02c08bba71
fix(codex): unblock Computer Use after plugin install ( #126699 )
...
* fix(codex): release config fence before readiness probe
* chore(codex): upgrade managed app-server to 0.148.0
2026-08-20 08:26:41 -07:00
d5aff660a2
fix(codex): keep large AGENTS.md instructions visible ( #125966 )
...
* fix(codex): raise native project doc budget
Default OpenClaw Codex threads to a bounded 128 KiB aggregate project-document budget so large AGENTS.md chains remain visible. Preserve explicit ordinary-thread overrides and keep restricted or lightweight turns at zero.
* test(codex): refresh project doc config expectations
2026-08-18 12:39:52 -07:00
5ebfbbf8d7
fix(plugins): honor per-agent runtime config ( #124978 )
...
* fix(plugins): resolve per-agent config through SDK
* test(codex): preserve agent runtime exports
* test(telegram): make default owner explicit
* refactor(plugins): use lightweight agent scope runtime
* fix(codex): preserve multi-agent execution ownership
* chore(plugin-sdk): record approved agent scope exports
* fix(codex): keep scoped sandbox ownership authoritative
* fix(codex): preserve agent scope in native side actions
* fix(ci): avoid counting node check as environment variable
2026-08-17 01:53:08 -07:00
45dd558d92
fix(codex): prevent session handoffs and native tasks from losing thread ownership ( #120740 )
...
* fix(codex): preserve thread ownership across session lifecycles
* test(codex): keep canonical context-engine session fixtures
* fix(codex): fence replacement thread rollback by ownership
* fix(codex): fence thread handoffs by physical client ownership
* fix(codex): derive conversation privacy from its source session
* fix(codex): claim active native subagents at their lifecycle owner
* fix(codex): preserve conversation ownership when detach fails
* fix(codex): fence stale native child close notifications
* fix(codex): preserve active child ownership during rollback
* test(codex): keep lifecycle fixtures aligned with public contracts
* fix(codex): preserve rollback failure causes across ownership recovery
* fix(codex): retain aggregate rollback causes through lint analysis
* fix(codex): release native children when idle retention fails
2026-08-08 16:20:16 -07:00
b5180b6816
fix(codex): support app-server 0.147.0 ( #120594 )
...
* fix(codex): support app-server 0.147.0
* docs(codex): clarify marketplace version provenance
2026-08-08 23:07:05 +08:00
b269e652bc
chore(codex): bump app-server to 0.146.1
2026-08-06 07:11:37 +08:00
30c79e4db1
fix(inference): prevent lost cancellation, stuck compaction, and runaway tools ( #118146 )
...
* fix(inference): preserve cancellations, compaction, and tool-loop safety
* fix(inference): satisfy Codex and mock-provider type checks
* fix(codex): secure tool-free recovery and restricted turns
* fix(codex): satisfy host-prompt provenance lint
2026-08-02 14:42:01 -07:00
b721cffa44
fix(inference): simplify lifecycle and preserve Codex tool identity ( #117298 )
2026-08-01 02:05:45 -07:00
378d4ff938
fix(codex): preserve authoritative turn completion ( #117185 )
...
Retain terminal and assistant-completion facts when pre-start notifications exceed the bounded buffer. Exclude commentary from replies, accept legacy unphased final messages, and let completed terminal items own the final answer while rejecting interrupted, failed, or non-terminal outcomes.
Co-authored-by: Vincent Koc <vincentkoc@ieee.org >
Co-authored-by: Peter Steinberger <58493+steipete@users.noreply.github.com >
2026-08-01 15:34:30 +08:00
cb16d739cf
fix(inference): harden Codex streaming, cancellation, and live QA ( #116012 )
...
* fix(inference): harden Codex turns, streams, and live QA
* fix(inference): dispatch open CR-delimited response frames
* fix(inference): finish live goal and split streaming regressions
* fix(codex): wait for interrupted turn completion
* fix(codex): narrow terminal collector notification ownership
* fix(inference): harden completion authority and lifecycle
* fix(inference): use canonical source delivery contract
* test(inference): align lifecycle probes with current main
* style(inference): format source delivery verification
* fix(goals): prevent premature completion across staged work
* fix(qa): settle streamed goal turns before continuation
* fix(goals): require visible replies after goal completion
* test(qa): keep goal flow regressions within lint limits
2026-07-31 21:29:33 -07:00
a00438a867
fix(codex): restore connected apps for token-authenticated runs ( #115075 )
...
* fix(codex): restore connected apps for token-authenticated runs
* fix(codex): keep app inventory protocol types private
* fix(codex): align native runtime with Codex 0.146.0
Co-authored-by: Steven Lee <stevenlee@openai.com >
* fix(codex): clean up latest app-server integration
Co-authored-by: Steven Lee <stevenlee@openai.com >
* fix(codex): keep internal protocol types private
* fix(ci): repair current main Codex landing gates
* fix(ci): format inherited code mode matrix
* fix(codex): reconcile native app-server contracts with main
Prepare a verified GitHub-hosted mainline merge while preserving the reviewed Codex 0.146.0 fixes and canonical OpenAI authentication.
Co-authored-by: Steven Lee <stevenlee@openai.com >
* fix(codex): keep QA evidence in its owning plugin
Resolve the current-main Code Mode test rename without resurrecting the retired core test path.
