772235cc55
fix(memory-core): stop MEMORY.md compaction from deleting user headings ( #116057 )
...
* fix(memory-core): stop MEMORY.md compaction from deleting user headings
parseMemoryBlocks segmented MEMORY.md only on "## ", so a user heading of
any other level did not close the promotion section above it. The section
ran on to the next "## " heading or EOF, and dropping it to fit the budget
deleted the user text it had swallowed, with no backup and no diagnostic.
Close the current block on any ATX heading, keeping the generator's own
"### Global" and "### Project: <key>" subheadings inside the promotion
body so multi-project sections stay droppable whole.
* fix(memory-core): identify generated promotion subsections by their entry marker
The first exception treated every "### Global" and "### Project: <key>"
heading under a promotion block as dreaming-owned, so a user who wrote one
of those headings themselves still lost it to compaction, which is the same
data-loss class this change set out to fix.
A generated subsection always leads with an openclaw-memory-promotion entry
marker comment, so require that marker as the next non-blank line before
treating the heading as part of the promotion body. User headings that
collide with the generated names now terminate the block and survive.
* fix(memory-core): recognize tab-delimited and empty ATX headings
The heading detector required a literal ASCII space after the opening #
sequence. CommonMark also allows a tab or end of line, so a user note
starting with a tab-delimited heading stayed inside the promotion block
above it and was deleted when compaction dropped that block.
Accept a space, a tab, or end of line after the # sequence. The generated
subsection pattern stays space-only because that is what buildPromotionSection
emits, so a tab-delimited heading is user-authored and is preserved.
* fix(memory-core): preserve Setext headings during compaction
Setext headings were still absorbed into the generated promotion block above them, so dropping that block could silently delete durable user notes. Move the heading paragraph into a preserved block when its underline is encountered, while keeping marker-backed generated content compactable.
* fix(memory-core): preserve indented ATX headings
---------
Co-authored-by: Vincent Koc <vincentkoc@ieee.org >
2026-07-30 09:13:57 +08:00
e00ef16ee7
fix(xai): follow OAuth default model automatically ( #115617 )
...
* fix(xai): default OAuth login to Grok 4.5
* fix(xai): follow OAuth default model automatically
* fix(xai): send OAuth proxy request headers
* fix(xai): avoid provider API shadowing
* fix(qa): restore current main validation gates
---------
Co-authored-by: echeung <echeung@agentsonly.com >
Co-authored-by: fuller-stack-dev <263060202+fuller-stack-dev@users.noreply.github.com >
2026-07-29 23:05:29 +00:00
7380875375
fix(memory): keep degraded status actionable ( #116074 )
...
* fix(memory): diagnose degraded auth owners
* fix(memory): use shared sqlite opener
2026-07-29 16:58:57 -04:00
83aca8a59c
fix(memory): return early for blank searches ( #116034 )
2026-07-30 02:48:50 +08:00
cf927f7b1b
fix(memory): keep rollbacks compatible after recall metadata upgrade ( #116003 )
...
* fix(memory): keep agent database rollbacks compatible
* fix(memory): satisfy rollback migration guards
2026-07-29 11:19:22 -06:00
841bfcdcb8
fix(memory): make legacy session backfill rollback re-applicable ( #116004 )
...
* fix(memory): reset legacy backfill cursors on rollback
* fix(memory): track complete backfill rewind baselines
2026-07-29 13:08:25 -04:00
6dc13c63b6
fix(memory-core): adopt legacy dreaming jobs ( #115986 )
2026-07-29 12:26:43 -04:00
5bfc65d7f4
refactor: remove 3,543 lines of redundant runtime and tests ( #115961 )
...
* refactor: remove 3,543 lines of redundant runtime and tests
* refactor: ratchet production environment variable budget
2026-07-29 11:43:41 -04:00
53815217e9
fix(memory): session backfill drains and rolls back reversibly ( #115926 )
...
* fix(memory): complete reversible session backfill
* refactor(memory): split backfill lifecycle helpers
* fix(memory): break backfill lifecycle import cycle
* fix(memory): keep lifecycle contract exports minimal
2026-07-29 10:48:16 -04:00
1f9dd150e8
fix(memory-core): harden dreaming lifecycle ( #115925 )
...
