81f291db58
perf(sessions): watermark-cache derived titles and single-pass list filtering ( #114842 )
...
* perf(sessions): watermark-cache derived titles and single-pass list filtering
* refactor(sessions): split title reader and transcript watermark modules
The origin/main merge pushed session-transcript-readers.ts and
session-accessor.sqlite-active-events.ts over the max-lines ceiling.
Move the title-read feature (bounded probes + watermark cache) into
session-transcript-title-reader.ts and the watermark reader into
session-accessor.sqlite-transcript-watermark.ts; update callers.
2026-07-27 23:56:30 -04:00
cba26e3b68
fix(pr): bind review artifacts to the PR being landed ( #114897 )
...
scripts/pr review artifacts carried no PR identity, so a review authored for
another PR validated clean and could gate someone else's landing. Stamp both
review.json and review.md with the reviewed PR number and head, anchor
pr-meta.json to the guarded pr-meta.env, and re-stamp foreign artifacts on init
instead of silently adopting them. review-claim now works in the PR worktree so
no subcommand writes review state to the shared canonical checkout.
2026-07-27 23:55:21 -04:00
938749180e
refactor(nodes)!: retire arming leases for durable capability enablement ( #114892 )
...
* refactor(nodes): retire phone control leases
* fix(doctor): clean retired phone control state
* docs(nodes): document durable capability enablement
* docs(changelog): defer node enablement note
* fix(doctor): harden retired phone control cleanup
* fix(doctor): fail closed on unreadable lease state
* fix(doctor): validate retired lease journals
* fix(doctor): preserve deny-shadowed consent
* docs: refresh node authorization map
* fix(doctor): keep retirement helpers private
2026-07-27 23:51:30 -04:00
77e1f213b6
fix(gateway): restore observer delivery and fence companion ( #114898 )
2026-07-27 23:49:04 -04:00
cf4cb0ac85
feat(agents): report per-run stats (code-mode engagement, round trips, cost) in agent JSON envelopes ( #114688 )
...
* feat(agents): add per-run stats to embedded agent run meta
Adds codeModeEngaged, assistantTurns, bridgeCalls, and costUsd to
EmbeddedAgentRunMeta.agentMeta and mirrors them on the agent exec --json
envelope. Code-mode engagement is stamped from the tool-surface truth,
round trips accumulate across attempts beside usage, bridge counts come
from the run's tool-search catalog counters, and cost reuses the shared
model pricing helpers (cache tiers included, omitted without cost data).
* fix(agents): accumulate bridge call counts across run attempts
Attempt cleanup clears the per-attempt tool-search catalog, so retries and
fallbacks discarded earlier bridge counts. Fold each attempt's bridgeCalls
into the run accumulator beside assistantTurns and stamp the cumulative
totals into agentMeta, matching the documented per-run contract.
2026-07-27 23:48:01 -04:00
e1ced6de50
fix(code-mode): preserve concurrent tool execution safely ( #114884 )
...
* fix(code-mode): preserve concurrent tool execution safely
* fix(code-mode): keep worker settlement type private
2026-07-27 23:45:21 -04:00
0297f0ed39
test(ai): freeze packed-package and stream parity contracts ( #114843 )
...
* test(ai): freeze provider and package parity
* refactor(ai): remove provider transport package cycles
* fix(ai): drop unused stream-options re-export
2026-07-27 23:43:57 -04:00
1153ef4c4d
chore(plugin-sdk): refresh API baseline
2026-07-27 22:40:32 -05:00
1c65628fe8
fix(auth): keep OAuth refresh policy provider-owned
2026-07-27 22:40:32 -05:00
0ba4adb1cb
test(github-copilot): type token exchange fetch mock
2026-07-27 22:40:32 -05:00
5249b617ec
test(github-copilot): keep token exchange helper private
2026-07-27 22:40:32 -05:00
e9414c684b
fix(github-copilot): preserve expired legacy profiles
2026-07-27 22:40:32 -05:00
a706d49cdb
refactor(github-copilot): own runtime request identity
2026-07-27 22:40:32 -05:00
3da4ef3a6c
fix(github-copilot): format legacy oauth credentials
2026-07-27 22:40:32 -05:00
7c980eaec0
docs(github-copilot): update runtime auth contract
2026-07-27 22:40:32 -05:00
fbd6b842f9
fix(github-copilot): authenticate fine-grained tokens
2026-07-27 22:40:32 -05:00
f229356689
fix(slack): preserve native tables during outbound delivery ( #111955 )
...
