Host zlib versions compress identical startup assets into different bytes, causing false Linux budget failures. Emit canonical shipped pako gzip sidecars, restore the 512 B ratchet tolerance, and lower the startup baseline from 348351 B to 344531 B.
* fix(config): validate config writes against the config being written
writeConfigFileFromContext passed the pre-write snapshot's plugin
metadata into strict validation. During onboarding that snapshot belongs
to an intermediate config written by agent creation, which has no plugin
entries, so its scoped manifest registry is empty. Validating the final
candidate against it made every plugin entry added by the same write look
unknown, and non-interactive onboarding warned that the openai and codex
entries it had just written were stale or uninstalled.
Drop the stale snapshot so validation resolves the manifest registry from
the candidate it is actually validating. Strict semantic validation is
unchanged, and the registry load stays lazy.
* fix(ci): raise the Control UI startup JS baseline to unblock main
main is red on the Control UI startup-JS ratchet: unrelated PR #126725 measures 348289 B and this branch measures 348351 B against a 347023 B baseline + 1056 B tolerance. Twenty-six UI commits have landed since the last bump (#126474), none individually large. Baseline moves to the CI-measured 348351 B, well under the 358400 B maintainer-approved ceiling that still guards cumulative creep.
Give maintainers immediate visibility when Mantis is requested. Bare mentions now react, link the active run, and keep one run-owned status comment through proof, short-circuit, or failure.
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
* fix(gateway): admit recovering workers during startup
* fix(gateway): admit recovering nodes during startup
* fix(crabbox): bind worker desktop to XFCE session
* fix(workers): reuse Git base during workspace transfer
large clean/stale worktrees were downloading every tracked file after the verified base pack, crossing transfer authority; selectively checkout desired base-index paths, preserving deletions and symlink confinement.
* fix(workers): clone reachable stale workspace commits
tip-only origin detection forced published ancestor commits through heavyweight Gateway transfer; the existing exact checkout and manifest verification safely own reachability/fallback.
* perf(workers): use blobless origin clones
* fix(workers): bundle undici in worker deploy artifact
Add trusted ClawSweeper-label and maintainer-comment dispatch for Mantis Telegram proof. Short-circuit non-visible PRs before desktop setup while preserving exact-head, fork, credential, and comment-ownership boundaries.
Move Mantis Telegram Desktop proof from the remote AWS/Crabbox lane to a recorder-driven local Docker desktop. Keep proof scenarios agent-authored, cache trusted build outputs, and publish exact visible Telegram evidence without writing the QA bot token to artifacts.
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
The "includes weekday and relative time" test computed the expected
weekday with the ambient host locale (`toLocaleDateString(undefined, ...)`)
while `formatNextRun` formats the weekday through `i18n.getLocale()`
(default "en"). On hosts whose default locale is not English (e.g.
`LANG=zh_CN.UTF-8` -> "周一"), the two diverge and the slice assertion
fails: `expected 'Mon,' to be '周一, '`.
Mirror `i18n.getLocale()` in the test so the expected weekday always
matches the locale the presenter uses. No production behavior change.
Verified: passes under `LANG=zh_CN.UTF-8` and `LANG=C` via
`pnpm test:unit:fast -- test/ui.presenter-next-run.test.ts`.
AI-assisted.
* test(unit-fast): isolate computer-tool.test-helpers consumers
The unit-fast shard classifier recognizes "stateful" test helpers
(those whose source trips a disqualifying pattern such as `vi.mock(`
or top-level dynamic `import`) via `statefulTestHelperImportPattern`,
so that tests importing them are routed to the isolated pool instead
of the shared `isolate:false` pool.
`computer-tool.test-helpers` was missing from that pattern, even though
the helper sets up `vi.mock("./gateway.js")`, `vi.mock("./nodes-utils.js")`
and uses top-level `await import(...)` — i.e. it is stateful. Its
consumers (`computer-tool.v2/schema/context.test.ts`) therefore
classified with empty `reasons`, fell into the `isolate:false` pool,
and relied on `vi.mock` against a shared module registry. When another
test file loaded the real `./gateway.js` / `./nodes-utils.js` in the
same worker first, the mock was bypassed and `computer-tool.v2.test.ts`
threw `GatewayCredentialsRequiredError: gateway node.list requires
credentials` for all 8 of its cases — while passing in isolation.
Add `computer-tool\.test-helpers` to the pattern (mirroring the existing
`message-action-runner\.test-helpers` entry) so consumers are routed to
the isolated pool where the mock is honored.
Verified on `main` (`83d279a`), Node 24.15.0:
- Before: `pnpm test:unit:fast` -> 8 failures in
`src/agents/tools/computer-tool.v2.test.ts` (`GatewayCredentialsRequiredError`);
the file passes alone (8/8).
