3b14a93000
test(mcp): isolate catalog size checks from wall-clock load ( #118871 )
2026-08-03 12:15:36 -07:00
a67c52611e
fix(deps): bump brace-expansion override to 5.0.9 for HIGH advisory 1130705 ( #118804 )
...
* fix(deps): bump brace-expansion override to 5.0.9 for advisory 1130705
* test(mcp): isolate oversized catalog proof from wall-clock timeouts
2026-08-03 11:01:02 -07:00
7c35cbc4f4
test(node-host): isolate linux plugin discovery ( #118556 )
...
Co-authored-by: Peter Steinberger <steipete@mac-studio-sf2.local >
2026-08-03 00:25:48 -07:00
bc212450bc
test(node-host): reuse approvals database fixture ( #118517 )
...
Co-authored-by: Peter Steinberger <steipete@mac-studio-sf2.local >
2026-08-02 22:59:19 -07:00
bb5c649e31
fix: bound pending approvals and preserve delivery order ( #118252 )
...
* refactor: centralize pending request lifecycles
Share timeout and settlement registries across worker, LSP, node-host, and approval fanout paths. Bound plugin conversation-binding approvals and preserve terminal notification ordering during slow delivery.
* style: satisfy pending registry lint rules
* test: await deferred plugin approval delivery
* test: satisfy forwarder type-aware lint
2026-08-02 17:30:53 -07:00
75aa8306f7
fix: canonicalize single-flight promise caching ( #118245 )
...
* fix: canonicalize promise single-flight caches
* fix: make TUI refresh outcome explicit
* fix: satisfy single-flight lint contracts
2026-08-02 16:33:25 -07:00
c574a6544c
fix(auth): retain the selected account when migrating Codex sessions ( #118205 )
...
* fix(auth): preserve selected OAuth accounts during Codex migrations
* test(auth): complete doctor context and stabilize MCP pagination
2026-08-02 16:14:11 -07:00
6c9b38862d
refactor(plugins): root-owned bundle installation with scoped registry handles ( #117587 )
...
* refactor(plugins): root-owned bundle installation with scoped registry handles
* refactor(plugins): root-owned bundle installation with scoped registry handles
* test(gateway): expect gateway-binding fact in reload rewarm
* fix(agents): reuse gateway prepared runtime generations
* test(agents): isolate runtime handle fixtures
* test(agents): align runtime owner fixtures
* test(cron): mock run-owned registry loading
2026-08-01 16:17:30 -07:00
3856b4fa1b
refactor(cli): unify gateway RPC transport ( #117601 )
2026-08-01 14:06:30 -07:00
e051a7bb4a
fix(mcp): bound catalog pagination ( #116845 )
...
* fix(node-host): bound MCP tool pagination
* fix(node-host): bound MCP catalog duration
* style(node-host): format MCP pagination test
* fix(mcp): share bounded pagination
* fix(mcp): keep pagination types private
* test(mcp): normalize abort rejection
* fix(mcp): enforce pagination deadline after loading
* fix(mcp): stabilize pagination deadline ownership
2026-07-31 06:41:41 -07:00
52f81a3684
fix(exec): require approval for abbreviated inline eval flags [AI] ( #116529 )
...
* fix: gate abbreviated interpreter eval flags
* fix(exec): cover legacy gawk source abbreviation
2026-07-31 13:42:17 +05:30
bb68389a66
fix(ui): deduplicate gateway-native session hosts
2026-07-30 15:22:37 +08:00
032defb172
fix(nodes): cancel paired local inference when callers disconnect ( #115624 )
2026-07-29 02:00:22 -04:00
6c81253985
feat(node-host): migrate retired state before connecting ( #115495 )
...
* feat(node-host): run doctor-owned state migrations at startup
* fix(node-host): satisfy startup migration lint
2026-07-29 01:04:48 -04:00
107bc4f963
fix: make gateway nodes and local inference reliable under stress ( #115185 )
2026-07-28 08:41:14 -04:00
98b8a18b4c
fix(node): harden reconnect and local inference cancellation ( #115033 )
...