* fix(memory-core): harden dreaming lifecycle
* fix(memory-core): keep sweep result internal
2026-07-29 10:06:27 -04:00
dcd3c5b202
fix(test): restore isolated memory manager tests ( #115880 )
2026-07-29 20:24:14 +08:00
a2ead0a929
fix(memory): recover divergent dreaming journals ( #115855 )
...
* fix(memory): recover divergent dreaming journals
Co-authored-by: brokemac79 <martin_cleary@yahoo.co.uk >
* chore: drop changelog edit (release generation owns it)
---------
Co-authored-by: brokemac79 <martin_cleary@yahoo.co.uk >
2026-07-29 07:32:26 -04:00
7bdd1f646b
fix(memory-host-sdk): resolve stable execPath for worker fork to survive Homebrew Node upgrades ( #99318 )
...
* fix(memory): survive Homebrew Node upgrades
Co-authored-by: 袁龙辉0668001277 <yuan.longhui@xydigit.com >
* test(whatsapp): isolate last-route coverage
* fix(deepinfra): preserve offline model compatibility
* test(memory): isolate migration cleanup lifecycle
* test: stabilize aggregate extension gates
* ci: retrigger pull request workflow
* test: preserve inherited Node options
* test(cli): tolerate cold hosted startup
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-29 06:49:02 -04:00
20668eed03
fix(memory): quarantine writes from tainted agent turns ( #115818 )
...
* feat(memory): taint writes after network tools
* fix(memory): keep provenance mutations recoverable
* fix(memory): roll back failed provenance writes
* fix(memory): serialize provenance mutations
* docs(memory): explain flush provenance boundary
* refactor(memory): share provenance mutation wrapper
* docs(memory): clarify flush provenance fallback
* fix(memory): canonicalize provenance paths
2026-07-29 06:02:06 -04:00
47c1921d5d
fix(ui): stabilize memory engine selection ( #115750 )
2026-07-29 11:37:39 +02:00
6dc55fa65e
fix(plugins): recover user turns with scoped reply hooks ( #114836 )
...
Allow before_agent_reply plugins to declare host-enforced trigger eligibility so scheduled-only hooks do not block interrupted user-turn recovery. Keep omitted and malformed scopes fail-closed, scope both memory-core maintenance hooks, and cover three runner reload cycles through the public registration contract.
Refs: #111442
Source: #114836
Co-authored-by: Vincent Koc <vincentkoc@ieee.org >
2026-07-29 17:22:16 +08:00
4232126bba
chore: update dependencies across workspace ( #115677 )
...
* chore(deps): update dependencies
* fix(deps): restore CI compatibility
2026-07-29 05:16:42 -04:00
fb788b79cf
feat(memory): retain recent project scopes per session ( #115731 )
...
* feat(memory): retain active project set
* refactor(memory): require prepared active set
* docs(memory): explain active project set
2026-07-29 04:58:14 -04:00
ed6010ed54
fix(memory): keep dreaming consolidation within project scope ( #115721 )
...
* fix(memory): isolate consolidation by project
* test(memory): align dreaming status threshold
2026-07-29 04:27:24 -04:00
1b6ad8da8f
fix(memory): avoid phantom continuation pages ( #115722 )
...
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-29 04:24:19 -04:00
5692baafc3
fix(memory): exclude annotation carriers from recall text ( #115719 )
2026-07-29 04:03:12 -04:00
b2cc5f5042
fix(memory): promote durable facts after repeated recall ( #115715 )
...
* fix(memory): calibrate promotion gate defaults
* docs: refresh generated docs map
2026-07-29 03:51:59 -04:00
dd459ac1d7
refactor(memory): deduplicate promotion and CLI flows ( #115706 )
2026-07-29 03:29:48 -04:00
ddd0b48673
refactor: remove 3,527 lines of runtime and test duplication ( #115626 )
...
* refactor: remove obsolete runtime and test duplication
* test: preserve typed cron and realtime fixtures
2026-07-29 02:21:20 -04:00
1084f6dda8
fix(memory): preserve Unicode in short-term promotion ( #115591 )
...
