collection-rollback's directory helper lost its external caller in
bdf202ccc8 — make it local; register collection-review's focused-test
seam per the knip ignoreIssues convention; regenerate the API baseline
after recent harness/channel contract drift.
Reverts the arg-forwarding change from #121696: forwarding bigint options
shifts which publication-identity lstat the injected EIO lands on, and on
Windows the snapshot fails with 'publication source identity did not
match' instead of the inspection failure under test, breaking
checks-windows-node-test deterministically. Restore the previously
Windows-green single-argument forwarding with a comment explaining why.
Replace divergent per-skill curation with one daily isolated collection review that can consolidate, rewrite, create, and drop writable skills atomically.
Autonomous auto mode remains automatic. Adds bounded review, transactional recovery, durable cadence, shared locking, and reuse-first /learn behavior.
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
approval.ts was pushed unformatted; worker-provider-registry.ts pulled the
full OpenClawConfig graph back into the plugins layer — use the
CloudWorkersConfig leaf instead.
A campaign apply that succeeds at the git level but fails its managed-service
handoff (e.g. a post-restart health-probe false negative under SQLite load)
marked the update sentinel "error", so the #121328 receipt-backed upstream
fallback never engaged and dev campaigns stalled silently on "no-upstream"
until manual branch re-attach. The receipt now records the install fact
proven by the running process (git mode, root + revision verified, install
changed) regardless of sentinel status; the reader and store drop their
redundant success gates; the concept is renamed Successful* -> Verified*.
Receipt writes are scoped to git mode (the only mode ever read), so dead
npm-mode rows can no longer clobber a valid git receipt.
Fixes#121634
* fix(ui): name new session groups in an owned dialog
Sidebar Move to group -> New group and the Sessions page New group action collected the group name with window.prompt, so the only text-entry step in that flow was browser chrome: unthemed, unvalidated, and unable to keep the typed name when the create was rejected.
Adds showPromptDialog next to the existing showConfirmDialog helper and routes both new-group surfaces through it. createSessionGroup now reports its mutation result so a rejected create keeps the dialog and its value for a retry.
* fix(ui): keep the prompt dialog usable when its operation throws
A rejected submit left the field disabled and the module-level guard latched, so every later prompt in the session was dropped. Report the thrown error as the visible failure instead.
* refactor(ui): keep the prompt dialog options type module-local
Nothing outside prompt-dialog.ts consumes the options type, and the deadcode export gate rejects unused public surface.
* fix(ui): keep the new-group catalog write and assignment on one scope
rememberSessionCustomGroup discarded whether its connection was still current, so a groups.put that outlived its connection was followed by a sessions.patch issued on the replacement one. It now reports completed/failed/stale like the sidebar catalog write, and the Sessions page threads one captured scope through both writes.
* refactor(ui): name new session groups through the shared input dialog
input-dialog.ts already owns Control UI text entry, so the new-group flow no
longer ships a second near-identical dialog next to it. showInputDialog gains
two additive options instead:
- requireValue trims the entry and holds submission closed while it is blank,
replacing the ?.trim() bail every prompt call site repeated. Rename keeps it
off, because an empty rename still has to clear a custom label.
- submit runs the operation behind the dialog and keeps it open on failure with
the typed value intact, so a rejected create is correctable rather than
retyped. The Gateway rejects a group name over 512 characters, and that
message now reaches the operator without discarding what they wrote.
The input stays uncontrolled: its value binding is constant, so repaints for the
submit and failure states leave the caret and IME composition alone. The
AbortSignal contract and the reentrancy guard are unchanged.
Both catalog writes also honor the result groupsPut returns. The capability
retires a write on its own connection epoch, which the caller's scope predicate
cannot observe, so discarding it could file a session into a group no live
connection ever confirmed.
* fix(ui): survive a submit callback that throws before it returns
The catch was attached to the returned promise, so a non-async callback that
threw during synchronous validation escaped it: the rejection left submitting
latched, every control disabled, escape blocked, and the module-level guard held
for the rest of the session. The call now happens inside the try.
Also aligns the shared sidebar harness with the catalog contract. groupsPut
resolved undefined while its groupsRename and groupsDelete siblings already
resolved "completed", so the harness disagreed with the capability it stands in
for as soon as the caller started reading that result.
* fix(ui): do not recreate a session that vanished during the catalog write
Awaiting the group catalog write before the assignment opens a window in which
the target row can be deleted. sessions.patch creates a store entry for an
unknown key, so the assignment would resurrect the session the operator just
removed. assignCategory already guards its own patch this way; the new-group
path now does the same.
* test(ui): widen the empty session-list cast for the vanished-row case
* fix(ui): re-resolve sidebar group targets before assigning them
The new-group dialog no longer blocks, so the rows captured when the menu opened
can be deleted while the catalog write is in flight. sessions.patch creates a
store entry for an unknown key, so assigning them would resurrect the sessions
the operator just removed. The Sessions-page path already guards this; the
sidebar now re-resolves every target against the current list before patching.
