e94ece85b6
fix(anthropic): preserve opus fallback pricing
2026-07-25 19:30:49 +08:00
4df130d0be
fix(anthropic): honor opus 5 aliases
2026-07-25 19:30:49 +08:00
8373a55116
fix(anthropic): trust fallback boundary events
2026-07-25 19:30:49 +08:00
a69001850b
fix(anthropic): canonicalize fallback model identities
2026-07-25 19:30:49 +08:00
aaea5c67ab
test(anthropic): cover fallback serving transitions
2026-07-25 19:30:49 +08:00
604daecafc
fix(anthropic): price fallback serving models
2026-07-25 19:30:48 +08:00
3764d6739e
fix(anthropic): use native fast mode for opus
2026-07-25 19:30:48 +08:00
18d4128215
fix(anthropic): enable default fallback for opus 5
2026-07-25 19:30:48 +08:00
e42401bce7
refactor(anthropic): centralize 1m context capability
2026-07-25 19:30:48 +08:00
589ac0372e
refactor(zalouser): compile blocks from CommonMark IR ( #113590 )
...
* refactor(zalouser): compile blocks from commonmark ir
* refactor(markdown-core): keep block metadata internal
* test(markdown-core): type hidden block metadata
* refactor(zalouser): drop split-module leftovers
* test(markdown-core): assert serialized metadata shape
* refactor(zalouser): satisfy formatter lint contracts
* refactor(zalouser): internalize source span helpers
* fix(zalouser): preserve nested container semantics
2026-07-25 03:34:53 -07:00
e9f2bd63a3
refactor(models): share config ref flattening ( #113591 )
2026-07-25 17:20:38 +08:00
446816f751
test: table-drive followup scenarios, centralize sanitizer wiring, remove obsolete negatives ( #113583 )
...
* test(auto-reply): table-drive followup runner scenarios
* test(channels): centralize sanitizer wiring coverage
* test: remove obsolete negative coverage
2026-07-25 02:14:44 -07:00
0f92546408
fix(sdk): preserve zero values in normalized event IDs ( #113349 )
...
* fix(sdk): preserve zero values in event ids
* test(sdk): isolate zero event ID components
---------
Co-authored-by: destire-mio <248462155+destire-mio@users.noreply.github.com >
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-25 02:07:59 -07:00
b0525e1a70
refactor(ai): split OpenAI Responses transport ( #113569 )
2026-07-25 01:23:28 -07:00
3018e8b78a
refactor: deduplicate micro helpers onto canonical homes ( #113534 )
...
* refactor: deduplicate micro helpers
* fix(ai): keep hash prefix helper internal
2026-07-25 00:41:01 -07:00
b4598365d9
refactor(packages): reuse shared error coercion ( #113529 )
2026-07-25 14:59:59 +08:00
82d1a03f25
refactor(agents): move implicit-main fallback into load-time roster injection ( #112678 )
...
