Commit Graph

11104 Commits

Author SHA1 Message Date
Jason (Json) bccbb8a0c7 fix(memory): make persistence promises receipt-backed (#120989)
* fix: require memory persistence receipts

* fix(memory): bind persistence failures to tool owners

* fix(memory): preserve Codex persistence ownership

* test(plugin-sdk): account for owner metadata export

* test(codex): split owner timeout regression

* fix(memory): cover durable deletes across runtimes

* test(codex): type dynamic mutation fixtures

* fix(agents): fail closed ambiguous side-effect owners

* fix(memory): fail zero-row delete receipts
2026-08-16 00:50:10 -06:00
Nehorai Hadad 7d05f7c5b9 fix(auto-reply): suppress fallback notices in rooms (#107209)
Hide model fallback and recovery notices in group and channel conversations while preserving direct-chat notices, persisted state, and lifecycle events.

Co-authored-by: NehoraiHadad <nehorai.hadad.projects@gmail.com>
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
2026-08-16 12:14:25 +05:30
Peter Steinberger 99bf0b1f3b fix: preserve cloud workspace results across tunnel reconnects (#124406)
* fix: preserve workspace reconcile across tunnel reconnect

* fix: preserve reconcile before stateful tunnel dispatch

* fix: close reconnect pre-dispatch races

* style: satisfy reconnect gate lint

* test: align workspace action fixture
2026-08-15 23:11:11 -07:00
Peter Steinberger 6aa27d6ecd refactor: retire August compat windows (embedding API, pi aliases, target parser, spawning hook, setup exports, WhatsApp inbound aliases) (#124416)
* refactor(plugin-sdk): retire embedded Pi aliases

* refactor(channels): retire explicit target compatibility

* refactor(plugins): retire subagent spawning hook

* refactor(plugin-sdk): retire shipped channel setup exports

* refactor(whatsapp): retire inbound callback aliases

Proof: focused build and WhatsApp E2E green; broad WhatsApp suite 188/189 files green. extensions/whatsapp/src/monitor-inbox.policy.test.ts flakes only in the parallel batch and passes isolated (10/10).

* refactor(plugin-sdk): retire memory embedding registrar

Migrate every bundled provider and manifest to registerEmbeddingProvider and contracts.embeddingProviders. Preserve memory-specific batching, local-service acquisition, index identity, and auto-selection through the canonical generic registry adapter, then remove the parallel registrar, registry, diagnostics, contracts, tests, and docs.

* chore(plugin-sdk): tighten retired surface budgets

Pin the post-retirement public SDK surface to 144 entrypoints, 4,312 exports, 2,564 callable exports, and 1,133 deprecated exports; agent-harness-runtime now permits exactly nine deprecated exports.
2026-08-15 22:43:47 -07:00
Peter Steinberger fff38795e4 docs(plan): W5-REF landed (#124374) (#124403) 2026-08-15 21:24:46 -07:00
Peter Steinberger 717f77678a refactor(heartbeat): delete unreachable prompt-null skip and dead lanes-busy surface (#124385)
resolveHeartbeatRunPrompt can no longer return prompt: null — the only
null producer (inferred commitments follow-ups) was deleted in
4b0151682e — so the two not-due short-circuits in
heartbeat-runner-execution.ts were dead branches. Narrow the resolution
type to string and delete both consumers.

HEARTBEAT_SKIP_LANES_BUSY had no remaining producer and
HeartbeatDeps.getCommandLaneSnapshots no prod reader (the per-lane busy
check was consolidated into requests-in-flight admission). Delete the
constant, the dep, and the tests that only exercised the dead seam;
retarget the retry-simulation tests at live retryable reasons and drop
the stale lanes-busy mention from the troubleshooting doc.
2026-08-15 20:48:00 -07:00
Peter Steinberger 527d155055 docs(plan): mark wave-5 computer-use rows landed (#124155)
* docs(plan): mark wave-5 rows landed and record Linux as partial

* docs(plan): record trust-model, tool-split, ref-convergence, and rig root cause

* docs(plan): carry wave-4 rows forward, define partial status, order rows by wave
2026-08-15 20:24:52 -07:00
Patrick Erichsen 1b954672b1 feat(ui): move incognito to new-session rail (#124352) 2026-08-15 19:44:08 -07:00
Vyctor H. Brzezowski aed4510bd0 improve(ui): unify chat side rails in a tabbed panel (#123874)
* Control UI: unify chat rails in a tabbed panel

