40dbc7a65a
test(plugin-sdk): remove repo-local test helper fossils ( #121190 )
2026-08-09 11:44:18 -07:00
c70aee247e
refactor(scripts): migrate JavaScript tools to TypeScript ( #121005 )
...
* refactor(scripts): migrate JavaScript tools to TypeScript
* fix(ci): keep changed-scope preflight zero-install
* fix(ci): preserve zero-install script owners
* fix(ci): complete script migration follow-through
* fix(release): keep stable closeout zero-install
* fix(scripts): preserve standalone execution boundaries
* fix(scripts): repair standalone loader boundaries
* fix(scripts): normalize gateway observation ids
* fix(scripts): keep Docker packager standalone
* test(scripts): preserve rebase cleanup helpers
* test(sessions): use tracked temp directory
2026-08-09 07:21:35 -07:00
33ea7ffa54
fix(ci): isolate package Telegram QA harness ( #120193 )
...
* fix(qa): isolate package Telegram harness
Keep private QA source, dependencies, taxonomy, and SDK dist in the trusted harness while the installed candidate owns its CLI, Gateway runtime, and persisted mock auth. Preserve the documented package RTT canary after taxonomy selection.
Co-authored-by: Dallin Romney <dallinromney@gmail.com >
Co-authored-by: Vincent Koc <vincentkoc@ieee.org >
* fix(qa): export private QA harness SDK entries
Canonicalize the QA-only plugin SDK entries shared by the private build and package Telegram harness manifest so qa-runtime and qa-lab resolve from trusted dist.
* fix(qa): expose private runtime to package harness
* fix(qa): surface Telegram observer conflicts
* fix(qa): accept separate preview and final messages
* test(qa): exercise Telegram poll delay contract
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
Co-authored-by: Vincent Koc <vincentkoc@ieee.org >
2026-08-08 15:11:03 -07:00
d4c9a4d8f1
Revert "feat(audit): preserve exact agent execution provenance"
...
This reverts commit 79b8775bc9
2026-08-07 18:40:17 -05:00
79b8775bc9
feat(audit): preserve exact agent execution provenance
2026-08-07 15:27:14 +08:00
4273ca9dbd
refactor(sessions): remove file-era transcript runtime ( #113233 )
...
* refactor(sessions): keep helper transcripts in memory
* refactor(sessions): remove file-era transcript storage
* test(sessions): use SQLite identity in attempt persistence
* test(codex): isolate legacy transcript fixtures
* fix(sessions): preserve SQLite transcript identity
* fix(sessions): harden transcript lifecycle invariants
* fix(sessions): validate transcript identities
* fix(sessions): close identity compatibility gaps
* fix(sessions): preserve leaf and plugin identities
* fix(sessions): retain dispatch transcript targets
* fix(sessions): preserve active transcript context
* fix(sessions): isolate artifact accounting
* fix(sessions): bound SQLite usage accounting
* fix(sessions): retain bounded latest usage
* fix(sessions): align rebased transcript targets
* test(sessions): align accessor scope fixture
* fix(telegram): derive SQLite transcript identity
* refactor(sessions): remove file-era compaction residue
* chore(sessions): lower max-lines baseline
* fix(sessions): preserve structured transcript identity
* test(sessions): align doctor identity assertions
* fix(sessions): isolate default SDK database
* refactor(sessions): remove dead file-era exports
* fix(sessions): reconcile SQLite transcript identity
* fix(sessions): pass checkpoint identity explicitly
* test(sessions): make entry field probe explicit
* test(sessions): satisfy transcript cleanup lint
* test(sessions): align diagnostics identity proof
* fix(sessions): finish transcript runtime teardown
* fix(sessions): preserve transcript identity invariants
* fix(sessions): harden transcript compatibility edges
* fix(sessions): preserve checkpoint transcript anchors
* fix(sessions): preserve SQLite lifecycle invariants
* fix(sessions): retarget compaction successors
* test(sessions): preserve transcript fixture semantics
* feat(plugin-sdk): add command transcript targets
* fix(sessions): serialize transcript rewrites
* fix(sessions): validate legacy successor identity
* fix(sessions): normalize compaction ownership
* fix(sessions): validate successor identity before adoption
* fix(sessions): preserve plugin transcript ownership
* fix(sessions): carry transcript identity through commands
* fix(sessions): import legacy checkpoint artifacts into SQLite
* fix(sessions): preserve successor transcript ownership
* fix(sessions): align transcript consumers with target identity
* fix(sessions): scope transcript token estimates
* fix(sessions): retain agent identity across lifecycle hooks
* fix(sessions): resolve scoped SQLite targets
* fix(sessions): isolate lifecycle transcript targets
* fix(sessions): validate compaction agent ownership
* fix(sessions): preserve reset and cleanup lifecycle
* fix(sessions): serialize prompt cleanup lifecycle
* fix(sessions): remove stale lock import
* fix(sessions): preserve reset target context
* fix(sessions): fence prompt reload takeover
* fix(sessions): unblock abort and default lifecycle reads
* fix(sessions): validate legacy successor scope
* fix(sessions): reject metadata-only runtime rows
* fix(sessions): propagate custom transcript stores
* fix(sessions): preserve adopted retry targets
* fix(sessions): allow unkeyed usage reads
* fix(sessions): harden runtime target boundaries
* fix(sessions): serialize retry transcript writes
* fix(sessions): bound prompt reload disposal
* fix(sessions): complete retry marker identity
* fix(sessions): keep legacy marker identity minimal
* test(sessions): tighten teardown fixture types
* fix(sessions): preserve compatibility target identity
* test(sessions): persist post-checkpoint boundary turn
* test(sessions): align runtime store mock contracts
* style(sessions): simplify persisted identity guard
* fix(sessions): prefer complete typed targets
* fix(sessions): recover legacy marker targets
* test(sessions): align marker lookup fixture scope
* fix(sessions): validate partial transcript targets
* fix(sessions): reconcile partial transcript identities
