491dc7f8b1
fix(codex): report native project docs truthfully ( #126010 )
2026-08-18 14:42:56 -07:00
d412c6b284
fix(codex): inherit agent workspace instructions in native subagents ( #125783 )
...
* fix(codex): inherit agent workspace instructions in native subagents via thread developer instructions
* fix(codex): satisfy lint on thread instruction changes
* fix(codex): persist frozen agent instructions across supervised materialization
2026-08-18 17:15:15 +05:30
1bf4c1d18c
fix(sessions): inherit agent bootstrap outside workspace ( #125675 )
...
* fix(sessions): inherit agent bootstrap outside workspace
* fix(sessions): layer execution-dir project context over agent bootstrap
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
Co-authored-by: Ayaan Zaidi <hi@obviy.us >
2026-08-18 14:23:28 +05:30
568b920b21
feat(lint): enforce import ordering and deduplication ( #124730 )
...
* refactor(imports): dedupe and hoist imports
* feat(lint): enforce import/no-duplicates and import/first
2026-08-16 11:44:52 -07:00
b080dd1e76
refactor: consolidate coercion contracts ( #122458 )
...
* refactor: consolidate coercion contracts
Centralize exact string, record, numeric, date, Boolean, argument, and structured-error coercions while preserving call-site semantics.
Migrate canonical-name collisions and deprecated internal SDK bypasses, deleting 55 net production/tooling lines. Expand declaration ownership enforcement to 101 allowed helpers and add a narrow export-completeness audit.
* fix: preserve standalone script coercions
Keep copied Control UI tooling self-contained and retain the trusted release harness module-relative source seam when the harness runs against an old target cwd.
2026-08-11 23:26:37 -07:00
73a9eed95b
refactor(audit): add canonical admitted-run context ( #120534 )
...
* feat(audit): carry canonical admitted execution context
* fix(agents): preserve admitted context across retries
* fix(worker): fence legacy launch dialect
* test(gateway): track approval temp dirs
* fix(plugin-sdk): preserve harness attempt compatibility
* fix: close delegated run authority at owner boundaries
* fix: internalize delegated authority validators
* refactor: split delegated authority proof surfaces
* refactor: centralize command admission identity
* test: claim runtime tool authority
* fix(gateway): keep lifecycle cleanup within static budgets
* fix(agents): revalidate harness policy authority
* fix(agents): fence awaited approval capability results
* test(copilot): supply required harness capability fixtures
* fix(agent): preserve scoped embedded run admission
* fix(agent): preserve keyless and worker authority
* test(agent): bind incomplete-turn authority
* docs: preserve execution authority invariants
* chore(plugin-sdk): regenerate API baseline
* fix(gateway): notify pending claim closure
* fix(gateway): revalidate delegated tool authority
* fix(plugin-sdk): keep source guard internal
* fix: close delegated authority races
* fix: revalidate delegated side effects
* fix: close harness authority projection gaps
* fix: align authority integration types
* fix: isolate settled harness finalization
* fix: fence recovery identity finalization
* fix: preserve committed session worktrees
* fix: preserve worker placement agent identity
* fix: fence active harness tool work
* fix(plugins): restore embedded run admission owner
* chore(plugin-sdk): compose integrated surface budgets
* fix(copilot): keep finalization attempt type internal
* fix(plugins): complete admission owner type imports
* test(harness): use settled finalization attempt shape
* fix(security): retain exact side-run and approval authority
* fix(security): preserve protected authority through terminal sweep
* fix(agents): follow moved recovery store owner
* fix(ci): align integrated authority owners with gates
* fix(plugins): distinguish embedded agent adapter export
* chore(plugin-sdk): regenerate API baseline after rolling integration
* refactor(gateway): keep session authority within owner budgets
* fix(gateway): keep session helpers private
* docs(plugin-sdk): name the V2 parameter subpath
* chore(integration): reconcile worker and SDK surfaces
* docs(plugin-sdk): require the V2 host API floor
* chore(plugin-sdk): regenerate after proxy-auth integration
2026-08-10 23:15:20 -05:00
5621979a46
fix(models): preserve session selection across fallback turns ( #119325 )
...