Use the existing surrogate-safe helpers at the dreaming lead and heading boundaries. Preserve contributor investigations in #107882 and #107910 .
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-29 01:29:43 -04:00
d41a56fca1
feat(memory): isolate curated entries by project ( #115438 )
...
* feat(memory): scope recall to active projects
* feat(memory): preserve project scope in promotion
* docs(memory): explain project-scoped recall
* fix(memory): chunk curated files per entry
* refactor(memory): narrow project scope internals
* fix(memory): exclude annotations from concept tags
* fix(memory): tighten project isolation boundaries
* fix(memory): preserve project path casing
* fix(memory): prioritize project bootstrap candidates
* docs: refresh memory architecture map
* test(memory): cover project scope schema repair
* fix(memory): complete project isolation paths
* fix(memory): close project ranking checks
* fix(memory): reinitialize search provider before ranking
* fix(memory): tolerate missing bootstrap paths
2026-07-28 23:55:49 -04:00
5922dd4380
fix(memory): fall back to keyword search when embeddings cannot start ( #115397 )
...
* fix(memory): degrade bootstrap failures to keyword search
* docs(memory): clarify recovery status projection
* fix(memory): handle bootstrap embedding failures
* fix(memory): trust resolved provider diagnostics
* fix(memory): keep degraded syncs keyword-only
* fix(memory): confirm embedding recovery before semantic mode
* fix(memory): restore semantic readiness after recovery
2026-07-28 21:01:44 -04:00
5578d01777
test: remove stale persisted session file identity ( #115442 )
2026-07-29 00:55:13 +01:00
811444d6db
fix(memory-core): avoid cubic MMR similarity rescans ( #113359 )
...
* fix(memory): avoid cubic MMR similarity rescans
* style(memory-core): oxfmt mmr.test.ts
* test(memory-core): allow packed CI integration tests
* fix(ci): serialize targeted memory-core tests
* fix(ci): pin agentic cli worker count
---------
Co-authored-by: Vincent Koc <vincentkoc@ieee.org >
2026-07-29 03:53:43 +08:00
ca48f6c0fb
feat(memory): backfill past sessions from Control UI ( #115266 )
...
* feat(memory): expose session backfill gateway methods
* feat(ui): add session memory backfill controls
* fix(memory): keep session backfill internals private
2026-07-28 12:57:21 -04:00
bb06e0fbcc
fix(memory-core): recover dreaming cron reconciliation ( #115174 )
...
Co-authored-by: IWhatsskill <284122573+IWhatsskill@users.noreply.github.com >
2026-07-28 11:51:34 -04:00
10c6c0cb98
fix(memory-core): dream diary stays empty because narrative sessions have no agent scope ( #115069 )
...
* fix(memory-core): scope dream narrative sessions to their owning agent
Dreaming narratives built unscoped subagent session keys
(`dreaming-narrative-<phase>-<hash>`). Sessions live in per-agent SQLite
stores, so the plugin-runtime ownership pre-check could not resolve a store
and every narrative call failed with "Cannot resolve SQLite session scope
without an agent id" — the whole diary pipeline produced nothing while the
sweep still logged "dreaming promotion complete".
The agent id was available all along: `resolveMemoryDreamingWorkspaces`
returns it per workspace and the hook context carries the triggering agent.
Both were dropped. Session keys are now `agent:<id>:dreaming-narrative-...`,
while runIds stay unscoped so the orphan-transcript scrub marker still
matches. An unexpected narrative failure now writes the same dated fallback
diary entry the other failure branches write, and the promotion summary
warns instead of informing when every workspace failed.
* fix(memory-core): narrow the narrative export surface and type the sweep test double
* test(memory-core): drop the now-unused missing-path helper
* fix(memory-core): scope the narrative run id and keep empty sweeps a no-op
* fix(memory-core): route the ownerless narrative fallback through detached dispatch
2026-07-28 08:15:37 -04:00
f0bf74bad4
feat(memory): backfill retained session transcripts ( #115162 )
...