* fix(sessions): canonicalize compatibility identities
* test(sessions): cover compatibility aliases
* fix(sessions): adopt legacy successor identity
* fix(sessions): preserve usage read identity
* fix(sessions): preserve partial marker compatibility
* fix(sessions): validate legacy successor mappings
* fix(sessions): reconcile marker store mappings
* fix(sessions): preserve legacy fallback identity
* fix(sessions): harden marker alias resolution
* fix(sessions): prefer verified successor aliases
* fix(sessions): resolve preferred marker aliases
* fix(sessions): serialize cleanup admission
* fix(sessions): align marker lookup scopes
* fix(codex): type marker alias summaries
* style(sessions): satisfy changed lint
* test(sessions): align structured target assertions
* fix(sessions): reconcile latest identity contracts
* fix(sessions): validate transcript identity boundaries
* docs(sessions): explain stable registry keys
* fix(sessions): harden compatibility target round trips
* fix(sessions): port usage identity to split modules
* test(sessions): align subagent transcript identity
* fix(sessions): finish transcript identity migration
* fix(agents): route subagent completion capture through transcript targets
* fix(agents): settle SQLite prompt handoff during cleanup
* chore: shrink max-lines baseline after teardown
* fix(sessions): port teardown across split runtime owners
* fix(sessions): carry transcript targets through split owners
* test(agents): use SQLite compaction target in abort coverage
* chore: retain unrelated max-lines suppressions
* chore: shrink max-lines baseline after main splits
* style(agents): const compaction checkpoint locals
* fix(sessions): harden SQLite teardown boundaries
* test(sessions): use typed metadata in predicate isolation fixture
* test(agents): cover malformed settlement rejections lint-safely
* fix(sessions): close remaining SQLite identity races
* fix(agents): fail closed on incomplete successor targets
* fix(sessions): preserve transcript identity fallbacks
* fix(agents): preserve session-key abort admission
* fix(trajectory): validate incomplete export targets
* test(sessions): drop retired pricing cache imports
* fix(sessions): validate partial transcript identities
* fix(sessions): close transcript identity edge cases
* fix(plugins): reserve retired transcript locator slot
* fix(sessions): scope transcript locks by target
* style(sessions): simplify SDK initialization error
* fix(sessions): preserve initialized transcript state
* fix(codex): verify mirrored history session keys
* fix(sessions): reject stale transcript ownership
* fix(sessions): anchor asynchronous transcript ownership
* fix(sessions): measure active transcript state
* fix(sessions): preserve scoped transcript compaction
* fix(sessions): harden transcript identity and lifecycle
* fix(sessions): resolve scoped command transcript stores
* fix(sessions): make transcript appends failure-atomic
* fix(sessions): enforce scoped transcript ownership
* fix(sessions): reject cross-owner transcript handoffs
* fix(sessions): fence cleanup transcript ownership
* fix(sessions): retire stale write ownership contexts
* fix(sessions): preserve pending session migration state
* fix(sessions): validate migrated transcript ownership
* fix(sessions): validate usage transcript targets
* fix(sessions): clear predecessor transcript metadata
* fix(sessions): align durable session event targets
* fix(sessions): fence late prompt handoffs
* fix(sessions): fence lifecycle transcript fallbacks
* fix(sessions): bound zero-length memory capture
* fix(sessions): preserve transcript teardown ownership
* fix(sessions): reject duplicate cleanup ownership
* fix(sessions): serialize runtime writes with sqlite leases
* fix(sessions): close sqlite teardown concurrency gaps
* fix(sessions): preserve nested lifecycle failures
* fix(sessions): canonicalize sqlite transcript ownership
* fix(sessions): settle disposed prompt handoffs
* fix(sessions): resolve canonical attempt lock targets
* test(sessions): align canonical target fixtures
* test(sessions): retire redundant jsonl parser coverage
* refactor(sessions): split active transcript cursors
* test(memory): retire legacy marker fixture
* fix(sessions): preserve canonical transcript access after rebase
* fix(sessions): fence prompt lease and return transcript targets
* fix(sessions): colocate transcript leases with target store
* fix(sessions): canonicalize transcript lease and worker targets
* fix(sessions): preserve plugin and fork identity markers
* fix(sessions): complete sqlite transcript target migration
* fix(sessions): integrate canonical followup identity
* fix(sessions): preserve bounded transcript topology
* fix(sessions): validate transcript identity boundaries
* fix(context): separate caller and successor targets
* test(sessions): split persistence compatibility coverage
* test(sessions): preserve fixture topology efficiently
* chore(sdk): refresh plugin api baseline
* test(agents): align compaction lock target mocks
* test(sessions): seed malformed transcript fixtures directly
* fix(agents): canonicalize transcript compatibility inputs
* fix(agents): type optional tool result ids
* test(ci): stabilize loaded process timing
* test(tui): wait for collect queue admission
2026-07-27 22:33:24 -04:00
502d1cf56b
refactor(browser): split Playwright interaction tools ( #113771 )
...
* refactor(browser): split Playwright interactions
* test(browser): track split lint suppressions
* refactor(browser): inline interaction timeout resolver
2026-07-25 12:17:43 -07:00
5bd719fb9c
refactor(system-agent): split setup inference phases ( #113028 )
...
* refactor(system-agent): split setup inference phases
* fix(system-agent): preserve activation helper types
* fix(system-agent): keep read-only inference verification
* test(system-agent): track moved lint suppressions
2026-07-23 06:52:23 -07:00
edecdbd05e
refactor(config): config-surface reduction tranche 3 — product consolidations (review request) ( #111527 )
...