* feat(models): add session-only model selection
* fix(models): use trailing session scope option
* test(models): satisfy session scope lint
* fix(models): reject duplicate model options
* fix(models): clarify default and session scope
* fix(models): require complete session option tokens
* fix(models): report configured default dispatch
* fix(models): keep directive handler within lint limit
* fix(models): parse model options in either order
* fix(models): apply session scope to aliases
* fix(models): align alias scope with reply routing
* fix(discord): surface model selection scope in picker
* fix(models): preserve mixed-text model selection
* fix(models): centralize command selection ownership
* fix(models): align session scope lifecycle
* fix(models): preserve command and auth ownership
* fixup! fix(models): preserve command and auth ownership
* fix(auth): preserve scoped CLI provider discovery
* test(models): align result and cron fixtures
* test(models): nest result timing metadata
* fix(discord): narrow silent dispatch results
* fix(transcript): preserve admitted turn identity
* fix(context-engine): fence the admitted transcript turn
* fix(context-engine): stabilize plugin compatibility contract
* chore(plugin-sdk): refresh context engine API baseline
* chore(plugin-sdk): use Linux context engine API baseline
* fix(context-engine): align fallback ownership
* fix(fallback): scope auth skip cache by profile
* fix(context-engine): settle only accepted fallback turns
* refactor(sessions): issue canonical turn admissions
* refactor(context-engine): own logical turn advancement
* fix(context-engine): settle cron fallback winners
* fix(models): align picker and fallback transactions
* fix(delivery): notify block admission after queueing
* fix(sessions): preserve canonical admission receipts
* chore(plugin-sdk): refresh API baseline hash
* fix(context-engine): commit accepted turns durably
* fix(context-engine): validate durable host transitions
* fix(context-engine): preserve fallback turn ownership
* fix(context-engine): preserve queued turn order
* fix(models): preserve fallback retry ownership
* fix(context-engine): enforce durable transcript anchors
* fix(runtime): close fallback persistence gaps
* fix(context-engine): preflight fallback harnesses
* chore(plugin-sdk): use Linux API baseline
* fix(context-engine): drain durable commits before reads
* fix(models): scope harness auth failures by profile
* fix(codex): fence legacy transcript history
* fix(commands): honor suppressed directive interpretation
* chore(runtime): remove unused branch exports
* test(context-engine): derive private outbox payload type
* fix(context-engine): apply durable drain degradation
* fix(context-engine): recover durable turn intents
* fix(context-engine): settle durable turn intents
* refactor(context-engine): satisfy branch quality gates
* fix(context-engine): close durable recovery gaps
* fix(discord): preserve dropped model command outcome
* test(copilot): keep journal fixture types local
* fix(auto-reply): preserve model alias provenance
* fix: close model scope review gaps
* fix(models): close review-found scope leaks
* fix(review): satisfy branch line budgets
* fix(agents): preserve context engine turn facts
* fix(agents): finalize silent context turns
* fix(context-engine): preserve compatibility window
* test(agents): cover both harness preparations
* fix(context-engine): retain blocked turn advancements
* fix(models): parse compact runtime options
* fix(telegram): report runtime resets accurately
* fix(models): isolate automatic auth failure skips
* fix(context-engine): project commit turn host params
---------
Co-authored-by: VACInc <3279061+VACInc@users.noreply.github.com >
Co-authored-by: Vincent Koc <vincentkoc@ieee.org >
2026-08-07 16:19:12 +08:00
d06fc25a0c
fix(agents): protect private memory in shared chats ( #119198 )
...
