* perf(doctor): keep bundled doctor contract closures dependency-light
Doctor contract enumeration cold-loads each plugin's doctor-contract-api
closure via jiti, so a static value import of openclaw/plugin-sdk/runtime-doctor
pulled the state-db/kysely graph (~4.3s per closure) into
listPluginDoctorLegacyConfigRules / listPluginDoctorStateMigrationEntries.
- migrate all light doctor-contract closures (66 files) to the
dependency-light openclaw/plugin-sdk/runtime-doctor-migrations subpath
- voice-call: load detect/repairOpenClawStateDatabaseSchema* lazily inside
the migration bodies; keep only a type-only static runtime-doctor import
- matrix: split pure credential record shapes/normalizers into
credentials-state.ts so the doctor closure no longer imports the sync
plugin-state store through credentials-read
- guard: doctor-contract-closure-guard.test.ts now forbids static value
imports of runtime-doctor in closures alongside agent-runtime
* fix(matrix): keep credential revocation record type module-local
Knip production scan flags the export as consumer-less; the type is only
referenced by the exported union and revocation guard signature.
* perf(plugins): declare doctor contract surfaces
* perf(doctor): slim migration import closures
* perf(plugins): narrow doctor declaration record surface and wire owner-test lane
Registry records carry only the doctorContract declaration instead of the whole
parsed manifest, and check:changed now selects the src/plugins-owned declaration
honesty and closure-guard tests for extension module/manifest changes so
cross-lane drift cannot pass PR classification.
* fix(doctor): keep control-plane dist imports require-safe
Keep doctor and channel control-plane chunks off exec-class dependencies, and enforce native require(esm) loading during postbuild.
* chore(plugin-sdk): regenerate API baseline
* chore(plugin-sdk): sync export ordering
* fix(plugins): satisfy doctor contract CI boundaries
* perf(doctor): make qqbot doctor closure dependency-light
qqbot was the last plugin above 5s in doctor state-migration enumeration
(~8s under tsx/jiti). The cost was not the state-key builder (already a
leaf): its doctor closure value-imported the runtime-doctor SDK barrel,
whose plugin-state-store/state-db re-exports pull kysely (~330 modules),
plus security-runtime for one fileExists (~200 modules), all resolved
per-module by jiti during enumeration.
Split the migration-define helpers and light re-exports into a new
private-local plugin-sdk/runtime-doctor-migrations subpath; runtime-doctor
re-exports it so its public surface is byte-identical (API baseline hash
unchanged). qqbot's doctor-contract and state-migrations now import only
the light subpath, swapping fileExists for the equivalent async
legacyStateFileExists already in the closure.
qqbot enumeration: ~8.0s/531 modules -> ~0.25s/18 modules.
* chore(plugin-sdk): drop private-local subpath from API baseline
runtime-doctor-migrations is private-local-only; the baseline tracks public
modules, and the earlier line was generated before the classification.
* fix(plugins): register runtime-doctor-migrations boundary paths
The private-local subpath list feeds the extension package boundary map;
the shared paths config and xai's derived overrides must carry the same
entry or the boundary contract test fails.
* fix(ollama): resolve web search secret refs
* fix(ollama): preserve blocked search secret refs
* fix(ollama): share web search credential policy
* fix(ollama): resolve web search secret refs via shared resolver
Route configured models.providers.ollama.apiKey resolution through the
existing shared resolveWebSearchProviderCredential helper so env-backed
SecretRefs resolve for web search, and resolve the ambient OLLAMA_API_KEY
independently of the configured selected-host key so mixed setups still
reach the Ollama Cloud fallback after both selected-host attempts fail
(regression fixed at web-search-provider.ts:195).
Drop the two optional plugin-SDK resolver hooks (provider normalization
and unavailable-configured-ref callback) added earlier: the fix does not
depend on them, so the shared resolver and its generated plugin-SDK
baseline stay identical to main and no new plugin-SDK contract surface is
introduced. Ollama applies its own non-secret-marker filter locally on
the resolver output instead.
Add a mixed-credential regression test (configured host key plus a
distinct ambient OLLAMA_API_KEY reaching the cloud fallback) and drop the
tests for the removed fail-closed-throw behavior.
* fix(ollama): fail closed on unavailable web search refs
* fix(web-search): resolve env shorthand secret refs
* docs(changelog): note Ollama web-search SecretRef fix
* chore(changelog): remove release-owned entry
---------
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
* fix(ollama): do not advertise tools when /api/show fails
Failed show responses left capabilities undefined, which
buildOllamaModelDefinition treats as optimistic supportsTools.
Match setup inspect: return empty capabilities instead.
* test(ollama): cover show-fail tools gate including L3 live HTTP
Unit paths for HTTP error/throw plus real 127.0.0.1 server proving
buildOllamaProvider keeps supportsTools false when /api/show 500s.
* fix(ollama): keep reasoning heuristics when /api/show fails
Distinguish failed inspection from authoritative empty capabilities
so tools stay conservative without suppressing model-name reasoning.
* test(ollama): cover three capability states for tools and reasoning
Failed show keeps reasoning heuristics; authoritative [] disables both.
* fix(ollama): propagate showInspectionFailed through setup configs
Setup inspection failures now use the three-state marker instead of
authoritative empty capabilities, keeping tools off and reasoning heuristics.
* test(ollama): setup show-fail keeps tools off and reasoning heuristics
Cover interactive setup when /api/show returns 500 for deepseek-r1.
* fix(ollama): propagate showInspectionFailed through dynamic model resolve
/models add dynamic path now builds failed-show definitions with tools
off while preserving reasoning name heuristics.
* test(ollama): dynamic resolve covers failed /api/show three-state behavior
Mock builder matches production tools/reasoning contract for inspection failure.
* fix(ollama): keep catalog-missing dynamic resolve fail-closed on show failure
Failed /api/show is an existence probe for unresolved models; return undefined so typos/404s stay rejected. Tag-discovered and setup paths keep showInspectionFailed tools-off behavior.
* chore(changelog): remove release-owned entry
---------
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
Retain the existing guarded-fetch timeout callback while consuming native Ollama NDJSON. Prove active slow HTTP streams remain alive and genuine stalls still expire.
Reconstructed from the independently reviewed contributor fix for #94251.
Co-authored-by: Henry <henrybrewer93@icloud.com>
Peter Steinberger