* fix(ui): compact chat side panel navigation

* Polish rail separators around the active tab

* Soften rail tab separators

* Inset the rail tab strip from the resize handle

* Remove the rail tab strip bottom rule

* Add compact close controls to rail tabs

* Redistribute rail tabs after closing a surface

* Restore bottom docking from the rail terminal

* Fade clipped rail tab labels at the edge

* Add drag reordering to rail tabs

* Polish terminal tab chrome

* Polish rail tab close controls

* Regularize rail tab separators

* Space rail tabs evenly

* Add feedback to inactive rail tabs

* Smooth rail tab selection

* Hide unavailable rail menu items

* Preserve browser multi-tab entry

* Support bottom-docked rail tabs

* Polish rail tab sizing

* Refine side panel actions

* Neutralize rail empty-state icons

* Separate dark rail surfaces

* Fade only clipped rail tab labels

* Compact rail header controls

* Refine the surface picker

* Raise and tighten the surface empty state

* Keep Browser and Tasks in the chat topbar

* Unify surface list cards

* Keep embedded rails inside their dock

* Reveal rail tab close actions on demand

* Show full rail labels only when clipped

* Let rail tabs use available space

* Align chat topbar surface controls

* Unify rail surface empty states

* Center rail tab glyphs

* Fade clipped rail labels smoothly

* Keep rail tab labels visible

* Tighten rail tab separator and label fade

* Keep the new-tab control beside the rail tabs

* Keep rail tab separators from reflowing on activation

* Anchor the new-tab control outside the rail tab scroll

* Scroll rail tabs at the floor instead of clipping them

* Tighten spacing between rail tabs

* Report an unusable terminal open response as a readable failure

* Keep the terminal session menu inside the panel

* Share one dock destination cluster across rails, terminal and browser

* Align the terminal mini rail with its management icons

* Tidy panel pickers, browser chrome and task detail retry

* Type the sidebar callbacks object so tsgo:ui passes

* Space out the panel picker rows

* Measure tab strip edges by rect and cancel superseded installs

* Validate every terminal session field and release unusable sessions

* Fold the terminal rail stretch rules into one

* test(ui): match rail tab checks to the tabbed panel header

Anchoring the new-tab control outside the scroll area wrapped the strip in
.side-panel__header-tabs, and every query written as a direct-child chain
started matching nothing. The assertions did not fail loudly: they compared
an empty label list, so three side-panel journeys and the background-tasks
rail went red on a selector detail rather than on behaviour.

Give the label query one named owner scoped to the panel's own header, so
Terminal and Browser strips in the panel body stay excluded while header
layout can keep moving. Freeing that width also means two short tabs now
fit where they used to be squeezed, so the closing step asserts the honest
invariant - a strip that fits again releases the fade - while the overflow
and tooltip regime stays proven earlier in the same journey.

Settle the shared side-panel helper on whichever surface renders: an empty
panel offers its type list and a populated one offers the header menu, and
probing before either existed left it waiting for a control that never
comes. Also drop a shadowed seed binding and an unused locator that oxlint
flagged in the same file.

* fix(ui): adapt session discussion slot to the unified panel layout

* test(ui): capture the bottom dock evidence with a resting divider

* fix(ui): drop the dead previousDock toggle path

* test(ui): align sibling suites with the tabbed panel decisions

* fix(ui): keep narrow-pane hides above the icon-button styling cascade

* fix(ui): create tooltip descriptions via ownerDocument

* fix(lint): merge duplicate terminal header styles and drop dead branches

* refactor(ui): extract embedded panel templates from the pane render

* refactor(ui): delete rail-era dead exports

* test(ui): repair type drift after the rebase

* fix(ui): keep the workspace toggle module-local and settle test caps

* fix(ui): give side-panel tabs their runtime and their own header actions

The tabbed side panel dropped two things the old rails owned. The discussion
tab lost its only runtime registration, so `openclaw-session-discussion` was
never defined and the tab rendered as a permanently blank box; it now loads
through the per-slot lazy runtime map like the other panel types.

Panels also have no header of their own anymore, so any action on the active
panel's content had to reach the shared header. The header now takes panel
contributed actions instead of a discussion-only open-url special case, which
brings back the side-chat "Clear thread" overflow menu — its gateway reset had
no reachable entry point at all in the embedded rail.