* fix(node): harden reconnect and local inference cancellation
* fix(browser): refresh bundled gateway client
* fix(gateway): preserve restart after reconnect reset
* fix(node): preserve tracked remote command ownership
2026-07-28 04:18:51 -04:00
a92f85e642
fix(node): cancel remote commands and stabilize local inference ( #114935 )
2026-07-28 01:03:25 -04:00
9bcc44301b
fix(nodes): preserve gateway connections and local inference ( #114857 )
2026-07-27 22:28:32 -04:00
10966ed344
fix(exec): defer failed auto reviews to human approval ( #114802 )
2026-07-27 20:45:09 -04:00
96a7a21d31
fix(agents): prevent opaque shell commands bypassing auto-review ( #114558 )
...
* fix(agents): reject opaque auto-review shell carriers
* fix(security): block auto-review PowerShell remoting modes
* fix(security): require human review for PowerShell script files
* fix(security): block encoded PowerShell argument aliases
2026-07-27 09:35:59 -04:00
521f45592e
fix(agents): harden exec auto-review shell approval ( #114519 )
2026-07-27 06:50:18 -04:00
269bc5c89e
fix(cli): preserve machine-readable stdout ( #113654 )
...
Co-authored-by: 1052326311 <65798732+1052326311@users.noreply.github.com >
2026-07-27 05:44:16 -04:00
fd6e042d87
fix(gateway): keep configured local auth authoritative ( #114462 )
...
* fix(gateway): align configured local credentials
* test(gateway): align local credential coverage
* chore(gateway): leave release note to release process
2026-07-27 05:43:31 -04:00
9eae43bd37
refactor(infra): move exec approvals into the shared SQLite state DB ( #114063 )
...
* refactor(infra): move exec approvals into the shared SQLite state DB
Delete the file-runtime exec-approvals store (exec-approvals.json + .lock
sidecar machinery) on both runtimes and make the reserved
exec_approvals_config singleton row canonical. Doctor owns the one-time
import with claim/verify/receipt discipline; runtime fails closed with a
doctor instruction while un-migrated legacy state exists. The wire CAS
contract, socket semantics, and gateway auth-token derivations are
unchanged. Kills the #113929 lock-contention bug class structurally and
nets around -2.9k lines.
* fix(infra): green CI gates and retire file-era exec approvals tests
Break the migration-type import cycle with a leaf contract, regenerate the
plugin-SDK API and native i18n baselines for the intentional surface change,
drop unused exports, and replace the macOS file-era approvals test suite with
SQLite-backed behavior coverage per the obsolete-internals test policy.
* chore: green max-lines ratchet, native i18n baseline, and unused-export scan
2026-07-26 06:39:23 -04:00
3018e8b78a
refactor: deduplicate micro helpers onto canonical homes ( #113534 )
...
* refactor: deduplicate micro helpers
* fix(ai): keep hash prefix helper internal
2026-07-25 00:41:01 -07:00
82d1a03f25
refactor(agents): move implicit-main fallback into load-time roster injection ( #112678 )
...
* refactor(agents): require explicit roster defaults
* feat(onboard): create named first roster agent
* refactor(agents): remove runtime main fallbacks
* style(agents): apply roster refactor formatting
* refactor(agents): finish roster-only runtime sweep
* fix(doctor): migrate legacy main session sqlite
* fix(doctor): harden roster session migrations
* fix(onboard): commit first agent atomically
* fix(config): support empty-roster analysis
* fix(agents): preserve legacy main state during creation
* fix(setup): materialize baseline agent roster
* fix(agents): harden legacy default transfer recovery
* fix(agents): simplify roster-only legacy compatibility
* fix(agents): preserve staged first-agent entries
* fix(config): migrate persisted implicit-main rosters
* fix(config): preserve staged empty rosters
* fix(agents): finalize roster-only upgrade paths
* fix(sessions): close legacy main migration outcomes
* fix(config): migrate legacy roster markers at load
* fix(sessions): preserve roster upgrade history
* refactor(sessions): restore lean legacy main compatibility
* fix(setup): prepare first-agent credentials before publish
* fix(config): stabilize roster snapshot migration
* refactor(sessions): shrink legacy main compatibility
* fix(agents): restore roster compatibility fidelity
* fix(sessions): preserve divergent legacy history
* refactor(agents): narrow roster-only scope
* fix(config): isolate roster migration
* test(agents): align roster-only fixtures
* fix(agents): keep main agent undeletable
* fix(agents): harden roster migration invariants
* fix(agents): close setup and audit scope gaps
* fix(cron): scope session reaper throttles by agent
* fix(agents): preserve scoped owner precedence