* feat(memory): enumerate retained session transcripts
* feat(memory): add session transcript backfill
* test(memory): cover session backfill workflows
* docs(memory): document session transcript backfill
* fix(memory): preserve oldest session backfill ordering
* fix(memory): harden session archive backfill
* test(memory): prove owner-turn provenance gating
* fix(memory): persist session backfill progress
* fix(memory): preserve ranged backfill progress
* fix(memory): order per-file backfill candidates
* fix(memory): retain paged backfill diary entries
* fix(memory): preserve rem backfill diary history
* fix(memory): adapt backfill to retained session identity
* fix(memory): keep rem backfill preview-only
* fix(memory): satisfy backfill CI guards
2026-07-28 08:12:30 -04:00
e834293747
test(memory): align QMD alias identity fixture ( #115150 )
2026-07-28 07:07:44 -04:00
28630a9a65
feat(memory): provenance-gated memory with dreaming on by default ( #114819 )
...
* feat(memory): add provenance and recall metadata to the memory index
* feat(memory): provenance-gated promotion and capture hygiene
* feat(dreaming): LLM consolidation with deterministic gates, on by default
* feat(active-memory): deterministic recall lane with escalation default
* feat(memory): user model file and standing intents
* docs(memory): document the memory architecture
* fix(memory): live-QA fixes — metadata writers, provenance classes, intent scope, claim accumulation
2026-07-28 06:04:25 -04:00
4273ca9dbd
refactor(sessions): remove file-era transcript runtime ( #113233 )
...
* refactor(sessions): keep helper transcripts in memory
* refactor(sessions): remove file-era transcript storage
* test(sessions): use SQLite identity in attempt persistence
* test(codex): isolate legacy transcript fixtures
* fix(sessions): preserve SQLite transcript identity
* fix(sessions): harden transcript lifecycle invariants
* fix(sessions): validate transcript identities
* fix(sessions): close identity compatibility gaps
* fix(sessions): preserve leaf and plugin identities
* fix(sessions): retain dispatch transcript targets
* fix(sessions): preserve active transcript context
* fix(sessions): isolate artifact accounting
* fix(sessions): bound SQLite usage accounting
* fix(sessions): retain bounded latest usage
* fix(sessions): align rebased transcript targets
* test(sessions): align accessor scope fixture
* fix(telegram): derive SQLite transcript identity
* refactor(sessions): remove file-era compaction residue
* chore(sessions): lower max-lines baseline
* fix(sessions): preserve structured transcript identity
* test(sessions): align doctor identity assertions
* fix(sessions): isolate default SDK database
* refactor(sessions): remove dead file-era exports
* fix(sessions): reconcile SQLite transcript identity
* fix(sessions): pass checkpoint identity explicitly
* test(sessions): make entry field probe explicit
* test(sessions): satisfy transcript cleanup lint
* test(sessions): align diagnostics identity proof
* fix(sessions): finish transcript runtime teardown
* fix(sessions): preserve transcript identity invariants
* fix(sessions): harden transcript compatibility edges
* fix(sessions): preserve checkpoint transcript anchors
* fix(sessions): preserve SQLite lifecycle invariants
* fix(sessions): retarget compaction successors
* test(sessions): preserve transcript fixture semantics
* feat(plugin-sdk): add command transcript targets
* fix(sessions): serialize transcript rewrites
* fix(sessions): validate legacy successor identity
* fix(sessions): normalize compaction ownership
* fix(sessions): validate successor identity before adoption
* fix(sessions): preserve plugin transcript ownership
* fix(sessions): carry transcript identity through commands
* fix(sessions): import legacy checkpoint artifacts into SQLite
* fix(sessions): preserve successor transcript ownership
* fix(sessions): align transcript consumers with target identity
* fix(sessions): scope transcript token estimates
* fix(sessions): retain agent identity across lifecycle hooks
* fix(sessions): resolve scoped SQLite targets
* fix(sessions): isolate lifecycle transcript targets
* fix(sessions): validate compaction agent ownership
* fix(sessions): preserve reset and cleanup lifecycle
* fix(sessions): serialize prompt cleanup lifecycle
* fix(sessions): remove stale lock import
* fix(sessions): preserve reset target context
* fix(sessions): fence prompt reload takeover
* fix(sessions): unblock abort and default lifecycle reads
* fix(sessions): validate legacy successor scope
* fix(sessions): reject metadata-only runtime rows
