Record every accepted Telegram automatic delivery in the scoped sent-message ledger, including finalized streaming previews. This restores bot-owned reaction checks and removes the per-send full-ledger expiry scan.
The no-round-trip clause from #111385 covered the unchanged-head case; once rank-up moves are applied the old comment attests stale code. Head unchanged: land without re-review, as before. Head changed after review: one exact-head re-review, land when no actionable finding and no remaining rank-up move.
* fix(auth): cooldown inline api key billing failures
* fix: mark inline api key prompt failures
* fix(auth): propagate inline api key cooldown to provider visibility
* fix(types): fix test type errors in agents and ui
* fix(auth): correct null check for cooldown gate and fix test case
* fix(ui): remove unrelated test drift and fix expired toast expectation
* fix(auth): preserve inline cooldown usageStats in warm worker snapshots
* test(auth): update warm snapshot expectation with usageStats
* test(auth): format inline cooldown worker proof
* fix(auth): narrow inline cooldown classifier
* fix(auth): mark managed file/exec SecretRef inline keys on auth/billing failure
The inline-api-key cooldown marker only fired for literal, env-marker, and
env SecretRef sources, while the resolution gate already covered managed
file/exec SecretRef provider keys via coerceSecretRef. As a result a
file/exec SecretRef models.providers.<id>.apiKey could never record a 402
billing cooldown, so the gate that would honor it never triggered.
Align the runner failure-marker trigger with the gate predicate
(isConfigBackedInlineProviderApiKey) so managed non-env SecretRef inline keys
are marked on auth/billing failure. Adds focused regression coverage.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* refactor(auth): drop now-unused isInlineProviderApiKeyAuth export
The runner failure-marker now gates on isConfigBackedInlineProviderApiKey, so
isInlineProviderApiKeyAuth has no remaining callers. Removing the dead export
also trims one public callable export back under the plugin-SDK surface budget.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix(auth): enforce inline cooldown for managed file/exec SecretRef keys
The inline-api-key cooldown was recorded for managed (file/exec) SecretRef
provider keys but never enforced: these keys resolve through the synthetic
runtime path (resolveSyntheticLocalProviderAuth) and the explicit api-key
override path, neither of which consulted the inline-key cooldown gate. So an
exhausted file/exec SecretRef provider kept resolving and reporting available
during an active inline-api-key:<provider> cooldown.
Gate both resolution exits (and the provider-availability check) on
isConfigBackedInlineProviderApiKey + assertInlineProviderApiKeyUsable, matching
the literal/env paths. Local no-auth markers are not config-backed inline keys,
so they stay untouched. Adds regression coverage for both resolution paths.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix(auth): gate runtime SecretRef cooldown checks
* fix(auth): honor inline key cooldowns in model-list and tool auth checks
Direct hasRuntimeAvailableProviderAuth callers omitted the auth store, so
inline provider keys in billing cooldown were still advertised as available
in model browsing (models.list) and model-backed tool auth checks. Pass the
scoped auth store at each call site and cover the cooled-key paths with
regression tests, including profile fallback and cooldown expiry.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(auth): resolve merge CI failures (format + browse cooldown mock independence)
- failover-retry-controller.ts: apply oxfmt formatting missed after the port.
- model-auth-availability.ts: the browse-side inline cooldown check imported
resolveInlineProviderApiKeyUnusableUntil from the auth-profiles usage module,
which several command/directive tests partially mock — the new export was
absent from those mocks, so every mocking test threw at the browse path.
Read the inline cooldown via usage-state primitives (resolveProfileUnusableUntil
+ isAuthCooldownBypassedForProvider) and build the usage id with the same
normalizeProviderId the write side uses, so the hot browse path no longer
depends on the mocked usage module while keeping key resolution identical.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(auth): make model-auth inline cooldown reads mock-independent
resolveApiKeyForProvider/assertInlineProviderApiKeyUsable read the inline
provider API-key cooldown, which this PR routes through the auth-profiles
usage module. Many existing suites partially mock that barrel (e.g.
run.overflow-compaction.test.ts) without the new export, so those tests
threw once merged code reached the inline path.
Read the cooldown via usage-state primitives (resolveProfileUnusableUntil +
isAuthCooldownBypassedForProvider) and build the `inline-api-key:<provider>`
usage id with the same normalizeProviderId the write side uses, so model-auth
no longer depends on the mocked usage module while key resolution stays
identical. Verified across all 30 suites that mock the auth-profiles module.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(test): use main's terminal failure shape for the inline-key billing case
Main reworked EmbeddedRunAttemptResult so attempt failures are reported via
`terminal: { kind: "failed", source, error }` instead of the old
`promptError`/`promptErrorSource` fields. The inline-key billing regression
test still used the removed fields, which merged cleanly but broke
check-test-types.
Switch it to the same shape the sibling helper in this file already uses.
Verified with `pnpm check:test-types` (exit 0).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Mert Basar <MertBasar0@users.noreply.github.com>
Co-authored-by: Ceviz Agent <ceviz@openclaw.local>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Vincent Koc