b671c1bfe7
test: consolidate Bash tools suites ( #117856 )
...
* test: consolidate bash tools suites
* test: satisfy consolidated suite checks
2026-08-01 23:21:52 -07:00
f275db6974
refactor: remove dead split facades ( #114726 )
...
* refactor: remove dead split facades
* fix: update facade ownership references
2026-07-27 16:32:52 -04:00
9eae43bd37
refactor(infra): move exec approvals into the shared SQLite state DB ( #114063 )
...
* refactor(infra): move exec approvals into the shared SQLite state DB
Delete the file-runtime exec-approvals store (exec-approvals.json + .lock
sidecar machinery) on both runtimes and make the reserved
exec_approvals_config singleton row canonical. Doctor owns the one-time
import with claim/verify/receipt discipline; runtime fails closed with a
doctor instruction while un-migrated legacy state exists. The wire CAS
contract, socket semantics, and gateway auth-token derivations are
unchanged. Kills the #113929 lock-contention bug class structurally and
nets around -2.9k lines.
* fix(infra): green CI gates and retire file-era exec approvals tests
Break the migration-type import cycle with a leaf contract, regenerate the
plugin-SDK API and native i18n baselines for the intentional surface change,
drop unused exports, and replace the macOS file-era approvals test suite with
SQLite-backed behavior coverage per the obsolete-internals test policy.
* chore: green max-lines ratchet, native i18n baseline, and unused-export scan
2026-07-26 06:39:23 -04:00
82d1a03f25
refactor(agents): move implicit-main fallback into load-time roster injection ( #112678 )
...
* refactor(agents): require explicit roster defaults
* feat(onboard): create named first roster agent
* refactor(agents): remove runtime main fallbacks
* style(agents): apply roster refactor formatting
* refactor(agents): finish roster-only runtime sweep
* fix(doctor): migrate legacy main session sqlite
* fix(doctor): harden roster session migrations
* fix(onboard): commit first agent atomically
* fix(config): support empty-roster analysis
* fix(agents): preserve legacy main state during creation
* fix(setup): materialize baseline agent roster
* fix(agents): harden legacy default transfer recovery
* fix(agents): simplify roster-only legacy compatibility
* fix(agents): preserve staged first-agent entries
* fix(config): migrate persisted implicit-main rosters
* fix(config): preserve staged empty rosters
* fix(agents): finalize roster-only upgrade paths
* fix(sessions): close legacy main migration outcomes
* fix(config): migrate legacy roster markers at load
* fix(sessions): preserve roster upgrade history
* refactor(sessions): restore lean legacy main compatibility
* fix(setup): prepare first-agent credentials before publish
* fix(config): stabilize roster snapshot migration
* refactor(sessions): shrink legacy main compatibility
* fix(agents): restore roster compatibility fidelity
* fix(sessions): preserve divergent legacy history
* refactor(agents): narrow roster-only scope
* fix(config): isolate roster migration
* test(agents): align roster-only fixtures
* fix(agents): keep main agent undeletable
* fix(agents): harden roster migration invariants
* fix(agents): close setup and audit scope gaps
* fix(cron): scope session reaper throttles by agent
* fix(agents): preserve scoped owner precedence
* fix(config): preserve authored config ownership
* fix(setup): keep default workspace and roster in sync
* fix(setup): preserve default entry workspace on bare runs
* fix(agents): adapt roster rebase to keyed entries
* fix(agents): honor both roster representations
* fix(agents): route roster reads through shared helpers
* fix(config): preserve canonical roster writes
* fix(cron): resolve dynamic default for session reaper
* fix(agents): close dynamic default migration gaps
* fix(agents): align scoped session ownership
* fix(sessions): preserve legacy main directory casing
* fix(agents): align cron and legacy auth ownership
* fix(setup): provision the committed default workspace
* fix(cron): align scoped ownership and reaping
* fix(cron): treat blank agent ids as absent
* fix(cron): retain configured session-store owners
* fix(agents): repair roster-aware CI boundaries
* fix(cron): preserve scoped ownership resolution
* fix(agents): preserve rosterless maintenance paths
* fix(agents): propagate roster ownership through runtime boundaries
* fix(agents): preserve roster ownership across runtime paths
* fix(agents): harden roster diagnostics and legacy routing
* fix(agents): remove redundant diagnostic import
* test(agents): type CLI policy fixture explicitly
* fix(config): preserve canonical roster mutation identity
* fix(doctor): read canonical agent rosters consistently
* fix(config): resolve compound roster unsets safely
* fix(config): finalize main-session reconciliation
* fix(doctor): read canonical session state safely
* fix(sessions): preserve current visibility alias
* fix(config): track roster include provenance
* test(config): type roster provenance cases
* fix(config): refine roster include ownership
* fix(agents): preserve staged roster invariants
* test(config): align fixtures with explicit roster ownership
* test(node-host): preserve optional plan typing
* fix(config): preserve authored roster projections
* test(config): keep raw roster fixtures explicit
* test(config): normalize rosters at runtime fixtures
* fix(config): protect authored roster ownership
* fix(agents): require explicit session ownership
* fix(agents): enforce scoped roster ownership
* fix(sessions): merge fixed-store agent partitions
* fix(agents): harden roster ownership boundaries
* fix(config): reject ambiguous roster projections
* fix(sessions): preserve persisted store ownership
* fix(sessions): keep collision diagnostics additive
* fix(security): scan malformed roster workspaces
* test(config): align snapshot fixtures after rebase
* test(agents): use explicit roster fixtures
* fix(config): harden roster diagnostic boundaries
* fix(sessions): isolate fixed-store agent databases
* test(agents): type malformed default markers
* refactor(sessions): extract store collision resolution
* test(system-agent): split oversized setup coverage
* style(system-agent): format split setup suite
* fix(sessions): preserve promoted store ownership
* fix(sessions): derive scoped owner before target
* fix(sessions): preserve explicit sqlite ownership
* fix(agents): restore roster compatibility across CI
* fix(agents): enforce roster-owned runtime boundaries
* fix(agents): satisfy default lookup lint
* test(sessions): split known-owner coverage
* fix(state): satisfy path identity lint
* fix(agents): preserve malformed roster safety boundaries
* fix(agents): restore roster compatibility at runtime boundaries
* fix(config): satisfy roster boundary type checks
* fix(agents): preserve roster ownership across runtime probes
Setup inference probes now execute as the configured roster owner. Malformed agent-prefixed session rows are intentionally omitted by the fail-closed visibility contract rather than normalized by tests.