- After: the three consumers classify `inIsolated=true`; `pnpm test:unit:fast`
no longer runs them in the shared pool; the suite's only remaining
failures are unrelated (`test/ui.presenter-next-run.test.ts` locale,
`test/scripts/resolve-openclaw-ref.test.ts` git version) and the
computer-tool suite passes (16/16) under `vitest --isolate`.
AI-assisted.
* test(unit-fast): cover computer-tool helper isolation
Punchcard-Session: ember-willow-valley-9r
---------
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
* refactor(agents): reduce tool failure warnings to two rules
* test(agents): remove obsolete tool recovery receipt proof
* refactor(agents): drop unused meta param from buildToolMutationState
* test(agents): remove stale tool warning assertions
* test: export runtime source snapshot from closed runtime-snapshot mocks
Heal the main breakage introduced by 9441e3fe6e / #126531, which added a runtime source-snapshot read to provider model route resolution. Closed Vitest factories now return null for that source snapshot, preserving their pre-projection behavior.
* test(gateway): make compaction read-error faults order-immune
Generation-2 CI failure in run 32342180898, job 96343444772 showed that the mock factory initialized while shared gateway-server importers remained bound to the real transcript reader.
The dedicated isolated project fixes normal shards. Complete its ownership by adding it to the root project matrix and excluding the test from the non-isolated OPENCLAW_GATEWAY_PROJECT_SHARDS=0 fallback.
`server.sessions.compaction-read-errors` mocks
`config/sessions/session-accessor.sqlite-read.js`, but production reaches
`loadTranscriptEvents` through re-exports: `server-methods/sessions-compact.ts`
imports it from the `session-accessor.js` barrel and
`preflightSessionTranscriptForManualCompact` imports it from the leaf. The
`gateway-server` project is `isolate: false`, so when a neighbour has already
evaluated those importers they stay bound to the real implementation and the
mock never fires -- the injected read error simply does not happen and all three
tests fail with `expected true to be false`, reading like a product regression.
Trigger: 33744584f3 added `server.chat-metadata-boundary.test.ts`, which boots
a full non-minimal Gateway in `beforeAll` and lands immediately before this file
in the shard. Main has gone red on it repeatedly since (32338154086, 32339521003,
32339928383, 32341300955, 32341946296); e294c154a6 fixed only the sibling
symptom where the factory had not run yet.
Route the file to a new `gateway-server-isolated` project instead, mirroring
`unit-fast-isolated` -- whose comment describes this exact hazard. A fresh graph
per file makes both symptoms structurally impossible rather than order-dependent.
The list is explicit so the reason travels with the file.
Not reproducible on macOS: the exact 24-file stripe in CI's own order, and the
triggering pair three times, are green locally every time.
Hybrid runs attempt 1 on Blacksmith but packs bins with the GitHub-calibrated
`COMPACT_GITHUB_GROUP_SECONDS_HINTS`. Measured across four healthy main runs
(32316204633, 32317242374, 32318250756, 32320063231), normalized per run by
that run's own VM speed, those hints land at 0.64x on Blacksmith across 100
groups -- so nearly everything is over-predicted and only five groups overshoot:
core-runtime-infra-process x2.03 34.5s vs 17
agentic-cli-process x1.64 109.8s vs 67
agentic-agents-core-models x1.45 81.3s vs 56
core-runtime-cron-service x1.35 107.8s vs 80
agentic-commands-doctor x1.30 82.9s vs 64
Those five are exactly the ones that matter: an under-predicted group leaves
budget for partners, so the packer piles work onto the bins that already set the
wall. Replaying the plan against the measured per-shard medians, the tallest bin
drops from 164s to 141s of test time and the runner-up from 151s to 140s, for one
extra job (47 -> 48 on push). The plateau is flat and queue time is ~2s, so the
extra job is free and the 23s comes straight off the critical path.
Guard counts move with the plan; they exist to make repacking deliberate, and the
150s non-dist ceiling and 140s max are unchanged.
* fix(package): bound worker artifact parsing
Keep canonical self-contained worker bundles above the generic dist-file cap while enforcing an 80 MiB limit before installed-package verification reads or parses them.
* fix(package): bound every verifier read
Route the context-engine and dependency scans through one root-dist pre-read policy, exclude plugin-owned extension assets from the root marker contract, and cover the public verifier flow.
* fix(cron): honor failure alert thresholds
Per-run Gateway announcements bypassed threshold, cooldown, and opt-out policy. Make the scheduler the sole owner of failure notification decisions.
* fix(cron): preserve safe failure details
Keep trusted failure detail proof on the scheduler-authorized transport and remove the obsolete Gateway event-context handoff after the ownership consolidation.
* test(cron): assert alternate failure route isolation
* Move raw transcript from system to user prompt to protect provenance.
* Type fix.
* fix(voice-call): harden transcript context handling
* fix(voice-call): initialize inbound Twilio control state
* test(voice-call): align runtime coordinator fixture
---------
Co-authored-by: joshavant <830519+joshavant@users.noreply.github.com>
Vincent Koc