* refactor(ui): load the input dialog behind one lazy boundary
input-dialog.ts was imported statically by the Sessions page and dynamically by
the sidebar controller. Mixing both for one module makes the dynamic import
ineffective and pulls the dialog into a startup chunk that never needs it until
an operator opens a menu. All four call sites now share the lazy boundary.
* fix(ui): keep a stale group submission open for retry
A Gateway connection replaced mid-write confirmed neither the group nor the
move, but both surfaces mapped that outcome to a silent close: the dialog
vanished and the typed name went with it, leaving nothing on screen to explain
why no group appeared. Both now report a retryable message so the entry stays
put and resubmitting runs against the replacement connection.
The row-vanished path still closes: there the group did land, and only the
assignment was skipped.
* fix(ui): close the input dialog when its owner goes away
The dialog mounts on document.body, so navigating away left it over the
destination with a detached owner, and a later submit ran against a page that
had already torn down its subscriptions. Both the Sessions page and the sidebar
controller now hand it a lifecycle AbortSignal and abort on disconnect, using
the option the component already accepted.
* fix(ui): prove the target session when a delayed patch lands
The new-group assignment guarded itself by asking whether the row was still in
the current list. That list is a bounded, filtered projection, so an ordinary
refresh that pages a row out of view read as a deletion and silently dropped a
legitimate move, while a row that was genuinely replaced still looked present.
Both surfaces now carry the identity captured when the operator acted, and the
Gateway decides: sessions-patch-engine compares expectedSessionId against the
stored entry and refuses a changed target, so a patch can neither land on a
successor session nor recreate one that is gone. The projection guards are
removed rather than kept alongside it.
SessionPatch and the sidebar patchMany targets carry the field, and
SidebarRecentSession keeps the sessionId its rows already had from the Gateway,
so every sidebar mutation the operator starts before a replacement is covered,
not just group creation.
* fix(ui): make the dialog's lazy boundary safe to await
Three races opened up when the dialog moved behind a dynamic import.
The Sessions page read the target's identity after awaiting the chunk, so a
refresh during a cold load handed back whichever row had replaced it and the
identity guard then approved the wrong session. The lookup now happens before
any await.
The lifecycle was armed only after the chunk resolved, so a sidebar that
disconnected mid-import left nothing for hostDisconnected to abort and the
dialog opened behind a dead host. The import now runs inside the lifecycle.
A rejected chunk load produced no dialog, no error and an unhandled rejection at
the void callers. Both surfaces now report it where they report their other
failures.
* test(ui): make the sidebar projection case prove the assignment
The case waited on a condition that was already true before the catalog write
landed, so it returned before the continuation reached patchSessions and its
negative assertions passed without exercising anything. It also still claimed
the old behaviour: rows leaving the projection now do not suppress the
assignment, because a bounded, filtered list is not evidence of deletion.
It now waits for the batch itself and asserts each target carries the identity
captured with its row, which is what lets the Gateway refuse a replaced target.
* test(ui): split the sidebar new-group cases out of interactions
Adding the projection case pushed interactions.ts past the 700-line ceiling.
The multi-select helpers move to multi-select-support.ts so both files share one
definition, and the two new-group dialog cases get their own case module beside
the other per-topic sidebar suites.
No behaviour change: 246 sidebar cases still pass, and interactions.ts drops to
well under the limit without a suppression.
* fix(ui): stop cancelling the sidebar dialog on a re-layout
The compact-viewport E2E caught this: at 420px the sidebar is dropped from the
DOM, which fired hostDisconnected and aborted the open dialog, so resizing the
window mid-edit closed it and discarded the typed name — the same silent loss
this PR set out to remove.
A sidebar detach is not the operator leaving. The dialog is a body-level modal
and outlives the sidebar's DOM position by design, so the controller no longer
tears it down. The Sessions page keeps its binding, where a page unmount really
is a navigation.
* style(ui): format the extracted sidebar multi-select helpers
* fix(ui): keep the live dialog abortable when a second open overlaps
Two fire-and-forget new-group actions during the lazy import both installed a
lifecycle controller. showInputDialog drops the reentrant request, but the
second call still cleared the field on its way out, so the dialog actually on
screen was left with nothing for disconnect to abort and survived navigation.
A second open now reuses the active controller instead of taking ownership, and
a regression case overlaps two opens then detaches the page.
* refactor(ui): defer session-identity plumbing to its own change
The new-group dialog work had grown a second, separable concern: threading the
identity of the row the operator acted on through SessionPatch, the sidebar
patchMany targets and SidebarRecentSession, so the Gateway could refuse a patch
whose session had been replaced. That contract is real and already enforced by
server-methods/sessions-patch-engine.ts, but it reaches every session mutation
the sidebar makes rather than group creation alone, and a rejected identity
still needs its own terminal outcome before it helps an operator. It belongs in
a change that can be judged on those terms.
