Use a manifest-first inventory with independent coverage for manifest-only bundled capabilities.
Retire the undocumented thread-ownership plugin while Doctor removes stale references.
Document Talk voice and persist only provider-scoped voice selection.
Closes#121353
Recognize Crabbox workload-routing provider exhaustion as a pre-dispatch backend outage so check:changed runs its documented local fallback.
The observed full provider-chain outage previously exited 2 without running local lanes.
The existing command-exit veto still runs first, so a remote run that actually executed and failed remains fail-closed.
Resolve pnpm's configured modules directory from the checkout root before TypeScript boot, preserving both environment spellings and canonical checkout/common-worktree fallbacks. Use Node package self-resolution from the hydrated tsx package so nested wrappers cannot change relative path semantics.
* test(gateway): boot a minimal test gateway in the gateway lane
A gateway startup stall (#120926, awaited chat-metadata refresh in minimal
mode) shipped with green CI and first surfaced by hanging every checks-ui-e2e
suite that boots a minimal test gateway: no gateway-lane test booted one with
bundled plugins enabled (gateway.test.ts disables them, which masked the
stall), and the changed-scope classifier only selects the ui-e2e lane for
ui-touching diffs.
Add a minimal-gateway boot smoke in src/gateway that mirrors the ui-e2e boot
environment (bundled plugins enabled, minimal skips, strict time budget).
Selection is automatic: the smoke imports the gateway server, so the changed
node test plan picks it up through the import graph for any diff that can
affect startup, and full-suite plans run it in the
agentic-control-plane-startup-core shard. Reintroducing the #120926 hunk makes
the smoke fail (watchdog kill) in the gateway lane; healthy code boots in ~10s.
A planner regression test keeps the smoke classified as a gateway-server test
file and import-graph-reachable from gateway startup sources, so a rename or
graph-invisible import shape cannot silently drop the coverage again.
* test(ui): resolve labs rows by registry id, not positional index
Unblocks landing onto red main: 8fdf7570a1 (#120727) added the Cloud Worker
Desktop labs entry with a hardcoded row index that collides with Message audit
metadata, so enabling it toggled the neighboring row and the full-suite lane
failed deterministically (labs-page.test.ts, exposed only on PRs that run the
compact full suite). Derive each table case's row index from LAB_FEATURES by
feature id — the idiom the rest of the suite already uses — so a new labs
entry can no longer silently retarget an existing case.
* perf(doctor): keep telegram doctor enumeration off the runtime graph
Telegram's built doctor artifact reached execa through dist chunking, so a
source-run host (pnpm dev, tsx CLI, vitest) could not require it and silently
dropped all 9 telegram legacy config rules plus its state migration. The
artifact also pulled telegram's runtime stores, making it a 674-chunk outlier
that dominated doctor enumeration.
Root cause: `src/token.ts` took the broad `plugin-sdk/provider-auth` barrel for
`resolveDefaultSecretProviderAlias`, dragging the auth-profile store, provider
runtime, and plugin install graph (execa, kysely, commander) into the closure.
The alias now has a narrow `plugin-sdk/secret-provider-alias` leaf, and
provider-auth re-exports it so its runtime surface is unchanged.
Thread-binding, sent-message, and sticker-cache row shapes, keys, and legacy
sidecar readers move to `*.legacy-state.ts` leaves. The doctor closure keeps
the rows and drops the ACP, session-binding, send, logger, and plugin-runtime
graphs the stores also load.
The postbuild control-plane verifier only required each artifact in a plain
Node child, the one host where these graphs resolve fine, so it proved nothing
about the invariant that broke. It now also walks each built doctor artifact's
static import closure and fails when it reaches the process-spawn graph, which
is the dist-level analogue of the source closure guard.
Guard rules added for provider-auth, acp-runtime, and conversation-runtime; the
telegram boundary test became a real closure assertion instead of a string grep.
* fix(doctor): drop dead export surface from the telegram legacy-state split
Knip and oxlint caught leftovers from the split: the leaves exported helpers
only they use, the store modules re-exported constants nobody imports from them
anymore, and thread-bindings kept a `testing` barrel whose last production
caller was the migration path that now reads the leaf directly. Tests import the
constants from the leaf that owns them, and the reset helper directly.
