* fix(control-ui): drop stale Create PR row after merge and surface PR chips mid-turn
* test(gateway): split session-PR branch tests to satisfy max-lines
* test(gateway): drop unused GitContext export from test support
Sync loadExecApprovals fabricated a fail-closed deny policy whenever the
approvals lock was held by an async holder in the same process, which the
Codex app-server gate then misread as configured tools.exec.mode=deny and
killed entire agent runs on fully permissive hosts. Read the committed file
directly in that provably race-free case; cross-process contention, missing,
malformed, and unreadable states stay fail-closed.
The update_plan checklist tool has been default-on with no model gating for a
while, so keeping it under tools.experimental misrepresented it and kept a
container key alive for a single boolean. Rename it to a plain boolean
tools.updatePlan (camel-cased tool id, matching tools.agentToAgent and
tools.toolSearch), keeping the !== false default-on semantics.
The strict schema rejects the retired key, so openclaw doctor --fix now lifts
tools.experimental.planTool to tools.updatePlan and deletes the emptied
container. Registration also drops five parameters that were never read
(agentSessionKey, agentId, modelProvider, modelId, pluginToolAllowlist).
Docs: config-tools.md dropped a stale claim that the tool defaults off behind a
strict-agentic GPT-5 rule that no longer exists, experimental-features.md no
longer lists the tool and now cites the real Codex app-server floor (0.143.0,
per MIN_CODEX_APP_SERVER_VERSION).
Config baseline core count drops 2307 -> 2306.
The dreaming toggle writes `plugins.entries.<memoryPluginId>.config.dreaming.enabled`,
which matches the `{ prefix: "plugins", kind: "hot" }` reload rule in
src/gateway/config-reload-plan.ts, so `restartGateway` stays false and no restart
ever happens. The confirmation modal nonetheless showed a red danger callout
promising a Gateway restart that "may temporarily interrupt chats, automations,
and connected channels".
Replace it with an accurate confirmation that states the real consequence:
dreaming is global, so the single managed cron sweep it schedules covers every
configured agent workspace (resolveMemoryDreamingWorkspaces iterates all agent
entries), not just the agent whose page the panel is on. Copy is now
direction-aware, since turning it off is the consequential direction.
Renames the i18n block from `dreaming.restartConfirmation` to
`dreaming.toggleConfirmation` and the component from `restart-confirmation.ts`
to `toggle-confirmation.ts`; memory-panel was its only caller. No runtime or
server behavior changes.
Sensitive log redaction became unconditional and `logging.redactSensitive`
was retired from the config schema, but the policy doctor still classified
`dataHandling.sensitiveLogging.requireRedaction` as an automatic repair that
would have written the retired key back into config.
Remove the automatic repair (check-id registration, patch branch, and the
`enableSensitiveLoggingRedaction` writer), drop the `logging.redactSensitive`
config target, and reclassify the check as `validateOnly`. The check keeps
evaluating the policy declaration against the redaction invariant; it just no
longer claims a fixable config target. Refresh the policy docs, the finding
fix hint, and a stale comment in `src/logging/redact.ts`.
* docs: correct retired cron/audit config keys, cron failure-alert default, memory recall default, and tool-search telemetry claims
- configuration-reference: cron block documented cron.webhook and cron.failureDestination, both retired by the config-surface reduction tranches (58452de711, edecdbd05e); the cron schema is strict so a copied snippet is rejected. Document only the live keys and note the doctor --fix migrations.
- configuration-reference: root-level audit block is retired; canonical path is logging.audit (src/config/zod-schema.root-shape.ts).
- configuration-reference: cron.failureAlert.after default is 2, not 3 (src/cron/service/failure-alerts.ts).
- memory-config: rememberAcrossConversations defaults on for personal installs (packages/memory-host-sdk/src/host/config-utils.ts), matching the canonical table earlier in the page.
- tool-search: telemetry records catalogSize, per-source counts, and search/describe/call counts, and only on tool_search_code results. No byte accounting exists in the runtime.