Both surfaces return to the projection-presence guarantee this change shipped
first: captured rows are re-resolved against the current list and an assignment
whose row is gone is skipped, which is what keeps sessions.patch from recreating
a session the operator just deleted.
The sidebar case covering that keeps the waiting fix it gained meanwhile. It now
waits for the dialog to be removed, which happens only once the submit chain has
run, instead of for a condition that was already true before the catalog write
landed and let the negative assertions pass without exercising anything.
* fix(ui): say when a new group landed without its move
Both new-group paths skip the assignment when the captured row is no longer in
the current list, because sessions.patch would otherwise recreate a store entry
for a session the operator had removed. That guard was silent: the dialog closed
on the same "completed" a full success returns, so an operator whose list had
simply refreshed or paged got a new group, an unmoved session, and nothing that
accounted for the difference.
The list is a bounded, filtered projection, so a row leaving it is not proof the
session is gone. The skip stays — it is the safe choice without the target's
identity — but it now ends in a visible outcome. The Sessions page records the
partial result in its own error surface and closes; the sidebar raises a toast,
singular or plural with the rows the operator selected. Both are terminal rather
than retryable: the group already exists, so resubmitting the same name could
only fail.
A header-created group still starts empty with no notice, since nothing was
requested to move.
* fix(ui): tighten the skipped-move notice
The two-string singular/plural pair pushed the Control UI startup bundle past
its gzip ceiling: the catalog is loaded at startup, so long copy is paid for on
every page load, and the check failed by 41 bytes.
One string covers both surfaces and both counts. It still states the outcome and
the next step, which is what the notice is for, and it drops the count branch in
createSessionGroup along with the second key.
* test(ui): split the new-group case out of the groups e2e file
The groups e2e file crossed the 1000-line ceiling for test files once this
branch's new case landed on top of the growth main had already added, and a
max-lines suppression is not an option here.
The owned-dialog case moves to its own file beside it, matching the split the
sidebar cases already got. It keeps the same shared helpers, so the move is
mechanical, and it leaves the groups file with room for the cases that stay.
* fix(ui): report sidebar group moves that were skipped
Re-resolving the selection against the live list stopped a removed row from
being recreated, but only the all-removed case reached the operator. When part
of a multi-row selection left the list while the catalog write was in flight,
the survivors were patched and the call returned a plain success, so the dialog
closed with the group created, some sessions moved, and nothing saying the rest
were not.
The count comparison now covers the partial case: the surviving subset is still
patched, and whenever fewer rows resolve than were requested the skipped outcome
is named. It stays terminal, since the group already exists and retrying would
only recreate it.
The Sessions-page path takes a single optional key, so all-or-nothing is the
only shape it has and it already reports the skip; the sidebar is the surface
with a multi-row selection to partially satisfy.
Native approval delivery and resolution now stay bound to the originating or explicitly targeted channel account. Unbound requests fail closed across multiple eligible accounts; trusted reviewer-less SDK callers remain compatible.
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
The automations tool shipped two near-duplicate ~1.4k-token object schemas
(job for add, patch for update) in every prompt on the default tool path —
13,016 chars of tool schema, 88% of it the duplicated pair. One nullable
object schema now serves both actions (7,864 chars, ~1.3k tokens saved per
prompt): update reads the job parameter, and the add path strips null
clears before the strict gateway cron.add contract while preserving the
agentId/sessionKey nulls that cron.add accepts.
Fixes#121606
The bounded raw tail window that chat.history reads can be filled entirely
by records that project to nothing (tool traffic, hidden memory-flush
prompts, dropped silent turns, or one oversized record). The first page then
came back empty even though the branch still held visible turns, and every
snapshot client rebuilds destructively from that page, so the TUI wiped a
conversation the transcript still had.
Scan older transcript chunks when the first page projects to no display
rows, bounded in records and bytes so a pathological transcript cannot turn
the tail read into a full scan, project each chunk beside the newer records
it borders so paired rows survive a chunk boundary, and report the scanned
record count so older paging still resumes strictly before the served page.
toSorted/flat in the labeler coverage test, drop no-op empty-object spread
fallbacks in the telegram command-menu e2e config, and attach the caught
cause when rewrapping the trusted-workflow parse error.
The image-actions feature landed with an untyped fetch spy and an unknown
URL argument; newer vitest types surface both. Capture anchor downloads via
a typed mock implementation and coerce the probed block URL. Also add the
toolCallId/itemId fields to the Discord harness's stale local copies of the
onToolStart/onCommandOutput payload types (canonical type already has them).
Keep configured engines selected before the current turn is persisted, then durably advance accepted turns across embedded and CLI paths. Preserve runtime plugin ownership and canonical transcript anchors through prepared execution.
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
Co-authored-by: Peter <noreply@anthropic.com>
Peter Steinberger