* refactor(config): consolidate media model lists
* refactor(config): unify memory configuration
* refactor(config): consolidate TTS ownership
* refactor(config): move typing policy to agents
* refactor(config): retire product-level config surfaces
* refactor(config): share scoped tool policy type
* chore(config): refresh generated baselines
* fix(config): honor agent typing overrides
* fix(config): migrate sibling config consumers
* refactor(infra): keep base64url decoder private
* fix(config): strip invalid legacy TTS values
* chore(config): refresh rebased baseline hash
* fix(doctor): route legacy messages.tts.realtime voice to talk during tts move
* refactor(config): polish final layout names
* refactor(config): freeze retired tuning defaults
* feat(config): add fast mode default symmetry
* refactor(config): key agent entries by id
* docs(config): update final layout reference
* test(config): cover final layout migrations
* chore(config): refresh final layout baselines
* fix(config): align final layout runtime readers
* fix(config): align remaining readers
* fix(config): stabilize final layout migrations
* fix(config): finalize config projection proof
* fix(config): address final layout review
* docs(release): preserve historical config names
* fix(config): complete keyed agent migration
* fix(config): close final migration gaps
* fix(config): finish full-branch review
* fix(config): complete runtime secret detection
* fix(config): close final review findings
* fix(config): finish canonical docs and heartbeat migration
* fix(config): integrate latest main after rebase
* refactor(env): isolate test-only controls
* refactor(env): isolate build and development controls
* refactor(env): collapse process identity indirection
* refactor(env): remove duplicate config and temp aliases
* docs(env): define the operator-facing allowlist
* ci(env): ratchet production variable count
* fix(env): remove stale provider helper import
* fix(env): make ratchet sorting explicit
* test(env): keep test seam in dead-code audit
* test(env): cover ratchet growth and boundary; document surface budgets
* docs(config): document tier-eval consolidations
* docs(config): clarify speech preference ownership
* test(memory): align retired tuning fixtures
* refactor(memory): freeze engine heuristics
* refactor(config): apply tier-eval tranche
* refactor(tts): move persona shaping to providers
* refactor(compaction): move prompt policy to providers
* test(config): align hookified prompt fixtures
* chore(deadcode): classify test-only exports
* chore(github): remove unused spawn helper
* chore(deadcode): classify queue diagnostics
* chore(deadcode): remove unused lane snapshot export
* chore(plugin-sdk): ratchet consolidated surface
* fix(config): integrate latest main after rebase
2026-07-21 20:28:43 -07:00
db482e6e97
fix(agents): race in-flight tool promises against run abort ( #103905 ) ( #110704 )
...
* fix(agents): race in-flight tool promises against run abort (#103905 )
wrapToolWithAbortSignal forwarded the combined abort signal into tool
execute calls but awaited the returned promise without racing it, so a
tool that never observes the signal kept running after stuck-session
recovery aborted the run and delivered its result into a dead run.
Race the execute promise against the combined signal so the wrapped
call rejects with AbortError as soon as the abort fires. The tool
promise itself cannot be cancelled in JavaScript; it keeps running in
the background and its late settlement is detached so it never lands
in the aborted run. Tool results and errors pass through unchanged
while the run is alive.
Refs #103905
* fix(agents): satisfy oxlint abort-race rejection rules without losing tool errors
* fix(lint): annotate intentional non-Error pass-through rejections
The race intentionally forwards tool rejections untouched (including
non-Error values), which trips oxlint's promise-rejection rules; mark
both sites with oxlint-disable-next-line justifications.
* test(scripts): allowlist intentional abort-race rejection suppression
The raw non-Error pass-through reject() in agent-tools.abort.ts is the
documented tool-error contract; register its prefer-promise-reject-errors
suppression in the production allowlist.
* fix(agents): observe sync-aborted tool rejections
Co-authored-by: thomas.szbay <thomas.szbay@xydigit.com >
---------
Co-authored-by: thomas.szbay <thomas.szbay@example.com >
Co-authored-by: Peter Steinberger <steipete@gmail.com >
Co-authored-by: thomas.szbay <thomas.szbay@xydigit.com >
2026-07-20 21:24:52 -07:00
df714814c8
test: drop retired reef transport suppression from the allowlist
...
A landed change removed the no-useless-assignment suppression in
extensions/reef/src/transport.ts without pruning the allowlist tail,
failing checks-node-compact-small-7 on every PR (merge-skew).
2026-07-17 13:27:12 -07:00
a0d6cd724a
feat(ui): animated Clawd mascot on the new-session welcome hero ( #108825 )
...
* feat(ui): animated Clawd mascot on the new-session welcome hero
Ports the native mascot to the Control UI as a canvas-backed
<openclaw-mascot> Lit component: exact 120x120 vector geometry, mood
loops (idle/curious/thinking/working/happy/celebrating/sad/sleepy/
attentive), deterministic seeded animator, DPR-aware rendering,
visibility-paused rAF, theme-reactive palette, and a reduced-motion
static pose. The new-session welcome hero swaps its static lobster
sprite for the living mascot.
* fix(ui): cancel stale mascot gestures on mood change
* fix(ui): keep MascotEffect internal to the pose module
* test(lint): allowlist the canvas fill suppression for the web mascot
2026-07-16 07:38:14 -07:00
7181233320
fix(ci): settle deadcode hard-zero sweep debt across guard lanes
...
The repository hard-zero sweep (bae9752c5a#108641 ) left five CI lanes
red on every PR: a stale max-lines baseline entry for the shrunken
live-cache-regression-runner, session-accessor debt baseline above the
real count, two sqlite-reliability contract types un-exported while
scripts/lib still imports them, a deleted-file entry on the production
lint-suppression allowlist, and a stale wildcard-barrel assertion in the
parallels smoke model test.
