Every dark palette defines --secondary with the same hex as --card, so the
markdown code chip painted with --secondary collapsed into the surface it sat
on (1.00:1 against a user bubble, 1.06-1.08:1 against the flat assistant
column) and --border was too close to the background to draw an edge. Light
mode never showed the bug because it overrode both properties.
Promote the light override into the single canonical rule: code chips and code
blocks paint --bg-muted with a --border-strong edge in every theme, and the
mode-specific overrides (including the raw rgba border) are deleted.
Also fixes the theme-contrast guard, which merged repeated `:root` blocks by
overwriting instead of merging, so the default `dark` theme resolved to an
empty token map and skipped every assertion. A new case reads the chip tokens
out of the shipped rule and asserts surface and border separation from --card
and --bg on all six themes.
* fix(ui): pin sidebar sessions optimistically in the mutation owner
Pin/unpin had no visible outcome until `sessions.patch` and the canonical
`sessions.list` refresh both landed: the row, its icon, and its section kept
the pre-click value for the whole round trip.
`createSessionMutations.patch` already owns an optimistic/rollback lifecycle
for model overrides, and the capability already exposes `patchRowLocal`, but
no pin path used it. Give the pin its own pending intent in the same owner:
flip the published row up front, chain `previous` through overlapping patches
so a rollback lands on the last Gateway-confirmed value, and let the newest
intent win when an older completion's list refresh republishes stale truth.
Retiring the connection or disposing the capability drops pending intents.
Every pin surface routes through this one operation, so the sidebar button,
the row menu, sidebar drag/drop, and the Sessions page all get the same
feedback and the same rollback. A rejected zone drop still writes no sidebar
slot: `handleSidebarZoneDrop` persists only on `completed`.
Closes#121247
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* test(ui): return only the pin harness fields the cases use
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix(ui): re-assert pending pin intents on canonical session rows
A sessions.changed event during a pin/unpin round trip queues a canonical
list replacement, and every Gateway session payload carries the server's
pre-patch pinned/pinnedAt. The optimistic row was therefore reverted to the
pre-click value until the patch resolved, restoring the no-feedback bug.
The session capability already has one seam where canonical rows become
published rows, so the pending pin joins swarm notes there instead of being
a write the next refresh can lose. Settling no longer republishes a newer
intent by hand; it only hands that intent the baseline the Gateway confirmed.
The optimistic write now moves pinned and pinnedAt together, matching the
Gateway (which derives pinned from pinnedAt) so an in-flight row cannot sort
into a slot the server would never produce.
* fix(ui): publish pin intents to every session list
The optimistic write only reached the primary session snapshot. The archived
and all sidebar filters keep their own published lists, so pinning from
either one still waited on the Gateway, and a canonical refresh landing
inside the patch window could leave them on a value the rollback never
corrected.
Both the intent and its rollback now republish through the roster's
decoration seam, so every held list lands on the same value in one pass and
a failed pin needs no extra canonical list to settle.
* fix(ui): take the pin rollback baseline from the published row
The rollback baseline came from the primary session snapshot alone. A
sidebar on archived or all renders its own subscribed list, so a row shown
only there recorded an unpinned baseline; a rejected unpin then rolled it
back to that guess and left a session the Gateway still has pinned looking
unpinned, with no refresh to correct it.
The roster owns every published list, so it answers where a row currently
is, and the mutation owner captures the baseline from that row.
* fix(ui): move a superseded pin's baseline to confirmation time
An overlapping intent's rollback baseline was rebased only after the older
patch's list refresh returned. A rejected unpin landing in that gap rolled
back to the pre-pin value, and if the refresh then failed the row stayed
unpinned while the Gateway held the pin.
The Gateway has committed once the patch resolves, so the baseline moves
there instead.
* docs(ui): record why pin intents need no rollback on connection retirement
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Gate reuse on the watcher-owned snapshot version and persisted entry manifest, while keeping safe paths process-owned and reconciling only changed skills.
Cache config fingerprints by object identity and reset them at the applied-config lifecycle owner.
Control UI declares its typography tokens once, in ui/src/styles/base.css:
--mono and --font-body. Fifteen rules asked for --font-mono / --font-sans
instead, names that only exist in other documents (canvas widget host,
provider OAuth page, MCP Apps spec keys). Those references are invalid at
computed-value time, so the declarations were dropped: nine had no fallback
and silently inherited the body font, and the four `font:` shorthand sites
lost their size, weight, and line height along with the family.