* fix(config): preserve authored config ownership
* fix(setup): keep default workspace and roster in sync
* fix(setup): preserve default entry workspace on bare runs
* fix(agents): adapt roster rebase to keyed entries
* fix(agents): honor both roster representations
* fix(agents): route roster reads through shared helpers
* fix(config): preserve canonical roster writes
* fix(cron): resolve dynamic default for session reaper
* fix(agents): close dynamic default migration gaps
* fix(agents): align scoped session ownership
* fix(sessions): preserve legacy main directory casing
* fix(agents): align cron and legacy auth ownership
* fix(setup): provision the committed default workspace
* fix(cron): align scoped ownership and reaping
* fix(cron): treat blank agent ids as absent
* fix(cron): retain configured session-store owners
* fix(agents): repair roster-aware CI boundaries
* fix(cron): preserve scoped ownership resolution
* fix(agents): preserve rosterless maintenance paths
* fix(agents): propagate roster ownership through runtime boundaries
* fix(agents): preserve roster ownership across runtime paths
* fix(agents): harden roster diagnostics and legacy routing
* fix(agents): remove redundant diagnostic import
* test(agents): type CLI policy fixture explicitly
* fix(config): preserve canonical roster mutation identity
* fix(doctor): read canonical agent rosters consistently
* fix(config): resolve compound roster unsets safely
* fix(config): finalize main-session reconciliation
* fix(doctor): read canonical session state safely
* fix(sessions): preserve current visibility alias
* fix(config): track roster include provenance
* test(config): type roster provenance cases
* fix(config): refine roster include ownership
* fix(agents): preserve staged roster invariants
* test(config): align fixtures with explicit roster ownership
* test(node-host): preserve optional plan typing
* fix(config): preserve authored roster projections
* test(config): keep raw roster fixtures explicit
* test(config): normalize rosters at runtime fixtures
* fix(config): protect authored roster ownership
* fix(agents): require explicit session ownership
* fix(agents): enforce scoped roster ownership
* fix(sessions): merge fixed-store agent partitions
* fix(agents): harden roster ownership boundaries
* fix(config): reject ambiguous roster projections
* fix(sessions): preserve persisted store ownership
* fix(sessions): keep collision diagnostics additive
* fix(security): scan malformed roster workspaces
* test(config): align snapshot fixtures after rebase
* test(agents): use explicit roster fixtures
* fix(config): harden roster diagnostic boundaries
* fix(sessions): isolate fixed-store agent databases
* test(agents): type malformed default markers
* refactor(sessions): extract store collision resolution
* test(system-agent): split oversized setup coverage
* style(system-agent): format split setup suite
* fix(sessions): preserve promoted store ownership
* fix(sessions): derive scoped owner before target
* fix(sessions): preserve explicit sqlite ownership
* fix(agents): restore roster compatibility across CI
* fix(agents): enforce roster-owned runtime boundaries
* fix(agents): satisfy default lookup lint
* test(sessions): split known-owner coverage
* fix(state): satisfy path identity lint
* fix(agents): preserve malformed roster safety boundaries
* fix(agents): restore roster compatibility at runtime boundaries
* fix(config): satisfy roster boundary type checks
* fix(agents): preserve roster ownership across runtime probes
Setup inference probes now execute as the configured roster owner. Malformed agent-prefixed session rows are intentionally omitted by the fail-closed visibility contract rather than normalized by tests.
* fix(agents): satisfy session list owner lint
* fix(agents): preserve roster-owned runtime boundaries
Restore shared logical rows for exact SQLite session locators while keeping their physical database owner separate. The ownership regression test now constructs an explicit sole-owner database directly instead of relying on first-touch capture, matching the intentional shared-store contract.
* fix(sessions): preserve multiply owned exact stores
* fix(sessions): restore runtime owner boundaries
Keep incognito sentinels agent-owned, fold default-agent approvals into the global snapshot, and preserve the configless legacy-main CLI policy fallback. Also repair the existing CLI watchdog test lifecycle so the compact shard observes its timeout without an unawaited assertion or async timer stall; product behavior is unchanged by that test-only fix.