* test(ui): anchor the sidebar scroll proof to the panel host

The bounding contract moved from `.sidebar-column__panel` to
`.side-panel__panel`; mounting the detail panel under the removed class let it
grow instead of scroll, so the test failed for its harness rather than for the
behavior it guards.

* refactor(ui): move side-panel wiring out of the chat render monolith

`chat-pane-render.ts` crossed its line budget. The region callbacks are layout
policy, so they resolve in the layout module with the pane injecting only what
it owns, and the two panel-action producers collapse into the single header
contribution the region consumes.

* fix(ui): keep one terminal intent queue per document

A session route mounts the side-panel terminal beside the shell instance kept
for the bottom dock. Each owned a private action array over one sessionStorage
key, so their whole-array writes erased each other's intents and a freshly
mounted panel drained through a reconnect fence it never saw.

The queue, its persisted record, and the fence now belong to the document;
panels bind as executors while connected. The chat pane records a toggle intent
where it observes it, instead of parking the raw event in memory and handing it
to a panel that may not be mounted yet — a service-worker reload in that window
dropped the request, thread id and all, with nothing explaining why. That makes
the deferred-restore handshake dead weight, so it goes.

* fix(ui): let the panel that starts a terminal intent finish it

Opening a catalog terminal from a chat route mounts the side-panel terminal
right after the request, which swapped the queue's executor mid-flight and
stranded the in-flight action; the panel's own mount restore then opened a
plain session instead. The executor that began an action stays responsible for
it as long as it can still run.

* test(ui): cover closed legacy side docks

* refactor(ui): split side panel controllers

* fix(ui): stabilize embedded panel handoffs

* style(ui): format browser panel refresh

* test(ui): settle catalog prepend paint incrementally

* docs(ui): describe the unified chat side panel

* test(ui): settle catalog clock transitions

---------

Co-authored-by: Jason (Json) <263060202+fuller-stack-dev@users.noreply.github.com>
2026-08-15 20:40:00 -06:00
Peter Steinberger 289a9cabc8 docs(computer-use): state the authorization chokepoint explicitly (#124355) 2026-08-15 19:30:29 -07:00
Jason (Json) 5f1bbed42d fix(doctor): report missing managed local embedding setup (#123575)
* fix(gateway): expose startup blockers before cutover

* fix(gateway): include session blockers in preflight

* fix(gateway): keep preflight finding type private

* fix(gateway): preflight startup auth blockers

* fix(gateway): complete startup preflight readiness

* fix(llama-cpp): keep preflight remediation private

* fix(gateway): keep preflight passive and activation-aware

* fix(gateway): apply startup guard in preflight

* fix(gateway): align auth mode preflight

* fix(gateway): keep preflight state reads isolated

Share the read-only inspection snapshot scope across duplicated runtime chunks so blocked gateway preflight remains non-mutating when bundled provider artifacts read canonical state.

* fix(gateway): keep startup preflight passive

* fix(gateway): ignore inactive embedding owner shadows

* fix(gateway): preserve startup preflight parity

* fix(llama-cpp): keep cache inspection types private

* fix(gateway): close startup preflight parity gaps

* fix(gateway): handle uninitialized memory databases

* test(gateway): observe shell fallback portably

* fix(llama-cpp): normalize embedding model paths

* refactor(gateway): drop broad startup preflight surface

* fix(doctor): report missing managed local embedding setup

* style(memory): simplify setup enablement check

* fix(memory): keep diagnostic result type private

* fix(memory): inspect local setup with remote secret refs

* fix(memory): keep doctor index inspection immutable

* fix(memory): make readiness inspection owner-aware

* fix(doctor): mirror memory slot allowlist policy

* test(doctor): use canonical memory slot id

* fix(doctor): normalize memory provider ids

* fix(doctor): resolve external embedding readiness owner

* fix(plugins): keep embedding inspection result internal

* fix(doctor): isolate plugin state during lint

* fix(doctor): route lint metadata through snapshot

* fix(cli): keep doctor lint startup source-only

* fix(cli): keep doctor lint compile-cache free

* fix(doctor): keep local embedding readiness opt-in

* test(doctor): preserve plugin artifact roots during lint

* fix(doctor): refresh memory readiness registration

* test(doctor): type nullable provider policy mock

* fix(doctor): scope lint state snapshot to provider check

* fix(doctor): isolate selected plugin state checks

* test(doctor): restore only scoped environment

* fix(doctor): defer readiness state inspection

* fix(doctor): keep deferred config reads isolated

* fix(doctor): keep plugin state mode internal

* fix(config): preserve default plugin validation
2026-08-15 20:15:06 -06:00
Jason (Json) 4490eaac9f feat(ui): open links in Control UI browser (#123912)
* feat(ui): open links in Control UI browser