* fix(agents): protect private memory in shared chats
Fixes #84466
Co-authored-by: Peter Steinberger <steipete@gmail.com >
* fix(agents): propagate shared chat type across runtimes
* fix(agents): enforce bootstrap privacy after hooks
* test(agents): cover final bootstrap filtering
* fix(agents): filter private memory before allowlists
* fix(agents): preserve bootstrap source identity
* refactor(agents): simplify bootstrap source identity
* fix(agents): keep bootstrap source identity private
* fix(agents): unify CLI runtime chat type
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-08-04 23:01:38 +08:00
895bf61ea0
feat(agents): surface watched-session awareness to the model ( #114835 )
2026-07-29 07:39:20 +09:00
669db2968f
refactor(agents): retire TOOLS.md into an AGENTS.md section with a doctor migration ( #113966 )
...
* fix(agents): stop retired attestation hashes from faking a vanished workspace
* feat(agents): migrate TOOLS.md content into the AGENTS.md tools section
* refactor(agents): drop TOOLS.md from the workspace bootstrap set
* refactor(policy): read tool policy entries from AGENTS.md
* docs: describe local tool notes as an AGENTS.md section
* test(codex): drop TOOLS.md developer-instruction coverage with the removed path
* test(agents): cover the TOOLS.md doctor migration behaviors
* refactor(doctor): satisfy TOOLS.md migration lint
* test(agents): split workspace attestation survival coverage
* refactor(codex): simplify workspace context basenames
* refactor(doctor): keep TOOLS.md migration helpers module-local
* docs: regenerate docs map
* fix(doctor): keep migration claims fresh
* fix(doctor): preserve nested tool notes
* refactor(doctor): split tools migration helpers
* refactor(doctor): limit TOOLS.md migration to workspace root
* style(doctor): keep migration under line limit
* fix(doctor): recover interrupted AGENTS publish
* docs(hooks): describe root-only TOOLS.md migration accurately
* fix(doctor): preserve migrated tool guidance visibility
* test(agents): regenerate prompt snapshots after rebase
* fix(policy): block evaluation while TOOLS.md is unmigrated
* fix(doctor): check merged bootstrap budget per agent
* fix(doctor): keep budget helper internal
* refactor(doctor): keep migration budget helpers to their consumers
2026-07-27 03:56:30 -04:00
61f036f748
refactor(agents): close embedded attempt terminal outcomes ( #113201 )
...
* refactor(agents): close embedded attempt outcomes
* test(agents): align trajectory terminal fixture
* refactor(codex): share attempt failure type
* fix(codex): retain projector result contract
* test(agents): keep terminal projections test-only
* chore(plugin-sdk): refresh attempt terminal baseline
2026-07-23 19:56:03 -07:00
3e2b3ea4d5
feat(cron): database-backed heartbeat monitor scratch replaces HEARTBEAT.md ( #112967 )
...
* feat(cron): move heartbeat context into database-backed per-job cron scratch
- new additive cron_job_scratch SQLite table (revision tombstones keep
compare-and-swap monotonic across unset/recreate; 256KiB cap)
- heartbeat runner reads monitor scratch instead of workspace HEARTBEAT.md;
heartbeat_respond gains a private scratch replacement parameter
- openclaw doctor --fix migrates HEARTBEAT.md into scratch (hash-verified,
archived under state backups, idempotent, symlink-contained)
- gateway cron.scratch.get/set admin RPCs + openclaw cron scratch CLI
- workspace bootstrap no longer seeds HEARTBEAT.md; Codex heartbeat file
guidance removed; docs and prompt snapshots updated
* fix(cron): review round 2 — shared-workspace heartbeat migration and non-default agent monitors
- doctor migration groups agents by heartbeat source file and imports into
every monitor before archiving/removing the shared file once
- exempt heartbeat payloads from the main-session default-agent restriction:
monitors only poke the wake bus, so non-default agents converge again
- document why disabled monitors retain their last cadence (config default
already resolves before the fallback)
* fix(cron): honor configured cron store, legacy heartbeat fallback, and safer doctor claim
* fix(cron): claim HEARTBEAT.md before committing scratch and restore without clobbering
* fix(cron): pin migration CAS to precondition revision, re-verify claim on release, archive first, report scratch as pending