* test(ci): align owner-scoped fixtures
These assertions are unchanged. The fixtures now declare the intended non-default runner, expose the session-key constant imported by production status code, and select the main approvals bucket explicitly on Windows.
* fix(agents): close final roster ownership gaps
2026-07-24 22:38:09 -07:00
509a5f0373
fix(sqlite): reject schema data loss during upgrades ( #113473 )
...
* fix(sqlite): reject schema data loss during upgrades
* test(macos): align native state schema boundary
2026-07-25 12:22:02 +08:00
2628fae0da
fix: recognize more shell wrappers [AI] ( #112955 )
...
* fix: recognize more shell wrappers
* fix: cover windows shell wrapper aliases
* fix: limit shell rewrite parsing set
* fix: recognize yash cmdline option
* fix: fail closed for opaque shell rewrites
* fix: recognize nushell execute mode
* fix: fail opaque shell allowlist matches closed
* fix: suppress opaque shell positional previews
* fix: parse nushell value options before commands
* fix: block opaque shell script fallbacks
* fix: keep nushell startup configs bound
* fix: preserve plus-option shell script binding
* fix: fail opaque shell fallback paths closed
* fix: reject shell inline flags in script fallback
* fix: block nushell startup option binding
* fix: fail opaque system run transports closed
* fix: deny hidden opaque shell approvals
* fix: keep startup shell payloads opaque
* fix: keep osh shell payloads opaque
* fix: use analysis result in allowlist test
* fix: parse nushell attached command flags
* fix: keep nushell attached parsing local
2026-07-24 15:03:58 +05:30
1a42e005fb
fix(anthropic): forward selected profiles to Claude CLI ( #112458 )
...
* fix(anthropic): forward Claude CLI auth profiles
* fix(system-agent): inject CLI auth route stores
* fix(claude-cli): pass profile credentials by descriptor
* fix(anthropic): repair selected profile CI coverage
* fix(anthropic): preserve profile owner validation
* test(system-agent): preserve selected profile fixtures
* test(system-agent): narrow selected profile fixture
* test(system-agent): resolve profile store merge
* fix(anthropic): forward profiles to node Claude runs
* fix(system-agent): reconcile profile route projection
* test(system-agent): thread profile store through projection
* fix(anthropic): make selected profile authoritative
* fix(system-agent): type auth setup failures
* fix(system-agent): type setup auth failures
* style: format Claude profile maintenance
* fix(anthropic): keep gateway credentials off nodes
* fix(anthropic): clear ambient auth for selected profiles
* fix(anthropic): secure paired-node Claude auth
* fix(node-host): type Claude fd spawn streams
* style(node-host): satisfy Claude spawn lint
* fix(process): capture exit before secret delivery
* fix(anthropic): preserve node-native Claude auth
2026-07-21 23:27:37 -06:00
edecdbd05e
refactor(config): config-surface reduction tranche 3 — product consolidations (review request) ( #111527 )
...
* refactor(config): consolidate media model lists
* refactor(config): unify memory configuration
* refactor(config): consolidate TTS ownership
* refactor(config): move typing policy to agents
* refactor(config): retire product-level config surfaces
* refactor(config): share scoped tool policy type
* chore(config): refresh generated baselines
* fix(config): honor agent typing overrides
* fix(config): migrate sibling config consumers
* refactor(infra): keep base64url decoder private
* fix(config): strip invalid legacy TTS values
* chore(config): refresh rebased baseline hash
* fix(doctor): route legacy messages.tts.realtime voice to talk during tts move
* refactor(config): polish final layout names
* refactor(config): freeze retired tuning defaults
* feat(config): add fast mode default symmetry
* refactor(config): key agent entries by id
* docs(config): update final layout reference
* test(config): cover final layout migrations
* chore(config): refresh final layout baselines
* fix(config): align final layout runtime readers
* fix(config): align remaining readers
* fix(config): stabilize final layout migrations
* fix(config): finalize config projection proof
* fix(config): address final layout review
* docs(release): preserve historical config names
* fix(config): complete keyed agent migration
* fix(config): close final migration gaps
* fix(config): finish full-branch review
* fix(config): complete runtime secret detection
* fix(config): close final review findings
* fix(config): finish canonical docs and heartbeat migration
* fix(config): integrate latest main after rebase
* refactor(env): isolate test-only controls
* refactor(env): isolate build and development controls