Co-authored-by: Steven Lee <stevenlee@openai.com >
* fix(codex): enforce canonical OpenAI app-server auth
Reject retired provider aliases without runtime compatibility, direct operators to the doctor migration, and remove the redundant OpenAI API-key predicate.
Co-authored-by: Steven Lee <stevenlee@openai.com >
* chore(codex): reconcile latest main dependency graph
Preserve current main dependency changes while preparing the original Codex PR for an ancestry-preserving signed mainline merge.
Co-authored-by: Steven Lee <stevenlee@openai.com >
* fix(codex): unify bundled Codex 0.146 runtimes
Keep the ACP adapter on the same 0.146.0 Codex release as the managed runtime, remove obsolete 0.145.0 platform artifacts and unused semver compatibility, and preserve the latest main dependency upgrades.
Co-authored-by: Steven Lee <stevenlee@openai.com >
---------
Co-authored-by: Peter Steinberger <peter@steipete.me >
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-29 06:21:25 -04:00
09672312c4
feat(gateway): incognito sessions for the web Control UI ( #113006 )
...
* feat(gateway): add web-only incognito sessions held in process memory
* feat(ui): add incognito toggle and badges to the web new-session flow
* fix(sessions): classify incognito by key shape, fail closed on stale keys, and gate memory writes
* fix(codex): start harness threads ephemeral for incognito sessions
* fix(sessions): reshape internal-effects incognito keys and add doctor repair for reserved key collisions
* refactor(plugin-sdk): export canonical incognito key classifier and guard the sentinel path
* fix(state): classify incognito DB handles from the recorded open-time set
* fix(gateway): isolate incognito sessions from durable lineage and allocation on read-only misses
* docs(sessions): pin the reserved incognito namespace ownership decision
* feat(gateway): admin-scope incognito visibility and incognito-blind cross-session surfaces
* fix(ci): repair kysely guardrails, dead export, docs map, protocol bindings, and ACP reset rotation
* fix(gateway): remove non-admin observability side channels for incognito sessions
* fix(gateway): enforce admin-scope incognito access and cover all parent-reference creation paths
2026-07-23 09:04:36 -07:00
f81f9d8570
chore: enforce max-lines suppression ratchet ( #107315 )
...
* ci: enforce max-lines suppression ratchet
* chore: prune stale max-lines suppression
* fix: close max-lines ratchet enforcement gaps
* fix: harden max-lines ratchet checks
* fix(ci): satisfy max-lines ratchet checks
* style: format max-lines declarations
* fix(ci): match oxlint suppression grammar
* test: isolate max-lines git fixtures
* chore: prune resolved max-lines debt
* test: skip newline path fixture on Windows
* fix: harden max-lines suppression ratchet
* chore: refresh max-lines baseline
* fix: close max-lines ratchet bypasses
* fix: derive ratchet base from PR merge tree
* fix: support older Git in staged ratchet
* fix: align max-lines declarations and baseline
* chore: refresh max-lines baseline for current main
* fix: exclude generated wizard locales from max-lines
* chore: prune resolved max-lines debt
2026-07-14 09:27:02 -07:00
877af700bf
feat(codex): continue paired-node Codex catalog sessions from the Control UI ( #106927 )
...
* feat(codex): continue paired-node Codex catalog sessions from the Control UI
Codex catalog rows on paired nodes were view-only. Node rows are now
continuable when the node advertises and permits the codex threads.list,
thread.turns.list, and cli.session.resume commands. Continue adopts the
session into a locked codex OpenClaw session (deterministic
harness:codex:node-session key, bounded native-history import, two-phase
initializing marker) and installs a webchat conversation binding
(codex-cli-node-session) through the new generic
bindPluginSessionConversation seam with attempt-ID guarded rollback, so
each web turn runs codex exec resume on the owning node via the existing
inbound_claim path. Local continue/archive semantics are unchanged;
archived rows are no longer offered as continuable.
* fix(plugins): serialize plugin session binds per session
Review P2: the bind rollback checked the attempt id and then awaited the
unbind, so a concurrent Continue could install a newer binding between the
two and lose it to the older attempt's rollback. All session binds for one
session key now queue through an in-process tail, so a failing attempt can
only ever roll back its own binding; the attempt-id guard stays as defense
against out-of-band rebinds.
* refactor(codex): extract node-continue and session-bind modules for the LOC ratchet
Pure movement to satisfy the changed-file TypeScript size ratchet: the
paired-node continue flow moves to session-catalog-node-continue.ts and
session-catalog-node-adoption.ts, catalog paging/parsing helpers to
session-catalog-parsing.ts, the Control UI session-bind seam to
session-conversation-binding.ts (+ session-key helpers), and the internal
conversation-id/channel-prefix helpers to utils. transcript-mirror.ts is
restored to main byte-for-byte; the node history builder constructs a plain
CodexThread (only id is required) instead of widening signatures.
* fix(plugins): satisfy preserve-caught-error in the session-bind rollback
* fix(codex): gate node continue on operator.admin and resume by CLI session id
Second review round: (1) bound node turns pass canMutateCodexHost only for
owners/admins, while sessions.catalog.continue is operator.write — a
write-scoped Control UI client could adopt a node session whose every turn
would then be rejected. The gateway now forwards the caller's scopes to the
provider (SessionCatalogContinueProviderParams.clientScopes) and codex fails
node continues closed without operator.admin, before the dedupe join so a
non-admin cannot ride an admin's in-flight operation. (2) The node binding
stored the app-server threadId, but codex exec resume takes the CLI session
id and forked threads share a session tree where the two differ; the binding
now prefers record.sessionId.