* fix(ui): centralize Control UI link routing

* fix(ui): carry narrowed native link poster
2026-08-15 20:05:02 -06:00
Vito Cappello 7f93011562 fix: preserve Claude CLI prompt cache reuse across turns (#124300)
* fix: keep claude-cli prompt-cache prefix stable across turns

Claude CLI has no cache_control breakpoint, so mashed per-turn system
prompts rewrote the native prefix and burned cache hits on follow-ups.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(cli): scope Claude prompt cache suffix

* docs: scope Claude CLI cache guidance

* test(cli): cover Claude cache prompt modes

* fix: gate Claude CLI prompt cache flag

* docs: clarify Claude CLI cache flag gate

* fix: preserve Claude CLI system prompt roles

* fix(claude-cli): close cache flag compatibility gaps

* fix(claude-cli): reject prerelease cache flag versions

---------

Co-authored-by: VACInc <3279061+VACInc@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-08-15 18:17:17 -07:00
Peter Steinberger 78502eda6d feat(workers): run device sessions from Gateway bundles (#124037)
* feat(workers): run device sessions from Gateway bundles

Install the current Gateway bundle before a device environment becomes ready, verify it at attach and tunnel boundaries, launch only from the immutable namespaced bundle directory, and retire stale environments for idempotent reprovisioning. Remove the local execution mode and preserve the node-local build claim only as temporary inventory metadata for the final projection/cleanup slice.

* docs(runners): record Gateway bundle cutover

* test(ci): repair runner validation fixtures

# Conflicts:
#	src/scripts/test-projects.test.ts

* fix(workers): surface outdated node recovery

Keep legacy runner inventory diagnostic-only while exposing the update-and-reconnect action through node, environment, provider, placement, and Control UI surfaces.

* fix(workers): reject legacy inventory with recovery

* fix(workers): bundle worker deploy closure

* test(workers): close bundle cutover gates

* fix(workers): compose browser runtime at build

* fix(workers): satisfy bundle cutover gates

* fix(workers): route temp runtime through infra

* docs(workers): align bundle host guidance

* fix(ui): fence outdated session destinations
2026-08-15 17:46:44 -07:00
ClawSweeper 4c55629238 feat(sessions): preserve recent session history (#123987)
Co-authored-by: RoboClaw <309084314+roboclaw-bot@users.noreply.github.com>
2026-08-15 16:25:31 -06:00
Shakker 8f807ae912 docs: explain OpenRouter image route compatibility (#101367) 2026-08-15 20:41:41 +01:00
Robinnnnn 02af2fa053 fix(openrouter): use dedicated /api/v1/images endpoint for image generation 2026-08-15 20:41:41 +01:00
Pavan Kumar Gondhi 8668aeb969 fix(discord): bind transcript capture to source account [AI] (#118579)
* fix(discord): bind transcript capture to source account