* fix(slack): preserve rendered presentations across cloning
* test(slack): cover serialized presentation provenance
* test(slack): prove restart fallback for rendered payloads
- Reload the Slack adapter to simulate a runtime restart.
- Verify stale rendered provenance falls back to text without blocks.
* fix(slack): fail closed on invalid rendered metadata
---------
Co-authored-by: Pavonis <pavonis@martian.engineering >
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-27 23:39:20 -04:00
aa26ecfac1
fix(android): Wear Talk works after exiting and reopening ( #112383 )
...
* fix(android): scope Wear Talk client to ViewModel
* test(android): exercise Wear ViewModel factory lifecycle
Co-authored-by: NianJiuZst <180004567+NianJiuZst@users.noreply.github.com >
---------
Co-authored-by: NianJiuZst <180004567+NianJiuZst@users.noreply.github.com >
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-27 23:35:10 -04:00
7ebd486ed1
fix(googlechat): media downloads can grow unbounded without a size cap ( #98425 )
...
* fix(googlechat): bound uncapped media downloads
* fix(googlechat): align media download cap
2026-07-27 23:29:00 -04:00
7653bcce58
fix(agents): classify Google invalid API keys as auth ( #114825 )
2026-07-27 23:26:56 -04:00
478a895623
fix(voice-call): keep custom tail cursor aligned with short reads ( #108322 )
...
* fix(voice-call): keep custom tail cursor aligned with short reads
* test(voice-call): preserve timer behavior after rebase
* fix(voice-call): reset custom tail after short-read truncation
* style(voice-call): format custom log regression
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-27 23:25:11 -04:00
a84ea8b732
fix(ios): suppress stale delayed UI actions ( #113062 )
...
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-27 23:19:07 -04:00
b168e4b5ed
fix: align macos remote url validation copy ( #98548 )
...
* fix: align macos remote url validation copy
* fix(macos): match remote URL guidance to policy
Co-authored-by: haruaiclone-droid <281899875+haruaiclone-droid@users.noreply.github.com >
* chore(i18n): refresh native source inventory
Co-authored-by: haruaiclone-droid <281899875+haruaiclone-droid@users.noreply.github.com >
---------
Co-authored-by: haruaiclone-droid <281899875+haruaiclone-droid@users.noreply.github.com >
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-27 23:18:41 -04:00
124911aee0
fix: prevent cron and Workboard lifecycle regressions ( #114865 )
...
* fix: harden cron and Workboard lifecycle races
* fix: use canonical card identity for Workboard drops
2026-07-27 23:17:15 -04:00
ac795a5821
perf(skills): build snapshot cache key lazily ( #114584 )
...
Co-authored-by: VACInc <3279061+VACInc@users.noreply.github.com >
2026-07-27 23:16:27 -04:00
d7622734d5
feat(code-mode): unify node MCP namespaces ( #114876 )
2026-07-27 23:07:06 -04:00
5723d36b46
fix(doctor): honor configured plugin load paths ( #113200 )
2026-07-27 23:06:01 -04:00
8d682b74bd
test(messages): lock external alias authorization order
2026-07-27 22:05:04 -05:00
e0a119dabf
fix(channels): own account status in one closed state machine ( #114775 )
...
* refactor(channels): own account status in one closed state machine
* fix(gateway): stop storing derived reasons and configured in channel runtime
* fix(channels): separate linkage from configuration in whatsapp and zalo personal
* fix(cli): render channel state reasons apart from runtime failures
* refactor(channels): keep account-state projection internal to its owner
2026-07-27 23:04:28 -04:00
ea707382fd
feat(code-mode): first-class nodes API ( #114877 )
...
* feat(agents): add nodes to code mode
* fix(agents): add code mode nodes discovery hint
2026-07-27 23:03:23 -04:00
b244adf430
fix: speed up Control UI startup model projection ( #114605 )
...
Co-authored-by: VACInc <3279061+VACInc@users.noreply.github.com >
2026-07-27 23:01:01 -04:00
a0530259e2
fix(ui): preserve navigation during startup ( #114828 )
2026-07-27 23:00:04 -04:00
feb5883089
docs: add Buzz to generated plugin inventory ( #114875 )
...
* docs: refresh Buzz plugin inventory
* docs: refresh generated docs map
2026-07-27 22:59:32 -04:00
073f7a9ba2
improve(agents): avoid duplicate subagent registry write ( #114705 )
...