* refactor(env): collapse process identity indirection
* refactor(env): remove duplicate config and temp aliases
* docs(env): define the operator-facing allowlist
* ci(env): ratchet production variable count
* fix(env): remove stale provider helper import
* fix(env): make ratchet sorting explicit
* test(env): keep test seam in dead-code audit
* test(env): cover ratchet growth and boundary; document surface budgets
* docs(config): document tier-eval consolidations
* docs(config): clarify speech preference ownership
* test(memory): align retired tuning fixtures
* refactor(memory): freeze engine heuristics
* refactor(config): apply tier-eval tranche
* refactor(tts): move persona shaping to providers
* refactor(compaction): move prompt policy to providers
* test(config): align hookified prompt fixtures
* chore(deadcode): classify test-only exports
* chore(github): remove unused spawn helper
* chore(deadcode): classify queue diagnostics
* chore(deadcode): remove unused lane snapshot export
* chore(plugin-sdk): ratchet consolidated surface
* fix(config): integrate latest main after rebase
2026-07-21 20:28:43 -07:00
783a5d21cf
refactor(config): purge numeric tuning knobs behind built-in defaults ( #111382 )
2026-07-19 07:35:45 -07:00
58452de711
refactor(config): config-surface reduction tranche 1 — retire dead keys, dedupe channel schemas, add growth ratchet ( #111142 )
...
* refactor(config): retire dead and aliased config keys via doctor migrations
* refactor(config): dedupe bundled channel config schemas into shared builders
* feat(config): add config-surface count ratchet to doc-baseline check
* test(config): drop stale fixtures for retired config keys
* fix(doctor): migrate only positive finite MCP timeout aliases
* fix(migrate-hermes): emit canonical MCP timeouts only
* fix(config): satisfy lint and contract gates
2026-07-19 00:52:37 -07:00
1da345e9d3
fix(mcp): clamp oversized MCP timeouts ( #105784 )
...
* fix(mcp): clamp oversized MCP timeouts
* fix(mcp): centralize timer-safe timeout normalization
Co-authored-by: 杨浩宇0668001029 <yang.haoyu@xydigit.com >
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-18 21:50:19 +01:00
83da9500ae
fix(node-host): guard Claude CLI pipe errors ( #109794 )
...
* fix(node-host): guard Claude CLI stdout/stderr pipe errors
Co-authored-by: Cursor <cursoragent@cursor.com >
* fix(node-host): make request mock generic to fix test-types CI failure
* test(node-host): harden child pipe regression
---------
Co-authored-by: Cursor <cursoragent@cursor.com >
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-18 02:24:02 +01:00
da69daeb72
feat(onboarding): recommend plugins and skills from installed apps ( #109668 )
...
* feat(onboarding): recommend plugins and skills from installed apps
Scan installed macOS apps during classic onboarding (TCC-free), gather
candidates from official catalogs + ClawHub search, let the configured
model pick genuine matches, and offer an opt-in multiselect install step.
Adds a device.apps node-host command (default-off sharing, Android-parity
envelope) so remote gateways can request a paired Mac's inventory, and a
wizard.appRecommendations kill switch. Custom setup-inference completions
no longer inherit the 32-token verification-probe output cap.
* feat(onboarding): recommend apps in guided flow
* fix(onboarding): harden app recommendations against ClawHub self-promotion
Third-party ClawHub skills are never pre-selected regardless of model tier
(publisher-controlled listing text reaches the matcher prompt and could
promote itself); their labels now say they install third-party code.
Installed-app scans follow symlinked .app bundles. Matcher output stays
bounded by the resolved model's own maxTokens budget (documented invariant).
* fix(onboarding): key official catalog candidates by resolved plugin id
Real catalog entries are package manifests without a top-level id; keying the
candidate map and channel/provider classification by entry.id collapsed the
whole official catalog into one undefined-keyed entry, so no official plugin
or channel was ever recommended. Regression test runs against the bundled
catalogs.
* fix(onboarding): satisfy lint, types, deadcode, and migration gates
Split the guided-onboarding test into a self-contained custodian suite to stay
under max-lines. Narrow app-recommendation exports (drop dead node-payload
normalizer, unexport internal types/helpers, route candidate tests through the
public API), replace map-spread with a helper, unexport device.apps result
types, add installedAppsSharing to node-host migration expectations, cast the
wizard multiselect mock, and regenerate the docs map.
