* fix(feishu): honor abortSignal in drive comment reply retry loop
The inter-attempt delay in monitor.comment.ts used a bare setTimeout and
never received the owning monitor account's AbortSignal, so an account
teardown (ws disconnect, webhook stop, config reload) left the in-flight
comment reply retry running for up to ~6s after the rest of the lifecycle
settled. delayMs now wraps waitForAbortableDelay from async.ts and the
abortSignal is threaded through fetchDriveCommentContext →
resolveDriveCommentEventTurn → handleFeishuCommentEvent →
createFeishuDriveCommentNoticeHandler, sourced from
monitorSingleAccount.
The retry loop checks the waitMs return value and the abortSignal flag,
breaking out of the next 1s tick instead of running the full 6×1s poll
budget. Sibling surface monitor.bot-identity.ts already uses the same
pattern; #104431 explicitly skipped the comment-monitor retry because
it is a result-predicate poll, not an error retry, and this fix is
orthogonal to that decision.
Not tested: live Feishu tenant, real bot identity, real drive comment,
and account restart. requestFeishuOpenApi itself does not accept
AbortSignal — that is a separate, larger refactor and is out of scope.
* test(feishu): prove comment retry abort
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(acpx): migrate codex adapter to maintained @agentclientprotocol/codex-acp
The bundled codex ACP adapter pinned the npm-deprecated
@zed-industries/codex-acp@0.16.0, which embeds codex crates from the
rust-v0.137.0 era: GPT-5.6-era models are unknown to it and sessions fail
with 'requires a newer version of Codex'. Migrate to the maintained
@agentclientprotocol/codex-acp@1.1.4 (Node CLI, depends on @openai/codex
^0.144.4 matching the codex plugin pin):
- Wrapper generation resolves the adapter bin from its package manifest and
delivers startup config via CODEX_CONFIG; OpenClaw-owned wrapper args are
stripped before launch. Explicit new-adapter commands keep their own
-c/--config args untouched; only retired Zed commands migrate, with their
-c TOML overrides (dotted/quoted keys, attached forms, MCP config)
faithfully converted.
- Model overrides emit the bare model id plus a separate
model_reasoning_effort; composite model/effort ids are accepted as parse
input but never emitted.
- Process reaper recognizes the maintained adapter tree and packaged codex
app-server children without claiming native codex plugin processes.
Live proof: direct adapter smoke with local subscription auth initialized
1.1.4, advertised model gpt-5.6-sol with separate medium effort, and
completed a turn. Fixes#108664
* fix(acpx): pin codex-acp 1.1.2 to satisfy the lockfile release-age gate
1.1.4 is under the 48-hour minimumReleaseAge and fails lockfile
verification repo-wide. 1.1.2 (2026-07-09) passes the gate, carries the
same CODEX_CONFIG startup contract, and its ^0.144.0 codex dependency
resolves to the same 0.144.4 the codex plugin pins. Lockfile re-resolved
from main without any release-age bypass; shrinkwrap regenerated.
* chore(acpx): split oversized auth-bridge test file, register adapter as CLI-resolved dep
codex-auth-bridge.test.ts crossed the max-lines gate after the migration
regressions; the command-migration cluster moves to
codex-auth-bridge.migration.test.ts. knip's CLI-resolved dependency list
swaps the retired zed adapter for @agentclientprotocol/codex-acp (invoked
via generated wrapper/npx, never imported).
* fix(openai): cancel realtime reconnect backoff on close
* test(openai): cover reconnect after bridge close
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(acp): skip unsupported automatic thinking config in manager gate
When an ACP backend does not advertise thinking-related config options
(e.g. OpenCode advertising only mode/model), the manager's automatic
startup-control path would reject the session with
ACP_BACKEND_UNSUPPORTED_CONTROL.
Fix:
- Add THINKING_CONFIG_KEYS set and isThinkingConfigKey helper to
manager.runtime-controls.ts, following the existing OPTIONAL_TIMEOUT_CONFIG_KEYS pattern
- Skip thinking keys in the advertised-keys validation gate (auto-derived
options are best-effort)
- Skip unsupported-control rejection for thinking keys at the
setConfigOption catch level
- Extract isUnsupportedControlRejection helper to avoid duplicating the
error code check
- Forward getCapabilities input handle in ACPX runtime so session-scoped
capability queries work
- Inject thinking/thought_level aliases for Codex ACP sessions when
reasoning_effort is advertised
Closes#103802
* fix(acp): honor thinking control capabilities
---------
Co-authored-by: Erick Kinnee <erick@ekinnee.dev>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(gradium): treat blank env API key as unconfigured in synthesis paths
The isGradiumProviderConfigured helper already uses trimToUndefined on
GRADIUM_API_KEY, but synthesize and synthesizeTelephony still used the
bare env var. This made whitespace-only credentials pass the
missing-key guard and send unusable bearer tokens.