* fix(codex): defer node-session restore until the binding is durable
Third review round: continuing an archived adopted node session unarchived
it before the gateway installed the conversation binding, so a failed bind
left a visible session with no node routing. The unarchive now rides
afterConversationBound; finalizeNodeAdoptedSession already covers both the
initializing and finalized marker states, so the eager restore helper is
deleted.
2026-07-13 19:54:31 -07:00
26210c1600
refactor: remove browser and codex dead exports ( #105867 )
...
* refactor(browser): collapse Playwright export paths
* refactor(browser): remove dead plugin exports
* refactor(codex): remove dead app-server exports
* refactor(codex): remove remaining dead exports
* test(codex): use canonical private-type owners
* test(browser): isolate proxy startup state
* test(browser): remove stale chrome imports
* refactor(codex): privatize remaining helpers
* chore(deadcode): refresh export baseline after rebase
* refactor(browser): finish canonical helper ownership
* refactor: fix dead-export cleanup gates
* refactor(codex): keep runtime facades LOC-neutral
* chore(ci): refresh TypeScript LOC baseline
* chore(deadcode): refresh ratchets after rebase
* chore(ci): refresh LOC baseline after main advance
* chore(deadcode): align ratchets with latest main
2026-07-12 22:23:11 -07:00
96f0983a85
fix(onboarding): skip setup for configured gateways and require inference first ( #102883 )
...
* fix(crestodian): keep onboarding RPCs restart-safe
* fix(profiles): isolate approval state migrations
* fix(crestodian): bypass configured gateway setup
* test(crestodian): type onboarding mocks
* fix(onboarding): require inference before Crestodian
* fix(onboarding): enforce verified inference handoff
* fix(macos): reset setup on gateway endpoint edits
* chore(i18n): refresh native source inventory
* fix(gateway): keep socket on request cancellation
* test(packaging): require workspace templates
* fix(onboarding): bind setup to verified inference
* fix(onboarding): align inference gate contracts
* fix(crestodian): classify concurrent policy rejection
* test(crestodian): expect registry restoration
* fix(onboarding): bind setup to configured gateways
* fix(codex): preserve startup phase deadlines
* test(crestodian): match fail-closed policy ordering
* test(onboarding): assert bound gateway handoff
* fix(codex): bind runtime resolution to spawn cwd
* test(crestodian): assert policy rejection order
* fix(cli): preserve gateway routing across restarts
* fix(macos): fail closed during gateway edits
* test(macos): cover gateway route generation races
* chore: keep release notes out of onboarding PR
* fix(ci): refresh onboarding generated checks
* style(swift): align gateway channel formatting
* fix(ci): refresh plugin SDK surface budgets
* fix(ci): resync native string inventory
* refactor(swift): split gateway channel support
* test(doctor): isolate plugin compatibility registry
* test(macos): isolate gateway onboarding fixtures
* test(macos): assert gateway lease health ordering
* fix(codex): reconcile computer-use startup changes
2026-07-11 10:25:14 -07:00
f94a7dc183
feat(codex): supervise native Codex sessions ( #104045 )
...
* feat(codex): add native session supervision
* fix(codex): harden supervision integration
* fix(codex): preserve locked harness ownership
* fix(codex): fence native session archive
* fix(codex): revalidate archive binding ownership
* feat(codex): integrate supervision runtime
* feat(sessions): preserve harness-owned execution
* feat(sessions): persist harness ownership invariants
* feat(gateway): enforce harness-owned sessions
* feat(setup): enable detected Codex supervision
* feat(mac): expose supervised Codex sessions
* feat(ui): make Codex sessions actionable
* docs(codex): document session supervision
* test(codex): cover integration ownership
* chore(i18n): refresh supervision inventories
* fix(setup): finalize Codex activation atomically
* test(codex): narrow binding store update
* fix(sessions): preserve legacy model locks
* test(macos): serialize Codex catalog fixtures
* fix(sessions): preserve legacy lock admission
* chore(i18n): reconcile supervision metadata
* test(sessions): mark legacy lock fixture
* fix(macos): drain final Codex catalog frame
* docs: leave supervision note to release
* style(macos): satisfy Codex catalog type length
* chore: record session accessor seam owners
* fix(macos): honor configured Codex supervision
* fix(codex): preserve harness-owned model locks
* fix(codex): satisfy supervision lint gates
* chore(i18n): refresh native supervision inventory
* fix(codex): align supervision validation contracts
* fix(codex): close supervision boundary gaps
* fix(codex): preserve supervision activation contracts
* fix(codex): dispose standalone supervision runtime
* fix(codex): pin supervised source connection
* fix(plugins): bind delegated runs to exact session target
* fix(codex): scope supervised sessions to configured agents
* fix(codex): fingerprint effective supervision home
* fix(codex): normalize supervision plugin policy
* fix(codex): keep supervised bindings stable across upgrades
* fix(codex): guard all supervised binding connections
* fix(codex): preserve catalog filters and pending CAS identity
* fix(codex): preserve supervision identity for diagnostics
* fix(codex): bind uncertain commits to supervision connection
* fix(codex): satisfy supervision type boundaries
* fix(macos): reconcile current main validation
* fix(codex): handle absent runtime config in supervision
* fix(doctor): own local audio acceleration check
* fix(codex): satisfy integration lint gates
* fix(codex): satisfy lifecycle safety guards
2026-07-11 00:12:08 -07:00
0d981095d4
refactor(codex): store app-server thread bindings in SQLite plugin state ( #101210 )
...