* fix(sessions): propagate custom transcript stores
* fix(sessions): preserve adopted retry targets
* fix(sessions): allow unkeyed usage reads
* fix(sessions): harden runtime target boundaries
* fix(sessions): serialize retry transcript writes
* fix(sessions): bound prompt reload disposal
* fix(sessions): complete retry marker identity
* fix(sessions): keep legacy marker identity minimal
* test(sessions): tighten teardown fixture types
* fix(sessions): preserve compatibility target identity
* test(sessions): persist post-checkpoint boundary turn
* test(sessions): align runtime store mock contracts
* style(sessions): simplify persisted identity guard
* fix(sessions): prefer complete typed targets
* fix(sessions): recover legacy marker targets
* test(sessions): align marker lookup fixture scope
* fix(sessions): validate partial transcript targets
* fix(sessions): reconcile partial transcript identities
* fix(sessions): canonicalize compatibility identities
* test(sessions): cover compatibility aliases
* fix(sessions): adopt legacy successor identity
* fix(sessions): preserve usage read identity
* fix(sessions): preserve partial marker compatibility
* fix(sessions): validate legacy successor mappings
* fix(sessions): reconcile marker store mappings
* fix(sessions): preserve legacy fallback identity
* fix(sessions): harden marker alias resolution
* fix(sessions): prefer verified successor aliases
* fix(sessions): resolve preferred marker aliases
* fix(sessions): serialize cleanup admission
* fix(sessions): align marker lookup scopes
* fix(codex): type marker alias summaries
* style(sessions): satisfy changed lint
* test(sessions): align structured target assertions
* fix(sessions): reconcile latest identity contracts
* fix(sessions): validate transcript identity boundaries
* docs(sessions): explain stable registry keys
* fix(sessions): harden compatibility target round trips
* fix(sessions): port usage identity to split modules
* test(sessions): align subagent transcript identity
* fix(sessions): finish transcript identity migration
* fix(agents): route subagent completion capture through transcript targets
* fix(agents): settle SQLite prompt handoff during cleanup
* chore: shrink max-lines baseline after teardown
* fix(sessions): port teardown across split runtime owners
* fix(sessions): carry transcript targets through split owners
* test(agents): use SQLite compaction target in abort coverage
* chore: retain unrelated max-lines suppressions
* chore: shrink max-lines baseline after main splits
* style(agents): const compaction checkpoint locals
* fix(sessions): harden SQLite teardown boundaries
* test(sessions): use typed metadata in predicate isolation fixture
* test(agents): cover malformed settlement rejections lint-safely
* fix(sessions): close remaining SQLite identity races
* fix(agents): fail closed on incomplete successor targets
* fix(sessions): preserve transcript identity fallbacks
* fix(agents): preserve session-key abort admission
* fix(trajectory): validate incomplete export targets
* test(sessions): drop retired pricing cache imports
* fix(sessions): validate partial transcript identities
* fix(sessions): close transcript identity edge cases
* fix(plugins): reserve retired transcript locator slot
* fix(sessions): scope transcript locks by target
* style(sessions): simplify SDK initialization error
* fix(sessions): preserve initialized transcript state
* fix(codex): verify mirrored history session keys
* fix(sessions): reject stale transcript ownership
* fix(sessions): anchor asynchronous transcript ownership
* fix(sessions): measure active transcript state
* fix(sessions): preserve scoped transcript compaction
* fix(sessions): harden transcript identity and lifecycle
* fix(sessions): resolve scoped command transcript stores
* fix(sessions): make transcript appends failure-atomic
* fix(sessions): enforce scoped transcript ownership
* fix(sessions): reject cross-owner transcript handoffs
* fix(sessions): fence cleanup transcript ownership
* fix(sessions): retire stale write ownership contexts
* fix(sessions): preserve pending session migration state
* fix(sessions): validate migrated transcript ownership
* fix(sessions): validate usage transcript targets
* fix(sessions): clear predecessor transcript metadata
* fix(sessions): align durable session event targets
* fix(sessions): fence late prompt handoffs
* fix(sessions): fence lifecycle transcript fallbacks
* fix(sessions): bound zero-length memory capture
* fix(sessions): preserve transcript teardown ownership
* fix(sessions): reject duplicate cleanup ownership