* fix(agents): satisfy session list owner lint
* fix(agents): preserve roster-owned runtime boundaries
Restore shared logical rows for exact SQLite session locators while keeping their physical database owner separate. The ownership regression test now constructs an explicit sole-owner database directly instead of relying on first-touch capture, matching the intentional shared-store contract.
* fix(sessions): preserve multiply owned exact stores
* fix(sessions): restore runtime owner boundaries
Keep incognito sentinels agent-owned, fold default-agent approvals into the global snapshot, and preserve the configless legacy-main CLI policy fallback. Also repair the existing CLI watchdog test lifecycle so the compact shard observes its timeout without an unawaited assertion or async timer stall; product behavior is unchanged by that test-only fix.
* test(ci): align owner-scoped fixtures
These assertions are unchanged. The fixtures now declare the intended non-default runner, expose the session-key constant imported by production status code, and select the main approvals bucket explicitly on Windows.
* fix(agents): close final roster ownership gaps
2026-07-24 22:38:09 -07:00
855659a1dd
refactor(agents): privatize state reset seams ( #108285 )
...
* refactor(agents): privatize state reset seams
* chore(deadcode): shrink agents state seam baseline
2026-07-15 05:09:45 -07:00
9b9f44bf7e
test(exec): retry transient temp cleanup ( #106949 )
2026-07-13 18:04:46 -07:00
55750f7c6d
test: route security floor env setup
2026-06-18 15:06:13 +01:00
adad27d744
fix(exec): honor state dir approvals ( #92056 )
2026-06-11 09:30:56 +09:00
2feb81249f
docs: document exec tool entry
2026-06-04 06:16:34 -04:00
60dcaa3cf5
fix #88773 : [Bug]: Telegram DM exec requires approval despite allowlist + ask:off — works in webchat, not in Telegram ( #89035 )
...
* fix exec ask policy source
* fix gateway test type fixtures
* docs: update exec ask parameter docs to match runtime behavior
* fix: preserve trusted per-call exec ask hardening while blocking model-supplied overrides for channel runs
* docs: align exec ask contract with runtime
* refactor(agents): simplify exec ask policy cleanup
---------
Co-authored-by: Ayaan Zaidi <hi@obviy.us >
2026-06-03 18:33:08 +05:30
fee4e52f22
fix(exec): allow known safe shell builtins in allowlist mode
...
Treat pathless POSIX shell builtins (`:`, `cd`, `false`, `pwd`, `true`) as internally safe only during shell allowlist evaluation. This avoids approval prompts for chains like `cd /tmp && git status` when the executable segment is already allowlisted, without adding a `tools.exec.safeBuiltins` config knob.
Environment-mutating builtins (`export`, `unset`), code-evaluating builtins (`eval`, `source`, `.`), unknown commands, and direct argv execution remain approval-gated unless separately allowlisted.
Proof: `pnpm test src/infra/exec-safe-builtins.test.ts src/agents/bash-tools.exec.security-floor.test.ts -- --reporter=verbose`; `pnpm changed:lanes --json`; `pnpm check:no-conflict-markers`; `git diff --check origin/main...HEAD`. CI related failures were resolved on the final SHA; remaining `checks-node-core-runtime-media-ui` failure is unrelated to this PR.
Fixes #46056 .
Thanks @kinjitakabe.
Co-authored-by: kevinkang-ai <273844887+kevinkang-ai@users.noreply.github.com >
2026-05-31 13:39:13 +01:00
47c578034a
fix(exec): align release validation surfaces
...
Co-authored-by: Vincent Koc <25068+vincentkoc@users.noreply.github.com >
Co-authored-by: jesse-merhi <79823012+jesse-merhi@users.noreply.github.com >
2026-05-30 00:04:06 +10:00
80227005a0
feat(exec): add normalized auto mode
...
Co-authored-by: Vincent Koc <25068+vincentkoc@users.noreply.github.com >
Co-authored-by: jesse-merhi <79823012+jesse-merhi@users.noreply.github.com >
2026-05-30 00:04:06 +10:00
e8785972d0
test: tighten agent auth assertions
2026-05-11 16:21:43 +01:00
e50f323c1f
test(exec): isolate OpenClaw home in security floor tests
2026-05-11 13:18:50 +01:00
1cbe6e271b
fix(exec): address security floor review
2026-05-11 13:18:50 +01:00
235ad7ec95
fix(exec): keep configured security authoritative
2026-05-11 13:18:50 +01:00
Peter Steinberger