* docs(heartbeat): remove retired config options
* fix(cron): crash-recoverable migration claims, partial-import rollback, latest-response scratch pairing
* test(heartbeat): keep latest scratch proposal paired
* fix(cron): roll back committed scratch on changed-claim release and restore no-row state
* fix(cron): revision-guarded rollback delete and recreated-file detection on claim release
* fix(cron): treat every failed claim re-verification as a migration conflict
* test(heartbeat): rename ack test after ackMaxChars retirement
* fix(heartbeat): keep monitor scratch out of bypass-scope runs
* fix(cron): resolve claimed symlinks on release and gate legacy fallback on proven scratch state
* fix(cron): strict claim-name recovery and per-entry migration grouping
* fix(ci): heartbeat scratch gate repairs — lint causes, dead exports, since-train, inventory path, prompt snapshot, regenerated docs map, SDK baseline, protocol bindings
* fix(cron): live-owner claim guard and canonical entry-key migration grouping
* fix(cron): archive claimed inode on release and flag orphan claims beside recreated files
* docs(cron): document process-global state-db invariant for scratch service ops
* chore(i18n): refresh native inventory line numbers after protocol binding regen
2026-07-23 11:10:49 -07:00
d8f2645c2c
refactor(memory-wiki): move compiled cache to plugin state ( #110167 )
...
* feat(plugin-sdk): prepare memory prompts asynchronously
* refactor(memory-wiki): move compiled cache to plugin state
* fix(plugin-sdk): export memory prompt preparer type
* refactor(plugin-sdk): keep prompt preparer type private
* test(memory-wiki): isolate compiled cache state
* chore(memory-wiki): satisfy changed gates
* fix(memory): preserve prepared prompts across context engines
* docs(plugin-sdk): refresh API baseline
* fix(memory): revalidate prepared prompt ownership
* fix(codex): propagate sandboxed memory context
* test(memory-wiki): seed durable vault identity
* refactor(memory-wiki): keep cache lifecycle internal
* fix(memory-wiki): harden compiled cache publication
* style(memory-wiki): format cache lifecycle changes
* test(memory-wiki): support extension test lib target
* style(memory-wiki): remove redundant catch
* refactor(memory-wiki): keep vault generation helper private
2026-07-18 03:05:03 +01:00
f81f9d8570
chore: enforce max-lines suppression ratchet ( #107315 )
...
* ci: enforce max-lines suppression ratchet
* chore: prune stale max-lines suppression
* fix: close max-lines ratchet enforcement gaps
* fix: harden max-lines ratchet checks
* fix(ci): satisfy max-lines ratchet checks
* style: format max-lines declarations
* fix(ci): match oxlint suppression grammar
* test: isolate max-lines git fixtures
* chore: prune resolved max-lines debt
* test: skip newline path fixture on Windows
* fix: harden max-lines suppression ratchet
* chore: refresh max-lines baseline
* fix: close max-lines ratchet bypasses
* fix: derive ratchet base from PR merge tree
* fix: support older Git in staged ratchet
* fix: align max-lines declarations and baseline
* chore: refresh max-lines baseline for current main
* fix: exclude generated wizard locales from max-lines
* chore: prune resolved max-lines debt
2026-07-14 09:27:02 -07:00
26210c1600
refactor: remove browser and codex dead exports ( #105867 )
...
* refactor(browser): collapse Playwright export paths
* refactor(browser): remove dead plugin exports
* refactor(codex): remove dead app-server exports
* refactor(codex): remove remaining dead exports
* test(codex): use canonical private-type owners
* test(browser): isolate proxy startup state
* test(browser): remove stale chrome imports
* refactor(codex): privatize remaining helpers
* chore(deadcode): refresh export baseline after rebase
* refactor(browser): finish canonical helper ownership
* refactor: fix dead-export cleanup gates
* refactor(codex): keep runtime facades LOC-neutral
* chore(ci): refresh TypeScript LOC baseline
* chore(deadcode): refresh ratchets after rebase
* chore(ci): refresh LOC baseline after main advance
* chore(deadcode): align ratchets with latest main
2026-07-12 22:23:11 -07:00
0a8e3604ba
refactor: flip sessions and transcripts to sqlite storage ( #98236 )
...