Point every reference at the canonical token and drop the now-dead generic
fallbacks so ui/src has one spelling per font token.
ui/src/styles/base-theme-tokens.node.test.ts already guards this bug class
for color tokens (#113726, #113776) but never listed the font aliases; add
them so a re-introduction fails the existing lane instead of shipping.
* perf(sessions): avoid full-store single patches
Single-session non-label patches no longer materialize the whole session store. Label uniqueness remains store-wide, and stale aliases created while queued are still rejected.
* fix(build): refresh plugin SDK API baseline
Current main's generated manifest lagged merged Plugin SDK surface changes; canonical refresh restores the baseline check.
* fix(agents): exclude private shell output from context compaction
## What Problem This Solves
Shell executions explicitly excluded from model context could still contribute their private output to session replay, token estimates, compaction boundaries, or branch summaries.
## Why This Change Was Made
The session projection owner now omits context-excluded shell messages, while compaction assigns those messages zero tokens and prevents private persisted entries from becoming retained-history cut boundaries.
## User Impact
Private shell output remains durably recorded for its intended owner without leaking into model-visible conversation context or wasting compaction budget; legitimate retained context remains intact.
## Context
Actual production code executed in an isolated VM reduced more than 20,000 characters of private output to zero model-visible characters while preserving eligible context. New owner and sibling regressions cover replay, compaction, branch summaries, and token accounting. Existing oxfmt formatting and scoped whitespace checks passed.
* test(agents): cover private Codex history projection
Use a manifest-first inventory with independent coverage for manifest-only bundled capabilities.
Retire the undocumented thread-ownership plugin while Doctor removes stale references.
Document Talk voice and persist only provider-scoped voice selection.
Closes#121353
Symlink .claude/skills -> ../.agents/skills so Claude Code sessions can load
repo skills (test-audit authoring gate, openclaw-testing, pr-maintainer)
that were previously Codex-only.
- Rename openclaw-test-audit skill to test-audit; add an authoring-gate mode
invoked whenever tests are written, not only during sweeps.
- Repair Doctrine: capture the failing repro before editing; regression tests
must fail on pre-fix code. Bug fixes default to net <=0 production LOC via
the refactor that absorbs the fix, not a bolted-on guard.
- ClawSweeper policy: production-vs-test LOC reviewMetrics entry is now
unconditional for code PRs, counted with judgment; net-positive bug-fix
deltas become risks findings with bestSolution naming the absorbing refactor.
* fix(agents): pair reset tool results within retained session history
## What Problem This Solves
Session resets selected tool-call pairs from history preceding the retained-session boundary, allowing an excluded call to incorrectly claim a retained tool result and leaving replayed conversation history inconsistent.
## Why This Change Was Made
The session-context owner now identifies the retained range before pairing reset tool calls and results. Both reset and compaction flows reuse the same canonical bounded history slice, removing duplicate scan and membership logic.
## User Impact
Reset agent sessions retain only legitimate in-window tool exchanges, repeated resets remain consistent, and cloud-worker replay receives coherent session context without resurrecting discarded calls.
## Context
Actual production-source execution reproduced the previous failure and passed after the fix across valid in-window pairs, repeated resets, and cloud-worker boundaries. Focused session-context and worker-launcher regressions cover the owner and downstream consumer. Existing oxfmt formatting and scoped whitespace checks passed; production code decreases by five lines.
* test(gateway): cover reused reset tool call ids
Operators who disabled the GPT-5 friendly interaction style now keep that preference after openclaw doctor --fix. Existing OpenAI plugin personality config remains authoritative.
Recognize Crabbox workload-routing provider exhaustion as a pre-dispatch backend outage so check:changed runs its documented local fallback.
The observed full provider-chain outage previously exited 2 without running local lanes.
The existing command-exit veto still runs first, so a remote run that actually executed and failed remains fail-closed.
Worker live events rejected tls_certificate fallback payloads because duplicated closed reason lists had drifted. Establish one canonical dependency-light fallback vocabulary and share its explicit TypeBox schema across worker and cron protocol boundaries.
Centralize global session subscription keys by agent, preserve the default-agent raw global compatibility path, and let authoritative observer audiences reach their selected sockets without changing the public gateway broadcast contract.