* fix(sessions): serialize runtime writes with sqlite leases
* fix(sessions): close sqlite teardown concurrency gaps
* fix(sessions): preserve nested lifecycle failures
* fix(sessions): canonicalize sqlite transcript ownership
* fix(sessions): settle disposed prompt handoffs
* fix(sessions): resolve canonical attempt lock targets
* test(sessions): align canonical target fixtures
* test(sessions): retire redundant jsonl parser coverage
* refactor(sessions): split active transcript cursors
* test(memory): retire legacy marker fixture
* fix(sessions): preserve canonical transcript access after rebase
* fix(sessions): fence prompt lease and return transcript targets
* fix(sessions): colocate transcript leases with target store
* fix(sessions): canonicalize transcript lease and worker targets
* fix(sessions): preserve plugin and fork identity markers
* fix(sessions): complete sqlite transcript target migration
* fix(sessions): integrate canonical followup identity
* fix(sessions): preserve bounded transcript topology
* fix(sessions): validate transcript identity boundaries
* fix(context): separate caller and successor targets
* test(sessions): split persistence compatibility coverage
* test(sessions): preserve fixture topology efficiently
* chore(sdk): refresh plugin api baseline
* test(agents): align compaction lock target mocks
* test(sessions): seed malformed transcript fixtures directly
* fix(agents): canonicalize transcript compatibility inputs
* fix(agents): type optional tool result ids
* test(ci): stabilize loaded process timing
* test(tui): wait for collect queue admission
2026-07-27 22:33:24 -04:00
960b050add
refactor(extensions): remove orphaned shadow trial and retired config aliases ( #114709 )
...
* refactor(memory-core): remove orphaned shadow trials
* refactor(qqbot): migrate direct voice upload formats
Release note: QQBot configs using voiceDirectUploadFormats now migrate through openclaw doctor --fix to audioFormatPolicy.uploadDirectFormats at root and account scope. Existing nested uploadDirectFormats values win conflicts, and runtime reads only the nested policy.
* refactor(feishu): migrate tools base alias
Release note: Feishu configs using tools.base now migrate through openclaw doctor --fix to tools.bitable at root and account scope. Existing bitable values win conflicts, and runtime accepts only the canonical key.
* refactor(extensions): remove dead runtime state
* chore(config): refresh bundled channel metadata
* refactor(codex): keep realtime fallback type private
* test(ci): align QA compatibility scenario count
2026-07-27 17:12:41 -04:00
600fac1cf7
fix(memory-core): prune dangling recall refs during repair ( #114419 )
...
* fix(memory-core): prune dangling recall refs during repair
* refactor(memory-core): clarify dangling audit count
---------
Co-authored-by: Luka Dolenc <266726612+DolencLuka@users.noreply.github.com >
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-27 13:54:01 -04:00
669db2968f
refactor(agents): retire TOOLS.md into an AGENTS.md section with a doctor migration ( #113966 )
...
* fix(agents): stop retired attestation hashes from faking a vanished workspace
* feat(agents): migrate TOOLS.md content into the AGENTS.md tools section
* refactor(agents): drop TOOLS.md from the workspace bootstrap set
* refactor(policy): read tool policy entries from AGENTS.md
* docs: describe local tool notes as an AGENTS.md section
* test(codex): drop TOOLS.md developer-instruction coverage with the removed path
* test(agents): cover the TOOLS.md doctor migration behaviors
* refactor(doctor): satisfy TOOLS.md migration lint
* test(agents): split workspace attestation survival coverage
* refactor(codex): simplify workspace context basenames
* refactor(doctor): keep TOOLS.md migration helpers module-local
* docs: regenerate docs map
* fix(doctor): keep migration claims fresh
* fix(doctor): preserve nested tool notes
* refactor(doctor): split tools migration helpers
* refactor(doctor): limit TOOLS.md migration to workspace root
* style(doctor): keep migration under line limit
* fix(doctor): recover interrupted AGENTS publish
* docs(hooks): describe root-only TOOLS.md migration accurately
* fix(doctor): preserve migrated tool guidance visibility
* test(agents): regenerate prompt snapshots after rebase
* fix(policy): block evaluation while TOOLS.md is unmigrated
* fix(doctor): check merged bootstrap budget per agent
* fix(doctor): keep budget helper internal
* refactor(doctor): keep migration budget helpers to their consumers
2026-07-27 03:56:30 -04:00
1c42998f0d
refactor(retry): consolidate abort-safe ClawHub and memory retries ( #114300 )
...