* refactor(sessions): migrate runtime storage to sqlite
* test(sessions): fix sqlite CI regressions
* test(sessions): align remaining sqlite fixtures
* fix(codex): require sqlite trajectory recorder
* test(sessions): align orphan recovery sqlite fixture
* test(sessions): align sqlite rebase fixtures
* fix(sessions): finish current-main integration of the sqlite flip
Resolve the whole-store SDK removal across its owner boundary: drop the
loadSessionStore re-export and the registry whole-store wrappers, wire
hasTrackedActiveSessionRun into gateway chat, complete the
preserveLockedHarnessIds cleanup contract, flip the codex thread-history
import to storePath targets, and port remaining main-side tests from
file-store helpers to session accessor reads.
* chore: drop committed pebbles log, revert plugin-inspector bump, refresh generated docs
Remove the 1.8k-line .pebbles/events.jsonl work log from the branch, restore
the plugin-inspector advisory lane to main's pinned 0.3.10 so the supply-chain
bump gets its own review, and regenerate docs_map, the plugin SDK API baseline,
and the export-surface ratchet for the merged tree.
* feat(sessions): keep archived transcripts by default with zstd cold storage
Codex-style retention: deleting or resetting a session archives its
transcript as a zstd-compressed JSONL artifact (plain when the runtime
lacks node:zlib zstd) and keeps it until the disk budget evicts oldest
first. resetArchiveRetention now governs both deleted and reset archives
and defaults to keep; maxDiskBytes defaults to 2gb so retention stays
bounded, with archives evicted before live sessions. The cron reaper
follows the same knob instead of deleting archives on its own timer.
* fix(state): converge agent DB migration lineages and bound database growth
Merge coherence: run both structure-gated legacy memory-schema repairs
(flip-lineage drop, main-lineage identity rebuild) before the flip
migration so pre-flip v1/v2 and pre-merge flip v1/v4 databases all
converge, and hoist foreign_keys=OFF outside the schema transaction
where the pragma was silently ignored and the v1 sessions rebuild
cascade-deleted session_entries.
Growth guards: fresh agent DBs enable auto_vacuum=INCREMENTAL, WAL
maintenance releases freed pages in bounded passes (never a blocking
full VACUUM), and doctor reports state/agent DB bloat from freelist
stats.
* fix(codex): resolve the store path for thread-history import via the SDK
The supervision catalog passed the legacy sessionFile locator to the
storePath-targeted transcript mirror; resolve the agent store path with
the session-store SDK helper instead of a runtime-object seam so test
fakes and headless callers need no extra surface. Drop the obsolete
missing-session-id preprocessing case: sessions rows are NOT NULL on
session_id and upsert repairs id-less patches at write time.
* fix(sessions): fail safe on malformed disk-budget config and doctor stat errors
A malformed explicit maxDiskBytes disables the budget instead of
falling back to the destructive 2gb default the user never chose, and
the doctor bloat check skips databases whose paths stat-fail instead of
aborting doctor.
* fix(sessions): complete sqlite conflict translations
* test(sqlite): align hardening checks with maintenance
* test(sessions): inspect compressed transcript archives
* fix(tests): await session seeds and drop unused helpers flagged by CI lint
The five unawaited writeSessionStoreSeed calls raced their SQLite seeds
against the assertions, failing compact shards; the bloat probe drops a
useless initializer and the merged tests drop now-unused helpers.
* test(sessions): type legacy proof events directly
* test(sessions): align hardening contracts
* perf(sessions): read usage transcript sizes from SQL aggregates
Usage/cost scans walked every session and materialized every transcript
event just to re-stringify it for a byte estimate — the #86718 stall
class reborn on the DB. readTranscriptStatsSync sums stored JSON bytes
in SQLite without loading a single row.