* refactor(agents): require explicit roster defaults
* feat(onboard): create named first roster agent
* refactor(agents): remove runtime main fallbacks
* style(agents): apply roster refactor formatting
* refactor(agents): finish roster-only runtime sweep
* fix(doctor): migrate legacy main session sqlite
* fix(doctor): harden roster session migrations
* fix(onboard): commit first agent atomically
* fix(config): support empty-roster analysis
* fix(agents): preserve legacy main state during creation
* fix(setup): materialize baseline agent roster
* fix(agents): harden legacy default transfer recovery
* fix(agents): simplify roster-only legacy compatibility
* fix(agents): preserve staged first-agent entries
* fix(config): migrate persisted implicit-main rosters
* fix(config): preserve staged empty rosters
* fix(agents): finalize roster-only upgrade paths
* fix(sessions): close legacy main migration outcomes
* fix(config): migrate legacy roster markers at load
* fix(sessions): preserve roster upgrade history
* refactor(sessions): restore lean legacy main compatibility
* fix(setup): prepare first-agent credentials before publish
* fix(config): stabilize roster snapshot migration
* refactor(sessions): shrink legacy main compatibility
* fix(agents): restore roster compatibility fidelity
* fix(sessions): preserve divergent legacy history
* refactor(agents): narrow roster-only scope
* fix(config): isolate roster migration
* test(agents): align roster-only fixtures
* fix(agents): keep main agent undeletable
* fix(agents): harden roster migration invariants
* fix(agents): close setup and audit scope gaps
* fix(cron): scope session reaper throttles by agent
* fix(agents): preserve scoped owner precedence
* fix(config): preserve authored config ownership
* fix(setup): keep default workspace and roster in sync
* fix(setup): preserve default entry workspace on bare runs
* fix(agents): adapt roster rebase to keyed entries
* fix(agents): honor both roster representations
* fix(agents): route roster reads through shared helpers
* fix(config): preserve canonical roster writes
* fix(cron): resolve dynamic default for session reaper
* fix(agents): close dynamic default migration gaps
* fix(agents): align scoped session ownership
* fix(sessions): preserve legacy main directory casing
* fix(agents): align cron and legacy auth ownership
* fix(setup): provision the committed default workspace
* fix(cron): align scoped ownership and reaping
* fix(cron): treat blank agent ids as absent
* fix(cron): retain configured session-store owners
* fix(agents): repair roster-aware CI boundaries
* fix(cron): preserve scoped ownership resolution
* fix(agents): preserve rosterless maintenance paths
* fix(agents): propagate roster ownership through runtime boundaries
* fix(agents): preserve roster ownership across runtime paths
* fix(agents): harden roster diagnostics and legacy routing
* fix(agents): remove redundant diagnostic import
* test(agents): type CLI policy fixture explicitly
* fix(config): preserve canonical roster mutation identity
* fix(doctor): read canonical agent rosters consistently
* fix(config): resolve compound roster unsets safely
* fix(config): finalize main-session reconciliation
* fix(doctor): read canonical session state safely
* fix(sessions): preserve current visibility alias
* fix(config): track roster include provenance
* test(config): type roster provenance cases
* fix(config): refine roster include ownership
* fix(agents): preserve staged roster invariants
* test(config): align fixtures with explicit roster ownership
* test(node-host): preserve optional plan typing
* fix(config): preserve authored roster projections
* test(config): keep raw roster fixtures explicit
* test(config): normalize rosters at runtime fixtures
* fix(config): protect authored roster ownership
* fix(agents): require explicit session ownership
* fix(agents): enforce scoped roster ownership
* fix(sessions): merge fixed-store agent partitions
* fix(agents): harden roster ownership boundaries
* fix(config): reject ambiguous roster projections
* fix(sessions): preserve persisted store ownership
* fix(sessions): keep collision diagnostics additive
* fix(security): scan malformed roster workspaces
* test(config): align snapshot fixtures after rebase
* test(agents): use explicit roster fixtures
* fix(config): harden roster diagnostic boundaries
* fix(sessions): isolate fixed-store agent databases
* test(agents): type malformed default markers
* refactor(sessions): extract store collision resolution
* test(system-agent): split oversized setup coverage
* style(system-agent): format split setup suite
* fix(sessions): preserve promoted store ownership
* fix(sessions): derive scoped owner before target
* fix(sessions): preserve explicit sqlite ownership
* fix(agents): restore roster compatibility across CI
* fix(agents): enforce roster-owned runtime boundaries
* fix(agents): satisfy default lookup lint
* test(sessions): split known-owner coverage
* fix(state): satisfy path identity lint
* fix(agents): preserve malformed roster safety boundaries
* fix(agents): restore roster compatibility at runtime boundaries
* fix(config): satisfy roster boundary type checks
* fix(agents): preserve roster ownership across runtime probes
Setup inference probes now execute as the configured roster owner. Malformed agent-prefixed session rows are intentionally omitted by the fail-closed visibility contract rather than normalized by tests.