* refactor(retry): reuse canonical abort-safe retry policies
* fix(retry): keep retry-after parsing source-safe
2026-07-27 01:25:40 -04:00
d7627d6f4c
refactor(prompt): use plain inbound context labels and drop system-tag sanitizer ( #112000 )
...
* refactor(prompt): plain inbound context labels with a provenance marker
Replaces trust-worded inbound context labels ("(untrusted metadata)",
"(untrusted, for context)") with plain labels plus a fixed provenance
marker suffix appended to every OpenClaw-injected context header.
Detection keys on the marker, not label text, so strippers stay correct
across UI, TUI, replay, /trace segmentation, memory recall, and the Swift
chat preprocessor. Drops sanitizeInboundSystemTags in favor of the marker
boundary plus trusted system-prompt narration.
Renames the untrusted-named plugin SDK context identifiers to
channel-provenance names, keeping deprecated aliases registered for
removal after 2026-09-08.
Adds `openclaw doctor --fix` migrations that rewrite legacy inbound
labels in stored SQLite transcripts and purge legacy envelope-
contaminated LanceDB recall rows.
* fix(ci): resolve gate failures for plain inbound context labels
- doctor sqlite readers: open read-only connections via openNodeSqliteDatabase
so the Kysely connection-boundary guardrail holds; unexport the now-internal
transcript snapshot type (Knip unused-export gate).
- compat registry: split the record table into registry-records.ts and
plugin-sdk-subpath-records.ts. The new compat record pushed registry.ts past
the 700-line oxlint cap; suppressions are disallowed, so follow the existing
sibling record-module pattern. Public exports and PluginCompatCode literals
unchanged.
- acp-runtime test: assert current finalization behavior (newline normalization
only). The bracket de-fang and System: rewrite it expected were removed with
sanitizeInboundSystemTags; forged system lines are neutralized at the
system-event queue, the single chokepoint feeding the System:-per-line render.
- regenerate docs_map and the plugin SDK API baseline manifest.
* fix(prompt): harden inbound context label migration and drop in-band sanitizer
Review follow-ups on the plain-label + provenance-marker change:
- Remove src/security/system-tags.ts. Rewriting inbound text to neutralize
look-alike `System:`/`[System]` markers corrupted legitimate user text and is
not a real injection boundary; role separation plus external-content wrapping
is. Explicit product decision, recorded at the system-event queue.
- Narrow the LanceDB legacy-row purge so it cannot delete benign memories. It
now requires a complete known legacy sentinel line, a legacy label followed by
a fenced JSON body, or the complete legacy external-content header. The prior
predicates matched ordinary prose such as `Notes (untrusted metadata):`, and
deletion is irreversible.
- Make explicit-empty canonical ChannelStructuredContext win over the deprecated
alias via a present/absent result instead of collapsing `[]` to undefined.
- Keep `\r?` in the active-memory doctor rule. It is the only rule spanning the
header's line break, migrated assistant rows skip newline normalization, and
without it the marked-header replace wins and the body strips to empty. Added
a CRLF regression test.
- Fix stale comments that described removed behavior, and cover the Swift
prose-block strip path.
Claude-Session: https://claude.ai/code/session_01WNzsPddQmxy9Y7jKD4wAxH
2026-07-27 11:27:53 +10:00
43a695396d
test(memory): mock admitted search sync ( #114096 )
2026-07-26 07:33:24 -04:00
6bd8e0387c
fix(memory): close previous embedding provider before replacement ( #113471 )
...