2026-07-15 23:16:10 -07:00
69e9254e0e
fix(ci): regen rename-affected generated surfaces and fix e2e entrypoint
...
native i18n inventory + per-locale artifacts resynced for the OpenClaw
strings; Kotlin gateway protocol enum regenerated instead of hand-edited;
deadcode baseline re-sorted; lint suppression allowlist entries moved to
sorted position; setup TTY check drops redundant boolean compares;
ring-zero first-run e2e calls the real 'openclaw setup' subcommand.
Refs #107237
2026-07-14 11:03:02 -07:00
a6a0716486
feat(setup): rename Crestodian to OpenClaw system agent
...
User-facing name is now OpenClaw (the system speaks); internal code name is
system-agent. Gateway methods crestodian.* -> openclaw.chat/openclaw.setup.*,
agent tool -> openclaw, reserved agent ids openclaw + retired crestodian.
openclaw setup routes: onboarding flags -> onboard, -m/--yes -> system agent,
bare configured interactive -> OpenClaw chat, unconfigured -> onboarding.
Hidden crestodian CLI and /crestodian TUI aliases kept; docs moved to
docs/cli/openclaw.md with redirect stub. macOS/Android strings in lockstep.
Refs #107237
2026-07-14 11:03:02 -07:00
f81f9d8570
chore: enforce max-lines suppression ratchet ( #107315 )
...
* ci: enforce max-lines suppression ratchet
* chore: prune stale max-lines suppression
* fix: close max-lines ratchet enforcement gaps
* fix: harden max-lines ratchet checks
* fix(ci): satisfy max-lines ratchet checks
* style: format max-lines declarations
* fix(ci): match oxlint suppression grammar
* test: isolate max-lines git fixtures
* chore: prune resolved max-lines debt
* test: skip newline path fixture on Windows
* fix: harden max-lines suppression ratchet
* chore: refresh max-lines baseline
* fix: close max-lines ratchet bypasses
* fix: derive ratchet base from PR merge tree
* fix: support older Git in staged ratchet
* fix: align max-lines declarations and baseline
* chore: refresh max-lines baseline for current main
* fix: exclude generated wizard locales from max-lines
* chore: prune resolved max-lines debt
2026-07-14 09:27:02 -07:00
882b2fe900
feat(channels): bundle Reef guarded claw-to-claw channel ( #106232 )
...
* feat(channels): bundle Reef guarded claw-to-claw channel
Moves the Reef channel extension from openclaw/reef into the bundled extensions tree with the wire protocol vendored under extensions/reef/protocol. Includes channelConfigs manifest metadata, runtime status reporting via setStatus/buildAccountSnapshot, abort-aware inbox shutdown, monotonic device-auth timestamps, and immutable-model guard admission (dated snapshots plus documented gpt-5.6 ids).
* fix(reef): pin zod exactly per dependency pin guard
* style(reef): satisfy extension lint gates
Curly braces in vendored protocol, explicit type re-exports, typed catch callbacks, Object.assign over map-spread, abort-aware loop restructure.
* fix(reef): CI gates — knip workspace, boundary tsconfig, facade imports, cycle break, contract baselines
- knip: reef workspace project includes vendored protocol/ (owns noble deps)
- tsconfig: conform to canonical extension package-boundary include/exclude; add @openclaw/plugin-sdk devDependency
- imports: channel-inbound/channel-outbound facades instead of deprecated subpaths
- protocol: home ReplayStore contract in envelope.ts to break the envelope<->replay type cycle
- baselines: reef in unguarded runtime-api list; regenerate bundled channel config metadata
* feat(reef): plugin catalog cover art, channel label, changelog revert
* fix(reef): drop unused error-class exports, register lint suppression
* fix(reef): knip entry surface for vendored protocol, explicit WebSocketLike export
2026-07-13 05:17:44 -07:00
dc6befc072
fix(browser): bind wait predicates to allowed documents ( #101852 )
...
* fix(browser): bind waits to allowed documents
Co-authored-by: Michael Appel <3399869+mmaps@users.noreply.github.com >
* fix(browser): guard document-bound wait predicates
Co-authored-by: Michael Appel <3399869+mmaps@users.noreply.github.com >
* fix(browser): satisfy wait guard gates
* test(browser): update lint suppression baseline
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-12 13:27:51 +01:00
e0f45bfbf0
feat(tooling): enforce indexed access checks in root tests ( #105223 )
...
* feat(tooling): enforce indexed access checks in root tests
* style(tooling): clarify scoped package guard
2026-07-12 10:42:07 +01:00
38b2494bfc
test(lint): allow external public surface loader
2026-07-12 08:40:22 +08:00
96f0983a85
fix(onboarding): skip setup for configured gateways and require inference first ( #102883 )
...
* fix(crestodian): keep onboarding RPCs restart-safe
* fix(profiles): isolate approval state migrations
* fix(crestodian): bypass configured gateway setup
* test(crestodian): type onboarding mocks
* fix(onboarding): require inference before Crestodian
* fix(onboarding): enforce verified inference handoff
* fix(macos): reset setup on gateway endpoint edits
* chore(i18n): refresh native source inventory
* fix(gateway): keep socket on request cancellation
* test(packaging): require workspace templates
* fix(onboarding): bind setup to verified inference
* fix(onboarding): align inference gate contracts
* fix(crestodian): classify concurrent policy rejection
* test(crestodian): expect registry restoration
* fix(onboarding): bind setup to configured gateways
* fix(codex): preserve startup phase deadlines
* test(crestodian): match fail-closed policy ordering
* test(onboarding): assert bound gateway handoff
* fix(codex): bind runtime resolution to spawn cwd
* test(crestodian): assert policy rejection order
* fix(cli): preserve gateway routing across restarts
* fix(macos): fail closed during gateway edits
* test(macos): cover gateway route generation races
* chore: keep release notes out of onboarding PR
* fix(ci): refresh onboarding generated checks
* style(swift): align gateway channel formatting
* fix(ci): refresh plugin SDK surface budgets
* fix(ci): resync native string inventory
* refactor(swift): split gateway channel support
* test(doctor): isolate plugin compatibility registry
* test(macos): isolate gateway onboarding fixtures
* test(macos): assert gateway lease health ordering
* fix(codex): reconcile computer-use startup changes
2026-07-11 10:25:14 -07:00
49b5b862ac
feat: node-hosted plugins — dynamic tools, MCP servers, and skills ( #90431 )
...