* fix(agents): satisfy session list owner lint
* fix(agents): preserve roster-owned runtime boundaries
Restore shared logical rows for exact SQLite session locators while keeping their physical database owner separate. The ownership regression test now constructs an explicit sole-owner database directly instead of relying on first-touch capture, matching the intentional shared-store contract.
* fix(sessions): preserve multiply owned exact stores
* fix(sessions): restore runtime owner boundaries
Keep incognito sentinels agent-owned, fold default-agent approvals into the global snapshot, and preserve the configless legacy-main CLI policy fallback. Also repair the existing CLI watchdog test lifecycle so the compact shard observes its timeout without an unawaited assertion or async timer stall; product behavior is unchanged by that test-only fix.
* test(ci): align owner-scoped fixtures
These assertions are unchanged. The fixtures now declare the intended non-default runner, expose the session-key constant imported by production status code, and select the main approvals bucket explicitly on Windows.
* fix(agents): close final roster ownership gaps
2026-07-24 22:38:09 -07:00
b82d8e56b6
fix(qa): require persisted results in runtime parity ( #113499 )
...
* fix(qa): bind runtime parity to fixture session
* fix(qa): narrow session store reader input
* test(qa): isolate runtime session selection regression
* fix(ci): restore env surface ratchet
2026-07-24 21:52:53 -07:00
2a5ad61ce9
feat(system-agent): constrain planner JSON output at generation time ( #113482 )
...
* feat(system-agent): constrain planner JSON output
* fix(ai): align response format request typing
* fix(ai): preserve response format backend contracts
2026-07-24 21:00:28 -07:00
872ba27ff3
docs(anthropic): document the rolling opus alias and pin alias-split coverage ( #113413 )
...
Main already resolves bare opus to Claude Opus 5 but documents nothing about
the rolling behavior. State that bare family aliases follow the current
generation and that pinning is the opt-out, and add regression coverage
separating bare aliases, pinned aliases, and retired-ref upgrades.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com >
2026-07-24 17:14:49 -06:00
5bea268128
feat(anthropic): complete Claude Opus 5 rollout ( #113392 )
...
* feat(models): add Claude Opus 5 support
* test(models): align Opus 5 setup fixtures
* test(models): update ambient Opus 5 detection
* fix(models): reconcile Opus 5 support with main
2026-07-24 14:55:36 -07:00
2ee8730450
feat(anthropic): add Claude Opus 5 model support ( #113391 )
...
* feat(anthropic): add Claude Opus 5 model support
Wire claude-opus-5 through the Claude 5 contract seams: adaptive-by-default
thinking with the full low..max effort range, default-sampling and prefill
stripping, streaming refusal contract, model-bound thinking replay, and 1M/128k
catalog metadata across anthropic, claude-cli, Vertex, Bedrock, and Mantle.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
* fix(anthropic-vertex): normalize explicit Vertex Opus 5 model rows
Extend normalizeAnthropicVertexResolvedModel so user-configured Vertex Opus 5
rows regain reasoning, image input, 1M/128k limits, and the native thinking
map; update the live-model priority expectation and regenerate docs_map.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com >
2026-07-24 14:47:08 -06:00
2900026b33
fix: stop selected channel sessions from WebChat ( #111108 )
...
* fix: stop selected channel sessions from WebChat
* fix: clear channel working state after stop
* fix: cancel queued turns before session abort
* fix: replay pending stops after reconnect
* fix: align stop lifecycle test fixtures
* fix(ui): bind pending aborts to gateway client
* test(ui): keep chat pane specs within line limit
* chore(ios): refresh native i18n inventory
* chore: retrigger PR checks
* fix(system-agent): avoid blocking TUI catalog discovery
* fix: preserve session abort ownership
* test: align abort coverage with current main
* test: assert scoped session abort broadcast
* fix(agent-runs): expose SDK runtime abort state
* fix(ui): clear queued main-session stops by scope
* fix(ui): replay only exact run aborts
* fix(gateway): protect session abort cleanup
* fix(ui): narrow session abort intent
* test(ui): avoid unbound request assertions
---------
Co-authored-by: scotthuang <scotthuang@tencent.com >
Co-authored-by: Patrick Erichsen <patrick.a.erichsen@gmail.com >
2026-07-24 14:36:18 -05:00
e3636852ba
refactor(normalization): reuse trimmed list helpers ( #113295 )
2026-07-24 17:43:22 +08:00
89643f6401
fix(openai): fail fast on invalid TLS certificates ( #111818 )
...