* style(agents): keep transcript tool wiring compact

* fix(transcripts): declare account binding channels

* fix(transcripts): report effective capture account

* fix(transcripts): enforce account lifecycle ownership

* fix(transcripts): preserve cross-surface control

* fix(copilot): preserve transcript channel context

* fix(transcripts): fail closed for legacy channel owners

* fix(transcripts): add trusted legacy recovery

* fix(transcripts): preserve auto-start cleanup ownership

* fix(transcripts): reject untrusted account starts

* fix(transcripts): keep persisted ownership authoritative

* fix(transcripts): harden legacy recovery

* fix(transcripts): preserve agent ownership boundary

* fix(transcripts): scope account binding to source channel

* fix(transcripts): preserve unattributed owner isolation

* fix(transcripts): own configured captures by account

* docs(plugins): clarify transcript auto-start ownership

* test(transcripts): cover account-less recovery

* docs(transcripts): scope legacy recovery by provider

* fix(discord): reuse eligible account ordering for transcripts

* test(discord): use neutral transcript account fixtures

* fix(transcripts): keep accountless recovery local

* fix(discord): resolve transcript accounts by voice capability

* fix(transcripts): bound account resolution failures

* fix(transcripts): bound account tool output

* fix(transcripts): honor unresolved provider accounts

* fix(transcripts): preserve binding when providers are missing

* fix(transcripts): fail closed on unknown binding provenance

* fix(transcripts): qualify account lifecycle capability

* fix(transcripts): normalize provable legacy owners

* fix(transcripts): bind scheduled capture to caller authority

* fix(transcripts): preserve scheduled caller identity tuple

* fix(transcripts): preserve channel-less scheduled authority

* fix(plugin-sdk): publish transcript provider types

* fix(transcripts): use exact lifecycle ownership tokens

* fix(transcripts): preserve local ownerless lifecycle access

* fix(transcripts): allow local configured capture control

* fix(transcripts): preserve scheduled caller channel

* fix(transcripts): retain named-agent legacy recovery

* fix(transcripts): deny unrelated remote channels

* fix(doctor): validate transcript owner inference

* fix(transcripts): restrict legacy remote recovery

* fix(ci): align transcript Doctor checks

* fix(transcripts): require Doctor-owned legacy metadata

* fix(transcripts): reject unowned remote capture starts

* fix(transcripts): reject unbound Discord lifecycle calls

* fix(transcripts): distinguish legacy owner rows

* test(discord): keep unavailable account fixture typed

* fix(transcripts): mark current imports for Doctor

* fix(transcripts): complete account ownership validation

* fix(discord): restore transcript package boundary

* fix(discord): preserve bundled transcript entry boundary

* docs(transcripts): clarify Discord auto-start account

* fix(transcripts): bind account-owned imports

* fix: preserve transcript and cron policy state

* fix(cron): preserve scheduled transcript authority

* fix(discord): keep legacy transcript rows local

* fix(transcripts): narrow account ownership boundary

* fix(transcripts): preserve trusted caller ownership

* fix(discord): enforce transcript source authorization

* fix(ci): bound Control UI gzip build variance

* test(qa): align transcript scenario contracts

* fix(agents): repair rebased caller context

* fix(discord): restore rebased account ownership

* test(discord): restore voice account fixtures

---------

Co-authored-by: joshavant <830519+joshavant@users.noreply.github.com>
2026-08-15 12:10:43 -07:00
Sarah Fortune dbc2356abc feat(slack): make presence event guidance configurable (#123875)
* feat(slack): make presence event guidance configurable

* chore(config): regenerate channel metadata

* fix(slack): keep presence prompt SDK compatible

* chore(config): refresh config baseline

* fix(slack): cap presence event prompts

* chore(config): refresh Slack prompt metadata

* fix(slack): bound queued presence wake prompts

* fix(slack): inherit presence prompt for named accounts

* fix(slack): keep prompt limit at config boundary

---------

Co-authored-by: Sarah Fortune <sarah.fortune@gmail.com>
2026-08-15 12:02:19 -07:00
Josh Avant fc4d5d744f fix(sessions): prevent cleanup from deleting readable transcripts (#123495)
* fix(sessions): make transcript archival atomic

* fix(sessions): stabilize SQLite archive CI

* test(gateway): synchronize lifecycle patch race

* fix(sessions): finish archive recovery accounting

* fix: key transcript archives by generation

Remeasure physical disk usage after archive publication so budget results and pruning use the bytes actually present on disk.

Refs oc-8e9

* fix(sessions): normalize doctor archive generations (oc-a28)

---------

Co-authored-by: Josh Lehman <550978+jalehman@users.noreply.github.com>
2026-08-15 09:59:59 -07:00
Josh Lehman 56798ae085 fix(cli): accept inherited flags after nested subcommands (#116587)
* fix(cli): accept auth agent flag after subcommands

* openclaw-87a: normalize inherited skills options

* test(cli): classify curator leaf JSON flags

* test(cli): cover all auth agent leaves
2026-08-15 09:52:24 -07:00
Peter Steinberger 3109bc3b5d fix(gateway): restart after prepared maintenance suspension (#124157)
* fix(gateway): hand off prepared suspension to restart

* chore: keep release changelog owner-managed
2026-08-15 04:53:38 -07:00
WhatsSkiLL 632581477f fix(session-catalog): preserve explicit agent ownership across UI and CLI (#123899)
* fix(session-catalog): preserve explicit agent ownership across UI and CLI