* fix(sessions): re-root foreign-root transcript paths onto the current sessions dir
Restored backups, moved OPENCLAW_STATE_DIR, and rehearsal copies carry
absolute sessionFile paths from the old root; the containment fallback
kept those foreign paths, so migration read (and would archive) files in
the original root and reported local copies missing. Re-root the
canonical agents/<id>/sessions suffix onto the current dir when the file
exists there; genuine cross-root layouts still fall through unchanged.
* test(agents): seed harness admission through sqlite
* fix(sqlite): close agent db on pragma setup failure
* fix(doctor): compact and retrofit incremental auto-vacuum after session import
The migration is the sanctioned offline window: post-import compact
reclaims import churn and applies auto_vacuum=INCREMENTAL to databases
created before the fresh-DB pragma existed, so runtime maintenance can
release pages in bounded passes on every install.
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-11 14:50:37 -07:00
98b8c8c4ae
feat(memory-wiki): isolate vaults per agent ( #103349 )
...
* feat(memory-wiki): isolate per-agent vaults
Refs #63829 .
Co-authored-by: SunnyShu <shu.zongyu@xydigit.com >
* fix(memory-wiki): scope agent status metadata
Refs #103088 and #103196 .
Co-authored-by: SunnyShu <shu.zongyu@xydigit.com >
---------
Co-authored-by: SunnyShu <shu.zongyu@xydigit.com >
2026-07-10 05:19:13 +01:00
258b83c438
refactor: migrate plugin transcript mirrors ( #89518 )
2026-06-23 09:32:45 -07:00
b78718f42a
fix(codex): bound delivery hint prompts
2026-06-21 07:00:11 +08:00
b4651f3781
refactor(codex): drop unused memory tool wrapper
2026-06-20 00:16:50 +08:00
ab1e5832d2
fix(codex): sync app-server dynamic tool protocol
2026-06-17 04:28:32 +02:00
d498b1cce4
fix(plugin-sdk): expose delivery hints without utility imports
2026-06-14 18:18:20 +05:30
210877a73e
fix(auto-reply): share message-tool delivery hints
2026-06-14 18:18:20 +05:30
7387083a95
fix(codex): preserve memory prompt registration ( #92350 )
...
* fix(codex): restore memory recall guidance
* fix(codex): add memory recall fallback
* fix(codex): preserve memory prompt registration
* test(codex): expect memory slot in scoped harness load
Signed-off-by: sallyom <somalley@redhat.com >
---------
Signed-off-by: sallyom <somalley@redhat.com >
Co-authored-by: sallyom <somalley@redhat.com >
2026-06-12 12:17:02 -04:00
0b5298d24e
docs: document codex attempt context
2026-06-04 08:22:45 -04:00
530351e394
fix(codex): stop injecting mirrored history into prompts
...
Stop Codex app-server turns from projecting mirrored OpenClaw transcript history into prompt/model-input surfaces by default. Keep context-engine output on the rendered prompt/developer-instruction path and preserve mirrored history only for OpenClaw-side snapshots.
2026-05-30 09:13:38 +02:00
3fbd2432b6
fix(codex): move stable context to developer instructions
...
Move OpenClaw skills and the routed workspace-memory pointer out of native Codex turn user input and into turn-scoped collaboration developer instructions.
Preserve full MEMORY.md fallback prompt injection, delivery-hint rewrapping, lightweight cron exact prompts, and trajectory reporting for the rendered developer surface.
Co-authored-by: Beru <beru@lastguru.lv >
2026-05-30 08:59:02 +02:00
d93524d1cc
fix(codex): route workspace memory through tools ( #87383 )
...
* fix(codex): route workspace memory through tools
* fix(codex): preserve extra memory bootstrap files
* fix(codex): support memory_get-only context routing
* fix(codex): only tool-route canonical workspace memory
* fix(codex): keep memory fallback for sandbox workspaces
2026-05-27 20:55:27 +01:00
a4c2e7f5cf
refactor(codex): split app-server attempt seams
2026-05-27 18:11:16 +01:00
Peter Steinberger