* test(codex): shorten placeholder auth fixture strings
* feat(plugin-state): add reject-new overflow policy for keyed namespaces
* feat(agents): thread agent identity and session generation through reset and hooks
* refactor(codex): add SQLite-backed app-server thread binding store
* refactor(codex): move app-server runtime callers onto the binding store
* refactor(codex): move conversation, entry, and thread-tool flows onto the binding store
* refactor(codex): move command handlers onto the binding store
* feat(codex): import legacy binding sidecars via doctor state migration
* fix(codex): keep doctor sidecar scan inside stateDir
* fix(codex): make binding migration landable
* chore(changelog): defer release note
* test(plugin-state): stabilize durable-capacity ordering
2026-07-07 03:03:44 +01:00
72f837a4a4
fix(codex): require admin for native controls ( #97952 )
...
* fix(codex): require admin for native controls
Gate Codex native session controls and bound turns on current owner or operator.admin authority. Preserve gateway scope precedence and read-only status behavior.
* fix(codex): align native authorization
* fix(codex): preserve silent bound handling
* fix(codex): narrow bound auth contract
* fix(docs): refresh generated docs map
2026-06-29 20:41:28 -07:00
ac6f249de1
test(codex): cover binds without model overrides ( #89535 )
2026-06-28 18:09:51 -07:00
804e5f21d1
fix: honor bound agent exec host policy
...
* fix(codex): honor bound agent exec host policy
* fix(codex): carry bound agent into app-server runtime
* fix(codex): preserve main session exec overrides
* fix(codex): narrow runtime session reads
* fix(codex): honor default agent session aliases
* fix(codex): isolate bound session exec overrides
* fix(codex): honor unscoped default session policy
2026-06-18 14:00:57 +10:00
5c34695491
feat(codex): support app-server network proxy profiles ( #93538 )
...
Merged via squash.
Prepared head SHA: 9900b14dd525068+vincentkoc@users.noreply.github.com >
Co-authored-by: vincentkoc <25068+vincentkoc@users.noreply.github.com >
Reviewed-by: @vincentkoc
2026-06-17 17:01:47 +08:00
b4cdd92119
fix(codex): avoid guardian review for local models ( #88630 )
...
* fix(codex): avoid guardian review for local models
* fix(codex): route app-server auto exec review
* fix(codex): make guardian requirements provider-aware
* fix(codex): block unrouted bound approvals
* fix(channels): satisfy ingress queue lint
* fix(codex): use local-model policy for side forks
* fix(extensions): satisfy ingress lint
* fix(codex): require trusted exec reviewer model
* fix(exec): share control command approval guards
* fix(codex): fail closed for unknown guardian model provider
* fix(codex): reject custom exec reviewer endpoints
* fix(codex): preserve bound providers on app-server reuse
* fix(codex): prefer qualified app-server model providers
* fix(codex): preserve guardian on model control switches
* fix(codex): retain local providers across model switches
* fix(codex): distrust aliased reviewer model refs
* fix(codex): preserve providers after thread rotation
* fix(codex): clear stale providers on qualified model switches
* fix(codex): prefer qualified models over legacy providers
* fix(codex): validate reviewer trust before auto approvals
* fix(codex): recompute reviewer policy after binding rotation
* fix(codex): normalize reviewer aliases before trust checks
* fix(codex): retain bound providers for slashed local models
* fix(codex): normalize provider trust checks for exec review
* fix(codex): ignore stale bindings for explicit providers
* fix(codex): share trusted reviewer endpoint policy
* fix(codex): keep network approvals on plugin path
* fix(codex): route provider-qualified model refs
* fix(codex): reject blank masked OpenAI base overrides
* fix(codex): scope exec reviewer alias trust
* fix(codex): distrust exec reviewer transport overrides
2026-06-09 21:38:22 -07:00
6868cde4d4
docs: document large extension sources
2026-06-04 21:40:44 -04:00
22cb7fb6b7
chore(lint): enable no-promise-executor-return
2026-05-31 23:06:13 +01:00
4c33aaa86c
refactor: unify OpenAI provider identity ( #88451 )
...
* refactor: unify OpenAI provider identity
* refactor: move legacy oauth sidecar doctor helpers
* test: align OpenAI fixtures after rebase
* test: clean OpenAI provider unification
* fix: finish OpenAI provider cleanup
* fix: finish OpenAI cleanup follow-through
* fix: finish OpenAI CI cleanup
2026-05-31 00:29:44 +01:00
209732535f
fix(exec): align release validation checks
...
Co-authored-by: Vincent Koc <25068+vincentkoc@users.noreply.github.com >
Co-authored-by: jesse-merhi <79823012+jesse-merhi@users.noreply.github.com >
2026-05-30 00:04:06 +10:00
b5f8191887
fix(codex): honor exec approval floors in bindings
...
Co-authored-by: Vincent Koc <25068+vincentkoc@users.noreply.github.com >
Co-authored-by: jesse-merhi <79823012+jesse-merhi@users.noreply.github.com >
2026-05-30 00:04:06 +10:00
80227005a0
feat(exec): add normalized auto mode
...
Co-authored-by: Vincent Koc <25068+vincentkoc@users.noreply.github.com >
Co-authored-by: jesse-merhi <79823012+jesse-merhi@users.noreply.github.com >
2026-05-30 00:04:06 +10:00
5a7d5c6def
fix(codex): bound app-server timeout fallout
...
