership
* fix(agents): require explicit session ownership
* fix(agents): enforce scoped roster ownership
* fix(sessions): merge fixed-store agent partitions
* fix(agents): harden roster ownership boundaries
* fix(config): reject ambiguous roster projections
* fix(sessions): preserve persisted store ownership
* fix(sessions): keep collision diagnostics additive
* fix(security): scan malformed roster workspaces
* test(config): align snapshot fixtures after rebase
* test(agents): use explicit roster fixtures
* fix(config): harden roster diagnostic boundaries
* fix(sessions): isolate fixed-store agent databases
* test(agents): type malformed default markers
* refactor(sessions): extract store collision resolution
* test(system-agent): split oversized setup coverage
* style(system-agent): format split setup suite
* fix(sessions): preserve promoted store ownership
* fix(sessions): derive scoped owner before target
* fix(sessions): preserve explicit sqlite ownership
* fix(agents): restore roster compatibility across CI
* fix(agents): enforce roster-owned runtime boundaries
* fix(agents): satisfy default lookup lint
* test(sessions): split known-owner coverage
* fix(state): satisfy path identity lint
* fix(agents): preserve malformed roster safety boundaries
* fix(agents): restore roster compatibility at runtime boundaries
* fix(config): satisfy roster boundary type checks
* fix(agents): preserve roster ownership across runtime probes
Setup inference probes now execute as the configured roster owner. Malformed agent-prefixed session rows are intentionally omitted by the fail-closed visibility contract rather than normalized by tests.
* fix(agents): satisfy session list owner lint
* fix(agents): preserve roster-owned runtime boundaries
Restore shared logical rows for exact SQLite session locators while keeping their physical database owner separate. The ownership regression test now constructs an explicit sole-owner database directly instead of relying on first-touch capture, matching the intentional shared-store contract.
* fix(sessions): preserve multiply owned exact stores
* fix(sessions): restore runtime owner boundaries
Keep incognito sentinels agent-owned, fold default-agent approvals into the global snapshot, and preserve the configless legacy-main CLI policy fallback. Also repair the existing CLI watchdog test lifecycle so the compact shard observes its timeout without an unawaited assertion or async timer stall; product behavior is unchanged by that test-only fix.
* test(ci): align owner-scoped fixtures
These assertions are unchanged. The fixtures now declare the intended non-default runner, expose the session-key constant imported by production status code, and select the main approvals bucket explicitly on Windows.
* fix(agents): close final roster ownership gaps
2026-07-24 22:38:09 -07:00
73bba03e4c
refactor: canonicalize session delivery state ( #113225 )
...
* refactor: canonicalize session delivery state
* test: canonicalize reply persistence fixtures
* test: canonicalize talk delivery fixtures
* test: canonicalize voice session routes
* test: canonicalize attachment delivery fixtures
* test: migrate gateway delivery fixtures
* fix: skip invalid session delivery rows
* test: align delivery SDK surface gates
* fix: preserve legacy delivery precedence
* test: canonicalize heartbeat delivery fixtures
* fix: preserve delivery route prompt identity
* test: canonicalize session delivery fixtures
* fix: preserve recoverable legacy delivery routes
* fix: canonicalize remaining session state
* fix: preserve canonical session classification
* style: format delivery state changes
* test: refresh plugin SDK delivery baseline
* test: avoid mutating session fixture input
* style: simplify delivery identity check
* style: simplify delivery origin spread
* fix: preserve fresh delivery route metadata
* test: assert canonical surface route switch
* fix: canonicalize doctor file-store imports
* fix: preserve transitional delivery migration state
* fix: satisfy canonical delivery CI gates
* ci: scope GitHub App token permissions
* test: infer canonical delivery projections
* test: canonicalize ACP requester delivery fixtures
* test: canonicalize harness rollback fixture
* style: apply pinned formatter
2026-07-24 01:01:19 -07:00
c5a2220d37
refactor(sessions): restructure per-agent SQLite schema ( #113071 )
...
* refactor(sessions): restructure agent session schema
* fix(sessions): preserve sharing across node ownership
* refactor: split session node artifact helpers
* test: track session cleanup temp directories
* fix(sessions): preserve fresher alias artifacts
* fix(sessions): reject placeholder membership writes
* test(sessions): align schema ownership fixtures
* fix(sessions): align incognito and heartbeat ownership
* test(sessions): preserve retained window rehoming coverage
2026-07-23 10:21:05 -07:00
ef91ce5712
feat: keep reset session history searchable ( #111194 )
...
* feat(sessions): retain reset history in sqlite with physical disk budget
* fix(sessions): satisfy test-types, knip export scan, and docs map
* fix(sessions): align behavioral suites and flip proof with retained history, route-aware cleanup plans
2026-07-19 03:38:51 -07:00
bae9752c5a
refactor(deadcode): enforce repository hard zero ( #108641 )
2026-07-15 22:40:00 -07:00
e0f45bfbf0
feat(tooling): enforce indexed access checks in root tests ( #105223 )
...
* feat(tooling): enforce indexed access checks in root tests
* style(tooling): clarify scoped package guard
2026-07-12 10:42:07 +01:00
0ae352a648
fix(test): reclassify sqlite flip proof harness ( #104784 )
2026-07-11 16:38:37 -07:00
Peter Steinberger