* fix(openai): stop retrying TLS certificate failures
* fix(ai): centralize TLS certificate failover policy
---------
Co-authored-by: Altay <altay@hey.com >
2026-07-24 12:34:01 +03:00
aae10cade5
refactor(markdown): unify format profile declarations ( #113254 )
...
* refactor(markdown): unify format profile declarations
* test(markdown): avoid suppression inventory drift
2026-07-24 00:37:59 -07:00
bd559a98ed
fix(cron): migrate scheduled authority provenance
2026-07-24 01:24:03 -05:00
5d21ba0a2a
fix(cron): bind scheduled authority to creator accounts
2026-07-24 01:24:03 -05:00
9fc1f0b96b
refactor(speech-core): centralize provider attempts ( #113212 )
2026-07-24 12:08:12 +08:00
90aee82793
feat(sessions): suggestion queue + typing indicator ( #113173 )
...
* feat(protocol): add session collaboration contracts
* feat(gateway): add session suggestion queue and typing
* feat(ui): add session suggestion controls
* fix(collaboration): restrict suggestion resolution
* fix(collaboration): dedupe suggestion dispatch modes
* fix(collaboration): preserve resolver identity
* fix(collaboration): reconcile suggestion state
* fix(collaboration): filter identityless suggestion events
* fix(ui): expose full suggestion text
* fix(collaboration): durably claim suggestion dispatch
* fix(collaboration): harden suggestion events and typing
* fix(collaboration): reconcile suggestion races
* fix(ui): reconcile suggestion capabilities
* fix(collaboration): close suggestion privacy races
* test(ui): satisfy suggestion lifecycle lint
* fix(collaboration): fence resolved suggestion events
* test(collaboration): type deferred audit result
* fix(collaboration): fence delayed typing events
* fix(ui): coalesce suggestion refreshes
* fix(ui): preserve resolved self suggestions
* fix(collaboration): enforce draft suggestion visibility
* fix(collaboration): fence post-dispatch finalization
* fix(ui): retain suggestions across visibility changes
* fix(collaboration): fence suggestion context and archives
* fix(collaboration): fence suggestion resolve lifecycle
* fix(collaboration): map suggestion replacement races
* refactor(gateway): extract session typing state
* fix(collaboration): integrate suggestion storage with session nodes
* refactor(gateway): extract session sharing snapshot cache
* fix(collaboration): satisfy protocol and deadcode gates
* fix(ci): register iOS release script entrypoints
* fix(collaboration): fence typing by session instance
* fix(collaboration): enforce incognito suggestion privacy
* docs(ui): clarify solo suggestion dormancy
* test(gateway): preserve incognito literal type
* test(gateway): split session typing coverage
* test(gateway): register collaboration method expectations
2026-07-23 18:59:58 -07:00
bb657eec93
refactor(config): retire redundant settings ( #113174 )
...
* refactor(config): retire redundant settings
* style: apply current formatter
* chore: update plugin sdk baseline
* fix: keep Codex tool caps context-aware
* chore: remove stale imports
* test: align WhatsApp QA debounce config
* fix(config): clean up retired config checks
* fix(ci): align config cleanup checks
2026-07-23 17:45:02 -07:00
5fb3136be0
feat(telegram): render rich markdown lists natively ( #113158 )
2026-07-23 15:41:21 -07:00
cbf94c0d8b
feat(sessions): drafts UX — create-as-draft, promote, admin ghost treatment ( #113127 )
...