Retire timed-out Codex app-server clients with lease-aware cleanup and keep harness-owned timeouts out of provider fallback.
2026-05-26 22:41:02 +01:00
0f35ec29d3
fix(codex): disable native thread personality ( #85891 ) (thanks @lastguru-net)
...
Behavior addressed: Native Codex app-server threads now disable Codex's built-in personality on thread/start, thread/resume, turn/start, bound conversation turns, and /btw side-thread forks so OpenClaw agent workspace identity stays authoritative.
Real environment tested: Local OpenClaw source checkout plus GitHub CI on PR #85891 .
Exact steps or command run after this patch: pnpm test extensions/codex/src/app-server/thread-lifecycle.test.ts extensions/codex/src/app-server/side-question.test.ts extensions/codex/src/conversation-binding.test.ts extensions/codex/src/app-server/schema-normalization-runtime-contract.test.ts; pnpm check:docs; pnpm prompt:snapshots:check; OPENCLAW_ADDITIONAL_BOUNDARY_SHARD=1/4 OPENCLAW_ADDITIONAL_BOUNDARY_CONCURRENCY=4 node scripts/run-additional-boundary-checks.mjs.
Evidence after fix: Focused Codex test shard passed 4 files / 79 tests; docs check passed; prompt snapshots are current; CI passed all code/quality checks, with only Real behavior proof failing as unrelated proof-bot gating for this non-channel change.
Observed result after fix: App-server request snapshots and unit tests include personality: "none" on native Codex start/resume/turn/fork paths.
What was not tested: A live Codex app-server model run was not executed.
Co-authored-by: Beru <beru@lastguru.lv >
2026-05-25 23:15:03 +01:00
9b9d8970b0
fix(codex): recover stale preflight bindings ( #86602 )
...
Fixes #86211 .
Recreates the focused recovery from #86216 with maintainer-side tests.
Co-authored-by: Paul Frederiksen <paul@paulfrederiksen.com >
2026-05-25 19:37:49 +01:00
e0405ecc9b
fix(codex): honor node exec policy for native surfaces ( #85534 )
...
* fix(codex): honor node exec policy for native surfaces
* docs(changelog): note codex node exec policy fix
* fix(codex): keep node exec policy private
2026-05-22 20:01:29 -07:00
ba06376c79
fix: harden codex sandbox execution
...
Harden the Codex app-server native execution bridge for OpenClaw sandboxed runs. The change keeps core sandbox policy in OpenClaw while exposing the process, filesystem, and HTTP relay behavior Codex needs inside a scoped exec server.
The large exec-server/test files were split into focused modules before landing, and the PR was rebased onto current main with focused tests, Testbox changed checks, CI, and Codex autoreview green.
Co-authored-by: joshavant <830519+joshavant@users.noreply.github.com >
2026-05-21 23:47:32 +01:00
a5b1177b68
fix(codex): preserve agent scope for bound app-server sessions
2026-05-17 09:03:05 +01:00
a5c1956ca1
feat(codex): bind CLI sessions from nodes
...
Adds node-backed Codex CLI session listing and resume binding for paired nodes, including Windows shim-safe Codex resume spawning, docs, changelog, and focused Codex coverage.
Verification:
- pnpm exec oxfmt --check --threads=1 CHANGELOG.md docs/plugins/codex-harness.md extensions/codex/index.ts extensions/codex/src/command-formatters.ts extensions/codex/src/command-handlers.ts extensions/codex/src/commands.test.ts extensions/codex/src/conversation-binding-data.ts extensions/codex/src/conversation-binding.test.ts extensions/codex/src/conversation-binding.ts extensions/codex/src/node-cli-sessions.ts extensions/codex/src/node-cli-sessions.test.ts
- pnpm run lint:tmp:no-random-messaging
- pnpm run lint:extensions:bundled
- OPENCLAW_VITEST_MAX_WORKERS=4 pnpm test extensions/codex/src/node-cli-sessions.test.ts extensions/codex/src/conversation-binding.test.ts extensions/codex/src/commands.test.ts
- pnpm tsgo:extensions
- git diff --check
- AWS Crabbox focused proof run_a901a61e006f
2026-05-14 11:24:30 +02:00
694ca50e97
Revert "refactor: move runtime state to SQLite"
...
This reverts commit f91de52f0d
2026-05-13 13:33:38 +01:00
f91de52f0d
refactor: move runtime state to SQLite
...