* test(onboarding): register new live test in the shard classifier
2026-07-17 14:07:59 +01:00
1fc1b58ec8
fix(node-host): preserve native binary approvals after short reads ( #109485 )
2026-07-17 00:03:47 -04:00
a70d583f24
fix(node-host): connect to IPv6 gateway hosts ( #109179 )
...
Co-authored-by: Peter Steinberger <peter@steipete.me >
2026-07-16 15:47:21 -07:00
8dfb310b56
fix(infra): bound three warning dedupe caches with createDedupeCache ( #101746 )
...
* fix(infra): bound three warning dedupe caches with createDedupeCache
Replace unbounded Set<string> warning dedupe caches with the shared
createDedupeCache helper (ttlMs=0, maxSize=4096) to prevent unbounded
memory growth:
- safeBinTrustedDirWarningCache in invoke-system-run.ts
- chmodWarnedTargets in openclaw-state-db.ts
- clobberCapWarnedPaths in io.clobber-snapshot.ts
All three follow the same anti-pattern: .has()/.add() only, no eviction,
no size cap. Matches the fix pattern from #101696 and #101738 .
Co-Authored-By: Claude <noreply@anthropic.com >
* chore: refresh PR body evidence for ClawSweeper re-review
* test(io.clobber-snapshot): add clobber-cap warning deduplication test
Exercises warnClobberCapReached through the production API
(persistBoundedClobberedConfigSnapshot) to prove that
clobberCapWarnedPaths.check() suppresses duplicate warnings
on the same config path.
Co-Authored-By: Claude <noreply@anthropic.com >
* test(infra): tighten warning cache coverage
---------
Co-authored-by: Claude <noreply@anthropic.com >
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-16 12:45:51 -07:00
0d31fbf5f0
fix(skills): canonical frontmatter parser + per-file diagnostics ( #108926 )
...
* fix(skills): load JSON5-style metadata frontmatter
* fix(skills): diagnose invalid frontmatter
* test(skills): adapt session loader coverage
* ci: refresh merge ref
---------
Co-authored-by: jincheng-xydt <xu.jincheng@xydigit.com >
2026-07-16 04:18:06 -07:00
766742c674
refactor(node-host): move configuration to shared SQLite ( #108457 )
...
* refactor(node-host): move config to shared SQLite
* test(node-host): satisfy migration gates
2026-07-15 14:02:23 -07:00
674dd37cd0
refactor(deadcode): privatize core test seams ( #108325 )
...
* refactor(entry): privatize compile cache internals
* refactor(logging): privatize diagnostic test seams
* refactor(plugin-state): privatize store test seams
* refactor(skills): privatize lifecycle test seams
* refactor(node-host): privatize invoke test seam
* refactor(system-agent): privatize turn test seam
* chore(deadcode): shrink core test seam baseline
2026-07-15 06:37:40 -07:00
0754d23615
fix: group native sessions by host ( #108062 )
...
* fix(control-ui): group native sessions by host
* test: satisfy native session checks
* chore: remove release-owned changelog entry
2026-07-14 23:51:00 -07:00
57d926b4fd
fix: connect resumed native terminals reliably ( #107688 )
...
* fix: render resumed paired-node terminals
* fix(control-ui): connect native catalog terminals reliably
* chore: keep release notes in PR body
* fix(control-ui): require terminal reconnect cancellation
* fix(gateway): cancel timed-out terminal opens safely
* fix(control-ui): recover stalled terminal opens
* chore(ui): refresh i18n fallback baseline
* fix: preserve login shell path for resumed terminals
* refactor(plugin-sdk): avoid extra resolver export
* fix(gateway): normalize terminal open failures
* test(control-ui): split terminal readiness coverage
* docs: explain catalog terminal PATH restoration
* fix(control-ui): complete terminal readiness release gates
* fix(ci): remove unused shell resolver exports
* chore(plugin-sdk): refresh API baseline after rebase
2026-07-14 19:18:19 -07:00
75d029dae2
refactor: privatize Linux Canvas and Node Host internals ( #107884 )
...
* refactor(linux-canvas): privatize internal command surfaces
* refactor(node-host): privatize runtime manifest type
* chore(deadcode): shrink export baseline
2026-07-14 18:00:16 -07:00
b363d5a293
feat(linux): canvas UI via CLI-node + Tauri app IPC bridge ( #107633 )
...
