Release Telegram’s chat lane after structured Codex device-code delivery while account-owned authentication completes safely in the background.
Co-authored-by: Arthur Lacoste <arthurlacoste@users.noreply.github.com>
Run the built local TUI PTY lane after the other artifact checks so its real Gateway fixture has exclusive process and event-loop capacity.
Punchcard-Session: cobalt-brook-meadow-m9
…r debug capture
When the debug proxy is enabled it patches global fetch and clones every
response, so the caller-facing body is one branch of a live tee. Cancelling
such a branch settles only after both branches cancel, so awaiting it in the
rejected-download path leaves the download pending instead of surfacing the
malformed-response error.
Both providers read the completed media URL through the global fetch, so they
reach the capture clone. Switch them to the fire-and-forget release the other
generated-media owners already use, and cover each with a regression that keeps
a capture clone live while the download is rejected.
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
* test(msteams): serve JWKS from in-process server in auth coverage
The Entra/service-token validator tests spied JwksClient.prototype on the
jwks-rsa copy the test file imports, but the SDK's internal
require("jwks-rsa") resolves a different physical copy and vitest cannot
intercept a CommonJS require inside node_modules — so the spy missed and
the tests hit the real login.botframework.com / login.microsoftonline.com
JWKS endpoints (JwksError: Bad Request, SigningKeyNotFoundError).
Replace the mock with a real JWKS document served from an in-process
node:http server, pointed at via the SDK's own endpoint overrides
(openIdMetadataUrl cloud override for the service validator, loginEndpoint
for the Entra factory). The v2-issuer acceptance test drives the underlying
JwtValidator with a decoupled jwksUriOptions {type:'uri'} so issuer
validation uses the real login host while keys come from the local server.
Deterministic, no external network, and exercises the real fetch + RS256
verify path.
* test(msteams): fix cloud-environment import and drop unused jwks-rsa
The extensions test-types gate resolves @microsoft/teams.api's dual
.d.ts/.d.mts types strictly and does not see the root re-export of
withOverrides/PUBLIC (TS2305), so import them from the canonical
auth/cloud-environment subpath the SDK itself uses. The JWKS-server rework
also removed the last direct jwks-rsa import, so drop the now-unused
devDependency and refresh the lockfile (knip deadcode).
---------
Co-authored-by: Peter Steinberger <steipete@mac-studio-sf2.local>
withTempDir used a raw fs.mkdtemp(os.tmpdir()) path. On macOS os.tmpdir()
is a /var -> /private/var symlink while the production sandbox guard
compares against canonical paths, so the symlink-delete test failed with
"Path escapes sandbox root". Realpath the mkdtemp result so the fixture
matches the canonical form the guard expects.
Co-authored-by: Peter Steinberger <steipete@mac-studio-sf2.local>
The five monitor event suites each registered a second vi.mock for
"openclaw/plugin-sdk/system-event-runtime.js" alongside the extensionless
mock. The .js-suffixed subpath is not a declared export of the openclaw
package, so vitest fails suite collection with "not exported under the
conditions [node, development, import]" — taking down 42 suites before a
single test ran. The extensionless mock already intercepts the production
import, so the duplicate is removed.
Co-authored-by: Peter Steinberger <steipete@mac-studio-sf2.local>
Enforced-mode command rendering resolved every executable to an absolute
path, including POSIX shell builtins (cd, :, true, false, pwd, test).
Builtins are executed by the shell itself, not via a filesystem binary,
so rewriting cd -> /usr/bin/cd is semantically wrong and adds no
PATH-shadowing protection (the whole point of enforced-mode resolution
for real external executables). shouldRewriteCandidate now returns
satisfiedBy !== "safeBuiltins" in enforced mode, leaving real external
executables pinned to their resolved absolute path.
Adds a regression test locking that enforced mode renders cd . as-is.
Co-authored-by: Peter Steinberger <steipete@mac-studio-sf2.local>
Use the explicit topic selected by Telegram sends when recording delivery correlation, preventing successful message, poll, and sticker actions from leaving the matching inbound event falsely undelivered.
Arthur Lacoste