* feat(protocol): support draft session creation
* feat(ui): add draft session workflows
* docs: explain multi-user drafts
* test(ui): tighten draft ownership fixture
* test(ui): satisfy draft E2E lint
* test(ui): keep draft fixtures strictly typed
* docs: add drafts implementation report
* docs: clarify implementation LOC summary
* test: strengthen draft compatibility coverage
* docs: correct drafts cleanup report
* fix: harden draft availability policy
* docs: update draft policy review notes
* test(ui): type draft policy mock control
* fix: preserve keyed draft creation retries
* fix: keep disabled draft retries idempotent
* docs: finalize drafts cleanup report
* fix(ui): keep draft ownership helper internal
* docs: refresh drafts docs map
2026-07-23 13:06:35 -07:00
c519e01a24
feat(gateway): chat.send expectedLeafEntryId precondition keeps stale panes off switched branches ( #113073 )
2026-07-23 12:33:31 -07:00
013b24dd6d
feat(sessions): archive attribution (archivedBy) ( #113116 )
...
* feat(sessions): attribute archive transitions
* docs: add archive attribution report
* fix(sessions): restore alias layout after archive audit failure
* docs: update archive attribution report
* fix(sessions): isolate archive audit rollback
* docs: record final archive rollback design
* fix(sessions): make archive audit note best-effort
* docs: record best-effort archive audit policy
* chore: refresh native i18n baseline
2026-07-23 11:23:30 -07:00
2f5e7cfc5d
fix(ui): prevent duplicate image prompt and flicker ( #113113 )
...
* fix(ui): stabilize initial image prompt handoff
* chore(protocol): refresh sessions create model
* chore(i18n): refresh native source inventory
2026-07-23 12:11:52 -06:00
3e2b3ea4d5
feat(cron): database-backed heartbeat monitor scratch replaces HEARTBEAT.md ( #112967 )
...
* feat(cron): move heartbeat context into database-backed per-job cron scratch
- new additive cron_job_scratch SQLite table (revision tombstones keep
compare-and-swap monotonic across unset/recreate; 256KiB cap)
- heartbeat runner reads monitor scratch instead of workspace HEARTBEAT.md;
heartbeat_respond gains a private scratch replacement parameter
- openclaw doctor --fix migrates HEARTBEAT.md into scratch (hash-verified,
archived under state backups, idempotent, symlink-contained)
- gateway cron.scratch.get/set admin RPCs + openclaw cron scratch CLI
- workspace bootstrap no longer seeds HEARTBEAT.md; Codex heartbeat file
guidance removed; docs and prompt snapshots updated
* fix(cron): review round 2 — shared-workspace heartbeat migration and non-default agent monitors
- doctor migration groups agents by heartbeat source file and imports into
every monitor before archiving/removing the shared file once
- exempt heartbeat payloads from the main-session default-agent restriction:
monitors only poke the wake bus, so non-default agents converge again
- document why disabled monitors retain their last cadence (config default
already resolves before the fallback)
* fix(cron): honor configured cron store, legacy heartbeat fallback, and safer doctor claim
* fix(cron): claim HEARTBEAT.md before committing scratch and restore without clobbering
* fix(cron): pin migration CAS to precondition revision, re-verify claim on release, archive first, report scratch as pending
* docs(heartbeat): remove retired config options
* fix(cron): crash-recoverable migration claims, partial-import rollback, latest-response scratch pairing
* test(heartbeat): keep latest scratch proposal paired
* fix(cron): roll back committed scratch on changed-claim release and restore no-row state
* fix(cron): revision-guarded rollback delete and recreated-file detection on claim release
* fix(cron): treat every failed claim re-verification as a migration conflict
* test(heartbeat): rename ack test after ackMaxChars retirement
* fix(heartbeat): keep monitor scratch out of bypass-scope runs
* fix(cron): resolve claimed symlinks on release and gate legacy fallback on proven scratch state
* fix(cron): strict claim-name recovery and per-entry migration grouping
* fix(ci): heartbeat scratch gate repairs — lint causes, dead exports, since-train, inventory path, prompt snapshot, regenerated docs map, SDK baseline, protocol bindings
* fix(cron): live-owner claim guard and canonical entry-key migration grouping
* fix(cron): archive claimed inode on release and flag orphan claims beside recreated files
* docs(cron): document process-global state-db invariant for scratch service ops
* chore(i18n): refresh native inventory line numbers after protocol binding regen
2026-07-23 11:10:49 -07:00
acd92f6a3d
chore(deps): refresh repository dependencies ( #112453 )
...