- Wrap process.env.GRADIUM_API_KEY with trimToUndefined in synthesize
- Wrap process.env.GRADIUM_API_KEY with trimToUndefined in
synthesizeTelephony
- Add test for whitespace-only env key rejection in synthesize
This completes the blank-credential guard for the Gradium provider,
matching the pattern from OpenAI (#108212), Xiaomi (#108558),
Deepgram (#108565), and Inworld (#108783).
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(gradium): centralize speech API key resolution
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(inworld): treat blank env API key as unconfigured in speech provider
A whitespace-only INWORLD_API_KEY made the Inworld speech provider
report configured, then sent an unusable bearer credential from
synthesis, telephony synthesis, and voice listing.
- Wrap process.env.INWORLD_API_KEY with trimToUndefined in isConfigured
so blank values are treated as not configured
- Wrap process.env.INWORLD_API_KEY with trimToUndefined in synthesize,
synthesizeTelephony, and listVoices so blank values are rejected
locally before any network request
- Add test coverage for whitespace-only env key in isConfigured and
synthesize paths
This matches the blank-credential guard pattern applied in the OpenAI
(#108212), Xiaomi (#108558), and Deepgram (#108565) providers.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(inworld): centralize speech API key resolution
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(xiaomi): treat blank env API key as unconfigured in speech provider
A whitespace-only XIAOMI_API_KEY made the Xiaomi MiMo speech provider
report configured, then sent an unusable bearer credential from synthesis.
- Wrap process.env.XIAOMI_API_KEY with trimToUndefined in isConfigured
so blank values are treated as not configured
- Wrap process.env.XIAOMI_API_KEY with trimToUndefined in synthesize
so blank values are rejected locally before any network request
- Add test coverage for whitespace-only and blank env key in both paths
This matches the blank-credential guard applied in the OpenAI speech
provider (PR #108212).
* refactor(xiaomi): centralize speech key resolution
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* feat(canvas): let widget buttons send prompts into web chat
Inline show_widget documents get a sendPrompt(text) bridge: a private
MessageChannel offered to the Control UI before widget code runs. The chat
adopts only the first offer per frame, requires transient user activation,
a visible focused frame, plain text (no slash commands), and rate limits
10 prompts/minute per widget. Accepted prompts run the normal user send
path of the owning chat pane.
* fix(canvas): appease lint/knip/docs gates for widget prompts
Split widget prompt tests into their own file, drive validation and rate
limits through the real port path instead of exported internals, use
addEventListener on the adopted port, and regenerate docs_map.
* fix(canvas): install widget listeners per window for non-isolated tests
Module-boolean listener flags broke in shared vitest workers where each test
file gets a fresh jsdom window; key installation by window instead and give
port flushing more headroom.
* feat(presentation): support hosted widget actions
* refactor(discord): route widget launches through presentation
* chore: keep changelog release-owned
* test(interactive): type the invalid web-app boundary case explicitly
* test: type web-app action fixtures against the split union
The two-member web-app union no longer accepts a distributed
type: "url" | "web-app" literal or an empty receipt in typed
callbacks; use explicit action casts and the Discord receipt factory.
* fix(clickclack): commit websocket cursors after processing
Serialize realtime events and wait for queued handlers before reconnecting so only successfully processed cursors advance.
Co-Authored-By: OpenAI Codex <noreply@openai.com>
* fix(clickclack): replay failed websocket events
Keep the last successful cursor when realtime handling fails, then reconnect through durable backlog recovery before reopening the stream.
Co-authored-by: 詹幸心0668001037 <zhan.xingxin@xydigit.com>
---------
Co-authored-by: OpenAI Codex <noreply@openai.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(workboard): record resolved runtime metadata instead of hardcoded codex engine
Workboard executions labeled every dispatched run engine=codex, model=default,
and id suffix :codex even for Claude/other harness agents. The gateway agent
admission phase now returns the resolved {harness, provider, model} for plugin
subagent runs; the dispatcher records it verbatim and omits engine/model when
unresolved. Engine becomes an open runtime identifier in the workboard
contract (built-in launch choices stay a closed list), store/UI normalizers
preserve historical labels as written instead of inventing codex, and new
execution ids use an :agent-session suffix. Fixes#108362
* fix(workboard): accept undefined engine in ui engineModel helper
* refactor(channels): generalize channel retry runner and retry-after parsing; drop dead configured-state probes
* fix(channels): align retry and metadata contracts
* fix(anthropic-vertex): shim native fetch so Google auth avoids gaxios's node-fetch import
@anthropic-ai/vertex-sdk's bundled gaxios only uses native fetch when a
global `window.fetch` exists; otherwise it dynamically imports
`node-fetch`, which can fail to resolve depending on how the plugin's
dependencies are installed. That failure surfaces deep inside gaxios's
token-exchange path as "Cannot convert undefined or null to object",
breaking every Vertex auth request (#107341). The same gaxios root
cause hit a different provider in #41380, where a global window.fetch
shim was the confirmed workaround.