* feat: node-hosted plugins — dynamic tools, MCP servers, and skills
Nodes become declarative plugin hosts:
- node.pluginTools.update: node hosts publish plugin-registered agent tool
descriptors; gateway materializes them as agent tools executing via
node.invoke under the node command allowlist, with tools.effective
invalidation and node online/offline removal.
- Trusted paired-node descriptors: no gateway-side plugin registration
required; gateway.nodes.pluginTools.enabled off-switch (default on);
description/count caps; deterministic node-prefixed collision names.
- Declarative node-hosted MCP: nodeHost.mcp.servers (McpServerConfig shape)
starts MCP clients on the node host, publishes tools as pluginId node-mcp,
executes via built-in mcp.tools.call.v1 with per-layer timeouts, failure
isolation, and orphan-safe shutdown. No re-pairing when servers change.
- Node-hosted skills: node.skills.update publishes ~/.openclaw/skills
content (64 skills/64KB/512KB caps both sides); gateway merges them into
the skills snapshot while connected and exec host=node is available, with
node:// locators, node-prefixed collisions, disabled command dispatch,
and gateway.nodes.skills.enabled + nodeHost.skills.enabled switches.
- Security: node-supplied pluginIds cannot satisfy pluginId-scoped tool
allowlists unless gateway-registered; reserved node-mcp id requires the
core MCP descriptor shape; protocol registry kept out of public
plugin-sdk dts.
- E2E: pond harness proves publication, MCP round-trip, skills locator, and
disconnect/reconnect for all three surfaces.
* style: format node-plugin-tools test
* fix(skills): keep status loader unfiltered when eligibility is passed
skills.status started passing eligibility for the node-skill merge, which
flipped loadWorkspaceSkillEntries into filtered mode and dropped disabled
skills from status reports (QA plugin-lifecycle-hot-reload timeout). Status
now merges node skills explicitly around an unfiltered load. Also: regen
docs_map for new node docs sections; add the intentional node-host MCP
onclose suppression to the lint-suppression allowlist.
2026-07-11 10:16:34 -07:00
a789b92b39
fix(macos): harden fresh AI onboarding ( #102637 )
...
* fix(macos): bootstrap Codex before onboarding test
* fix(plugins): activate deferred runtimes on demand
* fix(macos): stage Codex runtime for onboarding probe
* fix(macos): expose sanitized onboarding errors
* fix(codex): reuse native CLI auth during onboarding
* fix(macos): hide Crestodian without inference
* fix(codex): honor explicit runtime policy during setup
* fix(onboarding): redact verification errors
* fix(macos): reset onboarding state with gateway route
* fix(onboarding): persist Codex plugin install metadata
* chore: refresh onboarding inventories
* fix(macos): restart AI setup after gateway change
* chore: refresh native onboarding inventory
* fix(onboarding): defer gateway restart until setup persists
* fix(macos): reset Crestodian on gateway changes
* chore(macos): refresh native i18n inventory
* fix(onboarding): harden inference setup state
* docs(skills): reuse pristine Parallels snapshots
* chore(macos): refresh onboarding i18n inventory
* fix(onboarding): prevent stale gateway and install state
* docs(skills): preserve saved Parallels sessions
* fix(macos): balance AI onboarding layout
* fix(parallels): parse npm workspace pack output
* chore(macos): refresh onboarding i18n inventory
* fix(parallels): bundle workspace runtime in package artifact
* fix(parallels): isolate canonical package helper
* fix(parallels): pack self-contained workspace artifact
* fix(packaging): exclude macOS app bundle
* fix(macos): restart inference checks after route changes
* docs(changelog): defer onboarding note to release
* fix(onboarding): enforce inference-first gateway setup
2026-07-10 04:59:15 +01:00
e6a8feb9c2
refactor(pairing): move device pairing store to shared SQLite state DB ( #103160 )
...
* refactor(pairing): move device pairing store to shared SQLite state DB
Device pairing, pending requests, and bootstrap tokens now live in the
device_pairing_* / device_bootstrap_tokens tables of state/openclaw.sqlite
instead of devices/{paired,pending,bootstrap}.json. Gateways import legacy
paired records once at startup (before the node-surface fold) and archive
the JSON files with a .migrated suffix; transient pending/bootstrap rows
are dropped. The unshipped node_pairing_* tables are removed from the
schema and dropped from existing DBs. Doctor now flags un-imported legacy
store files instead of corrupt-JSON reads.
* refactor(pairing): drop stale awaits now that store persistence is synchronous
* refactor(pairing): extract leaf record types to break store/domain module cycle
2026-07-10 01:46:56 +01:00
f53346944d
feat: correlate native search outcomes in audit history ( #98704 )
...