* build(deps): update QA broker dependency
* build(deps): refresh repository dependencies
* build(deps): reconcile rebased shrinkwraps
* test(plugins): remove stale loader test state
* test(deps): stabilize updated dependency coverage
* fix(swift): use caller-isolated TaskLocal overload
* build(deps): regenerate rebased shrinkwraps
* test(msteams): preserve DNS validation in fetch helper
* fix(deps): avoid vulnerable optional image stack
* test(deps): validate generated LRU override
* refactor(ui): extract chat resizable divider
* test(ui): update divider ownership path
* fix(matrix): retain restart-compatible SDK
* style(cron): format update test
2026-07-23 16:17:13 +00:00
09672312c4
feat(gateway): incognito sessions for the web Control UI ( #113006 )
...
* feat(gateway): add web-only incognito sessions held in process memory
* feat(ui): add incognito toggle and badges to the web new-session flow
* fix(sessions): classify incognito by key shape, fail closed on stale keys, and gate memory writes
* fix(codex): start harness threads ephemeral for incognito sessions
* fix(sessions): reshape internal-effects incognito keys and add doctor repair for reserved key collisions
* refactor(plugin-sdk): export canonical incognito key classifier and guard the sentinel path
* fix(state): classify incognito DB handles from the recorded open-time set
* fix(gateway): isolate incognito sessions from durable lineage and allocation on read-only misses
* docs(sessions): pin the reserved incognito namespace ownership decision
* feat(gateway): admin-scope incognito visibility and incognito-blind cross-session surfaces
* fix(ci): repair kysely guardrails, dead export, docs map, protocol bindings, and ACP reset rotation
* fix(gateway): remove non-admin observability side channels for incognito sessions
* fix(gateway): enforce admin-scope incognito access and cover all parent-reference creation paths
2026-07-23 09:04:36 -07:00
9cbbac8fc8
refactor(plugins): prune retired compatibility tombstones ( #113025 )
...
* refactor(plugins): prune retired compat tombstones
* chore: shrink cleanup ratchets
* test(tooling): model flattened agent-core exports
* test(system-agent): isolate TUI catalog discovery
2026-07-23 07:30:35 -07:00
3023d69fd8
feat(gateway): carry reviewer-only detail on plugin approvals ( #113027 )
...
* feat(gateway): carry reviewer-only detail on plugin approvals
* chore(protocol): regenerate projections for plugin approval detail
* chore(plugin-sdk): budget reviewer-detail surface additions
2026-07-23 06:28:23 -07:00
6251343384
feat(sessions): visibility states, membership, and server-enforced participation ( #112787 )
...