Fixes#107341
* fix(anthropic-vertex): compare window directly against undefined
oxlint's unicorn/no-typeof-undefined flagged the typeof check; a
direct comparison is safe here since target.window is a property
access, not a possibly-undeclared identifier.
* fix(anthropic-vertex): keep ADC fetch provider-local
Co-authored-by: Ian Alloway <ian@allowayllc.com>
* test(anthropic-vertex): inject auth in API fixtures
Co-authored-by: Ian Alloway <ian@allowayllc.com>
* refactor(anthropic-vertex): clarify auth transport contract
Co-authored-by: Ian Alloway <ian@allowayllc.com>
* fix(anthropic-vertex): preserve ADC proxy routing
* chore: leave changelog to release workflow
---------
Co-authored-by: Ian Alloway <ian@allowayllc.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(memory-core): write MEMORY.md atomically during short-term promotion
applyShortTermPromotions rewrote MEMORY.md with a single non-atomic
fs.writeFile, which truncates the file before streaming the new content.
An OS write failure part way through (for example EFBIG on a size-limited
or full volume) left MEMORY.md truncated to the bytes written before the
failure, permanently dropping user long-term memory. The dreaming cron
path invokes this writer automatically, and the recall store is only
updated after the write, so the promotion stays eligible and the next
run reads the already-truncated file.
Route the write through replaceFileAtomic (temp file, fsync, atomic
rename), the same durable-write helper the sibling DREAMS.md writer in
this extension already uses. On failure the temp file is discarded and
the existing MEMORY.md is left untouched; on success the content and the
existing file mode are preserved.
* fix(memory-core): harden atomic promotion durability
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(line): run post-ack webhook processing on its own admitted work root
LINE acks the webhook and dispatches event processing fire-and-forget on
the same async chain. The HTTP request admission that chain inherited is
released as soon as the route handler returns, and a released admission
refuses subordinate queue work - so every LINE inbound agent turn fails
with "GatewayDrainingError: Gateway is draining; new tasks are not
accepted" even though the gateway is healthy. DMs, group mentions, and
postbacks are all affected; the user-visible symptom is the bot replying
"Sorry, I encountered an error processing your message." to everything.
Add runDetachedWebhookWork to the plugin-sdk webhook-request-guards
surface (a thin wrapper over the gateway independent-root continuation,
the same shape core uses in gateway/server/hooks.ts) and route all three
LINE ack-first dispatch sites through it: the gateway monitor handler
(the live path), and the createLineNodeWebhookHandler / Express
middleware handlers (public webhook building blocks an embedder can
register under the gateway). #65375 unified these three into one ack-first
pattern; keeping the detach consistent avoids re-introducing the same
latent defect in the two that are not on the live gateway path today.
The continuation is reserved synchronously while the request is still
admitted, so the detached processing stays accepted and a real restart
drain can wait for it instead of stranding it mid-turn.
Tests pin every layer: the guards suite proves detached post-ack work is
admitted after the request admission is released (and that the inherited
chain without the helper is refused); the monitor lifecycle suite and the
webhook-node suite assert each dispatch site goes through the detached
root. Red/green verified: reverting any dispatch fails its test.
* fix(plugin-sdk): account for runDetachedWebhookWork in public surface budget
* fix(channels): track detached webhook processing
Co-authored-by: 許元豪 <146086744+edenfunf@users.noreply.github.com>
* docs: refresh generated docs map
* chore(plugin-sdk): refresh API baseline
* fix(webhooks): preserve post-ack ordering
* test(plugin-sdk): satisfy detached work lint
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* feat(line): wire base.allowlist config-edit adapter
LINE was the only DM/group channel without a base.allowlist adapter, so
`openclaw allow line` / the /allowlist command replied "does not support"
instead of editing the LINE allowlist. Reuse buildDmGroupAccountAllowlistAdapter
(DM + group + per-group-override scopes), matching Telegram/Signal; entry
normalization flows through the existing lineConfigAdapter.formatAllowFrom.
* fix(allowlist): preserve inherited account entries
* fix(allowlist): preserve all-scope store edits
Co-authored-by: Eden <146086744+edenfunf@users.noreply.github.com>
* test(allowlist): import config type
Co-authored-by: Eden <146086744+edenfunf@users.noreply.github.com>
* fix(allowlist): preserve empty effective overrides
Co-authored-by: Eden <146086744+edenfunf@users.noreply.github.com>
* fix(allowlist): reject group-only store edits
Co-authored-by: Eden <146086744+edenfunf@users.noreply.github.com>
* fix(allowlist): preserve cleared channel overrides
Co-authored-by: Eden <146086744+edenfunf@users.noreply.github.com>
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
Peter Steinberger