* perf(agents): avoid duplicate subagent registry write
* fix(agents): isolate subagent task runtime origin
---------
Co-authored-by: VACInc <3279061+VACInc@users.noreply.github.com >
2026-07-27 22:57:31 -04:00
eeba5a3433
fix(tui): prevent unsafe errors and out-of-order streamed replies ( #114869 )
...
* fix(tui): redact and sanitize terminal errors
Co-authored-by: Marnie0415 <xzh110415@gmail.com >
* fix(tui): keep streamed answers and tools chronological
Co-authored-by: Foxy6670 <snorblok@gmail.com >
* fix(tui): keep revised answers after tool calls
Co-authored-by: Foxy6670 <snorblok@gmail.com >
* fix(tui): discard retracted streamed assistant rows
Co-authored-by: Foxy6670 <snorblok@gmail.com >
---------
Co-authored-by: Marnie0415 <xzh110415@gmail.com >
Co-authored-by: Foxy6670 <snorblok@gmail.com >
2026-07-27 22:56:58 -04:00
577a0642fa
fix(plugin-sdk): classify loopback hosts consistently ( #114832 )
...
* fix(plugin-sdk): expose loopback host classifier
* fix(ollama): remove stale host normalizer import
* chore: keep release notes in PR context
2026-07-27 22:55:44 -04:00
b4e246be01
fix(line): preserve webhook object error details ( #113606 )
...
* fix(line): preserve webhook object error details
* fix(line): preserve structured errors on the live webhook route
* test(line): provide the complete typed runtime to webhook proof
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-27 22:46:21 -04:00
f2a12916d7
fix(codex): refuse Platform routes on a subscription-signed native Codex home ( #114719 )
...
A user-home app-server keeps its native Codex account, and OpenClaw verified only
half of that contract. A subscription route was checked against the native
account, but a Platform (API-key) route was not: an operator signed in to Codex
with a ChatGPT subscription who selected an API-billed model silently spent their
plan. Both directions of the same billing boundary now share one account/read
check. An absent account is left alone, since a native home may serve a custom
model provider that reports no OpenAI account at all.
The home-scope rule behind #114397 was also expressed four times: two
prepared-auth call sites spread it in conditionally from raw plugin config, two
others read resolved start options, and the supervision connection applied its
own default inline. resolveCodexAppServerHomeScope now owns it, and homeScope is
a required argument of resolveCodexAppServerPreparedAuthHandoff, so a new call
site that forgets it fails to compile instead of failing every turn.
Docs dropped the stale user-home paragraph that still described the startup
failure #114397 removed and told operators to delete a working OpenAI profile.
2026-07-27 22:42:18 -04:00
4273ca9dbd
refactor(sessions): remove file-era transcript runtime ( #113233 )
...
* refactor(sessions): keep helper transcripts in memory
* refactor(sessions): remove file-era transcript storage
* test(sessions): use SQLite identity in attempt persistence
* test(codex): isolate legacy transcript fixtures
* fix(sessions): preserve SQLite transcript identity
* fix(sessions): harden transcript lifecycle invariants
* fix(sessions): validate transcript identities
* fix(sessions): close identity compatibility gaps
* fix(sessions): preserve leaf and plugin identities
* fix(sessions): retain dispatch transcript targets
* fix(sessions): preserve active transcript context
* fix(sessions): isolate artifact accounting
* fix(sessions): bound SQLite usage accounting
* fix(sessions): retain bounded latest usage
* fix(sessions): align rebased transcript targets
* test(sessions): align accessor scope fixture
* fix(telegram): derive SQLite transcript identity
* refactor(sessions): remove file-era compaction residue
* chore(sessions): lower max-lines baseline
* fix(sessions): preserve structured transcript identity
* test(sessions): align doctor identity assertions
* fix(sessions): isolate default SDK database
* refactor(sessions): remove dead file-era exports
* fix(sessions): reconcile SQLite transcript identity
* fix(sessions): pass checkpoint identity explicitly
* test(sessions): make entry field probe explicit
* test(sessions): satisfy transcript cleanup lint
* test(sessions): align diagnostics identity proof
* fix(sessions): finish transcript runtime teardown
* fix(sessions): preserve transcript identity invariants
* fix(sessions): harden transcript compatibility edges
* fix(sessions): preserve checkpoint transcript anchors
* fix(sessions): preserve SQLite lifecycle invariants
* fix(sessions): retarget compaction successors