* feat(sessions): enforce visibility and membership
* feat(ui): add session sharing controls
* docs: add session sharing implementation report
* refactor(sessions): use canonical creator identity
* fix(sessions): adopt creator ownership contract
* docs: refresh session sharing rebase report
* docs: record final creator integration proof
* docs: record final main rebase
* chore: drop worktree report artifact
* fix(sessions): keep drafts owner-only
* fix(ui): preserve redacted session restrictions
* fix(sessions): preserve scoped sharing authorization
* fix(sessions): re-verify session instance inside sharing mutation queue
* test(sessions): cover stale sharing mutation
* fix(sessions): bind membership to session instance, gate absence blocking on sharing
* fix(sessions): preserve entry normalization on rebase
* fix(sessions): atomic visibility instance guard, reset visibility on recreate
* docs(ui): name the absence-heuristic tradeoff and link follow-up
* feat(protocol): expose session sharing row state
* docs: note generated creator identity type
* fix(sessions): bind member writes and visibility rollback to session instance
* fix(ui): discard stale-connection sharing loads; drop worktree scratch files
* fix(ui): block composer only on observed sharing state, never on list absence
* fix(gateway): authorize agent runs against the resolved session (close keyless bypass)
* chore(protocol): allowlist Control UI-only session.sharing event for mobile
* test(config): record session.sharing keys in common-tier snapshot
* refactor(sessions): unexport internal sharing helpers
* test(gateway): update sessions changed routing assertions
* fix(sessions): align sharing identity with created actor
* fix(sessions): align membership identities and storage keys
* fix(gateway): re-filter drafts against fresh sharing state in sessions.list
* fix(gateway): drafts stay owner+admin only in the sessions.list fresh filter
* fix(ui): re-export sharing protocol types for the Control UI
* fix(ui): keep SessionSharingRole internal to satisfy deadcode gate
* fix(gateway): read runtime config lazily in session-mutation authorization
authorizeSessionMutation ran on every gateway request but eagerly called
context.getRuntimeConfig() — a non-trivial config resolve — for methods that
are never session mutations. Read config only once a real session-mutation
target is resolved. Also register the four session sharing methods in the
2026.7 release-train inventory test.
* fix(gateway): share one config snapshot across session-mutation authorization
Group rename/delete discovery and the authorization loop were each resolving
runtime config separately after the lazy-read change. Memoize the resolve so
non-session requests still pay nothing, while any session mutation resolves
config at most once and both discovery and authorization use that single
snapshot (no double reload, no mid-request config-change split).
* fix(gateway): resolve session-sharing CI gates
- isGatewayAdmin: null-safe connect access so internal/plugin-runtime runs
(which reach authorization with a connect-less client) do not crash.
- emitSessionsChanged: scope only to a concrete session key; a [undefined]
sessionKeys scope filters nothing correctly and would strip draft gating.
- session stores: mark the sync TOCTOU re-read and the sqlite_master
existence probe as narrowly-justified raw SQLite primitives.
- tests: provide getRuntimeConfig to the session-action contract context,
drop a shadowed 'call' binding, use structuredClone, and assert the
agent-scoped sessions.changed broadcast shape.
* docs(gateway): note best-effort participation gate + refresh native i18n baseline
Session ownership/visibility are usability features, not a security boundary
(docs/concepts/multi-user.md, SECURITY.md); document that the pre-dispatch
authorization is intentionally not commit-bound to the resolved instance.
Also refresh apps/.i18n/native-source.json after the session-sharing protocol
codegen shifted line numbers of existing native strings (position-only).
* test(gateway): reset session sharing snapshots
* style(gateway): format sharing reset import
2026-07-23 08:53:57 -04:00
9ae9fcb1cd
fix: preserve transcript cursors across session resets ( #112988 )
...
* feat: add reset transcript boundaries
* feat: project reset boundaries in history
* refactor: reset sessions in place
* fix: fence reset runtime caches by lifecycle
* fix: preserve reset filtering during compaction
* fix: anchor compaction after reset boundaries
* fix: budget reset preludes during compaction
* fix: honor reset visibility in bounded history
* fix: couple reset boundaries to lifecycle commits
* fix: commit reset boundaries atomically
* fix: preserve reset boundary transition states
* fix: preserve concurrent reset lifecycle owners
* fix: preserve reset boundary storage compatibility
* fix: preserve reset windows across persisted histories
* fix: fence legacy reset lifecycle state
* fix: keep stale appends behind reset boundaries
* perf: index reset descendants linearly
* fix: bound reset history projection reads
* fix: narrow invalid leaf control types
* test: use typed cron lifecycle revision
* style: keep acp lifecycle helper within limit
* style: satisfy reset boundary lint rules
* test: split reset concurrency coverage
* style: satisfy compaction fixture lint
* refactor: remove retired reset replay exports
* test: assert in-place reply session resets
* test: assert reset boundary persistence
* test: mock session boundary counts
2026-07-23 06:22:43 -04:00
b5232bc4dd
refactor(markdown): add capability-driven fallbacks ( #112985 )
...