* fix(memory): close previous embedding provider before replacement
* fix(memory): increase embedding worker close grace period for slow hosts
* fix(memory): clear this.provider after close in resetProviderInitializationForRetry
Co-authored-by: Sanjay Santhanam <notifications@github.com >
* fix(memory): serialize embedding provider replacement
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): unify provider transition lifecycle
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): join worker shutdown lifecycle
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): block worker restart during close
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): retain failed provider retirements
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): drain retirements on manager close
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): make worker close joinable
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): preserve sync before provider retirement
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): separate worker exit from disposal errors
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): avoid shutdown admission gap
Co-authored-by: yt2102 <yt2102@qq.com >
* style(memory): format provider lifecycle fix
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): bound embedding worker termination
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): fail closed on fallback initialization errors
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): retry primary after fallback creation failure
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): retain disconnected embedding workers until exit
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): isolate shared fallback transition failures
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): serialize scoped manager retirement
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): retain failed global manager closes
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): serialize manager admission with teardown
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): serialize outer manager lifecycle
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(gateway): close request-scoped embedding providers
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): retire qmd managers before replacement
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(gateway): support synchronous embedding cleanup
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): isolate manager lifecycle scopes
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(cli): close request-scoped embedding providers
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): canonicalize manager lifecycle ownership
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): retry primary after null fallback result
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(gateway): retain failed embedding provider closes
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(gateway): lease closable embedding providers
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(gateway): drain retained embedding providers
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): join lazy fallback teardown
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(gateway): drain embedding providers after HTTP close
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): retain failed qmd candidate cleanup
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): aggregate retained qmd teardown failures
Co-authored-by: yt2102 <yt2102@qq.com >
* refactor(memory): keep qmd lifecycle policy unchanged
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): retain failed worker construction clients
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(gateway): scope local embedding retirement by provider
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): drain provider generations before retirement
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): drain admitted operations before teardown
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): preserve provider identity through vector search
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): lease provider generation through embedding
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): lease provider through index publication
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): keep sync harness hooks optional
Co-authored-by: yt2102 <yt2102@qq.com >
* refactor(memory): own generations in sync lifecycle
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): preserve query runtime across retirement
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): pin FTS-only sync generations
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): retry failed worker construction cleanup
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): drain admitted searches before closing
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): close manager and gateway admission races
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): serialize qmd wrapper replacement
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): serialize failed qmd retirement
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): satisfy qmd lifecycle type and deadcode gates
Co-authored-by: yt2102 <yt2102@qq.com >
* test(memory): type qmd lifecycle doubles
Co-authored-by: yt2102 <yt2102@qq.com >
* style(gateway): clarify created embedding provider
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): drain availability probes before close
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): preserve cleanup ownership without blocking fallback
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): retire lancedb embedding providers
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): preserve generic provider cleanup receiver
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): close lancedb CLI embeddings
Co-authored-by: yt2102 <yt2102@qq.com >
* test(memory): normalize abort rejection reason
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): retain lancedb provider retirements
Co-authored-by: yt2102 <yt2102@qq.com >
* fix(memory): drain lancedb embedding uses
Co-authored-by: yt2102 <yt2102@qq.com >
---------
Co-authored-by: Sanjay Santhanam <notifications@github.com >
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-26 03:00:22 -04:00
99d8d90572
refactor(memory-core): split CLI runtime ( #114013 )
...
* refactor(memory-core): split CLI runtime
* refactor(memory-core): narrow CLI helper exports
* test(memory-core): follow secret resolver split
2026-07-25 21:37:59 -07:00
6d6f36a8a5
refactor(memory-core): separate dreaming state codec ownership ( #113949 )
2026-07-25 18:22:44 -07:00
93a0fdb9b8
fix(release): align extension validation contracts ( #113919 )
2026-07-25 17:07:51 -07:00
9a7a5791c7
refactor(memory): split QMD manager by domain ( #113659 )
...
* refactor(memory): split QMD manager by domain
* refactor(memory): keep QMD base types private
2026-07-25 06:18:05 -07:00
48ab15851b
test: consolidate Slack and QMD matrices ( #113574 )
2026-07-25 01:53:49 -07:00
2942678214
refactor(memory): split retained state migrations ( #113542 )
2026-07-25 01:03:35 -07:00
1e93465a2a
refactor(sqlite): enforce one database connection boundary ( #113418 )
...
* refactor(sqlite): centralize database opens
* test(sqlite): mock connection owner boundary
2026-07-24 15:15:17 -07:00
Yuval Dinodia