* test(sessions): preserve transcript fixture semantics
* feat(plugin-sdk): add command transcript targets
* fix(sessions): serialize transcript rewrites
* fix(sessions): validate legacy successor identity
* fix(sessions): normalize compaction ownership
* fix(sessions): validate successor identity before adoption
* fix(sessions): preserve plugin transcript ownership
* fix(sessions): carry transcript identity through commands
* fix(sessions): import legacy checkpoint artifacts into SQLite
* fix(sessions): preserve successor transcript ownership
* fix(sessions): align transcript consumers with target identity
* fix(sessions): scope transcript token estimates
* fix(sessions): retain agent identity across lifecycle hooks
* fix(sessions): resolve scoped SQLite targets
* fix(sessions): isolate lifecycle transcript targets
* fix(sessions): validate compaction agent ownership
* fix(sessions): preserve reset and cleanup lifecycle
* fix(sessions): serialize prompt cleanup lifecycle
* fix(sessions): remove stale lock import
* fix(sessions): preserve reset target context
* fix(sessions): fence prompt reload takeover
* fix(sessions): unblock abort and default lifecycle reads
* fix(sessions): validate legacy successor scope
* fix(sessions): reject metadata-only runtime rows
* fix(sessions): propagate custom transcript stores
* fix(sessions): preserve adopted retry targets
* fix(sessions): allow unkeyed usage reads
* fix(sessions): harden runtime target boundaries
* fix(sessions): serialize retry transcript writes
* fix(sessions): bound prompt reload disposal
* fix(sessions): complete retry marker identity
* fix(sessions): keep legacy marker identity minimal
* test(sessions): tighten teardown fixture types
* fix(sessions): preserve compatibility target identity
* test(sessions): persist post-checkpoint boundary turn
* test(sessions): align runtime store mock contracts
* style(sessions): simplify persisted identity guard
* fix(sessions): prefer complete typed targets
* fix(sessions): recover legacy marker targets
* test(sessions): align marker lookup fixture scope
* fix(sessions): validate partial transcript targets
* fix(sessions): reconcile partial transcript identities
* fix(sessions): canonicalize compatibility identities
* test(sessions): cover compatibility aliases
* fix(sessions): adopt legacy successor identity
* fix(sessions): preserve usage read identity
* fix(sessions): preserve partial marker compatibility
* fix(sessions): validate legacy successor mappings
* fix(sessions): reconcile marker store mappings
* fix(sessions): preserve legacy fallback identity
* fix(sessions): harden marker alias resolution
* fix(sessions): prefer verified successor aliases
* fix(sessions): resolve preferred marker aliases
* fix(sessions): serialize cleanup admission
* fix(sessions): align marker lookup scopes
* fix(codex): type marker alias summaries
* style(sessions): satisfy changed lint
* test(sessions): align structured target assertions
* fix(sessions): reconcile latest identity contracts
* fix(sessions): validate transcript identity boundaries
* docs(sessions): explain stable registry keys
* fix(sessions): harden compatibility target round trips
* fix(sessions): port usage identity to split modules
* test(sessions): align subagent transcript identity
* fix(sessions): finish transcript identity migration
* fix(agents): route subagent completion capture through transcript targets
* fix(agents): settle SQLite prompt handoff during cleanup
* chore: shrink max-lines baseline after teardown
* fix(sessions): port teardown across split runtime owners
* fix(sessions): carry transcript targets through split owners
* test(agents): use SQLite compaction target in abort coverage
* chore: retain unrelated max-lines suppressions
* chore: shrink max-lines baseline after main splits
* style(agents): const compaction checkpoint locals
* fix(sessions): harden SQLite teardown boundaries
* test(sessions): use typed metadata in predicate isolation fixture
* test(agents): cover malformed settlement rejections lint-safely
* fix(sessions): close remaining SQLite identity races
* fix(agents): fail closed on incomplete successor targets
* fix(sessions): preserve transcript identity fallbacks
* fix(agents): preserve session-key abort admission
* fix(trajectory): validate incomplete export targets
* test(sessions): drop retired pricing cache imports
* fix(sessions): validate partial transcript identities
* fix(sessions): close transcript identity edge cases
* fix(plugins): reserve retired transcript locator slot