* refactor: remove stale file-backed shims
* fix: harden sqlite state ci boundaries
* refactor: store matrix idb snapshots in sqlite
* fix: satisfy rebased CI guardrails
* refactor: store current conversation bindings in sqlite table
* refactor: store tui last sessions in sqlite table
* refactor: reset sqlite schema history
* refactor: drop unshipped sqlite table migration
* refactor: remove plugin index file rollback
* refactor: drop unshipped sqlite sidecar migrations
* refactor: remove runtime commitments kv migration
* refactor: preserve kysely sync result types
* refactor: drop unshipped sqlite schema migration table
* test: keep session usage coverage sqlite-backed
* refactor: keep sqlite migration doctor-only
* refactor: isolate device legacy imports
* refactor: isolate push voicewake legacy imports
* refactor: isolate remaining runtime legacy imports
* refactor: tighten sqlite migration guardrails
* test: cover sqlite persisted enum parsing
* refactor: isolate legacy update and tui imports
* refactor: tighten sqlite state ownership
* refactor: move legacy imports behind doctor
* refactor: remove legacy session row lookup
* refactor: canonicalize memory transcript locators
* refactor: drop transcript path scope fallbacks
* refactor: drop runtime legacy session delivery pruning
* refactor: store tts prefs only in sqlite
* refactor: remove cron store path runtime
* refactor: use cron sqlite store keys
* refactor: rename telegram message cache scope
* refactor: read memory dreaming status from sqlite
* refactor: rename cron status store key
* refactor: stop remembering transcript file paths
* test: use sqlite locators in agent fixtures
* refactor: remove file-shaped commitments and cron store surfaces
* refactor: keep compaction transcript handles out of session rows
* refactor: derive transcript handles from session identity
* refactor: derive runtime transcript handles
* refactor: remove gateway session locator reads
* refactor: remove transcript locator from session rows
* refactor: store raw stream diagnostics in sqlite
* refactor: remove file-shaped transcript rotation
* refactor: hide legacy trajectory paths from runtime
* refactor: remove runtime transcript file bridges
* refactor: repair database-first rebase fallout
* refactor: align tests with database-first state
* refactor: remove transcript file handoffs
* refactor: sync post-compaction memory by transcript scope
* refactor: run codex app-server sessions by id
* refactor: bind codex runtime state by session id
* refactor: pass memory transcripts by sqlite scope
* refactor: remove transcript locator cleanup leftovers
* test: remove stale transcript file fixtures
* refactor: remove transcript locator test helper
* test: make cron sqlite keys explicit
* test: remove cron runtime store paths
* test: remove stale session file fixtures
* test: use sqlite cron keys in diagnostics
* refactor: remove runtime delivery queue backfill
* test: drop fake export session file mocks
* refactor: rename acp session read failure flag
* refactor: rename acp row session key
* refactor: remove session store test seams
* refactor: move legacy session parser tests to doctor
* refactor: reindex managed memory in place
* refactor: drop stale session store wording
* refactor: rename session row helpers
* refactor: rename sqlite session entry modules
* refactor: remove transcript locator leftovers
* refactor: trim file-era audit wording
* refactor: clean managed media through sqlite
* fix: prefer explicit agent for exports
* fix: use prepared agent for session resets
* fix: canonicalize legacy codex binding import
* test: rename state cleanup helper
* docs: align backup docs with sqlite state
* refactor: drop legacy Pi usage auth fallback
* refactor: move legacy auth profile imports to doctor
* refactor: keep Pi model discovery auth in memory
* refactor: remove MSTeams legacy learning key fallback
* refactor: store model catalog config in sqlite
* refactor: use sqlite model catalog at runtime
* refactor: remove model json compatibility aliases
* refactor: store auth profiles in sqlite
* refactor: seed copied auth profiles in sqlite
* refactor: make auth profile runtime sqlite-addressed
* refactor: migrate hermes secrets into sqlite auth store
* refactor: move plugin install config migration to doctor
* refactor: rename plugin index audit checks
* test: drop auth file assumptions
* test: remove legacy transcript file assertions
* refactor: drop legacy cli session aliases
* refactor: store skill uploads in sqlite
* refactor: keep subagent attachments in sqlite vfs
* refactor: drop subagent attachment cleanup state
* refactor: move legacy session aliases to doctor
* refactor: require node 24 for sqlite state runtime
* refactor: move provider caches into sqlite state
* fix: harden virtual agent filesystem
* refactor: enforce database-first runtime state
* refactor: rename compaction transcript rotation setting
* test: clean sqlite refactor test types
* refactor: consolidate sqlite runtime state
* refactor: model session conversations in sqlite
* refactor: stop deriving cron delivery from session keys
* refactor: stop classifying sessions from key shape
* refactor: hydrate announce targets from typed delivery
* refactor: route heartbeat delivery from typed sqlite context
* refactor: tighten typed sqlite session routing
* refactor: remove session origin routing shadow
* refactor: drop session origin shadow fixtures
* perf: query sqlite vfs paths by prefix
* refactor: use typed conversation metadata for sessions
* refactor: prefer typed session routing metadata
* refactor: require typed session routing metadata
* refactor: resolve group tool policy from typed sessions
* refactor: delete dead session thread info bridge
* Show Codex subscription reset times in channel errors (#80456 )
* feat(plugin-sdk): consolidate session workflow APIs
* fix(agents): allow read-only agent mount reads
* [codex] refresh plugin regression fixtures