* feat(linux): canvas via CLI-node + Tauri app IPC bridge
* refactor: extract gateway helper modules
* build(linux-canvas): register plugin package in lockfile
* fix(linux-canvas): move canvas advertise test out of core, regen docs/protocol/deadcode
* fix(gateway): break node-catalog/registry import cycle via leaf normalize module; add canvas glossary term
* style: oxfmt invoke.ts and runtime.ts after buildNodeEventParams extraction
* fix(linux): load Canvas WebView via dedicated data_directory context
Wry's Linux/WebKitGTK incognito mode discards Tauri's registered
WebContext (wry webkitgtk/mod.rs), so the Canvas window got a fresh
ephemeral context without the openclaw-canvas:// scheme handler — the
bundled A2UI page never committed (stayed about:blank) and every A2UI
command timed out. Use an isolated cache-backed data_directory instead,
which keeps the protocol handler while still isolating Canvas storage
from the dashboard window.
* fix(linux): keep Canvas WebView ephemeral via incognito + data_directory
Autoreview flagged that a dedicated data_directory alone persists Canvas
browser state (cookies, localStorage, IndexedDB, service workers) across
restarts, so an agent that navigates Canvas to a site could leak an
authenticated session into a later session. iOS uses a non-persistent
store; Linux should match.
Add .incognito(true) alongside .data_directory(): the distinct directory
gives Tauri a fresh WebContext key so it still attaches the
openclaw-canvas:// protocol closure, and incognito makes Wry swap in a
fresh *ephemeral* context carrying those protocols. Live-verified on a
Wayland/WebKitGTK box: the bundled page still loads
(location.href=openclaw-canvas://localhost/index.html, openclawA2UI
present, A2UI renders) and the canvas-webview dir holds no persistent
cookie/storage files.
2026-07-14 16:05:14 -07:00
084d1d9637
feat(control-ui): upload files into terminals ( #107364 )
...
* feat(control-ui): add terminal file uploads
* fix(control-ui): protect Windows terminal uploads
* fix(control-ui): satisfy terminal upload gates
* chore(ui): translate terminal upload labels
* fix(control-ui): reject unknown Windows upload shells
* fix(control-ui): harden Windows upload paths
* fix(control-ui): retry terminal upload cleanup
* chore(ui): reconcile locale translation memory
* fix(control-ui): validate terminal upload inputs
* fix(control-ui): retry failed upload cleanup
* chore(ui): refresh terminal upload locale metadata
* fix(terminal): integrate uploads with session recovery
* refactor(control-ui): isolate terminal upload transport
* fix(control-ui): keep upload helper types private
2026-07-14 09:33:39 -07:00
f81f9d8570
chore: enforce max-lines suppression ratchet ( #107315 )
...
* ci: enforce max-lines suppression ratchet
* chore: prune stale max-lines suppression
* fix: close max-lines ratchet enforcement gaps
* fix: harden max-lines ratchet checks
* fix(ci): satisfy max-lines ratchet checks
* style: format max-lines declarations
* fix(ci): match oxlint suppression grammar
* test: isolate max-lines git fixtures
* chore: prune resolved max-lines debt
* test: skip newline path fixture on Windows
* fix: harden max-lines suppression ratchet
* chore: refresh max-lines baseline
* fix: close max-lines ratchet bypasses
* fix: derive ratchet base from PR merge tree
* fix: support older Git in staged ratchet
* fix: align max-lines declarations and baseline
* chore: refresh max-lines baseline for current main
* fix: exclude generated wizard locales from max-lines
* chore: prune resolved max-lines debt
2026-07-14 09:27:02 -07:00
98de5832a7
refactor(process): remove internal export seams ( #107456 )
2026-07-14 05:23:29 -07:00
09e5d60d3c
fix(ci): format node-host runtime/worker tests
...
Unformatted test edits landed on main and fail check-lint's oxfmt gate
on every branch.
2026-07-14 03:35:07 -07:00
20f145f9c1
fix(mac): enable terminal actions for paired-node sessions ( #107361 )
...
* fix(mac): enable paired-node terminal sessions
* fix(ci): align node worker bridge checks
2026-07-14 03:22:28 -07:00
Peter Steinberger