The closure gate's failure message still interpolated a `host` field left over
from a probe-host approach that was reverted before commit; the existing verifier
test caught it. The gate now has its own coverage: a transitive chunk edge to a
forbidden dependency is reported, while dynamic imports and non-doctor contract
surfaces are not.
* fix(doctor): adopt the upstream telegram thread-binding store split
`main` landed an equivalent thread-binding leaf as `thread-bindings-store.ts`
while this branch was open, so the branch-local `thread-bindings.legacy-state.ts`
is dropped rather than kept as a second path for the same rows.
`state-migrations.ts` now reaches token.js through the lazy import `main` added,
so `token.ts` is no longer in the doctor closure at all. The narrow
`secret-provider-alias` leaf still matters: telegram's contract-api closure
reaches `provider-auth` through `token.ts` on current `main`, which is the same
execa/kysely/commander graph, so the barrel is repaired at its source instead of
being deferred a second time.
* fix(scripts): type the built doctor closure gate for the TypeScript migration
The gate was authored against the `.mjs` script and landed in the `.mts` file
`main` migrated to, so its parameters were implicitly `any` and `check:test-types`
failed. Adds the explicit signatures plus the violation type.
Regenerates the plugin-sdk API baseline: `provider-auth` re-exports the default
secret-provider alias from the new leaf, so its module hash moves while its
runtime export surface stays identical.
* fix: keep cron trigger once when editing only the script body
* test: cover cron trigger once preservation on script edit
* test: clean up temp script fixture in cron edit once test
The test leaked the mkdtemp directory under os.tmpdir. Remove it in a
finally block so repeated runs do not accumulate temp fixtures.
Fixes#120226
* test: prove trigger.once survives script edit via real gateway store
* fix(cron): preserve trigger metadata on script edits
Validate trigger script input before any Gateway lookup, retain existing trigger metadata during script-only edits, and replace mock-only handler coverage with isolated CLI-to-Gateway persistence proof.
Co-authored-by: Anuj Bolewar <bolewara@gmail.com>
* test(cron): normalize trigger-script rejection cases
Keep the table rows type-stable so the cron edit regression suite passes test type checking.
Co-authored-by: Anuj Bolewar <bolewara@gmail.com>
* style(cron): format trigger preservation tests
Co-authored-by: Anuj Bolewar <bolewara@gmail.com>
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(gateway): flush trailing chat deltas
Keep the fixed-deadline wake-up on the existing chat run record so terminal, abort, and shutdown cleanup cancel it at the lifecycle owner. Normalize voice runs onto their unique per-turn ID instead of compensating for a stale client alias downstream.
Fixes#119557
Co-authored-by: Serghei <43180231+xyrolle@users.noreply.github.com>
* test(gateway): drop obsolete delta length assertions
Remove stale fixtures and assertions for the write-only chat delta length field deleted by the owner-boundary repair.
Co-authored-by: Serghei <43180231+xyrolle@users.noreply.github.com>
* fix(gateway): preserve chat run state type contract
Keep the optional delta length field and its cleanup semantics in the exported ChatRunState closure without restoring runtime writes.
Co-authored-by: Serghei <43180231+xyrolle@users.noreply.github.com>
* refactor(gateway): hide chat delta timer from SDK shape
Keep the trailing wake physically on each run record while exposing it only through internal state-module accessors, preserving the public ChatRunState closure.
Co-authored-by: Serghei <43180231+xyrolle@users.noreply.github.com>
* refactor(gateway): narrow chat delta timer access
Use one Gateway-internal record accessor so the run-owned timer remains outside the public ChatRunState shape without extra state maps.
Co-authored-by: Serghei <43180231+xyrolle@users.noreply.github.com>
* refactor(gateway): keep chat timer casts private
Keep the run-owned timer invisible to the generated Plugin SDK closure by using module-private casts in each owning Gateway module.
Co-authored-by: Serghei <43180231+xyrolle@users.noreply.github.com>
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
Require the unified declaration cache to contain every production Plugin SDK declaration before accepting or stamping it. Matching partial v4 stamps are now stale and rebuild instead of failing later in the canonical declaration writer.
* fix(plugins): keep OpenCode Go bundled
* fix(plugins): mark OpenCode Go dist bundled
* fix(docs): show OpenCode Go as bundled
* fix(release): defer bundled plugin publication
Peter Steinberger