* fix(agents): restore compaction gateway logs
* test: tighten gateway startup assertions
* Redact persisted secret-shaped payloads [AI] (#79006 )
* test: tighten device pair notify assertions
* test: tighten hermes secret assertions
* test: assert matrix client error shapes
* test: assert config compat warnings
* fix(heartbeat): remap cron-run exec events to session keys (#80214 )
* fix(codex): route btw through native side threads
* fix(auth): accept friendly OpenAI order for Codex profiles
* fix(codex): rotate auth profiles inside harness
* fix: keep browser status page probe within timeout
* test: assert agents add outputs
* test: pin cron read status
* fix(agents): avoid Pi resource discovery stalls
Co-authored-by: dataCenter430 <titan032000@gmail.com >
* fix: retire timed-out codex app-server clients
* test: tighten qa lab runtime assertions
* test: check security fix outputs
* test: verify extension runtime messages
* feat(wake): expose typed sessionKey on wake protocol + system event CLI
* fix(gateway): await session_end during shutdown drain and track channel + compaction lifecycle paths (#57790 )
* test: guard talk consult call helper
* fix(codex): scale context engine projection (#80761 )
* fix(codex): scale context engine projection
* fix: document Codex context projection scaling
* fix: document Codex context projection scaling
* fix: document Codex context projection scaling
* fix: document Codex context projection scaling
* chore: align Codex projection changelog
* chore: realign Codex projection changelog
* fix: isolate Codex projection patch
---------
Co-authored-by: Eva (agent) <eva+agent-78055@100yen.org >
Co-authored-by: Josh Lehman <josh@martian.engineering >
* refactor: move agent runtime state toward piless
* refactor: remove cron session reaper
* refactor: move session management to sqlite
* refactor: finish database-first state migration
* chore: refresh generated sqlite db types
* refactor: remove stale file-backed shims
* test: harden kysely type coverage
# Conflicts:
# .agents/skills/kysely-database-access/SKILL.md
# src/infra/kysely-sync.types.test.ts
# src/proxy-capture/store.sqlite.test.ts
# src/state/openclaw-agent-db.test.ts
# src/state/openclaw-state-db.test.ts
* refactor: remove cron store path runtime
* refactor: keep compaction transcript handles out of session rows
* refactor: derive embedded transcripts from sqlite identity
* refactor: remove embedded transcript locator handoff
* refactor: remove runtime transcript file bridges
* refactor: remove transcript file handoffs
* refactor: remove MSTeams legacy learning key fallback
* refactor: store model catalog config in sqlite
* refactor: use sqlite model catalog at runtime
# Conflicts:
# docs/cli/secrets.md
# docs/gateway/authentication.md
# docs/gateway/secrets.md
* fix: keep oauth sibling sync sqlite-local
# Conflicts:
# src/commands/onboard-auth.test.ts
* refactor: remove task session store maintenance
# Conflicts:
# src/commands/tasks.ts
* refactor: keep diagnostics in state sqlite
* refactor: enforce database-first runtime state
* refactor: consolidate sqlite runtime state
* Show Codex subscription reset times in channel errors (#80456 )
* fix(codex): refresh subscription limit resets
* fix(codex): format reset times for channels
* Update CHANGELOG with latest changes and fixes
Updated CHANGELOG with recent fixes and improvements.
* fix(codex): keep command load failures on codex surface
* fix(codex): format account rate limits as rows
* fix(codex): summarize account limits as usage status
* fix(codex): simplify account limit status
* test: tighten subagent announce queue assertion
* test: tighten session delete lifecycle assertions
* test: tighten cron ops assertions
* fix: track cron execution milestones
* test: tighten hermes secret assertions
* test: assert matrix sync store payloads
* test: assert config compat warnings
* fix(codex): align btw side thread semantics
* fix(codex): honor codex fallback blocking
* fix(agents): avoid Pi resource discovery stalls
* test: tighten codex event assertions
* test: tighten cron assertions
* Fix Codex app-server OAuth harness auth
* refactor: move agent runtime state toward piless
* refactor: move device and push state to sqlite
* refactor: move runtime json state imports to doctor
* refactor: finish database-first state migration
* chore: refresh generated sqlite db types
* refactor: clarify cron sqlite store keys
* refactor: remove stale file-backed shims
* refactor: bind codex runtime state by session id
* test: expect sqlite trajectory branch export
* refactor: rename session row helpers
* fix: keep legacy device identity import in doctor
* refactor: enforce database-first runtime state
* refactor: consolidate sqlite runtime state
* build: align pi contract wrappers
* chore: repair database-first rebase
* refactor: remove session file test contracts
* test: update gateway session expectations
* refactor: stop routing from session compatibility shadows
* refactor: stop persisting session route shadows
* refactor: use typed delivery context in clients
* refactor: stop echoing session route shadows
* refactor: repair embedded runner rebase imports
# Conflicts:
# src/agents/pi-embedded-runner/run/attempt.tool-call-argument-repair.ts
* refactor: align pi contract imports
* refactor: satisfy kysely sync helper guard
* refactor: remove file transcript bridge remnants
* refactor: remove session locator compatibility
* refactor: remove session file test contracts
* refactor: keep rebase database-first clean
* refactor: remove session file assumptions from e2e
* docs: clarify database-first goal state
* test: remove legacy store markers from sqlite runtime tests
* refactor: remove legacy store assumptions from runtime seams
* refactor: align sqlite runtime helper seams
* test: update memory recall sqlite audit mock
* refactor: align database-first runtime type seams
* test: clarify doctor cron legacy store names
* fix: preserve sqlite session route projections