* refactor(markdown): add capability-driven fallbacks
* fix(markdown): type task-list core rule state
* style(markdown): make list-prefix return explicit
* fix(markdown): honor label-only plain links
* fix(markdown): retain clipped list provenance
2026-07-23 05:47:48 -04:00
84d149bf6f
fix(ui): use bundled model setup icons
2026-07-23 17:43:10 +08:00
fb4338b03c
test(memory): clear embedding watchdog timers ( #112887 )
2026-07-23 03:43:09 -04:00
9735945083
refactor(markdown): share attributed range rendering ( #112907 )
2026-07-23 01:41:56 -04:00
6b470b1fe8
fix(ui): thread-changes button leads to a dead end when the workspace is not a git checkout ( #112914 )
...
* fix(ui): disable the thread-changes button when the workspace is not a git checkout
* chore(protocol): regenerate Swift gateway models for sessions.files.list gitCheckout
2026-07-23 01:33:35 -04:00
099d6351b3
refactor(sessions): canonical lineage model — creation provenance, fork ancestry, generation chain, typed row contract ( #111861 )
...
* fix(sessions): preserve spawn/fork lineage across implicit daily/idle rollover
* refactor(sessions): canonical creation model with forkSource ancestry and generation chain
* feat(sessions): stamp creation provenance across all creation paths and emit created events
* refactor(gateway): lock lineage patching, split control from navigation, add typed session-row contract
* docs(gateway): document creation provenance stamping and lineage patch tightening
* fix(sessions): keep provenance proof-only on wire fallbacks and strip node-local lineage from cron continuations
* fix(gateway): never journal a created event for session adoption
* fix(gateway): keep post-create work on adoption while gating the created event
* fix(sessions): restore trusted ensure-main provenance and stamp navigation parent at spawn
* fix(sessions): allow parentSessionKey through the direct child spawn patch
* fix(ci): break type cycles, satisfy export scan, regenerate Swift protocol models
* refactor(sessions): replace createdBy with createdActor
* fix(protocol): export session row type
* fix(sessions): preserve proven creation provenance
* fix(sessions): close lineage creation gaps
* test(sessions): align atomic spawn lineage coverage
* test(sessions): widen transcript search reconcile wait
* fix(sessions): stamp reset-created rows
* test(sessions): keep reset provenance coverage focused
* fix(sessions): journal chat-created rows
* test(ci): anchor release skill reads to repo
* test(ci): avoid cached module paths
2026-07-22 22:54:31 -04:00
7eec1345f9
fix(gateway): preserve Control UI access across device-auth upgrades ( #112558 )
...
* fix(gateway): preserve device auth upgrade recovery
* fix(gateway): satisfy device auth upgrade gates
* fix(doctor): clean disabled device auth bypass
* fix(gateway): recheck migration operator boundary
* fix(gateway): keep migration guard internal
* fix(gateway): preserve insecure migration access
* fix(gateway): reject stale migration handshakes
* fix(gateway): revoke legacy migration sessions
* fix(gateway): bound device-less migration authority
* fix(gateway): require explicit migration pairing
* fix(gateway): revoke alternate migration sessions
* fix(gateway): close migration admission races
* style(gateway): format migration pairing import
* fix(security): audit pending device-auth migration
* fix(gateway): reconcile migration on startup
* fix(gateway): cap device auth migration scopes
* fix(gateway): retain migration socket restrictions
* perf(ui): trim migration startup bundle
* perf(ui): lazy-load device auth migration
* fix(gateway): bind migration completion to approved key
* fix(gateway): preserve migration authorization bounds
* fix(gateway): grant migrated device pairing capability
* fix(ui): preserve device migration bundle budget
* fix(ui): stabilize migration startup budget
* chore(ui): retain startup budget headroom
* fix(ui): split migration overlay helpers
2026-07-22 18:44:48 -06:00
Vincent Koc