* feat: correlate native search outcomes in audit history
Metadata-only audit ledger for agent runs and tool actions in the shared
state DB: stable event identity, closed action/status/error vocabularies,
one-way-hashed tool-call ids, never-inferred terminal outcomes for native
web-search (explicit completed/failed only; otherwise unknown), bounded
retention, audit.list gateway RPC and openclaw audit CLI. Squashed from
the 82-commit audit stack for replay onto current main.
* feat(audit): add audit.enabled config gate (default on)
The metadata-only audit ledger records by default: an audit trail enabled
only after an incident cannot explain the incident, and the rows are
strictly less sensitive than the transcripts every install already
stores. audit.enabled=false stops new writes at the gateway subscription
seam; audit.list and openclaw audit keep serving existing records until
they expire. Documented in the configuration reference, protocol page,
and CLI reference.
* fix: repair full-matrix CI findings after rebase
- break the dynamic-tools/dynamic-tool-execution import cycle by
extracting resolveCodexToolAbortTerminalReason into a leaf module
- restore main's session-worktree protocol exports lost in the
index.ts auto-merge
- register the audit event writer worker as a knip entry point
- docs table formatting; subagent wait-cancellation test scoped to its
audit intent (outcome + timing) and advanced past main's new
lifecycle-timeout retry grace
2026-07-06 12:30:12 +01:00
2ded26a5d6
fix(diffs): share SSR preloads and repair language-pack hydration ( #100487 )
...
* fix(diffs): share SSR preloads and repair language-pack hydration
Render viewer and file documents from a single @pierre/diffs SSR preload
per file (mode=both previously ran the full diff+highlight pipeline
twice; 651ms -> 303ms on an 8-file patch), apply the file-mode font bump
as a document-level override, and keep hydration payloads
variant-faithful.
Fix the language-pack runtime downgrading pack-only languages to plain
text at hydration by defining a per-target build flag and forwarding it
to payload normalization.
Also: case-insensitive language hints, identical before/after
short-circuit with details.changed, patch input failures classified as
tool input errors, canonical config values now win over deprecated
aliases, hash-pinned viewer runtime served immutable, truthful
browser-vs-render errors, timing-safe artifact token compare, unref
idle browser timer.
* docs(changelog): link diffs rendering entry to PR
* test(diffs): narrow manifest validation results before value access
* test(tooling): allowlist diffs viewer-client define suppression
2026-07-06 00:34:17 +01:00
e845a26fd6
fix(agents): fail fast with attributable reason after MCP stdio session dies mid-run ( #98738 )
...
* fix(agents): fail fast with attributable reason after MCP stdio session dies mid-run
Wires MCP Client onclose/onerror during bundle-mcp session creation so a
crashed/exited server flips session.connected instead of staying stale.
Next tool/resource/prompt call throws a domain-specific 'is disconnected'
error immediately instead of surfacing the SDK's generic 'Not connected'.
A disconnected reused session is retired and rebuilt fresh on the next
catalog pass rather than reused, since the SDK chains onclose/onerror
cumulatively on repeat connect() and the stdio transport never clears its
read buffer on an unexpected exit.
* fix(agents): retire a reused MCP session that dies mid-refresh, not just pre-refresh
codex review found: the catch-path retirement in getCatalog()'s per-server
task only covered two cases (fresh session that never connected this pass,
and a non-reused session that failed for any reason) - a reused session
that was healthy when this pass started but disconnects mid-refresh (child
process dies between ensureSessionConnected() returning and
listAllToolsBestEffort() finishing) hit neither branch, so onclose flipped
connected=false but the dead session object stayed in the map until the
next catalog rebuild happened to notice it. Added the missing branch plus
a regression test that kills the child process mid tools/list on a reused
session and asserts the session is purged from the map within the same
refresh (not just fail-fast on tool calls, which already worked).
* fix(agents): retire a dead reused MCP session even across overlapping catalog generations
codex round-2 review found: the mid-refresh retirement branch still
skipped when sharedWithNewerGeneration was true, which protects a
still-alive session another generation is actively using - but once
onclose flips session.connected=false, the transport is dead for every
generation sharing that object, so that guard no longer applies.
Simplified to a single !session.connected branch that always retires
(retireSessionIfCurrent already no-ops safely if a newer generation
replaced the map entry), and dropped the now-write-only
connectedForCatalog local it replaced.
* test(scripts): allow MCP SDK callback suppressions
* fix(agents): retire closed MCP sessions
---------
Co-authored-by: Vincent Koc <vincentkoc@ieee.org >
2026-07-01 22:55:15 -07:00
1f941a026e
fix: reload control ui on service worker update ( #96141 )
2026-06-25 16:33:27 -07:00
1658fb6c14
fix(ci): restore QA workflow gates ( #95890 )
2026-06-23 09:26:35 +08:00
d1169c3dd0
refactor(plugins): remove unused session helpers
2026-06-17 22:22:40 +08:00
58c663920d
docs: document script tests
2026-06-04 20:49:50 -04:00
8b29ff5f16
fix(ci): scope PR merge diff checks to first parent ( #90287 )
...
Summary:
- This PR adds opt-in first-parent merge-head diff-base handling for CI changed-scope, changed-lanes, and OpenGrep PR scans, plus synthetic merge coverage and small lint/type cleanups.
- PR surface: Source +6, Tests +204, Config +1, Other +179. Total +390 across 15 files.
- Reproducibility: yes. The synthetic merge tests and PR body live-ref proof show the stale payload-base path can include main-only files, and first-parent mode narrows it to PR-owned paths.