* docs: retire remaining references to removed cron, audit, and logging config keys
Sweep follow-up to the previous commit, covering the same bug class in the pages that still contradicted it.
- cron-jobs/cli-cron: global cron.failureDestination is retired; the destination fields now live on cron.failureAlert (src/config/zod-schema.root-shape.ts, merged by legacy-config-migrations.runtime.retired.ts:379). Per-job delivery.failureDestination bullets left intact.
- gateway/audit, cli/audit, gateway/protocol: root-level audit.* is retired; canonical path is logging.audit.*.
- logging: logging.redactSensitive is retired (dead-config-keys.test.ts:198; removed by legacy-config-migrations.runtime.tier-eval.ts:12). resolveConfigRedaction hardcodes DEFAULT_REDACT_MODE = tools, so redaction is unconditional. Also documented that redactPatterns replaces the defaults on the log path (redact.ts:419) while tool payloads always merge them.
- logging: consoleStyle accepts only pretty|json (zod-schema.root-shape.ts:106); compact remains the automatic non-TTY rendering style (logging/console.ts:40) but is no longer settable, and doctor maps a stored one to pretty.
- security: security --fix no longer touches redaction and the logging.redact_off audit check is retired (src/security/audit-loopback-logging.test.ts asserts it never fires).
* chore(docs): regenerate docs map after retired-key cleanup
* feat(ci): weekly Codex sweep for date-carrying to-dos
Mondays 06:23 UTC (plus default-branch-only manual dispatch with
dry_run): a deterministic prefilter collects candidate lines where
to-do markers co-occur with date tokens, plus every deprecated compat
record from the plugin registry; a pinned openai/codex-action step
judges each candidate in context (genuine dated commitment vs
historical date or fixture) and writes an OVERDUE / DUE-30-days /
FUTURE report; a separate privileged job validates the report (tracked
file:line locations, date shape, inert text) and upserts one
marker-tagged tracking issue via the Barnacle app token, commenting
only when items newly become due.
The app token is minted on a fresh runner and checkout — never beside
Codex or its child processes; only the validated report artifact
crosses jobs. No permission-* subsets on token minting (installations
reject explicit subsets; see pr-ci-sweeper).
* chore(ci): localize upsert helpers with no external consumers
* feat(ui): add persisted sidebar layout model
* feat(ui): render flexible chat sidebar columns
* test(ui): align board sidebar fixture type
* fix(ui): preserve sidebar panels across responsive layout
* fix(ui): satisfy sidebar CI ownership and performance
* test(ui): derive discussion helpers from panel config
* test(ui): mount session rail through its registry
* fix(ui): preserve sidebar state across projections
* style(ui): format sidebar state fixes
* fix(ui): satisfy sidebar lint constraints
* refactor(ui): break sidebar layout import cycle
* fix(ui): stabilize sidebar panel rendering
* fix(ui): keep the narrow sidebar grid off for an empty layout
The two-row narrow grid reserved a panel row even with no sidebar panel open, halving the primary surface height on every default mobile chat pane.
* fix(ui): lazy-load chat sidebar region
* style(ui): format rebased chat state page
* chore(ui): raise sidebar startup baseline
* fix(ui): preserve sidebar move and resize state
* chore(ui): align sidebar startup baseline
* chore(ui): refresh sidebar startup baseline
* test(ui): register discussion element in isolated test
* fix(ui): persist the dragged panel as the collapsed active panel
Drag moves activated the panel in its destination column but left the separate persisted collapsed-mode selection stale, so the narrow layout foregrounded the wrong panel after a move and the stale choice survived reload.
* fix(ui): preserve resolved canvas URL in detail panel
Gateway exec commands with shell-expanded arguments now fail closed immediately when approvals are disabled and askFallback is deny.
Refs #113191.
Prepared head SHA: 63f104e681
Co-authored-by: Shakker <165377636+shakkernerd@users.noreply.github.com>
Reviewed-by: @shakkernerd
Peter Steinberger