* fix(session-catalog): repair owner routing regressions

* Fix-session-catalog-CI-checks

* test(ui): split chat catalog pane coverage

Co-authored-by: IWhatsskill <284122573+IWhatsskill@users.noreply.github.com>

* refactor(session-catalog): bind Codex homes per request

Co-authored-by: IWhatsskill <284122573+IWhatsskill@users.noreply.github.com>

* refactor(session-catalog): centralize owner resolution

Co-authored-by: IWhatsskill <284122573+IWhatsskill@users.noreply.github.com>

* fix(codex): resolve session fork against the adopted home

Co-authored-by: IWhatsskill <284122573+IWhatsskill@users.noreply.github.com>

* refactor(ui): extract chat session discussion

* test(sessions): stabilize archive worker responsiveness check

---------

Co-authored-by: IWhatsskill <284122573+IWhatsskill@users.noreply.github.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-08-15 04:47:28 -07:00
Peter Steinberger abf0ef6513 fix(computer-use): repair artifact verification and post-approval descriptor found by the Linux gate (#124128)
* fix(cua-computer): prove Linux X11 live vertical

* test(computer-use): authenticate isolated Linux rig

* fix(gateway): refresh computer use after node approval

* refactor(cua-computer): resolve the plugin manifest by static import

* fix(gateway): break plugin runtime import cycle

* fix(computer-use): bind live rig to committed helpers
2026-08-15 03:53:23 -07:00
Peter Steinberger af99d1ac7b test(computer-use): security closure across the v2 action surface (#124112) 2026-08-15 01:54:06 -07:00
Peter Steinberger d2be00e171 feat(ui): persistent emoji session icons in the sidebar (#124034)
* feat(gateway): persist emoji session icons

* feat(ui): add persistent session icon menu

* docs: explain persistent session icons

* docs: list Set icon in the session context menu enumeration

* test(gateway): canonicalize group defaults workspace path

* fix(ci): sync session icon protocol coverage

* fix(sessions): enforce RGI emoji sequences for session icons

ClawSweeper P2: single non-emoji graphemes like 漢 passed the segmenter-based predicate. Anchored \p{RGI_Emoji} admits exactly one interchange emoji sequence and deletes the length cap and ASCII carve-out.

* fix(sessions): compile RGI emoji validation
2026-08-15 00:15:55 -07:00
Peter Steinberger 079bb34196 feat(cua-computer): recording family with host-owned resource handles (#124035)
* feat(cua-computer): add recording resource handles

* test(agents): split computer tool coverage
2026-08-15 00:14:13 -07:00
Peter Steinberger 6d9ea63a87 docs: correct computer use inventory counts (#124074) 2026-08-15 00:13:16 -07:00
Peter Steinberger a8f1a0d345 test(computer-use): live end-to-end gate for both macOS providers (#123991)
* fix(computer-use): preserve semantic click observations

* fix(cua-computer): isolate desktop and window sessions

* fix(cua-computer): route cursor reads through desktop scope

* test(computer-use): add isolated macOS live proof rig

* style(cua-computer): format driver sessions

* fix(cua-computer): forward lazy desktop tools

* fix(computer-use): narrow live proof artifact path

* test(computer-use): split schema contract coverage

* refactor(cua-computer): unify session start state

* build(computer-use): register live proof entrypoint

* style(computer-use): satisfy full lint contract

* fix(computer-use): harden live proof authority

* fix(cua-computer): keep window authority immutable

* fix(computer-use): close partial sessions safely
2026-08-14 23:37:53 -07:00
Jesse Merhi edb5adfbf5 Start new sessions with folder group defaults (#123276)
* feat(ui): add folder group session defaults