Automerge notes:
- PR branch already contained follow-up commit before automerge: fix(ci): update workflow guard expectations
- PR branch already contained follow-up commit before automerge: fix(ci): resolve plugin guardrail lint failures
- PR branch already contained follow-up commit before automerge: fix(ci): preserve plugin run context typing
- PR branch already contained follow-up commit before automerge: fix(ci): scope PR merge diff checks to first parent
Validation:
- ClawSweeper review passed for head 40235e8c3d40235e8c3dhttps://github.com/openclaw/openclaw/pull/90287#issuecomment-4621155576
Co-authored-by: Mason Huang <masonxhuang@tencent.com >
Co-authored-by: clawsweeper <274271284+clawsweeper[bot]@users.noreply.github.com>
Co-authored-by: clawsweeper[bot] <274271284+clawsweeper[bot]@users.noreply.github.com>
Approved-by: hxy91819
Co-authored-by: hxy91819 <8814856+hxy91819@users.noreply.github.com >
2026-06-04 17:24:03 +00:00
5522268b24
test(ci): align lint suppression guard
2026-06-04 07:51:28 -07:00
e16ac04330
refactor(auth): store auth profiles in sqlite ( #89102 )
2026-06-03 16:14:15 -07:00
f83886c12d
chore(lint): trim remaining suppressions
2026-05-31 13:01:19 +01:00
4de9b79d30
refactor(agents): simplify stale cli retry cleanup
2026-05-31 17:28:05 +05:30
afe9826fc1
Stabilize lint suppression guard in CI
2026-05-31 17:28:05 +05:30
2bd07eead7
Refactor cron SQLite runtime paths ( #88582 )
...
* refactor: clean cron sqlite runtime paths
* fix: preserve legacy cron sqlite delivery migration
* fix: keep legacy cron notify fallback for invalid webhooks
* test: handle packaged lint suppression files
* fix: keep invalid cron notify migrations retryable
* test: fix ui timer lint
2026-05-31 12:14:48 +01:00
77f1359612
refactor: extract media and ACP core packages ( #88534 )
...
* refactor: extract media and acp core packages
* refactor: remove relocated media and acp sources
* build: wire new core packages into dependency checks
* test: alias new core packages in vitest
* build: keep media sniffer runtime dependency
* docs: refresh plugin sdk api baseline
* fix: keep normalized proposal queries non-empty
* test: keep channel timer tests isolated
* fix: keep rebased plugin checks green
* fix: preserve sms numeric allowlist entries
* test: harden exec foreground timeout failure
* test: remove duplicate skill workshop assertion
* fix: remove channel config lint suppression
* test: refresh lint suppression allowlist
2026-05-31 11:30:33 +01:00
4f3d8a57dd
fix(codex): accept first-party OpenAI plugin marketplaces
...
Allow Codex native plugin config to target first-party OpenAI marketplaces, including openai-curated, openai-bundled, and openai-primary-runtime.
Fixes #82216 .
Thanks @yaanfpv for the contribution.
Verification:
- node scripts/run-vitest.mjs test/scripts/lint-suppressions.test.ts
- pnpm build:ci-artifacts
- OPENCLAW_VITEST_MAX_WORKERS=2 node scripts/run-vitest.mjs run --config test/vitest/vitest.full-core-support-boundary.config.ts test/scripts/lint-suppressions.test.ts
- node scripts/run-vitest.mjs extensions/codex/src/app-server/config.test.ts extensions/codex/src/app-server/plugin-activation.test.ts extensions/codex/src/app-server/session-binding.test.ts extensions/codex/src/migration/provider.test.ts extensions/sms/src/channel.test.ts extensions/sms/src/inbound.test.ts
- git diff --check
- ./.agents/skills/autoreview/scripts/autoreview --mode local
- GitHub PR CI on head 896640060b
2026-05-31 11:08:42 +01:00
23dac6c263
test: keep vitest cases under one second
2026-05-31 06:51:34 +01:00
8348af99e8
fix(ci): clear stale changed-check failures
2026-05-30 09:55:59 +01:00
7f4338d435
test: speed up slow assertions
2026-05-29 20:52:18 +02:00
47e86bc1ac
refactor: share task sqlite store helpers
2026-05-29 04:35:45 +02:00
313d6ae1b3
fix(whatsapp): strip control characters from outbound document fileName ( #77114 )
...
Merged via squash.
Prepared head SHA: 5417a8ee2c246810661+masatohoshino@users.noreply.github.com >
Co-authored-by: mcaxtr <7562095+mcaxtr@users.noreply.github.com >
Reviewed-by: @mcaxtr
2026-05-28 01:17:52 -03:00
bb46b79d3c
refactor: internalize OpenClaw agent runtime ( #85341 )
...
* refactor: extract agent core package
Introduce packages/agent-core as the OpenClaw-owned home for reusable agent loop, harness, session, prompt, and runtime dependency contracts.
* refactor: extract shared llm runtime
Move provider model registries, stream wrappers, OAuth helpers, and LLM utilities into src/llm with plugin-sdk barrels instead of depending on the old embedded runtime layout.
* refactor: remove pi runtime internals
Rename remaining Pi-shaped agent surfaces to OpenClaw agent runtime names, delete obsolete Pi docs and package graph checks, and add the third-party notice for incorporated code.
* refactor: tighten agent session runtime
Make agent-core/runtime dependencies explicit, consolidate compaction and session transcript helpers, and move model/session helpers behind OpenClaw-owned contracts.
* refactor: remove static model and pi auth paths
Drop static model catalogs and Pi auth bridges, move model/provider facts to manifest-owned runtime contracts, and harden internal embedded-agent utilities.