* feat(ui): float task-suggestion cards top-right with copy-prompt action
- Float a compact tray in .chat-main__conversation with absolute positioning, min(400px, 100% - margins) sizing, elevation, and internal scrolling.
- Remove the icon column, keep dismiss in the header row, and move a compact split button to the bottom-right.
- Add Copy prompt to the menu via shared copyToClipboard, copying the raw prompt while display-only sanitization remains documented inline.
Release note: Suggested-task cards now float as compact cards at the chat top-right and offer Copy prompt in the action menu.
* style(ui): neutral grey task-suggestion card and actions
Drop the accent-tinted card border/background, mute the eyebrow, and use default grey button treatment for the split control per operator direction.
* fix(ui): ungate copy-prompt and surface clipboard outcomes
- Menu now always renders with the client-local Copy prompt while acceptance-mode items stay capability+scope gated (addresses ClawSweeper finding 1).
- Copy success shows a transient Copied label and failures surface through the pane error path (finding 2).
- Task-suggestion pane logic extracted to chat-pane-task-suggestions.ts and the tray adapter moved into the component to keep files under the 700-line cap.
* fix(ui): test task suggestions through tray adapter
* test(ui): cover task-suggestion clipboard failure
* test(ui): split task-suggestion pane coverage
* chore(ui): raise startup JS budget for task-suggestion card feature
QA-profile measurement was 324617-324620 B versus the 324608 B effective budget; this owner-directed PR #121259 bump follows the baseline file’s documented feature-growth precedent.
* chore(ui): raise startup JS ceiling to 318 KiB for task-suggestion cards
The fixed 317 KiB ceiling (324608 B) was within ~20 B of CI-measured startup bytes after accumulated main drift; the task-suggestion card feature crossed it. Ceiling raised with in-file maintainer-approval comment per its own convention; ratchet baseline set to CI-measured 324626 B.
* fix(ui): keep task-suggestion copy available read-only
Remove the stale accept-or-dismiss tray guard now that Copy prompt is a client-local action. Keep Gateway-backed accept and dismiss controls independently gated, with a regression for operators who can only list suggestions.
* test(ui): cover list-only task-suggestion copy
Update the mocked-Gateway E2E to match the repaired read-only behavior: the suggestion remains visible, its mutating Start action is disabled, and Copy prompt stays available.
* fix(ui): scope the Control UI cursor convention to app-like display modes
The app-chrome cursor convention from #103357/#103411 was applied
unconditionally, so an ordinary browser tab lost the pointer hand on
buttons, menus, tabs, rails, selects and accordion summaries — the only
hover affordance a page owns. The convention is correct for the installed
window the manifest declares ("display": "standalone"), not for every
window the same bundle is served into.
base.css now owns one policy token, --cursor-action, selected by display
mode: pointer by default, the desktop arrow under standalone, minimal-ui
and window-controls-overlay. A low-specificity rule maps generic
actionable controls onto that token, restoring the affordance on the
surfaces #103411 stripped bare, while every component rule that owns a
semantic cursor (not-allowed, disabled, grab, resize, zoom-in, text,
wait) keeps winning without !important.
The 92 cursor: pointer declarations that had drifted back into ui/src
since July now consume the token instead of hardcoding the hand, so they
stop contradicting the policy in an installed window. Real hyperlinks
keep the pointer in every mode. The pre-boot mount fallback repeats the
policy locally because it must render when the bundle fails to load.
Closes#121242
* test(ui): run the cursor policy browser test in the node-driven project
ui/vitest.config.ts routes Playwright-from-Node .browser.test.ts files to the
unit-node project; without registering the new cursor policy test there, the
in-browser chromium project tried to import it and failed on node:fs/playwright.
* fix(ui): keep the desktop arrow in the native app hosts
The macOS dashboard embeds the Control UI in a plain web view, which
reports `display-mode: browser`, so the display-mode-only policy would
have handed it the browser-tab pointer. It already announces itself with
`openclaw-native-macos`/`-nav`/`-web-chrome` on `<html>`, the same markers
`ui/src/styles/layout.css` matches on, so the policy reads those too.
* fix(agents): keep requester settle attached to live children
* fix(agents): gate requester settle on terminal children
---------
Co-authored-by: VACInc <3279061+VACInc@users.noreply.github.com>
Vyctor H. Brzezowski