* test: fix copilot token cache test syntax
* docs: update database-first proof status
* test: align database-first test fixtures
* docs: update database-first proof status
* refactor: clean extension database-first drift
* test: align agent session route proof
* test: clarify doctor legacy path fixtures
* chore: clean database-first changed checks
* chore: repair database-first rebase markers
* build: allow baileys git subdependency
* chore: repair exp-vfs rebase drift
* chore: finish exp-vfs rebase cleanup
* chore: satisfy rebase lint drift
* chore: fix qqbot rebase type seam
* chore: fix rebase drift leftovers
* fix: keep auth profile oauth secrets out of sqlite
* fix: repair rebase drift tests
* test: stabilize pairing request ordering
* test: use source manifests in plugin contract checks
* fix: restore gateway session metadata after rebase
* fix: repair database-first rebase drift
* fix: clean up database-first rebase fallout
* test: stabilize line quick reply receipt time
* fix: repair extension rebase drift
* test: keep transcript redaction tests sqlite-backed
* fix: carry injected transcript redaction through sqlite
* chore: clean database branch rebase residue
* fix: repair database branch CI drift
* fix: repair database branch CI guard drift
* fix: stabilize oauth tls preflight test
* test: align database branch fast guards
* test: repair build artifact boundary guards
* chore: clean changelog rebase markers
---------
Co-authored-by: pashpashpash <nik@vault77.ai >
Co-authored-by: Eva <eva@100yen.org >
Co-authored-by: stainlu <stainlu@newtype-ai.org >
Co-authored-by: Jason Zhou <jason.zhou.design@gmail.com >
Co-authored-by: Ruben Cuevas <hi@rubencu.com >
Co-authored-by: Pavan Kumar Gondhi <pavangondhi@gmail.com >
Co-authored-by: Shakker <shakkerdroid@gmail.com >
Co-authored-by: Kaspre <36520309+Kaspre@users.noreply.github.com >
Co-authored-by: dataCenter430 <titan032000@gmail.com >
Co-authored-by: Kaspre <kaspre@gmail.com >
Co-authored-by: pandadev66 <nova.full.stack@outlook.com >
Co-authored-by: Eva <admin@100yen.org >
Co-authored-by: Eva (agent) <eva+agent-78055@100yen.org >
Co-authored-by: Josh Lehman <josh@martian.engineering >
Co-authored-by: jeffjhunter <support@aipersonamethod.com >
2026-05-13 13:15:12 +01:00
62adbe0b80
test: dedupe codex binding mock helper
2026-05-13 10:45:51 +01:00
250e16d3c9
test: dedupe codex conversation mock calls
2026-05-12 16:11:24 +01:00
c60950856d
test: tighten codex conversation binding assertions
2026-05-11 11:29:16 +01:00
c86f95cc16
test: tighten codex conversation binding assertions
2026-05-10 18:53:00 +01:00
86a54caee2
test: tighten codex app empty array assertions
2026-05-09 04:45:12 +01:00
fb106fb9ae
fix codex harness service tiers ( #79152 )
2026-05-08 12:10:41 +09:00
35da7d2c99
refactor: remove legacy agent dir resolver
2026-05-05 20:07:49 +01:00
a373468d82
fix: recover missing Codex bound threads
2026-05-05 04:04:58 +01:00
ac3cd1a0ca
Harden Codex harness control surfaces ( #77459 )
...
* fix(scripts): find codex protocol source from worktrees
* fix(test): keep codex harness docker caches writable
* fix(test): relax live codex cache mount permissions
* test(codex): add live docker harness debug output
* fix(test): detect numeric ci env in codex docker harness
* fix(codex): skip duplicate agent-command telemetry
* fix(tooling): skip sparse-missing oxlint tsconfig
* fix(tooling): route changed checks through testbox
* fix(qa): keep coverage json source-clean
* fix(test): preflight codex docker auth
* fix(codex): validate bind option values
* fix(codex): parse quoted command arguments
* fix(codex): reject extra control args
* fix(codex): use content for blank bound prompts
* fix(codex): decode local image file urls
* fix(codex): treat local media urls as images
* fix(codex): keep windows media paths local
* fix(codex): reject malformed diagnostics confirmations
* fix(codex): reject malformed resume commands
* fix(codex): reject malformed thread actions
* fix(codex): reject malformed turn controls
* fix(codex): reject malformed model controls
* fix(codex): resolve empty user input prompts
* fix(codex): enforce user input options
* fix(codex): reject ambiguous computer-use actions
* fix(codex): ignore stale bound turn notifications
* test(gateway): close task registries in gateway harness
* test(gateway): route cleanup through task seams
* fix(codex): describe current permission approvals
* fix(codex): disclose command approval amendments
* fix(codex): preserve approval detail under truncation
* fix(codex): propagate dynamic tool failures
* test(codex): align dynamic tool block contract
* fix(codex): reject extra read-only command operands
* fix(codex): escape command readout fields
* fix(codex): escape status probe errors
* fix(codex): narrow formatted thread details
* fix(codex): escape successful status summaries
* fix(codex): escape bound control replies
* fix(codex): escape user input prompts
* fix(codex): escape control failure replies
* fix(codex): escape approval prompt text
* test(codex): narrow escaped reply assertions
* test(codex): complete strict reply fixtures
* test(codex): preserve account fixture literals
* test(codex): align status probe fixtures
* fix(codex): satisfy sanitizer regex lint
* fix(codex): harden command readouts
* fix(codex): harden bound image inputs
* fix(codex): sanitize command failure replies
* test(codex): complete rate limit fixture
* test(tooling): isolate postinstall compile cache fixture
* fix(codex): keep app-server event ownership explicit
---------
Co-authored-by: pashpashpash <nik@vault77.ai >
2026-05-05 07:23:41 +09:00
8ea04f994a
fix: resolve Codex native auth by profile provider
2026-05-04 01:10:30 +01:00
71f55214ec
fix: select Codex OAuth profile for bound app-server turns
2026-05-04 01:10:30 +01:00
05d11a4318
fix: preserve Codex binding OAuth transport
...
(cherry picked from commit f45dc3168aea29030b80381dc9017e9ee7e82ba4)
2026-05-04 01:10:30 +01:00
Peter Steinberger