* refactor: remove legacy provider compat paths
* docs: remove agent parity notes
* fix: skip provider wildcard metadata parsing
* refactor: share session extension sdk loading
* refactor: inline acpx proxy error formatter
* refactor: fold edit recovery into edit tool
* fix: accept extension batch separator
* test: align startup provider plugin expectations
* fix: restore provider-scoped release discovery
* test: align static asset packaging expectations
* fix: run static provider catalogs during scoped discovery
* fix: add provider entry catalogs for scoped live discovery
* fix: load lightweight provider catalog entries
* fix: refresh provider-scoped plugin metadata
* fix: keep provider catalog entries on release live path
* fix: keep static manifest models in release live checks
* fix: harden release model discovery
* fix: reduce OpenAI live cache probe reasoning
* fix: disable OpenAI cache probe reasoning
* ci: extend OpenAI gateway live timeout
* fix: extend live gateway model budget
* fix: stabilize release validation regressions
* fix: honor provider aliases in model rows
* fix: stabilize release validation lanes
* fix: stabilize release memory qa
* ci: stabilize release validation lanes
* ci: prefer ipv4 for live docker node calls
* fix: restore shared tool-call stream wrapper
* ci: remove legacy pi test shard alias
* fix: clean up embedded agent test drift
* fix: stabilize runtime alias status
* fix: clean up embedded agent ci drift
* fix: restore release ci invariants
* fix: clean up post-rebase runtime drift
* fix: restore release ci checks
* fix: restore release ci after rebase
* fix: remove stale pi runtime path
* test: align compaction runtime expectations
* test: update plugin prerelease expectations
* fix: handle claude live tool approvals
* fix: stabilize release validation gates
* fix: finish agent runtime import
* test: finish post-rebase agent runtime mocks
* fix: keep codex compaction native
* fix: stabilize codex app-server hook tests
* test: isolate codex diagnostic active run
* test: remove codex diagnostic completion race
# Conflicts:
# extensions/codex/src/app-server/run-attempt.test.ts
* ci: fix full release manifest performance run id
* refactor: narrow llm plugin sdk boundary
* chore: drop generated google boundary stamps
* fix: repair rebase fallout
* fix: clean up rebased runtime references
* fix: decode codex jwt payloads as base64url
* fix: preserve shipped pi runtime alias
* fix: add scoped sdk virtual modules
* fix: decode llm codex oauth jwt as base64url
* fix: avoid stale vertex adc negative cache
* fix: harden tool arg decoding and codeql path
* fix: keep vertex adc negative checks live
* refactor: consolidate codex jwt and edit helpers
* fix: await codex oauth node runtime imports
* fix: preserve sdk tool and notice contracts
* fix: preserve shipped compat config boundaries
* fix: align codex oauth callback host
* fix: terminate agent-core loop streams on failure
* fix: keep codex oauth callback alive during fallback
* ci: include session tools in critical codeql scans
* fix: keep Cloudflare Anthropic provider auth header
* docs: redirect legacy pi runtime pages
* fix: honor bundled web provider compat discovery
* fix: protect session output spill files
* fix: keep legacy agent dir env blocked
* fix: contain auto-discovered skill symlinks
* fix: harden agent core sdk proxy surfaces
* fix: restore approval reaction sdk compat
* fix: keep live docker runs bounded
* fix: keep codex oauth redirect host aligned
* fix: resolve post-rebase agent runtime drift
* fix: redact anthropic oauth parse failures
* fix: preserve responses strict tool shaping
* fix: repair agent runtime rebase cleanup
* docs: redirect retired parity pages
* fix: bound auto-discovered resources to roots
* fix: repair post-rebase agent test drift
* fix: preserve bundled provider allowlist migration
* fix: preserve manifest-owned provider aliases
* fix: declare photon image dependency
* fix: keep provider headers out of proxy body
* fix: preserve shipped env aliases
* fix: refresh control ui i18n generated state
* fix: quote read fallback paths
* fix: preview edits through configured backend
* test: satisfy core test typecheck
* fix: preserve ZAI usage auth fallback
* test: repair codex diagnostic test
* fix: repair agent runtime rebase drift
* test: finish embedded runner import rename
* fix: repair agent runtime rebase integrations
* test: align compaction oauth fallback expectations
* fix: allow sdk-auth session models
* fix: update doctor tool schema import
* fix: preserve bedrock plugin region
* fix: stream harmony-like prose immediately
* ci: include session runtime in codeql shards
* fix: repair latest rebase integrations
* fix: honor explicit codex websocket transport
* fix: keep openai-compatible credentials provider-scoped
* fix: refresh sdk api baseline after rebase
* fix: route cli runtime aliases through openclaw harness
* test: rename stale harness mock expectation
* test: rename embedded agent overflow calls
* test: clean embedded auth test wording
* test: use openclaw stream types in deepinfra cache test
* fix: refresh sdk api baseline on latest main
* fix: honor bundled discovery compat allowlists
* fix: refresh sdk api baseline after latest rebase
* fix: remove stale rebase imports
* test: rename stale model catalog mock
* test: mock renamed doctor runtime modules
* fix: map canonical kimi env auth
* fix: use internal model registry in bench script
* fix: migrate deepinfra provider catalog entry
* fix: enforce builtin tool suppression
* fix: route compaction auth and proxy payloads safely
* refactor: prune unused llm registry leftovers
* test: update codex hooks session import
* test: fix model picker ci coverage
* test: align model picker auth mock types
2026-05-27 19:24:04 +01:00
f34a527f61
test: speed up tooling tests
2026-05-27 03:33:36 +01:00
4f4d108639
chore(lint): remove underscore-dangle allow list ( #83542 )
...
* chore(lint): reduce underscore-dangle exceptions
* chore(lint): reduce more underscore exceptions
* chore(lint): remove underscore-dangle allow list
* fix(lint): repair underscore cleanup regressions
* test(lint): track version define suppression
2026-05-18 14:56:06 +01:00
e43a2efcdb
test: harden wsl2 fixtures
2026-05-17 13:45:21 +01:00
b5b193076e
test: share repo file helpers
2026-05-17 02:29:55 +08:00
Peter Steinberger