* fix(ci): align folder group contracts

* fix(protocol): refresh Android gateway methods

* fix(ui): reuse folder picker for group defaults

* fix(ui): harden session group defaults

* test(ui): align group defaults with current main

* test(ui): keep group catalog defaults path-free

* fix(ui): close folder group CI gaps

* fix(ui): satisfy folder group CI contracts

* fix(session-groups): enforce defaults safety

* test(gateway): keep group defaults in workspace

* fix(session-groups): enforce defaults participation

* fix(session-groups): close review authorization races

* fix(session-groups): canonicalize defaults authorization

---------

Co-authored-by: Jesse Merhi <jesse-merhi@users.noreply.github.com>
Co-authored-by: Jesse Merhi <openclaw@users.noreply.github.com>
2026-08-15 15:24:13 +10:00
Peter Steinberger 19ae7f2110 perf(ci): keep hybrid Windows on one Blacksmith lane to dodge the 2-runner queue
Measured on run 31865243804: the 3-part split on
blacksmith-8vcpu-windows-2025 got exactly 2 runners; part 2 queued 211s
and only started when part 1 finished, pushing the wall to 6:45 despite
133-163s job bodies (vs 342s hosted). The runner class admits ~2
concurrent jobs, so any profile that can land on Blacksmith now uses the
single lane; the 3-part split stays for guaranteed-hosted executions
(github mode and dispatches, whose runner expression forces hosted in
every mode). A hybrid retry reruns the single lane hosted - slower but
bounded, and Windows-scoped retries are rare.
2026-08-14 22:00:25 -07:00
Peter Steinberger 124847928d fix(cli): name the agent escapes each command supports (#124018)
* fix(cli): name supported agent selection escapes

* refactor(cli): keep selection context compact

* fix(cli): preserve caught selection errors
2026-08-14 21:58:11 -07:00
Peter Steinberger 6e5bf3ec55 fix(doctor): stop false failures on multi-agent profiles (#124010)
* fix(doctor): resolve multi-agent health owners

* fix(doctor): keep bare json exit advisory
2026-08-14 21:45:55 -07:00
Peter Steinberger ed5e489633 perf(ci): widen ui-e2e to 12 shards, ride Blacksmith Windows on hybrid, overlap built-runtime verifiers
Three measured cuts toward the sub-4-minute wall:

- checks-ui-e2e hosted-planner matrix 10 -> 12 rows (11 Vitest shards +
  browser-extension). Shard 1 measured 230s with ~123s test body; Vitest
  hash sharding leaves count as the only balance lever.
- checks-windows hybrid attempt 1 now rides blacksmith-8vcpu-windows-2025
  (retries stay hosted windows-2025). The 3-part hosted split measured a
  342s pole on full-graph runs.
- build-artifacts folds the Doctor plugin-index proof (12s), singleton
  smoke, and startup-memory check (7s) into one step that overlaps them
  on Blacksmith and stays serial on hosted 4-core so the RSS measurement
  is unperturbed; any missing startup asset rebuild completes before the
  fork so no verifier reads dist mid-write.
2026-08-14 21:12:05 -07:00
Peter Steinberger a32a7ae9af feat(cua-computer): verify the managed driver artifact on Windows and Linux node hosts (#123986) 2026-08-14 21:08:13 -07:00
Peter Steinberger aa7a2fbe0d feat(cua-computer): browser action family over v2 (#123960)
* feat(cua-computer): add browser action family

* refactor(cua-computer): split browser action files

* refactor(cua-computer): move the shared act-params type to the leaf module

* fix(cua-computer): carry the contract params import with the moved type
2026-08-14 20:59:46 -07:00
Gio Della-Libera 103e1a4cc9 fix(claws): recover lifecycle state safely (#123254)
* fix(claws): preserve runtime lifecycle state

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 34377cd6-beac-4e49-8ab0-22cfaf8b54a5

* fix(claws): harden lifecycle reconciliation

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 34377cd6-beac-4e49-8ab0-22cfaf8b54a5

* fix(mcp): serialize ownership mutations

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 34377cd6-beac-4e49-8ab0-22cfaf8b54a5

* test(mcp): prove lifecycle lease ordering

* fix(claws): page cron recovery inventory

* fix(claws): fail closed on missing cron ownership

* refactor(claws): keep pending cron recovery unchanged

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Gio Della-Libera <235387111+giodl73-repo@users.noreply.github.com>
Copilot-Session: 34377cd6-beac-4e49-8ab0-22cfaf8b54a5
2026-08-14 20:52:45 -07:00
Peter Steinberger 53074ae91a feat(workers): install Gateway bundles on nodes (#123985)
* feat(workers): install Gateway bundles on nodes

Add a private paired-channel install command backed by a one-use Gateway HTTP capability, bounded archive validation, script-disabled dependency materialization, and atomic gateway-namespaced publication. Existing device provisioning remains on the local-build path until the next cutover slice.