* fix(sessions): scope transcript locks by target
* style(sessions): simplify SDK initialization error
* fix(sessions): preserve initialized transcript state
* fix(codex): verify mirrored history session keys
* fix(sessions): reject stale transcript ownership
* fix(sessions): anchor asynchronous transcript ownership
* fix(sessions): measure active transcript state
* fix(sessions): preserve scoped transcript compaction
* fix(sessions): harden transcript identity and lifecycle
* fix(sessions): resolve scoped command transcript stores
* fix(sessions): make transcript appends failure-atomic
* fix(sessions): enforce scoped transcript ownership
* fix(sessions): reject cross-owner transcript handoffs
* fix(sessions): fence cleanup transcript ownership
* fix(sessions): retire stale write ownership contexts
* fix(sessions): preserve pending session migration state
* fix(sessions): validate migrated transcript ownership
* fix(sessions): validate usage transcript targets
* fix(sessions): clear predecessor transcript metadata
* fix(sessions): align durable session event targets
* fix(sessions): fence late prompt handoffs
* fix(sessions): fence lifecycle transcript fallbacks
* fix(sessions): bound zero-length memory capture
* fix(sessions): preserve transcript teardown ownership
* fix(sessions): reject duplicate cleanup ownership
* fix(sessions): serialize runtime writes with sqlite leases
* fix(sessions): close sqlite teardown concurrency gaps
* fix(sessions): preserve nested lifecycle failures
* fix(sessions): canonicalize sqlite transcript ownership
* fix(sessions): settle disposed prompt handoffs
* fix(sessions): resolve canonical attempt lock targets
* test(sessions): align canonical target fixtures
* test(sessions): retire redundant jsonl parser coverage
* refactor(sessions): split active transcript cursors
* test(memory): retire legacy marker fixture
* fix(sessions): preserve canonical transcript access after rebase
* fix(sessions): fence prompt lease and return transcript targets
* fix(sessions): colocate transcript leases with target store
* fix(sessions): canonicalize transcript lease and worker targets
* fix(sessions): preserve plugin and fork identity markers
* fix(sessions): complete sqlite transcript target migration
* fix(sessions): integrate canonical followup identity
* fix(sessions): preserve bounded transcript topology
* fix(sessions): validate transcript identity boundaries
* fix(context): separate caller and successor targets
* test(sessions): split persistence compatibility coverage
* test(sessions): preserve fixture topology efficiently
* chore(sdk): refresh plugin api baseline
* test(agents): align compaction lock target mocks
* test(sessions): seed malformed transcript fixtures directly
* fix(agents): canonicalize transcript compatibility inputs
* fix(agents): type optional tool result ids
* test(ci): stabilize loaded process timing
* test(tui): wait for collect queue admission
2026-07-27 22:33:24 -04:00
6559e3f3b9
fix(media): keep hosted plugin media pinned ( #112515 )
2026-07-27 22:32:37 -04:00
9bcc44301b
fix(nodes): preserve gateway connections and local inference ( #114857 )
2026-07-27 22:28:32 -04:00
3806c3866b
fix(cli): keep read-only config queries from writing state ( #114847 )
...
* fix(cli): keep config queries read-only
* test(cli): preserve read-only routed config coverage
2026-07-27 22:27:00 -04:00
6de4b47203
fix(ollama): release failed discovery bodies ( #109967 )
...
* fix(ollama): release failed discovery bodies
* test(ollama): prove failed discovery sockets close
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-27 22:20:15 -04:00
c3713317b8
fix(active-memory): accept max thinking config ( #103614 )
...
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-27 22:06:00 -04:00
0b96c10aad
fix(messages): preserve policy ordering before target resolution
2026-07-27 21:04:10 -05:00
ca592adcc8
fix(messages): gate gateway action dry runs
2026-07-27 21:04:10 -05:00
d8eb6aa8d3
fix(messages): authorize external targets before resolution
2026-07-27 21:04:10 -05:00
153c4f088e
fix(channels): preserve external current target aliases
2026-07-27 21:04:10 -05:00
56d9d07516
feat(ui): match ClickClack discussion sidebars to host themes ( #114812 )
...
* feat(ui): align ClickClack discussion themes
* fix(ui): synchronize custom discussion palettes from first paint
* fix(clickclack): explicitly identify theme-aware discussion embeds
2026-07-27 22:03:58 -04:00
1292262996
fix(process): prevent concurrent scoped replacement leaks ( #114845 )
2026-07-27 22:02:33 -04:00
Peter Steinberger