* docs(runners): record node bundle installer
2026-08-14 20:52:39 -07:00
Jesse Merhi 47442197a1 feat(ui): review install policy warnings (#120900)
* feat(ui): review install policy warnings

* fix(ui): keep install feedback on runtime plugin
2026-08-15 13:07:02 +10:00
Peter Steinberger d8cd661517 fix(gateway): keep supervised restarts from migrating live state (#123920)
* fix(gateway): fence supervised restart schema ownership

* fix(gateway): target supervised safe restarts

* chore: leave changelog to release automation

* fix(gateway): satisfy restart control checks
2026-08-14 19:31:15 -07:00
Peter Steinberger 00164c7bdc perf(ci): cut the QA smoke double build and three audited wall lanes
Sub-agent caching audit tranche, all measured on runs 31856622489 and
31857193681:

- QA Smoke parts rebuilt the runtime twice and packed a docker tgz that no
  scenario in the smoke coverage set consumes (verified against the resolved
  plan: zero docker-lane, zero Control UI scenarios). One private overlay
  build replaces the public-build/ui:build/pack/private-rebuild chain
  (~35-50s per part); the run step fails closed if a docker-lane scenario
  ever returns, and the guard now pins never-pack-after-private-build.
- report-plugin-sdk-api-diff is pure reporting (nothing passes
  --require-acknowledgement); it now runs on manual/release dispatches only.
- check-npm-lock resolved ~94 npm graphs against the registry on every push;
  push/PR runs now use the reviewed --changed scoping (2.4s on dep-free
  diffs) with a fail-open full sweep on base-fetch failure, and dispatches
  keep --all for registry-drift coverage.
- Six restore-test-caches gates said 'github' only while the writer already
  runs in hybrid; hybrid attempt-1 lanes now restore the transform seed.
- QA smoke lane reads the protected build compile cache; test-type stripes
  widen to five.
2026-08-14 19:19:13 -07:00
Jason (Json) 318d82e91a fix: visible sessions explain working-directory denials (#123829)
* fix(sessions): explain visible cwd denials

* fix: classify visible cwd denials structurally
2026-08-14 20:12:41 -06:00
Peter Steinberger d7d059c7e6 perf(test): move direct import smoke to test fixtures (#123923) 2026-08-14 19:07:48 -07:00
Peter Steinberger 399f5a32e5 fix(workers): bound Gateway bundle cache growth (#123901)
* fix(workers): bound gateway bundle cache

* docs(plan): record Gateway bundle cache cleanup

* fix(workers): exclude terminal bundle diagnostics
2026-08-14 18:27:08 -07:00
Peter Steinberger 76e4ef68ce perf(ci): squeeze the last hybrid stragglers under the five-minute wall
Green tip run 31855637027 measured the remaining poles: ui-e2e shards up to
282s (imbalanced eight-way split), report-plugin-sdk-api-diff 246s on 4 vCPU,
and 220s test-type stripes (tsgo saturates a machine per graph, so stripe
count is the lever, not cores). Widen hosted-profile ui-e2e to ten rows,
test-type stripes to four, and lift the SDK diff to the 8 vCPU class.
2026-08-14 18:20:28 -07:00
Peter Steinberger 27bf9c2a74 docs: fix stale cua-computer section link on the Codex Computer Use page (#123892)
The Windows/Linux cross-reference still pointed at the pre-rename anchor
("experimental, via CUA Driver SDK"); the heading became "experimental,
direct SDK" in 19ace6830b, so the link landed at the top of the node
computer-use page instead of the fulfiller section.
2026-08-14 17:33:23 -07:00
Peter Steinberger 156af00a78 fix(memory): report truthful index outcomes (#123863) 2026-08-14 17:17:16 -07:00
Dallin Romney a01d40bfb9 fix(sessions): honor total entry cap with protected history (#123081)
* fix(sessions): count protected rows toward entry cap

* perf(sessions): defer maintenance snapshot loading

* test(sessions): assert total maintenance cap

* fix(sessions): align warning preservation

* fix(sessions): guard malformed maintenance rows
2026-08-15 08:03:57 +08:00
Peter Steinberger d913796112 fix(runners): preserve node workspaces across restarts (#123889)
* fix(runners): retain node workspaces from gateway state

* docs(plan): record authoritative node retention
2026-08-14 16:59:19 -07:00
Peter Steinberger 9adfe07d9b perf(ci): ride hybrid Blacksmith attempt-1 for the measured hosted poles
First hybrid main cycles (runs 31850815388-31851455918) landed at 5:47-6:32
walls with every remaining pole a hosted lane: the three test-type stripes
(232-269s), check-additional-runtime-topology (274s), check-dependencies
(260s), and report-plugin-sdk-api-diff (209s). Route them to their Blacksmith
labels on hybrid attempt 1 (retries stay hosted) and lift runtime topology to
the 8 vCPU class.
2026-08-14 16:56:52 -07:00